CWE-346 · Origin Validation Error (page 3)
Page 3 of 8 — CVEs classified under CWE-346, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-14105 | Medium | 4.3 | 2026-06-30 | Insufficient policy enforcement in Speech in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML pag… |
CVE-2026-14079 | Medium | 4.3 | 2026-06-30 | Insufficient policy enforcement in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML pa… |
CVE-2026-14057 | Medium | 4.3 | 2026-06-30 | Inappropriate implementation in FedCM in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (… |
CVE-2026-14053 | Medium | 4.3 | 2026-06-30 | Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to lea… |
CVE-2026-14046 | Medium | 4.3 | 2026-06-30 | Inappropriate implementation in CustomTabs in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a craf… |
CVE-2026-14039 | Medium | 4.3 | 2026-06-30 | Insufficient policy enforcement in GetUserMedia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HT… |
CVE-2026-13913 | Medium | 6.5 | 2026-06-30 | Insufficient policy enforcement in Autofill in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific… |
CVE-2026-13887 | Medium | 6.5 | 2026-06-30 | Inappropriate implementation in NFC in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to le… |
CVE-2026-13881 | Medium | 6.5 | 2026-06-30 | Inappropriate implementation in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTM… |
CVE-2026-13868 | Medium | 6.5 | 2026-06-30 | Inappropriate implementation in Network in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process t… |
CVE-2026-13840 | Medium | 6.5 | 2026-06-30 | Insufficient policy enforcement in Canvas in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page… |
CVE-2026-13839 | Medium | 6.5 | 2026-06-30 | Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Ch… |
CVE-2026-13838 | Medium | 6.5 | 2026-06-30 | Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Ch… |
CVE-2026-13826 | Medium | 6.5 | 2026-06-30 | Inappropriate implementation in Autofill in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-13822 | Medium | 6.5 | 2026-06-30 | Inappropriate implementation in Extensions in Google Chrome on Android prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious e… |
CVE-2026-13793 | Medium | 6.5 | 2026-06-30 | Insufficient policy enforcement in SVG in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Ch… |
CVE-2026-58169 | High | 7.5 | 2026-06-30 | Vibe-Trading before 0.1.10 contains a DNS rebinding authentication bypass vulnerability that allows remote attackers to bypass bearer-token authentication by e… |
CVE-2026-43700 | Medium | 6.5 | 2026-06-29 | A cross-origin issue was addressed with improved tracking of security origins. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2… |
CVE-2026-46611 | Medium | 5.3 | 2026-06-25 | Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances XML-RPC server (glances -s, implemented in glances/server.py) does… |
CVE-2026-55487 | High | 7.5 | 2026-06-25 | pnpm is a package manager. Prior to 10.34.2 and 11.5.3, the generic peer-suffix normalizer also stripped parenthesized text from git, URL, tarball, file, and o… |
CVE-2026-54030 | High | 8.0 | 2026-06-25 | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.5, LibreChat's MCP OAuth implementation does not validate that the res… |
CVE-2026-54069 | | 2026-06-24 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan Note's kernel HTTP server unconditionally trusts all chrome-extension://… | |
CVE-2026-13034 | Medium | 4.7 | 2026-06-24 | Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer process to bypass… |
CVE-2026-13022 | Medium | 6.5 | 2026-06-24 | Inappropriate implementation in Autofill in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer process to leak cr… |
CVE-2026-13021 | Medium | 4.3 | 2026-06-24 | Inappropriate implementation in DeviceBoundSessionCredentials in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to bypass same origin policy v… |
CVE-2026-54007 | Medium | 6.5 | 2026-06-23 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, the chat message listener allows non-same-or… |
CVE-2026-55767 | Medium | 5.8 | 2026-06-23 | Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, CookieJar incorrectly accepts cookies with a dot-only Domain attribute and whitespace-padded variants… |
CVE-2026-50168 | High | 8.2 | 2026-06-22 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2… |
CVE-2026-54665 | Medium | 5.3 | 2026-06-22 | Apache NiFi 0.0.1 through 2.9.0 support building qualified URLs from one of several HTTP request headers that provide an alternative to the standard Host heade… |
CVE-2026-6734 | High | 7.5 | 2026-06-17 | Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the reque… |
CVE-2026-12304 | Critical | 9.1 | 2026-06-16 | Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbi… |
CVE-2026-47825 | High | 8.6 | 2026-06-15 | Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies in certain configuration scenarios. This affects both the… |
CVE-2026-9595 | Medium | 5.3 | 2026-06-15 | Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it also intercepts the dev server's own HMR WebSocket and… |
CVE-2026-11624 | | 2026-06-13 | The Model Context Protocol has a security warning advising servers to validate the "Origin" header on all incoming connections to prevent DNS rebinding attacks… | |
CVE-2026-47691 | High | 8.7 | 2026-06-12 | Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's `DnsResolve… |
CVE-2026-45674 | High | 8.7 | 2026-06-12 | Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveC… |
CVE-2026-44894 | High | 7.5 | 2026-06-12 | Netty is a network application framework for development of protocol servers and clients. NoQuicTokenHandler is the tokenHandler used when the application does… |
CVE-2026-45173 | Medium | 6.5 | 2026-06-11 | Idira Identity Browser Extension (Chrome, Firefox, and Edge builds) versions prior to 26.8.1 exhibit an origin validation flaw within its internal web-page ver… |
CVE-2026-12032 | Low | 3.1 | 2026-06-11 | Inappropriate implementation in Passwords in Google Chrome on Android prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer proces… |
CVE-2026-12024 | Medium | 6.5 | 2026-06-11 | Insufficient policy enforcement in DevTools in Google Chrome prior to 149.0.7827.115 allowed a remote attacker to bypass same origin policy via a crafted HTML… |
CVE-2026-41700 | High | 8.1 | 2026-06-11 | Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking. An attacker can trick an authentica… |
CVE-2026-42558 | High | 7.6 | 2026-06-10 | Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.2, a vulnerability chain… |
CVE-2026-10846 | High | 7.5 | 2026-06-10 | NLnet Labs ldns 1.2.0 up to and including versions 1.9.0, when used in applications as (stub) resolver over UDP, lacks matching the query destination address a… |
CVE-2026-44755 | Medium | 4.3 | 2026-06-09 | SAP Business Objects Business Intelligence Platform does not sufficiently validate email sending parameters supplied by authenticated users, resulting in an em… |
CVE-2026-11693 | High | 8.1 | 2026-06-09 | Inappropriate implementation in Plugins in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to bypass s… |
CVE-2026-43972 | High | 7.2 | 2026-06-08 | Origin Validation Error vulnerability in ninenines gun (gun_http2 module) allows cross-origin cookie injection via unvalidated HTTP/2 PUSH_PROMISE authority. … |
CVE-2026-37737 | Medium | 6.5 | 2026-06-05 | sanic-cors version 2.2.0 and prior contains an improper regular expression in the try_match() function in sanic_cors/core.py that uses re.match without end-anc… |
CVE-2026-11309 | Medium | 4.3 | 2026-06-05 | Insufficient policy enforcement in History in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (C… |
CVE-2026-11298 | Medium | 4.3 | 2026-06-05 | Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a craf… |
CVE-2026-11291 | Medium | 4.3 | 2026-06-05 | Inappropriate implementation in Android Autofill in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via… |
CVE-2026-11278 | Medium | 6.5 | 2026-06-05 | Inappropriate implementation in CustomTabs in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to leak cross-origin data via a crafted… |
CVE-2026-11243 | Medium | 5.4 | 2026-06-05 | Inappropriate implementation in Downloads in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a crafted HTM… |
CVE-2026-11226 | Medium | 6.5 | 2026-06-04 | Insufficient policy enforcement in PreviewTab in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in sp… |
CVE-2026-11217 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Fenced Frames in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to byp… |
CVE-2026-11214 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted… |
CVE-2026-11200 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Ch… |
CVE-2026-11195 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in MHTML in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures… |
CVE-2026-11194 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (C… |
CVE-2026-11181 | Medium | 6.3 | 2026-06-04 | Inappropriate implementation in Media Session in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML… |
CVE-2026-11178 | Medium | 4.3 | 2026-06-04 | Insufficient policy enforcement in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted… |
CVE-2026-11176 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chr… |
CVE-2026-11161 | Medium | 4.3 | 2026-06-04 | Inappropriate implementation in DataTransfer in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML pag… |
CVE-2026-11133 | Medium | 6.5 | 2026-06-04 | Insufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page… |
CVE-2026-11132 | Medium | 6.5 | 2026-06-04 | Insufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page… |
CVE-2026-11084 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML… |
CVE-2026-11083 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML… |
CVE-2026-11081 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Canvas in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page… |
CVE-2026-11048 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to… |
CVE-2026-11036 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in DOM in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Ch… |
CVE-2026-11032 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML… |
CVE-2026-11020 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted XML file… |
CVE-2026-10996 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Workers in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page… |
CVE-2026-10937 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML pag… |
CVE-2026-6657 | High | 8.8 | 2026-06-03 | A vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allows an attacker to bypass CORS origin validation when the `allow_origin_pat` configuration… |
CVE-2026-47265 | High | 7.5 | 2026-06-02 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the `cookies` parameter on requests a… |
CVE-2026-34460 | Medium | 5.4 | 2026-06-02 | NamelessMC is website software for Minecraft servers. In versions 2.2.4 and prior, the OAuth callback handling does not validate the state parameter server-sid… |
CVE-2026-44649 | Critical | 9.8 | 2026-05-29 | SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-… |
CVE-2026-44698 | High | 8.3 | 2026-05-29 | Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.4.1 for iOS and 2026.4.4 for Android, he Home A… |
CVE-2026-9989 | Medium | 6.3 | 2026-05-28 | Inappropriate implementation in Media in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to bypass same origin policy via a crafted video file… |
CVE-2026-10010 | Medium | 5.0 | 2026-05-28 | Inappropriate implementation in Input in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to… |
CVE-2026-46685 | | 2026-05-28 | RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, when RUSTFS_CORS_ALLOWED_ORIGINS is unset, the RustFS S3 listener's Conditi… | |
CVE-2026-45021 | | 2026-05-28 | Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5, th… | |
CVE-2025-66593 | Medium | 6.1 | 2026-05-27 | An origin validation error vulnerability in Synology Assistant before 7.0.6-50085 allows local users to write arbitrary files with restricted content and condu… |
CVE-2025-66592 | Medium | 6.1 | 2026-05-27 | An origin validation error vulnerability in Synology Active Backup for Business Agent before 3.1.0-4967 allows local users to write arbitrary files with restri… |
CVE-2025-13593 | Medium | 6.1 | 2026-05-27 | Origin validation error vulnerability in Synology ActiveProtect Agent before 1.1.0-0439 allows local users to write arbitrary files with restricted content and… |
CVE-2026-44985 | Critical | 9.6 | 2026-05-26 | Dozzle is a realtime log viewer for docker containers. Prior to 10.5.2, he WebSocket upgrader for the /exec and /attach endpoints uses CheckOrigin: func(r *htt… |
CVE-2026-42901 | Critical | 10.0 | 2026-05-22 | Origin validation error in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-45207 | High | 7.8 | 2026-05-21 | An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to… |
CVE-2026-45206 | High | 7.8 | 2026-05-21 | An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to… |
CVE-2026-34930 | High | 7.8 | 2026-05-21 | An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to… |
CVE-2026-34929 | High | 7.8 | 2026-05-21 | An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to… |
CVE-2026-34928 | High | 7.8 | 2026-05-21 | An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to… |
CVE-2026-34927 | High | 7.8 | 2026-05-21 | An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. Please note: an at… |
CVE-2025-71217 | High | 7.8 | 2026-05-21 | An origin validation error vulnerability in the Trend Micro Apex One (mac) agent self-protection mechanism could allow a local attacker to escalate privileges… |
CVE-2025-71214 | High | 7.8 | 2026-05-21 | An origin validation error vulnerability in the Trend Micro Apex One (mac) agent iCore service could allow a local attacker to escalate privileges on affected… |
CVE-2025-71213 | High | 7.8 | 2026-05-21 | An origin validation error vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. Please note… |
CVE-2026-40622 | High | 7.5 | 2026-05-20 | NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could extend the ghost doma… |
CVE-2026-8971 | Medium | 6.5 | 2026-05-19 | Same-origin policy bypass in the Networking: JAR component. This vulnerability was fixed in Firefox 151 and Thunderbird 151. |
CVE-2026-8950 | Critical | 9.3 | 2026-05-19 | Same-origin policy bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird… |
CVE-2026-2611 | Critical | 9.6 | 2026-05-19 | In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote atta… |