CVE-2026-65957

Helio is an MCP proxy that sits between AI agents and the tools they use. Prior to version 0.8.0, the dashboard sideband default 127.0.0.1:3100 validated CORS request origins by matching the hostname against a private-network string prefix 10., 172.16.–172.31., 192.168. rather than validating an ...

EUVD-2026-124010

Helio is an MCP proxy that sits between AI agents and the tools they use. Prior to version 0.8.0, the dashboard sideband default 127.0.0.1:3100 validated CORS request origins by matching the hostname against a private-network string prefix 10., 172.16.–172.31., 192.168. rather than validating an ...

CVE-2026-65957

Helio is an MCP proxy that sits between AI agents and the tools they use. Prior to version 0.8.0, the dashboard sideband default 127.0.0.1:3100 validated CORS request origins by matching the hostname against a private-network string prefix 10., 172.16.–172.31., 192.168. rather than validating an ...

resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins "", reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to...

resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins "", reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to...

PT-2026-145475

Helio is an MCP proxy that sits between AI agents and the tools they use. Prior to version 0.8.0, the dashboard sideband default 127.0.0.1:3100 validated CORS request origins by matching the hostname against a private-network string prefix 10., 172.16.–172.31., 192.168. rather than validating an ...

CVE-2026-65957: gethelio helio: Helio is an MCP proxy that sits between AI agents and the tools they use

Helio is an MCP proxy that sits between AI agents and the tools they use. Prior to version 0.8.0, the dashboard sideband default 127.0.0.1:3100 validated CORS request origins by matching the hostname against a private-network string prefix 10., 172.16.–172.31., 192.168. rather than validating an ...

resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins "", reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to...

resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins "", reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to...

resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins "", reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to...

resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins "", reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to...

resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins "", reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to...

resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins "", reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to...

Fiber: CORS Wildcard Origins Matched Without A Dot Boundary, Allowing Credentialed Cross-origin Reads

Summary In v2.52.1 and v2.52.2 the CORS middleware matched a wildcard origin such as "https://.example.com" by suffix only, without a dot boundary and without comparing the scheme. Any origin whose host ends with the base domain, for example "https://evil-example.com" or "http://notexample.com",...

CVE-2026-62863

MoLing is a computer-use and browser-use based MCP server. Prior to 0.5.0, when MoLing runs in SSE mode using -l, its /sse and /message HTTP endpoints do not authenticate requests and the mcp-go dependency sets Access-Control-Allow-Origin: . A malicious web page can open a cross-origin EventSourc...

resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins "", reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to...

Permissive Cross-domain Policy with Untrusted Domains

Overview Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains via the push endpoint reflecting the request Origin into the Access-Control-Allow-Origin response header and allowing credentials. An attacker can access sensitive information by...

Permissive Cross-domain Policy with Untrusted Domains

Overview Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains via the push endpoint reflecting the request Origin into the Access-Control-Allow-Origin response header and allowing credentials. An attacker can access sensitive information by...

Permissive Cross-domain Policy with Untrusted Domains

Overview com.vaadin:vaadin-server is a Java framework for modern Java web applications. Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains via the push endpoint reflecting the request Origin into the Access-Control-Allow-Origin response heade...

Permissive Cross-domain Policy with Untrusted Domains

Overview Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains via the push endpoint reflecting the request Origin into the Access-Control-Allow-Origin response header and allowing credentials. An attacker can access sensitive information by...