PT-2026-84567

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.75 Description Improper input validation in the Omnibox allows a remote attacker to bypass the web origin policy through crafted network traffic, typically leveraging social engineering. Recommendatio...

CVE-2026-81267

A malicious webpage could stall a popup's cross-origin navigation after commit, causing the address bar to display the destination origin while continuing to render attacker-controlled content. This vulnerability was fixed in Firefox for iOS 155.0...

CVE-2026-81267 Stalled popup navigation could allow address bar origin spoofing in Firefox for iOS

A malicious webpage could stall a popup's cross-origin navigation after commit, causing the address bar to display the destination origin while continuing to render attacker-controlled content. This vulnerability was fixed in Firefox for iOS 155.0...

CVE-2026-81267

CVE-2026-81267 is a stalled popup cross-origin navigation vulnerability in Firefox for iOS . A malicious webpage could stall a popup's cross-origin navigation after commit, causing the address bar to display the destination origin while continuing to render attacker-controlled content — effective...

EUVD-2026-68739

A malicious webpage could stall a popup's cross-origin navigation after commit, causing the address bar to display the destination origin while continuing to render attacker-controlled content. This vulnerability was fixed in Firefox for iOS 155.0...

CVE-2026-82811

A security vulnerability has been detected in Toggl OÜ Toggl Track Extension 4.11.16. This affects an unknown function of the component postMessage Handler. The manipulation leads to origin validation error. It is possible to initiate the attack remotely. The exploit has been disclosed publicly a...

CVE-2026-82811

CVE-2026-82811 affects the Toggl Track Chrome extension (version 4.11.16 ). The vulnerability resides in the extension's postMessage Handler , which fails to properly validate message origins, allowing an attacker to accept forged session-state messages through an unauthenticated handler. The att...

EUVD-2026-68679

A security vulnerability has been detected in Toggl OÜ Toggl Track Extension 4.11.16. This affects an unknown function of the component postMessage Handler. The manipulation leads to origin validation error. It is possible to initiate the attack remotely. The exploit has been disclosed publicly a...

CVE-2026-82811 Toggl OÜ Toggl Track Extension postMessage origin validation

A security vulnerability has been detected in Toggl OÜ Toggl Track Extension 4.11.16. This affects an unknown function of the component postMessage Handler. The manipulation leads to origin validation error. It is possible to initiate the attack remotely. The exploit has been disclosed publicly a...

OPENSUSE-SU-2026:21713-1 Security update for MozillaFirefox, mozilla-nss, mozilla-nspr, rust-cbindgen

This update for MozillaFirefox, mozilla-nss, mozilla-nspr, rust-cbindgen fixes the following issues: Changes in MozillaFirefox: Firefox Extended Support Release 153.1.0 ESR. Fixed: Various security fixes. MFSA 2026-77 bsc1274867: CVE-2026-74934 Site isolation issue in the Graphics: CanvasWebGL...

CVE-2025-61163

A flaw was found in Cohere North AI. The server fails to properly validate the Origin header of incoming connection requests, leading to an excessively permissive cross-domain policy with untrusted domains. This vulnerability could allow an attacker to gain unauthorized access to sensitive...

CVE-2026-18408

A vulnerability in PostgreSQL allows a malicious origin-server superuser to achieve client-side arbitrary code execution during a database restore. By injecting untrusted data into a pgdump export, the attacker can exploit the input expansion of the psql \restrict meta-command. When a victim...

CVE-2026-71378

ResourceIsolationRequestCycleListener protects a Wicket application against cross-site request forgery by rejecting requests that a resource isolation policy judges to come from another origin. Its default policy, FetchMetadataResourceIsolationPolicy, was derived from a reference implementation...

CVE-2026-49853

A flaw was found in Tornado's SimpleAsyncHTTPClient. When following a redirect to a different origin, the client improperly retains and forwards sensitive authentication credentials, such as Authorization headers, to the new, potentially untrusted, destination. This vulnerability allows a remote...

CVE-2026-81315

Origin Validation Error vulnerability in ash-project ashai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor. In AshAi.Mcp.Server, with the default allowedorigins: nil, originallowed?/3...

CVE-2026-81315 MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header

Origin Validation Error vulnerability in ash-project ashai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor. In AshAi.Mcp.Server, with the default allowedorigins: nil, originallowed?/3...

EEF-CVE-2026-81315 MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header

Summary Origin Validation Error vulnerability in ash-project ashai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor. In AshAi.Mcp.Server, with the default allowedorigins: nil,...

EUVD-2026-68304

Origin Validation Error vulnerability in ash-project ashai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor. In AshAi.Mcp.Server, with the default allowedorigins: nil, originallowed?/3...

CVE-2026-81315 MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header

Origin Validation Error vulnerability in ash-project ashai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor. In AshAi.Mcp.Server, with the default allowedorigins: nil, originallowed?/3...

CVE-2026-81315

CVE-2026-81315 is an origin validation error in ash-project ash_ai (affecting AshAi.Mcp.Server), allowing a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server using that user's actor. The root cause lies in origin_allo...