CWE-346 · Origin Validation Error (page 4)
Page 4 of 8 — CVEs classified under CWE-346, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-69260 | High | 7.5 | 2026-01-08 | A message out-of-bounds read vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service condition on affected instal… |
CVE-2025-69259 | High | 7.5 | 2026-01-08 | A message unchecked NULL return value vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service condition on affect… |
CVE-2025-69258 | Critical | 9.8 | 2026-01-08 | A LoadLibraryEX vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to load an attacker-controlled DLL into a key executab… |
CVE-2026-20893 | High | 7.8 | 2026-01-07 | Origin validation error issue exists in Fujitsu Security Solution AuthConductor Client Basic V2 2.0.25.0 and earlier. If this vulnerability is exploited, an at… |
CVE-2025-69235 | High | 7.5 | 2025-12-30 | Whale browser before 4.35.351.12 allows an attacker to bypass the Same-Origin Policy in a sidebar environment. |
CVE-2025-61740 | | 2025-12-22 | Authentication issue that does not verify the source of a packet which could allow an attacker to create a denial-of-service condition or modify the configurat… | |
CVE-2025-63388 | Critical | 9.1 | 2025-12-18 | A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/system-features endpoint. The endpoint implemen… |
CVE-2025-63386 | Critical | 9.1 | 2025-12-18 | A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/setup endpoint. The endpoint implements an inse… |
CVE-2025-14331 | Medium | 6.5 | 2025-12-09 | Same-origin policy bypass in the Request Handling component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 14… |
CVE-2025-34291 | High | 8.8 | 2025-12-05 | Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS… |
CVE-2025-8074 | Medium | 5.6 | 2025-12-04 | Origin validation error vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.3-13973 allows local users to write arbitrary files with non-sens… |
CVE-2024-32642 | High | 8.8 | 2025-12-03 | Masa CMS is an open source Enterprise Content Management platform. Prior to 7.2.8, 7.3.13, and 7.4.6, there is vulnerable to host header poisoning which allows… |
CVE-2025-13947 | High | 7.4 | 2025-12-03 | A flaw was found in WebKitGTK. This vulnerability allows remote, user-assisted information disclosure that can reveal any file the user is permitted to read vi… |
CVE-2025-37734 | Medium | 4.3 | 2025-11-12 | Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI Assistant. |
CVE-2025-12905 | Medium | 5.4 | 2025-11-08 | Inappropriate implementation in Downloads in Google Chrome on Windows prior to 140.0.7339.80 allowed a remote attacker to bypass Mark of the Web via a crafted… |
CVE-2024-14006 | Medium | 6.1 | 2025-10-30 | Nagios XI versions prior to 2024R1.2.2 contain a host header injection vulnerability. The application trusts the user-supplied HTTP Host header when constructi… |
CVE-2025-12245 | Medium | 5.3 | 2025-10-27 | A vulnerability was identified in chatwoot up to 4.7.0. This vulnerability affects the function initPostMessageCommunication of the file app/javascript/sdk/IFr… |
CVE-2025-62250 | Medium | 6.5 | 2025-10-21 | Improper Authentication in Liferay Portal 7.4.0 through 7.4.3.132, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4… |
CVE-2025-62584 | High | 7.5 | 2025-10-16 | Whale browser before 4.33.325.17 allows an attacker to bypass the Same-Origin Policy in a dual-tab environment. |
CVE-2025-9265 | | 2025-10-13 | A broken authorization vulnerability in Kiloview NDI N30 allows a remote unauthenticated attacker to deactivate user verification, giving them access to state… | |
CVE-2025-2140 | Medium | 5.7 | 2025-10-12 | IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to spoof email identity of the sender… |
CVE-2025-59957 | Medium | 6.8 | 2025-10-09 | An Origin Validation Error vulnerability in an insufficient protected file of Juniper Networks Junos OS on EX4600 Series and QFX5000 Series allows an unauthent… |
CVE-2025-42706 | Medium | 6.5 | 2025-10-08 | A logic error exists in the Falcon sensor for Windows that could allow an attacker, with the prior ability to execute code on a host, to delete arbitrary files… |
CVE-2025-59159 | Critical | 9.6 | 2025-10-06 | SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-… |
CVE-2025-11304 | Medium | 6.3 | 2025-10-05 | A flaw has been found in CodeCanyon/ui-lib Mentor LMS up to 1.1.1. Affected by this vulnerability is an unknown functionality of the component API. Executing m… |
CVE-2025-59845 | High | 8.2 | 2025-09-26 | Apollo Studio Embeddable Explorer & Embeddable Sandbox are website embeddable software solutions from Apollo GraphQL. Prior to Apollo Sandbox version 2.7.2 and… |
CVE-2025-20364 | Medium | 4.3 | 2025-09-24 | A vulnerability in the Device Analytics action frame processing of Cisco Wireless Access Point (AP) Software could allow an unauthenticated, adjacent attacker… |
CVE-2025-56648 | Medium | 6.5 | 2025-09-17 | npm parcel 2.0.0-alpha and before has an Origin Validation Error vulnerability. Malicious websites can send XMLHTTPRequests to the application's development se… |
CVE-2025-10193 | | 2025-09-11 | DNS rebinding vulnerability in Neo4j Cypher MCP server allows malicious websites to bypass Same-Origin Policy protections and execute unauthorised tool invocat… | |
CVE-2025-10201 | High | 8.8 | 2025-09-10 | Inappropriate implementation in Mojo in Google Chrome on Android, Linux, ChromeOS prior to 140.0.7339.127 allowed a remote attacker to bypass site isolation vi… |
CVE-2025-9636 | High | 7.9 | 2025-09-04 | pgAdmin <= 9.7 is affected by a Cross-Origin Opener Policy (COOP) vulnerability. This vulnerability allows an attacker to manipulate the OAuth flow, potential… |
CVE-2024-13068 | High | 7.3 | 2025-09-03 | Origin Validation Error vulnerability in Akinsoft LimonDesk allows Forceful Browsing. This issue affects LimonDesk: from s1.02.14 before v1.02.17. |
CVE-2024-12973 | Medium | 4.7 | 2025-09-02 | Origin Validation Error vulnerability in Akinsoft OctoCloud allows HTTP Response Splitting, CAPEC - 87 - Forceful Browsing. This issue affects OctoCloud: from… |
CVE-2025-47909 | High | 7.3 | 2025-08-29 | Hosts listed in TrustedOrigins implicitly allow requests from the corresponding HTTP origins, allowing network MitMs to perform CSRF attacks. After the CVE-202… |
CVE-2025-51605 | High | 8.1 | 2025-08-22 | An issue was discovered in Shopizer 3.2.7. The server's CORS implementation reflects the client-supplied Origin header verbatim into Access-Control-Allow-Origi… |
CVE-2025-9180 | High | 8.1 | 2025-08-19 | Same-origin policy bypass in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 142, Firefox ESR 115.27, Firefox ESR 128.14, Firefox ESR… |
CVE-2025-52621 | Medium | 5.3 | 2025-08-15 | HCL BigFix SaaS Authentication Service is vulnerable to cache poisoning. The BigFix SaaS's HTTP responses were observed to include the Origin header. Its pre… |
CVE-2025-8881 | Medium | 6.5 | 2025-08-13 | Inappropriate implementation in File Picker in Google Chrome prior to 139.0.7258.127 allowed a remote attacker who convinced a user to engage in specific UI ge… |
CVE-2025-53399 | | 2025-08-01 | In Sipwise rtpengine before 13.4.1.1, an origin-validation error in the endpoint-learning logic of the media-relay core allows remote attackers to inject or in… | |
CVE-2025-7365 | High | 7.1 | 2025-07-10 | A flaw was found in Keycloak. When an authenticated attacker attempts to merge accounts with another existing account during an identity provider (IdP) login… |
CVE-2025-53600 | High | 7.5 | 2025-07-04 | Whale browser before 4.32.315.22 allow an attacker to bypass the Same-Origin Policy in a dual-tab environment. |
CVE-2025-5824 | High | 7.5 | 2025-06-25 | Autel MaxiCharger AC Wallbox Commercial Origin Validation Error Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to by… |
CVE-2025-42998 | Medium | 5.3 | 2025-06-10 | The security settings in the SAP Business One Integration Framework are not adequately checked, allowing attackers to bypass the 403 Forbidden error and access… |
CVE-2024-31127 | High | 7.3 | 2025-06-04 | An improper verification of a loaded library in Zscaler Client Connector on Mac < 4.2.0.241 may allow a local attacker to elevate their privileges. |
CVE-2025-30360 | Medium | 6.5 | 2025-06-03 | webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-server users' source… |
CVE-2025-30466 | Critical | 9.8 | 2025-05-29 | This issue was addressed through improved state management. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, visionOS 2.4. A w… |
CVE-2025-5320 | Low | 3.7 | 2025-05-29 | A vulnerability classified as problematic has been found in gradio-app gradio up to 5.29.1. This affects the function is_valid_origin of the component CORS Han… |
CVE-2025-5263 | Medium | 4.3 | 2025-05-27 | Error handling for script execution was incorrectly isolated from web content, which could have allowed cross-origin leak attacks. This vulnerability was fixed… |
CVE-2025-4839 | Low | 3.1 | 2025-05-17 | A vulnerability has been found in itwanger paicoding 1.0.0/1.0.1/1.0.2/1.0.3 and classified as problematic. Affected by this vulnerability is an unknown functi… |
CVE-2025-46737 | High | 7.4 | 2025-05-12 | SEL-5037 Grid Configurator contains an overly permissive Cross Origin Resource Sharing (CORS) configuration for a data gateway service in the application. This… |
CVE-2025-4542 | Low | 3.1 | 2025-05-11 | A vulnerability, which was classified as problematic, has been found in Freeebird Hotel 酒店管理系统 API up to 1.2. Affected by this issue is some unknown functional… |
CVE-2025-4515 | Medium | 4.3 | 2025-05-10 | A vulnerability, which was classified as problematic, was found in Zylon PrivateGPT up to 0.6.2. This affects an unknown part of the file settings.yaml. The ma… |
CVE-2025-3462 | | 2025-05-09 | "This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints." An insufficient validation in ASUS DriverHub may al… | |
CVE-2025-43929 | Medium | 4.1 | 2025-04-20 | open_actions.py in kitty before 0.41.0 does not ask for user confirmation before running a local executable file that may have been linked from an untrusted do… |
CVE-2025-3651 | | 2025-04-17 | Improper Verification of Source of a Communication Channel in Work Desktop for Mac versions 10.8.1.46 and earlier allows attackers to execute arbitrary comma… | |
CVE-2025-3071 | Medium | 5.4 | 2025-04-02 | Inappropriate implementation in Navigations in Google Chrome prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engage in specific UI ges… |
CVE-2024-45354 | Medium | 4.3 | 2025-03-27 | A code execution vulnerability exists in the Xiaomi shop applicationproduct. The vulnerability is caused by improper input validation and can be exploited by a… |
CVE-2024-45353 | Medium | 4.3 | 2025-03-27 | An intent redriction vulnerability exists in the Xiaomi quick App framework application product. The vulnerability is caused by improper input validation and c… |
CVE-2024-45352 | High | 8.8 | 2025-03-27 | An code execution vulnerability exists in the Xiaomi smarthome application product. The vulnerability is caused by improper input validation and can be exploit… |
CVE-2024-8487 | Critical | 9.8 | 2025-03-20 | A Cross-Origin Resource Sharing (CORS) vulnerability exists in modelscope/agentscope version v0.0.4. The CORS configuration on the agentscope server does not p… |
CVE-2024-8183 | High | 7.6 | 2025-03-20 | A CORS (Cross-Origin Resource Sharing) misconfiguration in prefecthq/prefect version 2.20.2 allows unauthorized domains to access sensitive data. This vulnerab… |
CVE-2024-8024 | High | 7.5 | 2025-03-20 | A CORS misconfiguration vulnerability exists in netease-youdao/qanything version 1.4.1. This vulnerability allows an attacker to bypass the Same-Origin Policy… |
CVE-2024-7819 | High | 7.4 | 2025-03-20 | A CORS misconfiguration in danswer-ai/danswer v1.4.1 allows attackers to steal sensitive information such as chat contents, API keys, and other data. This vuln… |
CVE-2024-6844 | Medium | 5.3 | 2025-03-20 | A vulnerability in corydolphin/flask-cors version 4.0.1 allows for inconsistent CORS matching due to the handling of the '+' character in URL paths. The reques… |
CVE-2024-11602 | High | 7.4 | 2025-03-20 | A Cross-Origin Resource Sharing (CORS) vulnerability exists in feast-dev/feast version 0.40.0. The CORS configuration on the agentscope server does not properl… |
CVE-2024-11045 | Critical | 9.6 | 2025-03-20 | A Cross-Site WebSocket Hijacking (CSWSH) vulnerability in automatic1111/stable-diffusion-webui version 1.10.0 allows an attacker to clone a malicious server ex… |
CVE-2024-10956 | High | 7.1 | 2025-03-20 | GPT Academy version 3.83 in the binary-husky/gpt_academic repository is vulnerable to Cross-Site WebSocket Hijacking (CSWSH). This vulnerability allows an atta… |
CVE-2025-2346 | Medium | 5.6 | 2025-03-16 | A vulnerability has been found in IROAD Dash Cam X5 and Dash Cam X6 up to 20250308 and classified as problematic. This vulnerability affects unknown code of th… |
CVE-2025-25306 | Critical | 9.3 | 2025-03-10 | Misskey is an open source, federated social media platform. The patch for CVE-2024-52591 did not sufficiently validate the relation between the `id` and `url`… |
CVE-2025-25302 | Medium | 6.5 | 2025-03-03 | Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the CORS middleware is setup incorrectly. All origins are reflected, which allows any… |
CVE-2025-23117 | Medium | 6.8 | 2025-03-01 | An Insufficient Firmware Update Validation vulnerability could allow an authenticated malicious actor with access to UniFi Protect Cameras adjacent network to… |
CVE-2025-1102 | Medium | 5.5 | 2025-02-12 | A CWE-346 "Origin Validation Error" in the CORS configuration in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker… |
CVE-2025-1083 | Low | 3.1 | 2025-02-06 | A vulnerability classified as problematic was found in Mindskip xzs-mysql 学之思开源考试系统 3.9.0. Affected by this vulnerability is an unknown functionality of the co… |
CVE-2025-23023 | High | 8.2 | 2025-02-04 | Discourse is an open source platform for community discussion. In affected versions an attacker can carefully craft a request with the right request headers to… |
CVE-2024-55948 | High | 8.2 | 2025-02-04 | Discourse is an open source platform for community discussion. In affected versions an attacker can make craft an XHR request to poison the anonymous cache (fo… |
CVE-2024-57965 | Unrated | | 2025-01-29 | In axios before 1.7.8, lib/helpers/isURLSameOrigin.js does not use a URL object when determining an origin, and has a potentially unwanted setAttribute('href'… |
CVE-2025-21542 | Medium | 6.3 | 2025-01-21 | Vulnerability in the Oracle Communications Order and Service Management product of Oracle Communications Applications (component: Security). Supported version… |
CVE-2025-21511 | High | 7.5 | 2025-01-21 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are Prior… |
CVE-2025-21497 | Medium | 5.5 | 2025-01-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and… |
CVE-2024-21245 | Medium | 5.4 | 2025-01-21 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC). Supported versions that are affected a… |
CVE-2025-24010 | Medium | 6.5 | 2025-01-20 | Vite is a frontend tooling framework for javascript. Vite allowed any websites to send any requests to the development server and read the response due to defa… |
CVE-2023-46715 | Medium | 5.0 | 2025-01-14 | An origin validation error [CWE-346] vulnerability in Fortinet FortiOS IPSec VPN version 7.4.0 through 7.4.1 and version 7.2.6 and below allows an authenticat… |
CVE-2025-23109 | Medium | 6.5 | 2025-01-11 | Long hostnames in URLs could be leveraged to obscure the actual host of the website or spoof the website address. This vulnerability was fixed in Firefox for i… |
CVE-2024-5872 | Medium | 6.5 | 2025-01-10 | On affected platforms running Arista EOS, a specially crafted packet with incorrect VLAN tag might be copied to CPU, which may cause incorrect control plane be… |
CVE-2024-55917 | High | 7.8 | 2024-12-31 | An origin validation error vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. Please note… |
CVE-2022-21505 | Medium | 6.7 | 2024-12-24 | In the linux kernel, if IMA appraisal is used with the "ima_appraise=log" boot param, lockdown can be defeated with kexec on any machine when Secure Boot is di… |
CVE-2022-32144 | High | 8.6 | 2024-12-20 | There is an insufficient input verification vulnerability in Huawei product. Successful exploitation of this vulnerability may lead to service abnormal. (Vulne… |
CVE-2024-56170 | Medium | 5.3 | 2024-12-18 | A validation integrity issue was discovered in Fort through 1.6.4 before 2.0.0. RPKI manifests are listings of relevant files that clients are supposed to veri… |
CVE-2024-54490 | Medium | 5.5 | 2024-12-12 | This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Sequoia 15.2. A local attacker may gain access to user's Keychain items. |
CVE-2024-44212 | Medium | 5.3 | 2024-12-12 | A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1, iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, tvOS… |
CVE-2024-45495 | Medium | 4.3 | 2024-11-29 | MSA FieldServer Gateway 5.0.0 through 6.5.2 allows cross-origin WebSocket hijacking. |
CVE-2024-51072 | Medium | 5.3 | 2024-11-22 | An issue in KIA Seltos vehicle instrument cluster with software and hardware v1.0 allows attackers to cause a Denial of Service (DoS) via ECU reset UDS service… |
CVE-2024-51037 | Medium | 5.3 | 2024-11-15 | An issue in kodbox v.1.52.04 and before allows a remote attacker to obtain sensitive information via the captcha feature in the password reset function. |
CVE-2024-50654 | High | 7.5 | 2024-11-15 | lilishop <=4.2.4 is vulnerable to Incorrect Access Control, which can allow attackers to obtain coupons beyond the quantity limit by capturing and sending the… |
CVE-2024-10534 | Critical | 9.8 | 2024-11-15 | Origin Validation Error vulnerability in Dataprom Informatics Personnel Attendance Control Systems (PACS) / Access Control Security Systems (ACSS) allows Traff… |
CVE-2024-6674 | High | 7.1 | 2024-10-29 | A CORS misconfiguration in parisneo/lollms-webui prior to version 10 allows attackers to steal sensitive information such as logs, browser sessions, and settin… |
CVE-2024-10460 | Medium | 5.3 | 2024-10-29 | The origin of an external protocol handler prompt could have been obscured using a data: URL within an `iframe`. This vulnerability affects Firefox < 132, Fire… |
CVE-2024-44734 | High | 7.5 | 2024-10-11 | Incorrect access control in Mirotalk before commit 9de226 allows attackers to arbitrarily change usernames via sending a crafted roomAction request to the serv… |
CVE-2024-9393 | High | 7.5 | 2024-10-01 | An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://pdf.js` origin. This could allow them to acc… |
CVE-2024-9392 | Critical | 9.8 | 2024-10-01 | A compromised content process could have allowed for the arbitrary loading of cross-origin pages. This vulnerability affects Firefox < 131, Firefox ESR < 128.3… |