On this page
CWE-306: Missing Authentication for Critical Function
Weakness Summary
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
- Canonical source: MITRE CWE-306 (opens in a new tab)
- Published Atomicorp CVE observations: 113
- Distinct affected products in those observations: 104
- Active Atomicorp rules associated with this weakness: 101
Atomicorp Research Context
Atomicorp has published CVE-specific research observations associated with this weakness category. Each linked CVE page states whether the tested request was detected or blocked and is the authoritative customer-facing finding.
The CVEs and rules shown here are selected published examples, not a complete list of Atomicorp protections. If a CWE, CVE, or rule is absent from this page, no conclusion should be drawn about whether Atomicorp protects against that weakness or attack method.
A CWE describes a class of software weakness. It does not identify one exploit request, and association with a CWE does not mean that every vulnerability or exploitation path in that category is detected or blocked.
Selected Published CVE Observations
| CVE | Vulnerability | Product | Atomicorp finding | Observed rules |
|---|---|---|---|---|
| CVE-2011-10013 | Traq admincp/common.php Remote Code Execution | Issue Tracking System | Protected by Atomicorp rules | 340011 , 340095 , 344363 , 346755 |
| CVE-2024-46506 | Unauthenticated RCE in NetAlertX | netalertx | Protected by Atomicorp rules | 340029 , 344370 , 392301 , 392648 |
| CVE-2025-34073 | Maltrail Unauthenticated Command Injection | Maltrail | Protected by Atomicorp rules | 340014 , 340029 , 344361 , 344363 , 344370 |
| CVE-2025-34112 | Riverbed SteelCentral NetProfiler/NetExpress Remote Code Execution | SteelCentral NetExpress | Protected by Atomicorp rules | 341245 |
| CVE-2026-45087 | Dalfox: Unauthenticated Remote Code Execution via found-action in Dalfox Server Mode | dalfox | Protected by Atomicorp rules | 330791 , 340014 , 340023 , 340029 , 340152 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-81735 | UI-TARS-desktop @agent-infra MCP Servers Bind Every Interface Without Authentication, Exposing Arbitrary Command Executi | UI-TARS-desktop | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390904 , 393655 |
| CVE-2026-42864 | FireFighter: Unauthenticated SSRF in Raid jira_bot endpoint allows IAM credential theft | firefighter-incident | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2017-18001 | Trustwave SWG 11.8.0.27 - SSH Unauthorized Access | secure web gateway | Protected by Atomicorp rules | 330039 , 330791 , 340152 |
| CVE-2018-0127 | Cisco RV132W/RV134W Router - Information Disclosure | rv132w firmware | Protected by Atomicorp rules | 312863 , 390716 |
| CVE-2018-6223 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | Protected by Atomicorp rules | 333141 , 337209 , 337210 , 337211 , 340145 , 340147 , 340148 , 340149 , 340156 , 341145 , 341245 , 341256 , 342259 , 344360 , 344370 , 344372 , 346755 , 350147 , 380018 , 390572 , 390585 , 390704 |
| CVE-2019-17506 | D-Link DIR-868L/817LW - Information Disclosure | dir-868l b1 firmware | Protected by Atomicorp rules | 330791 , 340152 |
| CVE-2020-10148 | SolarWinds Orion API - Auth Bypass | orion platform | Protected by Atomicorp rules | 390709 |
| CVE-2020-12720 | vBulletin /ajax/api/content_infraction/getIndexableContent nodeid Parameter SQL Injection | vbulletin | Protected by Atomicorp rules | 331028 , 340016 , 340017 , 340144 , 340145 , 340155 , 340156 , 340157 , 340159 , 341145 , 341155 , 341245 , 360147 , 360148 , 380026 , 390572 , 391235 |
| CVE-2020-9480 | Apache Spark - Authentication Bypass | spark | Protected by Atomicorp rules | 340162 , 340163 |
| CVE-2021-20158 | Trendnet AC2600 TEW-827DRU 2.08B01 - Admin Password Change | tew-827dru firmware | Protected by Atomicorp rules | 392301 |
| CVE-2021-22652 | Advantech iView Unauthenticated Remote Code Execution | iview | Protected by Atomicorp rules | 340014 , 340193 |
| CVE-2021-34621 | WordPress ProfilePress 3.0.0-3.1.3 - Admin User Creation Weakness | profilepress | Detected by Atomicorp rules | 377360 |
| CVE-2021-35587 | Oracle Access Manager unauthenticated Remote Code Execution | access manager | Protected by Atomicorp rules | 344361 , 344363 |
| CVE-2021-44077 | ManageEngine ServiceDesk Plus CVE-2021-44077 | manageengine servicedesk plus | Protected by Atomicorp rules | 330791 , 334168 , 340152 |
| CVE-2022-1388 | F5 BIG-IP iControl RCE via REST Authentication Bypass | big-ip access policy manager | Protected by Atomicorp rules | 344361 , 344363 , 392767 , 393655 |
| CVE-2022-21587 | Oracle E-Business Suite (EBS) Unauthenticated Arbitrary File Upload | e-business suite | Protected by Atomicorp rules | 330791 , 334168 , 340152 , 390700 |
| CVE-2023-42793 | JetBrains TeamCity Unauthenticated Remote Code Execution | teamcity | Protected by Atomicorp rules | 340014 , 340193 |
| CVE-2023-46747 | F5 BIG-IP TMUI AJP Smuggling RCE | big-ip access policy manager | Protected by Atomicorp rules | 390626 , 392767 |
| CVE-2024-10924 | WordPress Really Simple SSL Plugin Authentication Bypass to RCE | really simple security | Protected by Atomicorp rules | 340128 , 360152 , 390801 |
| CVE-2024-11680 | ProjectSend r1295 - r1605 Unauthenticated Remote Code Execution | projectsend | Protected by Atomicorp rules | 330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390801 |
| CVE-2024-12847 | Netgear DGN1000 Setup.cgi Unauthenticated RCE | dgn1000 firmware | Protected by Atomicorp rules | 312668 |
| CVE-2024-24578 | RaspberryMatic unauthenticated Remote Code Execution vulnerability through HMServer File Upload. | raspberrymatic | Protected by Atomicorp rules | 330791 , 334168 , 340152 , 390700 |
| CVE-2024-51567 | CyberPanel Multi CVE Pre-auth RCE | cyberpanel | Protected by Atomicorp rules | 390700 |
| CVE-2025-3248 | Langflow validate/code API Pre-Auth Remote Code Execution (CVE-2025-3248) | langflow | Protected by Atomicorp rules | 330791 , 340095 , 340152 , 344360 , 344370 |
| CVE-2026-23744 | MCPJam Inspector Connect API Command Execution | inspector | Protected by Atomicorp rules | 330791 , 340152 |
| CVE-2026-35273 | Oracle PeopleSoft PeopleTools PSEMHUB - Pre-Auth Java Deserialization RCE | peoplesoft enterprise peopletools | Detected by Atomicorp rules | 331032 |
| CVE-2026-45695 | Kopia Server 0.23.0 - Remote Code Execution | kopia | Protected by Atomicorp rules | 393655 |
| CVE-2026-47391 | PraisonAI's unauthenticated A2A official example can reach real LLM-driven eval() tool execution | PraisonAI | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-49819 | UpSnap - Unauthenticated Initial-Superuser Takeover Chains to Root RCE via wake_cmd | UpSnap | Protected by Atomicorp rules | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-49827 | WebErpMesv2 has Unauthenticated RCE via Unrestricted File Upload in HR Expense scan_file (CWE-434) | WebErpMesv2 | Protected by Atomicorp rules | 351000 |
| CVE-2026-57124 | PraisonAI UI MCP connect endpoint allows unauthenticated local command execution | PraisonAI | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390904 , 393655 |
| CVE-2026-57131 | praisonai: Jobs API exposes agent-execution endpoints with no authentication | PraisonAI | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9103 | Langflow OSS - Superuser Token Issuance | langflow | Protected by Atomicorp rules | 300008 |
| CVE-2026-53649 | Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE | joro | Protected by Atomicorp rules | 340014 , 340023 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-25895 | FUXA <= 1.2.9 - Unauthenticated Path Traversal to Arbitrary File Write | fuxa | Protected by Atomicorp rules | 340007 |
| CVE-2026-88062 | OmniRoute < 3.8.49 - Unauthenticated RCE | OmniRoute | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 345240 , 380026 , 393655 |
| CVE-2014-125118 | eScan Web Management Console Command Injection | eScan Web Management Console | Protected by Atomicorp rules | 344363 , 344364 , 344366 , 393655 |
| CVE-2022-26833 | Open Automation Software OAS Platform V16.00.0121 - Missing Authentication | oas platform | Protected by Atomicorp rules | 390726 , 392647 |
| CVE-2025-34104 | Piwik Superuser Plugin Upload | Web Analytics Platform | Protected by Atomicorp rules | 340128 , 360152 , 380018 , 390700 , 390801 |
| CVE-2014-125113 | Dell KACE K1000 File Upload | KACE K1000 Systems Management Appliance | Protected by Atomicorp rules | 340007 , 340128 , 344370 , 360152 , 380018 , 390801 |
| CVE-2014-125116 | HybridAuth install.php PHP Code Execution | HybridAuth | Protected by Atomicorp rules | 340095 , 340128 , 344370 , 346755 , 360152 , 390801 |
| CVE-2015-10141 | xdebug Unauthenticated OS Command Execution | Xdebug | Protected by Atomicorp rules | 340011 , 356331 |
| CVE-2018-25412 | Delta Sql 1.8.2 Arbitrary File Upload via docs_upload.php | deltasql | Protected by Atomicorp rules | 351000 |
| CVE-2021-47940 | WordPress Download From Files 1.48 Arbitrary File Upload | Download From Files | Protected by Atomicorp rules | 351000 |
| CVE-2023-7325 | Mingyu Operations and Maintenance Audit and Risk Control System xmlrpc.sock SSRF | Mingyu Operations and Maintenance Audit and Risk Control System | Protected by Atomicorp rules | 390719 , 390723 |
| CVE-2024-0012 | Palo Alto Networks PAN-OS Management Interface Unauthenticated Remote Code Execution | pan-os | Protected by Atomicorp rules | 340023 , 344361 , 344363 , 344370 |
| CVE-2024-5910 | Palo Alto Expedition Remote Code Execution (CVE-2024-5910 and CVE-2024-9464) | expedition | Protected by Atomicorp rules | 340029 , 344361 , 344363 , 344364 , 344366 , 350147 |
| CVE-2025-34100 | BuilderEngine Arbitrary File Upload Vulnerability and execution | CMS | Protected by Atomicorp rules | 340006 , 340007 , 344360 , 347009 , 390709 , 390719 , 399069 |
| CVE-2025-34101 | Serviio Media Server checkStreamUrl Command Execution | Media Server | Protected by Atomicorp rules | 330791 , 340152 |
| CVE-2025-34102 | Crypttech CryptoLog Remote Code Execution | CryptoLog | Protected by Atomicorp rules | 340145 , 340156 , 341145 , 341245 , 344364 , 393655 |
| CVE-2025-34111 | Tiki Wiki Unauthenticated File Upload Vulnerability | tikiwiki cms/groupware | Protected by Atomicorp rules | 330791 , 340006 , 340152 , 390719 , 393781 |
| CVE-2025-34121 | Idera Up.Time Monitoring Station 7.0 post2file.php Arbitrary File Upload | Up.Time Monitoring Station | Protected by Atomicorp rules | 340095 , 340128 , 360152 , 380018 , 380026 , 390801 |
| CVE-2026-105110 | Iskratel Innbox Unauthenticated Remote Code Execution via login.xgi CLI Parameter | Innbox | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-32985 | Xerte Online Toolkits Arbitrary File Upload - Unauthenticated Template Import | xerte online toolkits | Protected by Atomicorp rules | 330791 , 334168 , 340152 |
| CVE-2026-41940 | cPanel & WHM - Authentication Bypass via Session-File CRLF Injection | cpanel | Atomicorp rules identified for this CVE | 377364 |
| CVE-2026-4810 | Google ADK-Python - Unauthenticated Builder Endpoint | adk-python | Protected by Atomicorp rules | 390726 , 392647 |
| CVE-2026-56782 | Gorse < 0.5.10 - Unauthenticated Database Dump | gorse | Protected by Atomicorp rules | 301007 |
| CVE-2026-67426 | Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration | flyto-core | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-85688 | TEN Framework - Arbitrary File Read & Write | ten-framework | Protected by Atomicorp rules | 344360 , 390709 |
| CVE-2026-9209 | mJobTime 15.7.3.32 Unauthenticated SQL Execution RCE via Login.aspx | mJobTime | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2014-125126 | Simple E-Document Arbitrary File Upload | Simple E-Document | Protected by Atomicorp rules | 334168 , 340156 , 390700 |
| CVE-2026-41179 | RClone RC - Command Injection | rclone | Protected by Atomicorp rules | 340014 , 344370 |
| CVE-2026-42796 | Arelle < 2.39.10 - Remote Code Execution | arelle | Protected by Atomicorp rules | 340162 , 340163 |
| CVE-2019-9880 | WPEngine WPGraphQL 0.2.3 - Unauthenticated User Information Disclosure | wpgraphql | Protected by Atomicorp rules | 344361 , 344363 |
| CVE-2020-13382 | openSIS Unauthenticated PHP Code Execution | opensis | Protected by Atomicorp rules | 340016 , 340017 , 340145 , 340156 , 340157 , 340195 , 341145 , 341245 , 360147 , 360148 |
| CVE-2020-36333 | ThemeGrill Demo Importer < 1.6.2 - Database Reset | themegrill demo importer | Protected by Atomicorp rules | 375357 |
| CVE-2026-54670 | WeGIA: Unauthenticated Auth Bypass + Local File Inclusion | WeGIA | Protected by Atomicorp rules | 340007 , 344360 , 390709 |
| CVE-2026-86259 | OpenMAIC before 1.0.1 SSRF via Environment-Gated URL Validation | OpenMAIC | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 390719 , 398021 , 398022 |
| CVE-2026-48989 | Windows-MCP: HTTP transports expose unauthenticated PowerShell control with wildcard CORS | Windows-MCP | Protected by Atomicorp rules | 334168 , 390719 |
| CVE-2018-7357 | ZTE ZXHN H168N - Improper Access Restrictions | zxhn h168n firmware | Protected by Atomicorp rules | 330791 , 334168 , 340152 |
| CVE-2019-25678 | C4G BLIS 3.4 SQL Injection via users_select.php | computing for good's basic laboratory information system | Protected by Atomicorp rules | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2019-9082 | ThinkPHP Multiple PHP Injection RCEs | thinkphp | Protected by Atomicorp rules | 344361 , 393753 |
| CVE-2026-10054 | Eclipse Theia Missing Origin Validation in WebSockets Vulnerability | Eclipse Theia | Protected by Atomicorp rules | 390719 |
| CVE-2026-41473 | CyberPanel < 2.4.5 Unauthenticated API Access via AI Scanner Endpoints | cyberpanel | Protected by Atomicorp rules | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-60009 | theia Arbitrary Code Execution Vulnerability | theia | Protected by Atomicorp rules | 351000 |
| CVE-2026-73222 | Claude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (–studio) | claude-code-templates | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2013-10032 | GetSimpleCMS PHP File Upload Vulnerability | getsimplecms | Protected by Atomicorp rules | 330791 , 334168 , 340128 , 340152 , 360152 , 390700 , 390801 |
| CVE-2023-54350 | WordPress Augmented-Reality Plugin Remote Code Execution Unauthenticated | Augmented Reality | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 , 393781 |
| CVE-2025-34115 | OP5 Monitor <= 7.1.9 Authenticated Command Execution via command_test.php | OP5 Monitor | Protected by Atomicorp rules | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2025-34331 | AudioCodes Fax/IVR Appliance <= 2.6.23 Unauthenticated File Read via download.php | fax server | Protected by Atomicorp rules | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-4008 | MeteoBridge <= 6.1 - Remote Code Execution | meteobridge vm | Protected by Atomicorp rules | 393655 |
| CVE-2026-55094 | Taskcluster: Unauthenticated remote code execution in web-server via GraphQL filter argument (sift $where) | taskcluster | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-63722 | ICEcoder 8.1 Unauthenticated RCE via terminal-xhr.php | ICEcoder | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390904 , 393655 |
| CVE-2026-89250 | WWBN AVideo Unauthenticated File Read via getRecordedFile.php | AVideo | Protected by Atomicorp rules | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-34160 | Chamilo LMS: Unauthenticated SSRF via PENS Plugin allows attacker to probe internal network and reach cloud metadata ser | chamilo lms | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-56677 | 9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint | 9router | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-63429 | HeyForm has unauthenticated /api/upload endpoint that accepts arbitrary files with no auth/session/form context | heyform | Protected by Atomicorp rules | 351000 |
| CVE-2021-39144 | XStream 1.4.18 - Remote Code Execution | xstream | Protected by Atomicorp rules | 344363 |
| CVE-2026-55786 | Flyto2 Core: Unauthenticated Command Execution via HTTP MCP execute_module | flyto-core | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-46711 | Soft Machine: Unauthenticated workspace API exposes arbitrary file read & directory exfiltration to any peer on the Fly | security | Protected by Atomicorp rules | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-49471 | Serena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding → memory poisoning → RCE | serena | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-39363 | Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket | vite | Protected by Atomicorp rules | 340007 , 344360 , 347009 , 390709 |
| CVE-2020-12028 | Rockwell FactoryTalk View SE SCADA Unauthenticated Remote Code Execution | factorytalk view | Protected by Atomicorp rules | 390716 |
| CVE-2021-25094 | Tatsu Wordpress Plugin RCE | tatsu | Protected by Atomicorp rules | 330791 , 334168 , 340152 , 382238 |
| CVE-2024-5721 | Logsign Remote Command Injection | unified secops platform | Protected by Atomicorp rules | 344364 , 344366 |
| CVE-2017-10271 | Weblogic < 10.3.6 'wls-wsat' XMLDecoder Deserialization Remote Command Execution (CVE-2017-10271) | weblogic server | Protected by Atomicorp rules | 344362 , 344363 , 344364 , 344366 , 380026 |
| CVE-2019-19822 | TOTOLINK/Realtek Routers - Information Disclosure | a3002ru firmware | Protected by Atomicorp rules | 390716 |
| CVE-2020-10973 | WAVLINK - Access Control | wn530hg4 firmware | Protected by Atomicorp rules | 390716 |
| CVE-2022-24990 | TerraMaster TOS 4.2.29 or lower - Unauthenticated RCE chaining CVE-2022-24990 and CVE-2022-24989 | terramaster operating system | Protected by Atomicorp rules | 340006 , 340007 , 344360 , 344364 , 390709 , 390719 |
| CVE-2023-22047 | Oracle Peoplesoft - Unauthenticated File Read | peoplesoft enterprise | Protected by Atomicorp rules | 340165 , 344360 , 344365 , 347009 |
| CVE-2026-61891 | theia Exposure of Sensitive Information to an Unauthorized Actor Vulnerability | theia | Protected by Atomicorp rules | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-33715 | Chamilo LMS has Unauthenticated SSRF and Open Email Relay via install.ajax.php test_mailer action | chamilo lms | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-46555 | WhatsApp MCP: Unauthenticated bridge API allows message sending and arbitrary file exfiltration | whatsapp mcp server | Protected by Atomicorp rules | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-71257 | BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Authentication Bypass | footprints itsm | Protected by Atomicorp rules | 340014 , 340023 , 340193 , 344362 , 344363 , 344365 , 344370 , 344382 , 344385 , 390613 , 390614 , 390722 , 398008 |
| CVE-2026-65012 | InvokeAI < 6.13.7 Unauthenticated Directory Enumeration via scan_folder | InvokeAI | Protected by Atomicorp rules | 340007 , 344360 , 347009 , 390709 |
| CVE-2021-1499 | Cisco HyperFlex HX Data Platform unauthenticated file upload to RCE (CVE-2021-1499) | hyperflex hx data platform | Protected by Atomicorp rules | 330791 , 334168 , 340152 , 390700 |
| CVE-2021-20150 | Trendnet AC2600 TEW-827DRU - Credentials Disclosure | tew-827dru firmware | Protected by Atomicorp rules | 392301 |
| CVE-2026-112949 | Vitest: Code injection via unauthenticated manual mock registration | vitest | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
Associated Atomicorp WAF Rules
| Rule | Status | Behavior |
|---|---|---|
| 300008 | Active | disruptive (deny) |
| 301007 | Active | disruptive (deny) |
| 312668 | Active | disruptive (deny) |
| 312863 | Active | disruptive (deny) |
| 330039 | Active | disruptive (deny) |
| 330791 | Active | disruptive (deny) |
| 331028 | Active | disruptive (deny) |
| 331032 | Active | non-disruptive (pass) |
| 333140 | Active | disruptive (deny) |
| 333141 | Active | disruptive (deny) |
| 334168 | Active | disruptive (deny) |
| 337109 | Active | disruptive (deny) |
| 337110 | Active | disruptive (deny) |
| 337209 | Active | disruptive (deny) |
| 337210 | Active | disruptive (deny) |
| 337211 | Active | disruptive (deny) |
| 340006 | Active | disruptive (deny) |
| 340007 | Active | disruptive (deny) |
| 340011 | Active | disruptive (deny) |
| 340014 | Active | disruptive (deny) |
| 340016 | Active | disruptive (deny) |
| 340017 | Active | disruptive (deny) |
| 340023 | Active | disruptive (deny) |
| 340029 | Active | disruptive (deny) |
| 340095 | Active | disruptive (deny) |
| 340128 | Active | disruptive (deny) |
| 340144 | Active | disruptive (deny) |
| 340145 | Active | disruptive (deny) |
| 340147 | Active | disruptive (deny) |
| 340148 | Active | disruptive (deny) |
| 340149 | Active | disruptive (deny) |
| 340152 | Active | disruptive (deny) |
| 340155 | Active | disruptive (deny) |
| 340156 | Active | disruptive (deny) |
| 340157 | Active | disruptive (deny) |
| 340159 | Active | disruptive (deny) |
| 340162 | Active | disruptive (deny) |
| 340163 | Active | disruptive (deny) |
| 340165 | Active | disruptive (deny) |
| 340193 | Active | disruptive (deny) |
| 340195 | Active | disruptive (deny) |
| 341145 | Active | disruptive (deny) |
| 341155 | Active | disruptive (deny) |
| 341245 | Active | disruptive (deny) |
| 341256 | Active | disruptive (deny) |
| 342259 | Active | disruptive (deny) |
| 344360 | Active | disruptive (deny) |
| 344361 | Active | disruptive (deny) |
| 344362 | Active | disruptive (deny) |
| 344363 | Active | disruptive (deny) |
| 344364 | Active | disruptive (deny) |
| 344365 | Active | disruptive (deny) |
| 344366 | Active | disruptive (deny) |
| 344370 | Active | disruptive (deny) |
| 344372 | Active | disruptive (deny) |
| 344382 | Active | disruptive (deny) |
| 344385 | Active | disruptive (deny) |
| 345240 | Active | disruptive (deny) |
| 346755 | Active | disruptive (deny) |
| 347009 | Active | disruptive (deny) |
| 350147 | Active | disruptive (deny) |
| 350148 | Active | disruptive (deny) |
| 351000 | Active | disruptive (deny) |
| 356331 | Active | disruptive (deny) |
| 360147 | Active | disruptive (deny) |
| 360148 | Active | disruptive (deny) |
| 360152 | Active | disruptive (deny) |
| 375357 | Active | disruptive (deny) |
| 377360 | Active | non-disruptive (pass) |
| 377364 | Active | non-disruptive (pass) |
| 380018 | Active | disruptive (deny) |
| 380026 | Active | disruptive (deny) |
| 380122 | Active | disruptive (deny) |
| 382238 | Active | disruptive (deny) |
| 390572 | Active | disruptive (deny) |
| 390585 | Active | disruptive (deny) |
| 390613 | Active | disruptive (deny) |
| 390614 | Active | disruptive (deny) |
| 390626 | Active | disruptive (deny) |
| 390700 | Active | disruptive (deny) |
| 390704 | Active | disruptive (deny) |
| 390709 | Active | disruptive (deny) |
| 390716 | Active | disruptive (deny) |
| 390719 | Active | disruptive (deny) |
| 390722 | Active | disruptive (deny) |
| 390723 | Active | disruptive (deny) |
| 390726 | Active | disruptive (deny) |
| 390801 | Active | disruptive (deny) |
| 390904 | Active | disruptive (deny) |
| 391235 | Active | disruptive (deny) |
| 392301 | Active | disruptive (deny) |
| 392647 | Active | disruptive (deny) |
| 392648 | Active | disruptive (deny) |
| 392767 | Active | disruptive (deny) |
| 393655 | Active | disruptive (deny) |
| 393753 | Active | disruptive (deny) |
| 393781 | Active | disruptive (deny) |
| 398008 | Active | non-disruptive (pass) |
| 398021 | Active | disruptive (deny) |
| 398022 | Active | disruptive (deny) |
| 399069 | Active | disruptive (deny) |
Related MITRE CAPEC Context
MITRE associates this CWE with the following attack-pattern entries. These taxonomy relationships are context, not Atomicorp coverage claims:
CAPEC-12 (opens in a new tab) , CAPEC-166 (opens in a new tab) , CAPEC-216 (opens in a new tab) , CAPEC-36 (opens in a new tab) , CAPEC-62 (opens in a new tab)