CWE-940 通信信道源的不正确验证 类弱点 48 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-940属于通信源验证缺陷漏洞。攻击者通过建立来自不可信来源的通信通道，绕过身份验证机制，从而获取未授权访问权限或执行特权操作。开发者应在处理传入请求时，严格校验通信通道的来源，确保其符合预期信任域，并实施来源白名单或签名验证，以防止恶意实体伪造请求入口，保障系统交互的安全性。
IntentFilter filter = new IntentFilter("com.example.RemoveUser"); MyReceiver receiver = new MyReceiver(); registerReceiver(receiver, filter); public class DeleteReceiver extends BroadcastReceiver { @Override public void onReceive(Context context, Intent intent) { int userID = intent.getIntExtra("userID"); destroyUserData(userID); } }// Android @Override public boolean shouldOverrideUrlLoading(WebView view, String url){ if (url.substring(0,14).equalsIgnoreCase("examplescheme:")){ if(url.substring(14,25).equalsIgnoreCase("getUserInfo")){ writeDataToView(view, UserData); return false; } else{ return true; } } }// iOS -(BOOL) webView:(UIWebView *)exWebView shouldStartLoadWithRequest:(NSURLRequest *)exRequest navigationType:(UIWebViewNavigationType)exNavigationType { NSURL *URL = [exRequest URL]; if ([[URL scheme] isEqualToString:@"exampleScheme"]) { NSString *functionString = [URL resourceSpecifier]; if ([functionString hasPrefix:@"specialFunction"]) { // Make data available back in webview. UIWebView *webView = [self writeDataToView:[URL query]]; } return NO; } return YES; }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2026-89409 | Z-Wave 节点存在命令未验证导致删除端点漏洞 — Z-Wave SDK | 5.3 | Medium | 2026-10-22 |
| CVE-2026-66279 | Connect Stack 断开连接漏洞 — Connect SDK | 7.2 | High | 2026-10-22 |
| CVE-2026-112408 | SageMaker SDK 默认存储桶所有权验证缺失漏洞 — Amazon SageMaker Python SDK | 8.1 | High | 2026-10-21 |
| CVE-2026-102552 | FreeRTOS-Plus-TCP DNS 解析器通信源验证不当漏洞 — FreeRTOS-Plus-TCP | 5.9 | Medium | 2026-10-16 |
| CVE-2026-102551 | FreeRTOS-Plus-TCP 路由通告处理通信源验证漏洞 — FreeRTOS-Plus-TCP | 7.7 | High | 2026-10-16 |
| CVE-2026-87705 | Windows Hyper-V 安全功能绕过漏洞 — Windows 10 Version 1607 | 7.4 | High | 2026-10-13 |
| CVE-2026-94590 | WordPress Sell Downloads插件<=1.2.3 权限控制漏洞 — Sell Downloads | 6.5 | Medium | 2026-10-10 |
| CVE-2026-59786 | Active agent 心跳模块缺少TLS检查 — Zabbix | 6.9 | Medium | 2026-10-05 |
| CVE-2026-102511 | Apache PLC4X ADS发现响应欺骗漏洞 — Apache PLC4X | 8.5 | High | 2026-09-30 |
| CVE-2026-85125 | YAMAP 授权问题漏洞 — YAMAP -Social Trekking GPS App | 5.1 | Medium | 2026-09-14 |
| CVE-2026-89178 | Howyar WeenyGenius 授权问题漏洞 — WeenyGenius | 8.8 | High | 2026-09-11 |
| CVE-2026-85085 | Canva 授权问题漏洞 — Canva | 9.6 | Critical | 2026-09-04 |
| CVE-2026-78685 | Le-yan Medical Practice Management System 授权问题漏洞 — Medical Practice Management System | 8.8 | High | 2026-08-25 |
| CVE-2026-54106 | Government Accountability Office Electronic Protest Docketing System 授权问题漏洞 — Electronic Protest Docketing System (EPDS) | 4.7 | Medium | 2026-06-18 |
| CVE-2026-48745 | traccar-client 授权问题漏洞 — traccar-client | 9.3 | Critical | 2026-06-16 |
| CVE-2026-44894 | Netty 授权问题漏洞 — netty | 7.5 | High | 2026-06-12 |
| CVE-2026-43880 | WWBN AVideo 安全漏洞 — AVideo | 5.3 | Medium | 2026-05-11 |
| CVE-2026-40434 | Anviz CrossChex Standard 安全漏洞 — Anviz CrossChex Standard | 8.1 | High | 2026-04-17 |
| CVE-2026-35643 | OpenClaw 安全漏洞 — OpenClaw | 8.8 | High | 2026-04-10 |
| CVE-2026-33875 | Authenticator 安全漏洞 — app-Authenticator | 9.3 | Critical | 2026-03-27 |
| CVE-2019-25613 | Easy Chat Server 安全漏洞 — Easy Chat | 7.5 | High | 2026-03-22 |
| CVE-2026-2967 | Cesanta Mongoose 安全漏洞 — Mongoose | 3.7 | Low | 2026-02-23 |
| CVE-2026-22269 | Dell PowerProtect Data Manager 安全漏洞 — PowerProtect Data Manager | 4.7 | Medium | 2026-02-19 |
| CVE-2025-62439 | Fortinet FortiOS 安全漏洞 — FortiOS | 3.8 | Medium | 2026-02-10 |
| CVE-2025-40820 | Siemens多款产品 安全漏洞 — SIDOOR ATD430W | 7.5 | High | 2025-12-09 |
| CVE-2025-13086 | OpenVPN 安全漏洞 — OpenVPN | 7.5AI | High AI | 2025-12-03 |
| CVE-2025-61932 | MOTEX Lanscope Endpoint Manager 安全漏洞 — Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) | 9.8AI | Critical AI | 2025-10-20 |
| CVE-2025-20365 | Cisco Access Point Software 安全漏洞 — Cisco Aironet Access Point Software (IOS XE Controller) | 4.3 | Medium | 2025-09-24 |
| CVE-2025-9999 | PcVue 安全漏洞 — PcVue | 9.8AI | Critical AI | 2025-09-05 |
| CVE-2025-42978 | SAP NetWeaver Application Server Java 安全漏洞 — SAP NetWeaver Application Server Java | 3.5 | Low | 2025-07-08 |
CWE-940（通信信道源的不正确验证） 是常见的弱点类别，本平台收录该类弱点关联的 48 条 CVE 漏洞。