CVE-2026-40434
High · 8.1CVSS
8.1
EPSS
0.4%
Published
Apr 17, 2026
CISA due date
—
The record
Anviz CrossChex Standard lacks source verification in the client/server channel, enabling TCP packet injection by an attacker on the same network to alter or disrupt application traffic.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-89178 WeenyGenius, a computer lab management system by Howyar Technologies, has an Origin… CWE-940
- CVE-2026-85085 The Canva Android App before 2.376.0 allowed an external origin to be loaded in a… CWE-940
- CVE-2026-73419 NextAuth.js provides authentication for Next.js. CWE-940
- GHSA-g5qx-h5f3-mp2f TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable… CWE-940
- CVE-2026-54106 The U.S. CWE-940
- CVE-2026-6734 Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across… CWE-940
- CVE-2026-44894 Netty is a network application framework for development of protocol servers and clients. CWE-940
- GHSA-x426-x7cc-3fpc @hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme… CWE-940