oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass

Summary A flaw in the CORS plugin allowed the incoming request's Vary header to be reflected into the response, letting a client influence a header that should be controlled solely by the server. Details The CORS plugin previously copied the request's Vary header directly onto the response instea...

CVE-2026-77360

oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.8, the @orpc/server CORS plugin in packages/server/src/plugins/cors.ts copies a client's incoming Vary request header into the response instead of controlling Vary as a response-only...

CVE-2026-77360 oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass

oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.8, the @orpc/server CORS plugin in packages/server/src/plugins/cors.ts copies a client's incoming Vary request header into the response instead of controlling Vary as a response-only...

CVE-2026-77360 oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass

oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.8, the @orpc/server CORS plugin in packages/server/src/plugins/cors.ts copies a client's incoming Vary request header into the response instead of controlling Vary as a response-only...

CVE-2026-77360

oRPC is a tool for building type-safe APIs adhering to OpenAPI standards. Prior to 1.14.8 , the @orpc/server CORS plugin (packages/server/src/plugins/cors.ts) copies a client's incoming Vary request header into the response instead of controlling Vary as a response-only header and using Origin fo...

CVE-2026-25410

CVE-2026-25410 : WordPress WP-CORS plugin

EUVD-2022-50366

Malicious code in bioql PyPI...

CVE-2022-47606

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Tim Stephenson WP-CORS plugin = 0.2.1 versions...

UBUNTU-CVE-2024-6839

corydolphin/flask-cors version 4.0.1 contains an improper regex path matching vulnerability. The plugin prioritizes longer regex patterns over more specific ones when matching paths, which can lead to less restrictive CORS policies being applied to sensitive endpoints. This mismatch in regex...

CVE-2022-47606

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Tim Stephenson WP-CORS plugin = 0.2.1 versions...

Cross site scripting

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Tim Stephenson WP-CORS plugin = 0.2.1 versions...

CVE-2022-47606 WordPress WP-CORS Plugin <= 0.2.1 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Tim Stephenson WP-CORS plugin = 0.2.1 versions...

PT-2023-15428 · WordPress · Wp-Cors

Name of the Vulnerable Software and Affected Versions: Tim Stephenson WP-CORS plugin versions 0.2.1 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For Tim Stephenson WP-CORS...