CVE-2026-104048

A flaw in SSSD allows for an authorization bypass within trust-enabled identity management environments. The root cause is that SSSD evaluates Host-Based Access Control (HBAC) rules by stripping domain qualifiers and comparing only short usernames. Consequently, an authenticated user from a trust...

CVE-2026-104048 Sssd: sssd: authorization bypass via cross-domain username collision in hbac evaluation

A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control HBAC rules by stripping domain qualifiers and comparing only short usernames. An authenticated user in a trusted domain who shares the same username as an authorized local account...

CVE-2025-51471-POC

CVE-2025-51471 - Exposición de Token entre Dominios de Ollama - PoC Autor: ajtazer 🔥 Resumen Este repositorio contiene una Prueba de Concepto PoC para CVE-2025-51471 , una vulnerabilidad de Exposición de Token de Autenticación entre Dominios que afecta a todas las versiones de Ollama incluyendo l...

Rocky Linux 8 [CIQ] Security Update: delve / delve-debuginfo / delve-debugsource / go-toolset / golang / etc Multiple Vulnerabilities (crlsa-2025_3772)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20253772 advisory. golang: crypto/x509: crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints CVE-2024-45341 golang: net/http: net/http: sensitive headers...

golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect

A flaw was found in the net/http package of the Golang standard library. The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header redirected to b.com/ will not send that header to b.com. However, the...

golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect

A flaw was found in the net/http package of the Golang standard library. The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header redirected to b.com/ will not send that header to b.com. However, the...

CVE-2026-97508

A flaw was found in the Linux kernel's Thunderbolt subsystem. When a Thunderbolt domain is stopped, the driver fails to properly clear the root switch reference while handling active cross-domain requests. A connected host sending communication requests during domain shutdown can trigger an inval...

CVE-2026-18825

An Origin Validation Error in the middleware of the connect-xcors npm package allows an attacker to bypass origin verification and perform a cross domain authenticated request...

EUVD-2026-88239

An Origin Validation Error in the middleware of the connect-xcors npm package allows an attacker to bypass origin verification and perform a cross domain authenticated request...

CVE-2026-18825 Origin validation error in the connect-xcors npm package

An Origin Validation Error in the middleware of the connect-xcors npm package allows an attacker to bypass origin verification and perform a cross domain authenticated request...

CVE-2026-18825

The connect-xcors npm package contains an Origin Validation Error within its middleware. This flaw allows an attacker to bypass origin verification , potentially enabling the execution of cross-domain authenticated requests . The vulnerability has a CVSS 4.0 base score of 5.3 (MEDIUM) . No specif...

CVE-2026-18825 Origin validation error in the connect-xcors npm package

An Origin Validation Error in the middleware of the connect-xcors npm package allows an attacker to bypass origin verification and perform a cross domain authenticated request...

CVE-2026-18825: Origin Validation Error

An Origin Validation Error in the middleware of the connect-xcors npm package allows an attacker to bypass origin verification and perform a cross domain authenticated request...

CVE-2026-66070: Permissive Cross-domain Policy with Untrusted Domains

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, matchorigin/1 returned the bare reflected Origin and allowed credentials even when the wildcard "" was configured, so the response echoed the attacker's origin together with...

CVE-2026-90882: Permissive Cross-domain Policy with Untrusted Domains

The open-vsx.org deployment returned Access-Control-Allow-Origin reflecting the requesting origin together with Access-Control-Allow-Credentials: true on the authenticated /user/ endpoints. A page on any origin could therefore issue credentialed requests to the service in a logged-in user's brows...

Security Bulletin: IBM Optim 1.0.0, 1.1.0 and 1.2.0 impacted by an information disclosure vulnerability in follow-redirects

Summary follow-redirects is used by IBM Optim as part of its front-end user interface Optim UI to handle HTTP and HTTPS redirect chains in the browser. CVE-2026-40895 is an information disclosure vulnerability in follow-redirects prior to version 1.16.0, where custom authentication headers e.g.,...

golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect

A flaw was found in the net/http package of the Golang standard library. The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header redirected to b.com/ will not send that header to b.com. However, the...

CVE-2026-89058: Permissive Cross-domain Policy with Untrusted Domains

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins "", reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to...

golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect

A flaw was found in the net/http package of the Golang standard library. The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header redirected to b.com/ will not send that header to b.com. However, the...

CVE-2026-92359 ag-ui-protocol ag-ui CORSMiddleware utils.py create_strands_app cross-domain policy

A security flaw has been discovered in ag-ui-protocol ag-ui 0.3.0. The affected element is the function createstrandsapp of the file integrations/aws-strands/python/src/aguistrands/utils.py of the component CORSMiddleware. The manipulation results in permissive cross-domain policy with untrusted...