CVE-2026-18676 | | | 2026-08-12 | The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is… |
CVE-2026-46409 | Critical | 9.6 | 2026-08-07 | OpenYak is a local-first agent runtime for reliable tool-using models, with a desktop workspace built on top. Prior to version 1.1.3, the OpenYak desktop backe… |
CVE-2026-70604 | High | 7.4 | 2026-08-05 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.3, 41.4.0, and 42.0.0, a custom… |
CVE-2026-65310 | High | 7.5 | 2026-07-31 | ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration
of affected versions, exposes its data and configuration endpoint
without any authenticat… |
CVE-2026-66005 | Medium | 6.3 | 2026-07-24 | Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS misconfiguration vulnerability in its local API server that allows network-adjacent attackers to by… |
CVE-2026-15966 | High | 7.5 | 2026-07-23 | Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer.
This issue affects MOVEit Transfer: before 2025.1.5… |
CVE-2026-21761 | Medium | 4.2 | 2026-07-17 | HCL DevOps Loop is affected by a Cross-Origin Resource Sharing (CORS) misconfiguration. Improper CORS configuration may allow unauthorized cross-origin request… |
CVE-2024-23578 | Medium | 4.2 | 2026-07-17 | HCL Aftermarket EPC is vulnerable to attack as the application implements an HTML5 cross-origin resource sharing (CORS) policy for this request that allows acc… |
CVE-2026-62387 | High | 7.1 | 2026-07-17 | The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 shipped Access-Control-Allow-Origin: * as its default CORS configuration on all responses, inc… |
CVE-2026-61736 | Critical | 9.3 | 2026-07-15 | LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, the server defaults to CORS_ORIGINS=* combined with allow_credentials=True in… |
CVE-2026-8919 | | | 2026-07-15 | Permissive Cross-domain Security Policy with Untrusted Domains in ASUS GameSDK allows a remote user to obtain a local user’s NTLM hash by convincing the user t… |
CVE-2026-59148 | High | 8.8 | 2026-07-09 | Mockoon provides way to design and run mock APIs. Prior to 9.7.0, Mockoon's admin API in commons-server/src/libs/server/admin-api.ts is mounted on the same Exp… |
CVE-2026-59726 | Critical | 10.0 | 2026-07-09 | Ruflo is an agent meta-harness for Claude Code and Codex. Prior to 3.16.3, ruflo's default docker-compose deployment exposed the MCP bridge POST /mcp and POST… |
CVE-2026-56458 | Medium | 5.4 | 2026-07-09 | HCL DevOps Deploy uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as… |
CVE-2026-55110 | High | 7.5 | 2026-07-02 | A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Origin Resource Sharing (CORS) misconfiguration found in UniFi OS t… |
CVE-2026-12084 | Medium | 5.4 | 2026-06-30 | IBM UCD - IBM DevOps Deploy 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out p… |
CVE-2026-57957 | Medium | 4.7 | 2026-06-29 | Papermark through 0.22.0 contains a cross-origin resource sharing (CORS) misconfiguration vulnerability that allows unauthenticated remote attackers to perform… |
CVE-2026-54753 | Medium | 5.9 | 2026-06-26 | Nx is a monorepo solution for TypeScript and polyglot codebases. From 17.0.4 until 22.7.2 and 23.0.0-beta.2, the local HTTP server started by nx graph sent Acc… |
CVE-2026-46608 | High | 7.4 | 2026-06-25 | Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances XML-RPC server (glances -s) introduced a configurable CORS origin… |
CVE-2026-54290 | High | 7.1 | 2026-06-22 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, with credentials: true and no explicit origin (the defa… |
CVE-2026-56076 | High | 8.1 | 2026-06-18 | PraisonAI before 1.5.128 contains a cross-origin agent execution vulnerability in the AGUI endpoint that allows remote attackers to trigger arbitrary agent exe… |
CVE-2026-50088 | High | 8.2 | 2026-06-12 | The Aqara Developer Portal (developer.aqara.com) and shared test environments (developer-test.aqara.com, aiot-test.aqara.com) exhibit cross-origin request shar… |
CVE-2026-50087 | High | 8.2 | 2026-06-12 | The Aqara IAM/SSO gateway (gw-builder.aqara.com) exhibits a cross-origin request sharing vulnerability, which is an instance of "CWE-942: Permissive Cross-doma… |
CVE-2026-10056 | High | 7.5 | 2026-05-29 | CORS misconfiguration in the REST API of Network Optix Nx Witness VMS before version 6.1.2, when running in the default Standard security mode, on Linux and Wi… |
CVE-2026-46685 | | | 2026-05-28 | RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, when RUSTFS_CORS_ALLOWED_ORIGINS is unset, the RustFS S3 listener's Conditi… |
CVE-2026-45021 | | | 2026-05-28 | Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5, th… |
CVE-2026-9739 | | | 2026-05-27 | Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790). During the beta phase, we implemented `allowed-origins` and `allowed-hosts` flags to a… |
CVE-2026-44895 | | | 2026-05-26 | GitLab MCP Server lets an AI agent talk directly to GitLab. Prior to 0.6.0, the HTTP transport in src/transport.ts ships with no authentication layer at all an… |
CVE-2026-46431 | Medium | 4.3 | 2026-05-26 | Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, the SSE event server's Access-Control-Allow-Origin response header was hardcoded to the… |
CVE-2026-8948 | Critical | 9.1 | 2026-05-19 | Same-origin policy bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 151 and Thunderbird 151. |
CVE-2026-8576 | Medium | 4.3 | 2026-05-14 | Inappropriate implementation in CORS in Google Chrome on Linux and ChromeOS prior to 148.0.7778.168 allowed a remote attacker to leak cross-origin data via a c… |
CVE-2026-8537 | Medium | 4.3 | 2026-05-14 | Insufficient policy enforcement in ViewTransitions in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to leak cross-origin data via a crafted H… |
CVE-2026-44184 | High | 8.0 | 2026-05-12 | Cleanuparr is a tool for automating the cleanup of unwanted or blocked files in Sonarr, Radarr, and supported download clients like qBittorrent. Prior to 2.9… |
CVE-2026-7643 | Medium | 4.3 | 2026-05-02 | A flaw has been found in ChatGPTNextWeb NextChat up to 2.16.1. This impacts an unknown function of the file Next.js of the component API Endpoint. Executing a… |
CVE-2026-7581 | Medium | 4.3 | 2026-05-01 | A security vulnerability has been detected in alexta69 MeTube up to 2026.04.09. This affects the function on_prepare of the file app/main.py of the component C… |
CVE-2026-41056 | High | 8.1 | 2026-04-21 | WWBN AVideo is an open source video platform. In versions 29.0 and below, the `allowOrigin($allowAll=true)` function in `objects/functions.php` reflects any ar… |
CVE-2026-34839 | Medium | 6.5 | 2026-04-21 | Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, the Glances web server exposes a REST API (`/api/4/*`) that is accessi… |
CVE-2026-6662 | High | 7.3 | 2026-04-20 | A vulnerability was found in ericc-ch copilot-api up to 0.7.0. The impacted element is the function cors of the file src/server.ts of the component Token Endpo… |
CVE-2026-6143 | Medium | 6.3 | 2026-04-13 | A security flaw has been discovered in farion1231 cc-switch up to 3.12.3. Affected by this issue is some unknown functionality of the file src-tauri/src/proxy/… |
CVE-2026-5302 | Medium | 6.3 | 2026-04-08 | CORS misconfiguration in CoolerControl/coolercontrold <4.0.0 allows unauthenticated remote attackers to read data and send commands to the service via maliciou… |
CVE-2026-33533 | Medium | 6.5 | 2026-04-02 | Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.3, the Glances XML-RPC server (activated with glances -s or glances --ser… |
CVE-2026-5321 | Medium | 4.3 | 2026-04-02 | A flaw has been found in vanna-ai vanna up to 2.0.2. Affected by this issue is some unknown functionality of the component FastAPI/Flask Server. Executing a ma… |
CVE-2026-34449 | Critical | 9.6 | 2026-03-31 | SiYuan is a personal knowledge management system. Prior to version 3.6.2, a malicious website can achieve Remote Code Execution (RCE) on any desktop running Si… |
CVE-2026-34237 | Medium | 6.1 | 2026-03-31 | MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients. Prior to versions 0.83.0, 1.0.1, and 1.1.1, there is a hardcoded wildcard… |
CVE-2026-34227 | High | 8.8 | 2026-03-31 | Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to version 1.7.4, a single click on a malicious link gives an unauthenti… |
CVE-2026-34200 | High | 7.5 | 2026-03-31 | Nhost is an open source Firebase alternative with GraphQL. Prior to version 1.41.0, The Nhost CLI MCP server, when explicitly configured to listen on a network… |
CVE-2026-0397 | Low | 3.1 | 2026-03-31 | When the internal webserver is enabled (default is disabled), an attacker might be able to trick an administrator logged to the dashboard into visiting a malic… |
CVE-2025-55274 | Low | 2.6 | 2026-03-26 | HCL Aftermarket DPC is affected by Cross-Origin Resource Sharing vulnerability. CORS misconfigurations includes the exposure of sensitive user information to a… |
CVE-2026-33010 | High | 8.1 | 2026-03-20 | mcp-memory-service is an open-source memory backend for multi-agent systems. Prior to version 10.25.1, when the HTTP server is enabled (MCP_HTTP_ENABLED=true)… |
CVE-2026-33043 | High | 8.1 | 2026-03-20 | WWBN AVideo is an open source video platform. In versions 25.0 and below, /objects/phpsessionid.json.php exposes the current PHP session ID to any unauthentica… |
CVE-2026-30924 | Critical | 9.6 | 2026-03-19 | qui is a web interface for managing qBittorrent instances. Versions 1.14.1 and below use a permissive CORS policy that reflects arbitrary origins while also re… |
CVE-2026-32610 | High | 8.1 | 2026-03-18 | Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, the Glances REST API web server ships with a default CORS configuratio… |
CVE-2026-32617 | High | 7.1 | 2026-03-16 | AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, On default i… |
CVE-2026-28792 | Critical | 9.6 | 2026-03-12 | Tina is a headless content management system. Prior to 2.1.8 , the TinaCMS CLI dev server combines a permissive CORS configuration (Access-Control-Allow-Origin… |
CVE-2026-27579 | High | 7.4 | 2026-02-21 | CollabPlatform is a full-stack, real-time doc collaboration platform. In all versions of CollabPlatform, the Appwrite project used by the application is miscon… |
CVE-2025-9292 | High | 7.5 | 2026-02-13 | A permissive web security configuration may allow cross-origin restrictions enforced by modern browsers to be bypassed under specific circumstances. Exploitat… |
CVE-2026-25478 | High | 7.4 | 2026-02-09 | Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.20.0, CORSConfig.allowed_origins_regex is constructed using a regex built fro… |
CVE-2025-13984 | Medium | 6.1 | 2026-01-28 | Permissive Cross-domain Security Policy with Untrusted Domains vulnerability in Drupal Next.Js allows Cross-Site Scripting (XSS).This issue affects Next.Js: fr… |
CVE-2026-24435 | Medium | 6.5 | 2026-01-26 | Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) implement an insecure Cross-Origin Resource Sharing (CORS) policy on authenticat… |
CVE-2026-1181 | Critical | 9.0 | 2026-01-19 | Altium 365 workspace endpoints were configured with an overly permissive Cross-Origin Resource Sharing (CORS) policy that allowed credentialed cross-origin req… |
CVE-2025-55462 | Medium | 6.5 | 2026-01-13 | A CORS misconfiguration in Eramba Community and Enterprise Editions v3.26.0 allows an attacker-controlled Origin header to be reflected in the Access-Control-A… |
CVE-2026-22812 | High | 8.8 | 2026-01-12 | OpenCode is an open source AI coding agent. Prior to 1.0.216, OpenCode automatically starts an unauthenticated HTTP server that allows any local process (or an… |
CVE-2025-13019 | High | 8.1 | 2025-11-11 | Same-origin policy bypass in the DOM: Workers component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5. |
CVE-2025-13017 | High | 8.1 | 2025-11-11 | Same-origin policy bypass in the DOM: Notifications component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird… |
CVE-2025-43480 | High | 8.1 | 2025-11-04 | The issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS… |
CVE-2025-43392 | Medium | 4.3 | 2025-11-04 | The issue was addressed with improved handling of caches. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tah… |
CVE-2025-62523 | Medium | 6.3 | 2025-10-27 | PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. PILOS before 4.8.0 includes a Cross-Origin Resource Sharing (CORS) misco… |
CVE-2025-53092 | Medium | 6.5 | 2025-10-16 | Strapi is an open source headless content management system. Strapi versions prior to 5.20.0 contain a CORS misconfiguration vulnerability in default installat… |
CVE-2023-37401 | Medium | 5.3 | 2025-10-09 | IBM Aspera Faspex 5.0.0 through 5.0.13.1 uses a cross-domain policy file that includes domains that should not be trusted. |
CVE-2025-11304 | Medium | 6.3 | 2025-10-05 | A flaw has been found in CodeCanyon/ui-lib Mentor LMS up to 1.1.1. Affected by this vulnerability is an unknown functionality of the component API. Executing m… |
CVE-2025-41010 | | | 2025-10-02 | Incorrect Cross-Origin Resource Sharing (CORS) configuration in Hiberus Sintra. Cross-Origin Resource Sharing (CORS) allows browsers to make cross-domain reque… |
CVE-2020-36851 | | | 2025-09-25 | Rob--W cors-anywhere instances configured as an open proxy allow unauthenticated external users to induce the server to make HTTP requests to arbitrary targets… |
CVE-2025-10529 | Medium | 6.5 | 2025-09-16 | Same-origin policy bypass in the Layout component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3. |
CVE-2025-57755 | | | 2025-08-21 | claude-code-router is a powerful tool to route Claude Code requests to different models and customize any request. Due to improper Cross-Origin Resource Sharin… |
CVE-2025-27909 | Medium | 5.4 | 2025-08-18 | IBM Concert Software 1.0.0 through 1.1.0 uses cross-origin resource sharing (CORS) which could allow an attacker to carry out privileged actions as the domain… |
CVE-2025-25264 | Medium | 6.5 | 2025-06-16 | An unauthenticated remote attacker can trick an admin to visit a website containing malicious java script code. The current overly permissive CORS policy allow… |
CVE-2025-41366 | | | 2025-06-06 | In IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04, a configuration error has been detected in cross-origin resource sharing (CORS). Exploiting this vulnerability… |
CVE-2025-41363 | | | 2025-06-06 | In IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04, a configuration error has been detected in cross-origin resource sharing (CORS). Exploiting this vulnerability… |
CVE-2025-4839 | Low | 3.1 | 2025-05-17 | A vulnerability has been found in itwanger paicoding 1.0.0/1.0.1/1.0.2/1.0.3 and classified as problematic. Affected by this vulnerability is an unknown functi… |
CVE-2025-4542 | Low | 3.1 | 2025-05-11 | A vulnerability, which was classified as problematic, has been found in Freeebird Hotel 酒店管理系统 API up to 1.2. Affected by this issue is some unknown functional… |
CVE-2025-4515 | Medium | 4.3 | 2025-05-10 | A vulnerability, which was classified as problematic, was found in Zylon PrivateGPT up to 0.6.2. This affects an unknown part of the file settings.yaml. The ma… |
CVE-2025-25234 | High | 7.1 | 2025-04-17 | Omnissa UAG contains a Cross-Origin Resource Sharing (CORS) bypass vulnerability. A malicious actor with network access to UAG may be able to bypass administra… |
CVE-2024-11071 | High | 8.8 | 2025-04-07 | Permissive Cross-domain Policy with Untrusted Domains vulnerability in local API server of DestinyECM solution(versions described below) which is developed and… |
CVE-2025-30354 | Medium | 4.3 | 2025-04-01 | Bruno is an open source IDE for exploring and testing APIs. A bug in the assertion runtime caused assert expressions to run in Developer Mode, even if Safe Mod… |
CVE-2025-2865 | Medium | 6.1 | 2025-03-28 | SaTECH BCU, in its firmware version 2.1.3, could allow XSS attacks and other malicious resources to be stored on the web server. An attacker with some knowledg… |
CVE-2025-1083 | Low | 3.1 | 2025-02-06 | A vulnerability classified as problematic was found in Mindskip xzs-mysql 学之思开源考试系统 3.9.0. Affected by this vulnerability is an unknown functionality of the co… |
CVE-2024-22348 | Medium | 5.3 | 2025-01-20 | IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out… |
CVE-2024-53276 | | | 2024-12-23 | Home-Gallery.org is a self-hosted open-source web gallery to browse personal photos and videos. In 1.15.0 and earlier, an open CORS policy in app.js may allow… |
CVE-2024-49763 | | | 2024-12-02 | PlexRipper is a cross-platform media downloader for Plex. PlexRipper’s open CORS policy allows attackers to gain sensitive information from PlexRipper by getti… |
CVE-2024-45642 | Medium | 5.3 | 2024-11-14 | IBM Security ReaQta 3.12 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI th… |
CVE-2024-10315 | | | 2024-11-11 | In Gliffy Online an insecure configuration was discovered in versions before 4.14.0-6. Reported by Alpha Inferno PVT LTD. |
CVE-2024-6449 | Medium | 6.5 | 2024-08-28 | HyperView Geoportal Toolkit in versions lower than 8.5.0 does not restrict cross-domain requests when fetching remote content pointed by one of GET request par… |
CVE-2024-41657 | High | 8.1 | 2024-08-20 | Casdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform. In Casdoor 1.577.0 and earlier, a logic vulnerability exists in the… |
CVE-2024-41659 | High | 8.1 | 2024-08-20 | memos is a privacy-first, lightweight note-taking service. A CORS misconfiguration exists in memos 0.20.1 and earlier where an arbitrary origin is reflected wi… |
CVE-2024-32862 | Medium | 6.8 | 2024-08-01 | Under certain circumstances the ExacqVision Web Services does not provide sufficient protection from untrusted domains. |
CVE-2024-37131 | High | 7.5 | 2024-06-13 | SCG Policy Manager, all versions, contains an overly permissive Cross-Origin Resource Policy (CORP) vulnerability. A remote unauthenticated attacker could pote… |
CVE-2023-37526 | Medium | 6.5 | 2024-05-14 | HCL DRYiCE Lucy (now AEX) is affected by a Cross Origin Resource Sharing (CORS) vulnerability. The mobile app is vulnerable to a CORS misconfiguration which co… |
CVE-2023-38125 | High | 8.8 | 2024-05-03 | Softing edgeAggregator Permissive Cross-domain Policy with Untrusted Domains Remote Code Execution Vulnerability. This vulnerability allows remote attackers to… |
CVE-2023-38122 | High | 7.2 | 2024-05-03 | Inductive Automation Ignition OPC UA Quick Client Permissive Cross-domain Policy Remote Code Execution Vulnerability. This vulnerability allows remote attacker… |
CVE-2024-23823 | Medium | 4.2 | 2024-03-14 | vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Party Computation. The… |