CVE-2026-55842 | Medium | 5.4 | 2026-10-15 | Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, the apiCorsConfiguration() method in src/main/java/com/erudika/scoold/ScooldServer… |
CVE-2026-55587 | High | 8.1 | 2026-10-15 | AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.29.4, the AliasVault browser extension passkey provider does not bind p… |
CVE-2026-109829 | High | 7.4 | 2026-10-15 | undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cac… |
CVE-2026-101897 | | | 2026-10-14 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 1.20.0 until 1.21.1, t… |
CVE-2026-97381 | Critical | 9.9 | 2026-10-13 | Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 contains an origin validation error in… |
CVE-2026-96238 | Medium | 6.5 | 2026-10-13 | Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-96234 | Medium | 5.3 | 2026-10-13 | Origin validation error in .NET allows an unauthorized attacker to disclose information over a network. |
CVE-2026-88132 | Medium | 5.9 | 2026-10-13 | Origin validation error in Azure Key Vault allows an unauthorized attacker to disclose information over a network. |
CVE-2026-70213 | High | 8.0 | 2026-10-13 | Origin validation error in Microsoft Power Apps allows an authorized attacker to execute code over a network. |
CVE-2026-69877 | Medium | 6.5 | 2026-10-13 | Origin validation error in Azure DevOps allows an unauthorized attacker to disclose information over a network. |
CVE-2026-103417 | Medium | 5.5 | 2026-10-13 | Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation occurred while the saved-login UI was open. Autofill was not bound… |
CVE-2026-108362 | | | 2026-10-12 | Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.11.0, TEE attestation evidence in… |
CVE-2026-77363 | High | 8.8 | 2026-10-12 | obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, the Streamable HTTP transport does not validate the H… |
CVE-2026-109332 | Low | 3.1 | 2026-10-12 | Network-AI (npm network-ai) before 5.15.2 contains an origin validation error in McpSseServer._handleRequest in lib/mcp-transport-sse.ts that reflects localhos… |
CVE-2026-109286 | High | 8.1 | 2026-10-12 | Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user'… |
CVE-2026-9191 | Critical | 9.6 | 2026-10-12 | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently isolate user-supplied code executed through certain R… |
CVE-2026-108269 | | | 2026-10-09 | Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.5.0, the Rust and Go RA-TLS challenge verif… |
CVE-2026-108268 | | | 2026-10-09 | Enclave OS Virtual runs container workloads inside confidential virtual machines with end-to-end attestation. Prior to tdx-v0.2.43 and tdx-gpu-v0.6.27, the TDX… |
CVE-2026-108267 | | | 2026-10-09 | Privasys Go is a maintained fork of the Go programming language that adds RA-TLS support to crypto/tls. Prior to privasys-v0.5.1-go1.26.5, challenge-mode RA-TL… |
CVE-2026-108266 | | | 2026-10-09 | Privasys rustls is a maintained fork of the rustls TLS library that adds RA-TLS challenge and channel-binding support. Prior to privasys-v0.8.1, the fork emitt… |
CVE-2026-108265 | | | 2026-10-09 | Enclave OS Mini is a Rust-based runtime for confidential applications inside Intel SGX enclaves. Prior to wasm-v0.40.0, the SGX runtime's RA-TLS challenge cert… |
CVE-2026-108261 | Critical | 9.3 | 2026-10-09 | Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in packages/tinacms/src/admin/index… |
CVE-2026-107804 | Medium | 5.3 | 2026-10-09 | Nginx UI is a web user interface for the Nginx web server. From 2.2.0 until 2.6.0, the bundled reverse proxy does not preserve the external client identity use… |
CVE-2026-107292 | Medium | 6.4 | 2026-10-08 | Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 2.30.0, the Agent.to_web() and clai web d… |
CVE-2026-104659 | High | 7.5 | 2026-10-08 | Missing Host header validation and missing throttling of failed administrator sign-ins in the REST API listener of Progressive Robot hMailServer 6.0.0 through… |
CVE-2026-107503 | | | 2026-10-08 | In Eclipse Ditto versions 3.6.0 to 3.8.13 and 3.9.0 to 3.9.7, the Ditto Explorer UI loads its complete environment configuration, including the Ditto API URI a… |
CVE-2026-107281 | | | 2026-10-07 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16… |
CVE-2026-107230 | High | 7.4 | 2026-10-07 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 3.0.14… |
CVE-2026-33586 | | | 2026-10-07 | Authenticated users are able to manipulate both the SMTP
envelope “Envelope-from” and “From” fields when sending
emails through OVH mail servers.
Due to OVH… |
CVE-2026-101027 | High | 7.7 | 2026-10-06 | When `[migrations] ALLOWED_DOMAINS` was configured, a hostname matching the allow list was accepted without checking its resolved address against the local-net… |
CVE-2026-105861 | High | 8.2 | 2026-10-06 | Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, authenticated external URL-based upload retrie… |
CVE-2026-105783 | High | 8.0 | 2026-10-06 | Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with… |
CVE-2026-105396 | Medium | 5.4 | 2026-10-05 | Heym before v0.0.112 contains a token leakage vulnerability in build_public_base_url() that allows unauthenticated attackers to redirect HITL review links by s… |
CVE-2026-94486 | Medium | 5.4 | 2026-10-02 | Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protoc… |
CVE-2026-94485 | Medium | 5.3 | 2026-10-02 | Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the `next dev` development server exposes a Model Context Prot… |
CVE-2026-104056 | Critical | 9.8 | 2026-10-01 | Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poi… |
CVE-2026-103922 | Critical | 9.3 | 2026-10-01 | Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigati… |
CVE-2026-102588 | Medium | 6.5 | 2026-09-30 | A flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery (CSRF) token validation. By tricking an authenticated user wit… |
CVE-2026-102878 | High | 8.1 | 2026-09-29 | mcp-chrome-bridge through 1.0.31 contains an origin validation error in the native-server HTTP API that allows attackers to bypass CORS restrictions. Attackers… |
CVE-2026-102675 | High | 7.4 | 2026-09-29 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, re… |
CVE-2026-102673 | High | 8.2 | 2026-09-29 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened fro… |
CVE-2026-100830 | High | 8.1 | 2026-09-29 | Mitigation bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
CVE-2026-100821 | Medium | 4.7 | 2026-09-29 | Site isolation issue in the Panning and Zooming component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird… |
CVE-2026-100816 | High | 8.1 | 2026-09-29 | Site isolation issue in the DOM: Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
CVE-2026-100809 | High | 8.1 | 2026-09-29 | Same-origin policy bypass in the DevTools component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
CVE-2026-100803 | High | 8.1 | 2026-09-29 | Same-origin policy bypass in the WebExtensions component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 1… |
CVE-2026-101278 | Medium | 4.3 | 2026-09-29 | A weakness has been identified in Trusted Domain Project OpenDMARC up to 1.4.2. This affects the function opendmarc_get_tld of the file libopendmarc/opendmarc_… |
CVE-2026-18825 | | | 2026-09-28 | An Origin Validation Error in the middleware of the connect-xcors npm package allows an attacker to bypass origin verification and perform a cross domain authe… |
CVE-2026-100646 | High | 8.1 | 2026-09-26 | SiYuan is a self-hosted personal knowledge management system. In versions up to and including 3.8.3, the kernel's authentication guards (CheckAuth in kernel/mo… |
CVE-2026-100642 | High | 7.6 | 2026-09-26 | SiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery vulnerability in the CheckAuth lock-screen pass-through branch that grants admin… |
CVE-2026-100598 | High | 7.1 | 2026-09-26 | OpenClaw (npm package openclaw) before 2026.7.1 incorrectly binds Signal approval reactions. In affected versions, a reaction intended to resolve a structured… |
CVE-2026-61742 | | | 2026-09-24 | DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Versions prior to 0.22.5 expose an unauthenticated HTTP MCP endpoint w… |
CVE-2026-91132 | Medium | 4.3 | 2026-09-24 | Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, sites using wildcard patterns in the allowed_iframes sett… |
CVE-2026-85682 | High | 8.8 | 2026-09-24 | The YOP Poll plugin for WordPress is vulnerable to Origin Validation Error in all versions up to, and including, 7.0.10. This is due to the plugin transmitting… |
CVE-2026-97155 | Medium | 6.5 | 2026-09-24 | Fabasoft Folio Client before 2026, a locally installed component that communicates with the Fabasoft browser extension via web messaging, does not restrict whi… |
CVE-2026-94243 | High | 7.3 | 2026-09-23 | A vulnerability in Apache Sling Security Bundle: the ReferrerFilter accepts weaker-than-orgin evidence.
This issue affects Apache Sling Security Bundle: bef… |
CVE-2026-92706 | Low | 3.4 | 2026-09-22 | Dark Reader is an accessibility browser extension that makes web pages colors dark. Prior to 4.9.126, a website can cause the browser extension's image inversi… |
CVE-2026-94111 | Medium | 6.6 | 2026-09-20 | Tencent BrowserSkill through 0.3.0 contains an authentication bypass vulnerability in the local daemon WebSocket origin validation that accepts any chrome-exte… |
CVE-2026-92702 | Critical | 9.1 | 2026-09-18 | Cocos AI is a confidential computing system for AI. In Cocos AI 0.8.2 and earlier, VerifyAttestationReportTLS in the AMD SEV-SNP verifier sets Policy.ReportDat… |
CVE-2026-92701 | Critical | 9.1 | 2026-09-18 | Cocos AI is a confidential computing system for AI. In Cocos AI 0.8.2 and earlier, VerifTeeAttestation in the Intel TDX aTLS verifier receives an expected curr… |
CVE-2026-77339 | | | 2026-09-18 | Process Compose is a scheduler and orchestrator for non-containerized applications. Prior to 1.120.0, the MCP SSE listener in src/mcp/server.go accepts browser… |
CVE-2026-89058 | High | 7.4 | 2026-09-18 | A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-A… |
CVE-2026-12284 | Low | 3.7 | 2026-09-17 | Mattermost Desktop App versions <=6.2 6.2.2.0 fails to validate the IPC sender in the leaveCall handler which allows a malicious or compromised Mattermost serv… |
CVE-2026-75025 | Medium | 4.7 | 2026-09-16 | Mattermost Desktop App versions <=6.2 6.2.2.0 Fixed an issue where Mattermost Desktop did not sufficiently restrict server-rendered content from accessing loca… |
CVE-2026-77119 | Medium | 5.9 | 2026-09-16 | A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged unsigned ans… |
CVE-2026-92360 | Medium | 6.3 | 2026-09-16 | A weakness has been identified in ag-ui-protocol ag-ui 1.0. The impacted element is the function prepareRunAgentInput of the file agent/agent.ts of the compone… |
CVE-2026-92359 | Low | 3.1 | 2026-09-16 | A security flaw has been discovered in ag-ui-protocol ag-ui 0.3.0. The affected element is the function create_strands_app of the file integrations/aws-strands… |
CVE-2026-86466 | High | 8.1 | 2026-09-16 | Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the id_token it accepts. An at… |
CVE-2026-59971 | Critical | 10.0 | 2026-09-15 | MySQL MCP Server is a Model Context Protocol server that enables secure interaction with MySQL databases. Prior to 0.4.2, setting MCP_TRANSPORT=sse causes src/… |
CVE-2026-92068 | Medium | 5.4 | 2026-09-15 | Site isolation issue in the Reader Mode component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
CVE-2026-92034 | Critical | 9.1 | 2026-09-15 | Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. |
CVE-2026-57112 | High | 8.3 | 2026-09-15 | PraisonAI is a multi-agent teams system. From praisonaiagents 0.6.0 until 1.6.59 and PraisonAI 3.10.0 until 4.6.59, ToolsMCPServer.run_sse() in src/praisonai-a… |
CVE-2026-91201 | Medium | 5.4 | 2026-09-14 | DocsGPT through 0.20.0 posts OAuth connector session tokens to a wildcard target origin in the callback-status endpoint without validating sender origin. Attac… |
CVE-2026-55837 | Medium | 6.8 | 2026-09-14 | dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.20.0, the local OAuth helper in src/dbt_mcp/oauth/fastapi_app.py exposes GET /d… |
CVE-2026-82438 | High | 8.1 | 2026-09-14 | Description
Three separate mechanisms allowed a web page on an unrelated origin to read responses that Storm's HTTP
components served to an authenticated user… |
CVE-2026-23792 | Medium | 4.0 | 2026-09-14 | An issue was discovered in NR RRC in Samsung Mobile Processor and Modem Exynos 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, W1000, Modem 5300, M… |
CVE-2026-50025 | | | 2026-09-11 | Mousehole is a background service to update a seedbox IP for MAM and web app to manage it. Prior to version 0.4.05, Mousehole's HTTP/WebSocket management bound… |
CVE-2026-78807 | High | 7.1 | 2026-09-11 | An issue in wpa_supplicant all versions before v.2.12 allows a local attacker to bypass proper network context and AKMP matching for PMKSA caching via missing… |
CVE-2026-87563 | Medium | 4.3 | 2026-09-09 | Origin validation error in Paint in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromi… |
CVE-2026-69680 | High | 8.1 | 2026-09-08 | Origin validation error in Windows DNS allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-69559 | Medium | 5.8 | 2026-09-08 | Origin validation error in Microsoft Teams for Android allows an authorized attacker to disclose information over a network. |
CVE-2026-58649 | Medium | 6.5 | 2026-09-08 | Origin validation error in .NET allows an unauthorized attacker to disclose information over a network. |
CVE-2026-75156 | Critical | 9.1 | 2026-09-08 | Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD `id_token`s during OAuth login. Deployments are aff… |
CVE-2026-85152 | High | 7.4 | 2026-09-04 | undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a… |
CVE-2026-84482 | High | 8.8 | 2026-09-01 | WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the get_domain() and isSameDomain() functions that fail to properly… |
CVE-2026-84140 | Critical | 9.8 | 2026-09-01 | Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. |
CVE-2026-84137 | Medium | 4.3 | 2026-09-01 | Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. |
CVE-2026-84133 | Critical | 9.8 | 2026-09-01 | Site isolation issue in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird… |
CVE-2026-84129 | Critical | 9.8 | 2026-09-01 | Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. |
CVE-2026-82811 | Medium | 5.4 | 2026-08-31 | A security vulnerability has been detected in Toggl OÜ Toggl Track Extension 4.11.16. This affects an unknown function of the component postMessage Handler. Th… |
CVE-2026-81315 | | | 2026-08-31 | Origin Validation Error vulnerability in ash-project ash_ai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-sit… |
CVE-2026-70309 | Medium | 5.4 | 2026-08-28 | Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-59297 | Low | 3.1 | 2026-08-27 | Implementation of isSecure() call of ServerlessHttpServletRequest does not verify the actual scheme.
Spring Cloud Function 5.0.0 - 5.0.3
Spring Cloud Function… |
CVE-2026-81102 | Low | 3.1 | 2026-08-27 | The Dash MCP server bound its listener to the loopback address but never checked the host a request named. src/mcp_server_dash.py constructed the server for it… |
CVE-2026-81100 | Medium | 6.8 | 2026-08-27 | tiger-gh-mcp-server started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpSe… |
CVE-2026-81099 | Medium | 6.8 | 2026-08-27 | tiger-slack started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. mcp/src/httpServer.ts called the shared httpServer… |
CVE-2026-81095 | Medium | 6.8 | 2026-08-27 | pg-aiguide started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFacto… |
CVE-2026-81092 | Medium | 6.8 | 2026-08-27 | mcp-go accepted requests on its HTTP transports without checking the Host header. StreamableHTTPServer.ServeHTTP in server/streamable_http.go and SSEServer.Ser… |
CVE-2026-55637 | | | 2026-08-25 | genieacs-mcp is an MCP server for GenieACS written in Go. Prior to 0.3.2, the Streamable HTTP transport in cmd/server/main.go creates an unauthenticated /mcp l… |
CVE-2026-55532 | High | 7.6 | 2026-08-25 | PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, MCP HTTP Stream _validate_origin uses request_origin.startswith(allowed), allowing the atta… |