golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect

A flaw was found in the net/http package of the Golang standard library. The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header redirected to b.com/ will not send that header to b.com. However, the...

EUVD-2026-73168

Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-62895

Azure Arc SQL Server Extension is affected by a permissive cross-domain policy that permits untrusted domains, enabling an elevation of privilege over the network. The vulnerability requires user interaction and no prior privileges (CVSS 3.1: 8.8 HIGH , AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The r...

CVE-2026-12962

A Permissive Cross-domain Security Policy with Untrusted Domains in Armoury Crate allows a remote user to obtain a local user's NTLM hash by convincing the user to visit a crafted web page that sends a request containing a UNC path to the application's local service endpoint.Refer to the ' Securi...

EUVD-2026-72626

A Permissive Cross-domain Security Policy with Untrusted Domains in Armoury Crate allows a remote user to obtain a local user's NTLM hash by convincing the user to visit a crafted web page that sends a request containing a UNC path to the application's local service endpoint.Refer to the ' Securi...

CVE-2026-12962

ASUS Armoury Crate is affected by a permissive cross-domain security policy that allows untrusted domains to interact with the application's local service endpoint. A remote attacker can obtain a local user's NTLM hash by convincing the user to visit a crafted web page that sends a request contai...

CVE-2026-12962

A Permissive Cross-domain Security Policy with Untrusted Domains in Armoury Crate allows a remote user to obtain a local user's NTLM hash by convincing the user to visit a crafted web page that sends a request containing a UNC path to the application's local service endpoint.Refer to the ' Securi...

CVE-2025-51471-POC

CVE-2025-51471 - Ollama Cross-Domain Token Exposure PoC Author: ajtazer 🔥 Overview This repository contains a Proof of Concept PoC for CVE-2025-51471 , a Cross-Domain Authentication Token Exposure vulnerability that affects all versions of Ollama including the latest. 📋 Vulnerability Description...

CVE-2025-61163

A flaw was found in Cohere North AI. The server fails to properly validate the Origin header of incoming connection requests, leading to an excessively permissive cross-domain policy with untrusted domains. This vulnerability could allow an attacker to gain unauthorized access to sensitive...

Linux Distros Unpatched Vulnerability : CVE-2026-82255

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-controlle...

CVE-2026-82255

gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-controlled servers after HTTP redirects. The vulnerability occurs because credential validation checks the original URL instead of the effective U...

CVE-2026-82255

gitoxide versions from 0.25.4 contain an HTTP credential leak in the curl-based transport backend . The root cause is that credential validation checks the original URL rather than the effective URL after a redirect, allowing credentials to be sent to attacker-controlled destinations via cross-do...

CVE-2025-61163

Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with untrusted domains. This occurs via the server failing to validate the Origin header of incoming connection requests...

AsyncHttpClient stores cookie for an unrelated domain (cookie tossing) via ThreadSafeCookieStore

Impact A cookie tossing / cookie injection issue CWE-1275. ThreadSafeCookieStore stored a cookie under the value of its Domain attribute without verifying that the responding host is allowed to set a cookie for that domain RFC 6265 §5.3 step 6. A host the client connects to can therefore plant a...

PT-2026-82359

In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignment under any domain by passing a domain ID as scope.project.id with include subtree to the GET /v3/role assignments endpoint. The domain's project record has...

CVE-2025-61163

Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with untrusted domains. This occurs via the server failing to validate the Origin header of incoming connection requests...

CVE-2025-61163

Cohere North AI v1.1.5 contains an excessively permissive cross-domain policy with untrusted domains , caused by the server failing to validate the Origin header of incoming connection requests. This allows untrusted domains to interact with the service, rated CVSS 9.8 (Critical) with high impact...

EUVD-2025-210786

Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with untrusted domains. This occurs via the server failing to validate the Origin header of incoming connection requests...

Astra Linux – Vulnerability in Golang-1.23

The HTTP client discards sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header, which is redirected to b.com/, will not send that header to b.com. However, if the client receives a subsequent same-domain redirect, the...

CVE-2026-66722

Improper authorization for CRUD operations on Project Roles and Project Role permissions for domain admins in CloudStack. A Domain Admin can create, update, delete, and list project roles and project role permissions for projects in any domain, not just their own. The check only confirms the call...