Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-348
Weakness type CWE-348 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 47 | 47 | 0 |
Monthly trend
▃▆▁█▆
2026-06 6 · 2026-07 12 · 2026-08 1 · 2026-09 17 · 2026-10 11
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2026-44046 | 2.3 | 39.6 | — | Apache APISIX: wolf-rbac plugin Identity Spoofing |
| CVE-2026-61682 | 9.9 | 30.8 | — | kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authen… |
| CVE-2026-58122 | 9.3 | 29.7 | — | Hermes WebUI < 0.51.307 Authentication Bypass via X-Forwarded-For Header Spoofing |
| CVE-2026-90711 | 9.1 | 24.8 | — | proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet |
| CVE-2026-92395 | 9.1 | 24.8 | — | @fastify/proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet |
| CVE-2026-55641 | 8.2 | 23.7 | — | 9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay … |
| CVE-2026-64619 | 8.7 | 20.7 | — | FileCodeBox < 2.4 Anti-bruteforce Rate Limit Bypass via Spoofed Headers |
| CVE-2026-63770 | 8.2 | 20.7 | — | Glance 0.8.5 IP Spoofing Authentication Brute-Force Protection Bypass |
| CVE-2026-100653 | 8.3 | 19.6 | — | vLLM 0.22.1 before 0.28.0 Incomplete Artifact Pin Propagation |
| CVE-2026-57942 | 6.9 | 19.1 | — | LibreTranslate - IP Spoofing via X-Forwarded-For Header |
| CVE-2026-9561 | 8.8 | 19.0 | — | — |
| CVE-2026-97404 | 9.2 | 17.2 | — | — |
| CVE-2026-93483 | 9.5 | 13.3 | — | — |
| CVE-2026-46415 | 8.2 | 13.3 | — | Caddy Defender trusted proxy client IP bypass |
| CVE-2026-48772 | 10.0 | 12.6 | — | ProxySQL: PROXY-Protocol-v1 UNKNOWN parses spoofed source IP, bypassing mysql_query_rul… |
| CVE-2026-25552 | 6.3 | 12.3 | — | Ghost CLI < 1.30.1 IP Spoofing via X-Forwarded-For Header |
| CVE-2026-108736 | 6.3 | 9.9 | — | Speedtest Tracker through 1.15.0 IP Allowlist Bypass via X-Forwarded-For Spoofing |
| CVE-2026-62987 | 5.8 | 9.5 | — | Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/… |
| CVE-2026-110726 | 6.5 | 8.3 | — | — |
| CVE-2026-101277 | 5.5 | 8.2 | — | Trusted Domain Project OpenDKIM Tag Tokenizer dkim.c dkim_process_set less trusted source |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| dell | 2 |
| eclipse foundation | 2 |
| honojs | 2 |
| wheels | 2 |
| @fastify/proxy-addr | 1 |
| alexjustesen | 1 |
| apache | 1 |
| canonical | 1 |
| codeigniter4 | 1 |
| coder | 1 |
| decolua | 1 |
| djust-org | 1 |
| fabiolb | 1 |
| fastify | 1 |
| forgejo | 1 |
