CVE-2026-82287

Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions by reflecting any request origin in Access-Control-Allow-Origin responses while credentials are enabled. Attackers can issue credentialed cross-origin requests from any website t...

CVE-2026-82291

HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users to access workspaces, projects, forms,...

CVE-2026-70309

Origin validation error in Microsoft Edge Chromium-based allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-23550

🧨 CVE-2026-23550 – Modular Connector एडमिन बाईपास बिना प्रमाणीकरण के WordPress एडमिन लॉगिन,origin=mo पैरामीटर के माध्यम से Modular Connector प्लगइन ≤ 2.5.1 📖 विवरण WordPress के लिए Modular Connector प्लगइन संस्करण ≤ 2.5.1 में एक गंभीर प्रमाणीकरण बाईपास भेद्यता है। एक बिना प्रमाणीकृत हमलावर REST A...

langflow-cors-scanner

CVE-2025-34291 — Langflow Origin Validation / CORS Panoramica Una configurazione CORS eccessivamente permissiva abbinata alla configurazione del cookie di refresh token consente il furto di credenziali...

EUVD-2026-67853

Origin validation error in Microsoft Edge Chromium-based allows an unauthorized attacker to bypass a security feature over a network...

WebKit-NavigationAPI-SOP-Bypass

WebKit-NavigationAPI-SOP-Bypass WebKit Navigation API — bypass della Same-Origin Policy tramite intercettazione cross-port CVE-2026-20643...

flash-xdomain-xploit

Autore: Gursev Singh Kalra [email protected] Bypass della Same Origin Policy con Flash e crossdomain.xml insicuro Compilazione e distribuzione del codice ActionScript Proof of Concept 1. Scaricare e installare l'Apache Flex SDK. Include un compilatore ActionScript. 2. Copiare il codice...

flash-xdomain-xploit

Autor: Gursev Singh Kalra [email protected] Umgehung der Same-Origin-Policy mit Flash und unsicherer crossdomain.xml Kompilieren und Bereitstellen des Proof-of-Concept-ActionScript-Codes 1. Laden Sie das Apache Flex SDK herunter und installieren Sie es. Es enthält einen ActionScript-Compiler...

CVE-2026-82291 HeyForm Reflects Any Origin in CORS Responses While Allowing Credentials

HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users to access workspaces, projects, forms,...

CVE-2026-82291 HeyForm Reflects Any Origin in CORS Responses While Allowing Credentials

HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users to access workspaces, projects, forms,...

CVE-2026-82291

HeyForm versions before 3.0.0-rc.8 reflect the request Origin header in CORS responses while simultaneously allowing credentials. This misconfiguration enables attackers to execute authenticated GraphQL queries from a malicious page visited by a logged-in user, granting access to workspaces, proj...

EUVD-2026-67818

Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions by reflecting any request origin in Access-Control-Allow-Origin responses while credentials are enabled. Attackers can issue credentialed cross-origin requests from any website t...

CVE-2026-82287

Rybbit before 2.7.0 contains a CORS misconfiguration in its server that reflects any request origin in the Access-Control-Allow-Origin response header while credentials remain enabled. This allows an attacker on any website to issue credentialed cross-origin requests against a victim's session, r...

CVE-2026-82287 Rybbit Reflects Any Origin in CORS Responses While Allowing Credentials

Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions by reflecting any request origin in Access-Control-Allow-Origin responses while credentials are enabled. Attackers can issue credentialed cross-origin requests from any website t...

CVE-2026-82287 Rybbit Reflects Any Origin in CORS Responses While Allowing Credentials

Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions by reflecting any request origin in Access-Control-Allow-Origin responses while credentials are enabled. Attackers can issue credentialed cross-origin requests from any website t...

CVE-2026-25604-PoC

CVE-2026-25604 PoC Host Header Injection che porta al bypass dell'autenticazione SAML in AWS Auth Manager di Apache Airflow Un attaccante può iniettare un header Host malevolo nel flusso di login SAML, facendo sì che l'URL dell'Assertion Consumer Service ACS punti a un server controllato...

Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability

Origin validation error in Microsoft Edge Chromium-based allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-81733

WWBN AVideo through 30.0 and master up to commit 4cb576e contains a cross-site request forgery vulnerability in plugin/Live/myLiveControls.save.json.php. The endpoint only checks that a user is logged in and processes customUrl, customMessage, and autoRedirect parameters from $REQUEST via a GET...

CVE-2026-43735

CVE-2026-43735 WebKit divulgazione di informazioni cross-origin. Safari = 26.5.2: PATCHED NavigateEvent.sourceElement is null Principio Quando la pagina padre utilizza per attivare la navigazione di frammento di un iframe cross-origin, l'iframe riceve NavigateEvent.sourceElement che è l'elemento...