CWE-940 通信信道源的不正确验证 类弱点 38 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-940属于通信源验证缺陷漏洞。攻击者通过建立来自不可信来源的通信通道，绕过身份验证机制，从而获取未授权访问权限或执行特权操作。开发者应在处理传入请求时，严格校验通信通道的来源，确保其符合预期信任域，并实施来源白名单或签名验证，以防止恶意实体伪造请求入口，保障系统交互的安全性。
IntentFilter filter = new IntentFilter("com.example.RemoveUser"); MyReceiver receiver = new MyReceiver(); registerReceiver(receiver, filter); public class DeleteReceiver extends BroadcastReceiver { @Override public void onReceive(Context context, Intent intent) { int userID = intent.getIntExtra("userID"); destroyUserData(userID); } }// Android @Override public boolean shouldOverrideUrlLoading(WebView view, String url){ if (url.substring(0,14).equalsIgnoreCase("examplescheme:")){ if(url.substring(14,25).equalsIgnoreCase("getUserInfo")){ writeDataToView(view, UserData); return false; } else{ return true; } } }// iOS -(BOOL) webView:(UIWebView *)exWebView shouldStartLoadWithRequest:(NSURLRequest *)exRequest navigationType:(UIWebViewNavigationType)exNavigationType { NSURL *URL = [exRequest URL]; if ([[URL scheme] isEqualToString:@"exampleScheme"]) { NSString *functionString = [URL resourceSpecifier]; if ([functionString hasPrefix:@"specialFunction"]) { // Make data available back in webview. UIWebView *webView = [self writeDataToView:[URL query]]; } return NO; } return YES; }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2026-89178 | WeenyGenius Origin验证错误 — WeenyGenius | 8.8 | High | 2026-09-11 |
| CVE-2026-85085 | Canva 授权问题漏洞 — Canva | 9.6 | Critical | 2026-09-04 |
| CVE-2026-78685 | Le-yan Medical Practice Management System 授权问题漏洞 — Medical Practice Management System | 8.8 | High | 2026-08-25 |
| CVE-2026-54106 | Government Accountability Office Electronic Protest Docketing System 授权问题漏洞 — Electronic Protest Docketing System (EPDS) | 4.7 | Medium | 2026-06-18 |
| CVE-2026-48745 | traccar-client 授权问题漏洞 — traccar-client | 9.3 | Critical | 2026-06-16 |
| CVE-2026-44894 | Netty 授权问题漏洞 — netty | 7.5 | High | 2026-06-12 |
| CVE-2026-43880 | WWBN AVideo 安全漏洞 — AVideo | 5.3 | Medium | 2026-05-11 |
| CVE-2026-40434 | Anviz CrossChex Standard 安全漏洞 — Anviz CrossChex Standard | 8.1 | High | 2026-04-17 |
| CVE-2026-35643 | OpenClaw 安全漏洞 — OpenClaw | 8.8 | High | 2026-04-10 |
| CVE-2026-33875 | Authenticator 安全漏洞 — app-Authenticator | 9.3 | Critical | 2026-03-27 |
| CVE-2019-25613 | Easy Chat Server 安全漏洞 — Easy Chat | 7.5 | High | 2026-03-22 |
| CVE-2026-2967 | Cesanta Mongoose 安全漏洞 — Mongoose | 3.7 | Low | 2026-02-23 |
| CVE-2026-22269 | Dell PowerProtect Data Manager 安全漏洞 — PowerProtect Data Manager | 4.7 | Medium | 2026-02-19 |
| CVE-2025-62439 | Fortinet FortiOS 安全漏洞 — FortiOS | 3.8 | Medium | 2026-02-10 |
| CVE-2025-40820 | Siemens多款产品 安全漏洞 — SIDOOR ATD430W | 7.5 | High | 2025-12-09 |
| CVE-2025-13086 | OpenVPN 安全漏洞 — OpenVPN | 7.5AI | High AI | 2025-12-03 |
| CVE-2025-61932 | MOTEX Lanscope Endpoint Manager 安全漏洞 — Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) | 9.8AI | Critical AI | 2025-10-20 |
| CVE-2025-20365 | Cisco Access Point Software 安全漏洞 — Cisco Aironet Access Point Software (IOS XE Controller) | 4.3 | Medium | 2025-09-24 |
| CVE-2025-9999 | PcVue 安全漏洞 — PcVue | 9.8AI | Critical AI | 2025-09-05 |
| CVE-2025-42978 | SAP NetWeaver Application Server Java 安全漏洞 — SAP NetWeaver Application Server Java | 3.5 | Low | 2025-07-08 |
| CVE-2025-25305 | Home Assistant 安全漏洞 — core | 7.0 | High | 2025-02-18 |
| CVE-2025-23222 | dde-api-proxy 安全漏洞 — dde-api-proxy | 8.4 | High | 2025-01-24 |
| CVE-2024-7322 | Silicon Labs EmberZNet 访问控制错误漏洞 — EmberZNet | 5.8 | Medium | 2025-01-15 |
| CVE-2024-36506 | Fortinet FortiClientEMS 安全漏洞 — FortiClientEMS | 3.5 | Low | 2025-01-14 |
| CVE-2025-23019 | IPv6-in-IPv4 tunneling 安全漏洞 — IPv6 | 5.4 | Medium | 2025-01-14 |
| CVE-2025-23018 | IPv6-in-IPv4 tunneling 安全漏洞 — IPv6 | 5.4 | Medium | 2025-01-14 |
| CVE-2024-49579 | JetBrains YouTrack 安全漏洞 — YouTrack | 8.1 | High | 2024-10-17 |
| CVE-2024-20390 | Cisco IOS XR 安全漏洞 — Cisco IOS XR Software | 5.3 | Medium | 2024-09-11 |
| CVE-2024-1621 | NT-ware uniFLOW Online 安全漏洞 — uniFLOW Online | 9.8AI | Critical AI | 2024-09-02 |
| CVE-2024-0009 | Palo Alto Networks PAN-OS 安全漏洞 — PAN-OS | 6.3 | Medium | 2024-02-14 |
CWE-940（通信信道源的不正确验证） 是常见的弱点类别，本平台收录该类弱点关联的 38 条 CVE 漏洞。