CWE-807 在安全决策中依赖未经信任的输入 类弱点 97 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-807 属于依赖不可信输入进行安全决策的漏洞。攻击者通过篡改 Cookie、环境变量或隐藏表单字段等输入，绕过产品依赖这些值建立的保护机制。开发者需摒弃对客户端数据的盲目信任，不应假设此类输入不可修改。在关键安全逻辑中，必须对输入进行严格验证、完整性校验及服务端重新计算，确保决策依据不被恶意操纵，从而防止安全控制失效。
Cookie[] cookies = request.getCookies(); for (int i =0; i< cookies.length; i++) { Cookie c = cookies[i]; if (c.getName().equals("role")) { userRole = c.getValue(); } }$auth = $_COOKIES['authenticated']; if (! $auth) { if (AuthenticateUser($_POST['user'], $_POST['password']) == "success") { // save the cookie to send out in future responses setcookie("authenticated", "1", time()+60*60*2); } else { ShowLoginScreen(); die("\n"); } } DisplayMedicalHistory($_POST['patient_ID']);| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2026-50106 | DNSSEC 不安全父域 NXDOMAIN 响应漏洞 — Unbound | 6.5 | Medium | 2026-10-21 |
| CVE-2026-111748 | AIOHTTP 请求方案伪造漏洞 — aiohttp | 6.3 | Medium | 2026-10-19 |
| CVE-2026-111869 | Makeplane API 安全决策依赖不可信输入漏洞 — plane | 5.3 | Medium | 2026-10-18 |
| CVE-2026-108433 | Microsoft Office Word 安全功能绕过漏洞 — Microsoft 365 Apps for Enterprise | 7.8 | High | 2026-10-15 |
| CVE-2026-96251 | Microsoft PowerShell 远程代码执行漏洞 — PowerShell 7.4 | 8.8 | High | 2026-10-13 |
| CVE-2026-88210 | Microsoft Office Word 安全功能绕过漏洞 — Microsoft 365 Apps for Enterprise | 7.8 | High | 2026-10-13 |
| CVE-2026-83522 | Windows IKE 扩展欺骗漏洞 — Windows 10 Version 1607 | 8.1 | High | 2026-10-13 |
| CVE-2026-85817 | Microsoft PowerShell 远程代码执行漏洞 — Windows 10 Version 1607 | 8.8 | High | 2026-10-13 |
| CVE-2026-102234 | Visual Studio Code 安全功能绕过漏洞 — Visual Studio Code | 7.4 | High | 2026-10-13 |
| CVE-2026-105458 | GitLab 信任输入验证漏洞 — GitLab | 4.3 | Medium | 2026-10-13 |
| CVE-2026-108903 | pH7Builder 19.3.0之前 CAPTCHA绕过漏洞 — ph7builder | 5.3 | Medium | 2026-10-11 |
| CVE-2026-104658 | hMailServer 安全决策依赖不可信输入漏洞 — hMailServer | 7.8 | High | 2026-10-08 |
| CVE-2026-103923 | KaTeX 原型污染绕过信任限制漏洞 — KaTeX | 2.1 | Low | 2026-10-01 |
| CVE-2026-103267 | Ghost 6.62.0前版本任意邮箱注册漏洞 — Ghost | 4.3 | Medium | 2026-10-01 |
| CVE-2026-102117 | Kiteworks Core 远程代码执行漏洞 — Core | 7.2 | High | 2026-09-30 |
| CVE-2026-101131 | DeepSeek-Harness 依赖不可信输入的安全决策漏洞 — deepseek-harness | 3.3 | Low | 2026-09-28 |
| CVE-2026-101079 | agentverus-scanner 上下文安全决策依赖不可信输入漏洞 — agentverus-scanner | 2.8 | Low | 2026-09-28 |
| CVE-2026-84474 | Ansible AWX view_jobtemplate 权限提升漏洞 — Red Hat Ansible Automation Platform 2.4 for RHEL 8 | 9.9 | Critical | 2026-09-23 |
| CVE-2026-56681 | 9Router公共LLM API身份验证绕过漏洞 — 9router | 7.3 | High | 2026-09-22 |
| CVE-2026-87858 | Temporal Server 管理权限劫持漏洞 — Temporal Server | 7.2 | High | 2026-09-21 |
| CVE-2026-81179 | SysReptor 主机头注入账户接管漏洞 — sysreptor | 8.1 | High | 2026-09-18 |
| CVE-2026-78427 | Admission控制侧车镜像豁免硬编码绕过漏洞 — github.com/neuvector/neuvector | 5.3 | Medium | 2026-09-17 |
| CVE-2026-79701 | SP Page Builder Pro 验证码绕过漏洞 — SP Page Builder (Pro) extension for Joomla | 6.9 | Medium | 2026-09-14 |
| CVE-2026-79700 | Joomla SP Page Builder Pro 5.1.4-6.9.0 未认证CAPTCHA绕过 — SP Page Builder (Pro) extension for Joomla | 6.9 | Medium | 2026-09-14 |
| CVE-2026-87479 | Google Chrome 输入验证错误漏洞 — Chrome | - | - | 2026-09-09 |
| CVE-2026-82533 | DeepSeek Harness 输入验证错误漏洞 — DeepSeek Harness | 9.6 | Critical | 2026-09-08 |
| CVE-2026-66768 | SAP NetWeaver 输入验证错误漏洞 — SAP NetWeaver (SAP GUI for Java) | 9.0 | Critical | 2026-09-08 |
| CVE-2026-85602 | grav-plugin-form 输入验证错误漏洞 — grav-plugin-form | 5.3 | Medium | 2026-09-04 |
| CVE-2026-63041 | Apache APISIX 输入验证错误漏洞 — Apache APISIX | 5.3 | Medium | 2026-08-26 |
| CVE-2026-53789 | RsyncProject Rsync 输入验证错误漏洞 — rsync | 6.5 | Medium | 2026-08-13 |
CWE-807（在安全决策中依赖未经信任的输入） 是常见的弱点类别，本平台收录该类弱点关联的 97 条 CVE 漏洞。