CWE-807 在安全决策中依赖未经信任的输入 类弱点 68 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-807 属于依赖不可信输入进行安全决策的漏洞。攻击者通过篡改 Cookie、环境变量或隐藏表单字段等输入，绕过产品依赖这些值建立的保护机制。开发者需摒弃对客户端数据的盲目信任，不应假设此类输入不可修改。在关键安全逻辑中，必须对输入进行严格验证、完整性校验及服务端重新计算，确保决策依据不被恶意操纵，从而防止安全控制失效。
Cookie[] cookies = request.getCookies(); for (int i =0; i< cookies.length; i++) { Cookie c = cookies[i]; if (c.getName().equals("role")) { userRole = c.getValue(); } }$auth = $_COOKIES['authenticated']; if (! $auth) { if (AuthenticateUser($_POST['user'], $_POST['password']) == "success") { // save the cookie to send out in future responses setcookie("authenticated", "1", time()+60*60*2); } else { ShowLoginScreen(); die("\n"); } } DisplayMedicalHistory($_POST['patient_ID']);| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2026-32057 | OpenClaw 安全漏洞 — OpenClaw | 7.1 | High | 2026-03-21 |
| CVE-2026-29794 | Vikunja 安全漏洞 — vikunja | 5.3 | Medium | 2026-03-20 |
| CVE-2026-33068 | Claude Code 安全漏洞 — claude-code | 8.8 | - | 2026-03-20 |
| CVE-2026-21514 | Microsoft Word 安全漏洞 — Microsoft 365 Apps for Enterprise | 7.8 | High | 2026-02-10 |
| CVE-2026-25958 | Cube 安全漏洞 — cube | 7.7 | High | 2026-02-09 |
| CVE-2026-21509 | Microsoft Office 安全漏洞 — Microsoft 365 Apps for Enterprise | 7.8 | High | 2026-01-26 |
| CVE-2026-23848 | MyTube 安全漏洞 — MyTube | 6.5 | Medium | 2026-01-19 |
| CVE-2026-20849 | Microsoft Windows Kerberos 安全漏洞 — Windows 10 Version 1607 | 7.5 | High | 2026-01-13 |
| CVE-2025-12487 | Text Generation Web UI 安全漏洞 — text-generation-webui | 9.8 | - | 2025-11-06 |
| CVE-2025-12488 | Text Generation Web UI 安全漏洞 — text-generation-webui | 9.8 | - | 2025-11-06 |
| CVE-2025-11271 | WordPress plugin Easy Digital Downloads 安全漏洞 — Easy Digital Downloads – eCommerce Payments and Subscriptions made easy | 5.3 | Medium | 2025-11-06 |
| CVE-2025-53717 | Microsoft Windows Virtualization-Based Security Enclave 安全漏洞 — Windows 11 version 22H2 | 7.0 | High | 2025-10-14 |
| CVE-2025-59152 | Litestar 安全漏洞 — litestar | 7.5 | High | 2025-10-06 |
| CVE-2025-53882 | openSUSE Tumbleweed 安全漏洞 — openSUSE Tumbleweed | 4.4 | Medium | 2025-07-23 |
| CVE-2024-13974 | Sophos Firewall 安全漏洞 — Sophos Firewall | 8.1 | High | 2025-07-21 |
| CVE-2025-49827 | CyberArk Conjur 安全漏洞 — conjur | 8.2AI | High AI | 2025-07-15 |
| CVE-2024-55354 | Lucee 安全漏洞 — Lucee Server | 8.8 | High | 2025-04-08 |
| CVE-2025-0117 | Palo Alto Networks GlobalProtect 安全漏洞 — GlobalProtect App | 7.8 | - | 2025-03-12 |
| CVE-2025-1969 | Amazon AWS Temporary Elevated Access Management 访问控制错误漏洞 — Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center | 4.3 | Medium | 2025-03-04 |
| CVE-2025-1126 | Lexmark Print Management Client 安全漏洞 — Lexmark Print Management Client | 9.3 | Critical | 2025-02-11 |
| CVE-2025-24369 | Anubis 安全漏洞 — x | 4.9 | - | 2025-01-27 |
| CVE-2024-9310 | Federal Aviation Administration TCAS 安全漏洞 — Collision Avoidance Systems | 6.5 | - | 2025-01-22 |
| CVE-2024-45654 | IBM Security ReaQta 安全漏洞 — Security ReaQta | 4.3 | Medium | 2025-01-19 |
| CVE-2024-11146 | TrueFiling 安全漏洞 — TrueFiling | 6.3 | Medium | 2025-01-17 |
| CVE-2024-47254 | 2N Access Commander 安全漏洞 — 2N Access Commander | 6.3 | Medium | 2024-11-05 |
| CVE-2024-51561 | Brokerage Aero 安全漏洞 — Aero | 6.8AI | Medium AI | 2024-11-04 |
| CVE-2024-21510 | Sinatra 安全漏洞 — sinatra | 5.4 | Medium | 2024-11-01 |
| CVE-2024-5754 | Zephyr 安全漏洞 — Zephyr | 8.2 | High | 2024-09-13 |
| CVE-2024-29039 | tpm2-tools 安全漏洞 — tpm2-tools | 9.1 | Critical | 2024-06-28 |
| CVE-2023-46686 | Gallagher Command Centre 安全漏洞 — Command Centre Diagnostics Service | 5.5 | Medium | 2023-12-18 |
CWE-807（在安全决策中依赖未经信任的输入） 是常见的弱点类别，本平台收录该类弱点关联的 68 条 CVE 漏洞。