dns-rebind-toolkit

DNS Rebind Toolkit Demo | Security Advisory | Included Payloads | FAQ DISCLAIMER: This software is for educational purposes only. This software should not be used for illegal activity. The author is not responsible for its use. Don't be a dick. DNS Rebind Toolkit is a frontend JavaScript framewor...

toxssin

toxssin Purpose toxssin is an open-source penetration testing tool that automates the process of exploiting Cross-Site Scripting XSS vulnerabilities. It consists of an https server that works as an interpreter for the traffic generated by the malicious JavaScript payload that powers this tool...

resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins "", reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to...

CVE-2026-35113

HCL AION is affected by a vulnerability where the Cross-Origin-Opener-Policy COOP header was missing or insecure, allowing cross-origin documents to share a browsing context with the application. This may enable cross-window attacks, potentially resulting in unintended behavior or security impact...

CVE-2026-35111

HCL AION is affected by a vulnerability where the Cross-Origin-Resource-Policy CORP header was missing or insecure, allowing application resources to be loaded by other origins. This may expose resources to cross-origin data leakage, potentially resulting in unintended behavior or security impact...

CVE-2026-35112

HCL AION is affected by a vulnerability where the Cross-Origin-Embedder-Policy COEP header was missing or insecure, so embedded cross-origin resources were not required to explicitly grant permission. This weakens cross-origin isolation, potentially resulting in unintended behavior or security...

CVE-2026-35112 HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where the Cross-Origin-Embedder-Policy COEP header was missing or insecure, so embedded cross-origin resources were not required to explicitly grant permission. This weakens cross-origin isolation, potentially resulting in unintended behavior or security...

EUVD-2026-118235

HCL AION is affected by a vulnerability where the Cross-Origin-Embedder-Policy COEP header was missing or insecure, so embedded cross-origin resources were not required to explicitly grant permission. This weakens cross-origin isolation, potentially resulting in unintended behavior or security...

CVE-2026-35112

HCL AION is affected by a vulnerability involving a missing or insecure Cross-Origin-Embedder-Policy (COEP) header. This flaw prevents embedded cross-origin resources from being required to explicitly grant permission, which weakens cross-origin isolation and could lead to unintended behavior or ...

CVE-2026-35113 HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where the Cross-Origin-Opener-Policy COOP header was missing or insecure, allowing cross-origin documents to share a browsing context with the application. This may enable cross-window attacks, potentially resulting in unintended behavior or security impact...

EUVD-2026-118234

HCL AION is affected by a vulnerability where the Cross-Origin-Opener-Policy COOP header was missing or insecure, allowing cross-origin documents to share a browsing context with the application. This may enable cross-window attacks, potentially resulting in unintended behavior or security impact...

CVE-2026-35113

The software HCL AION is affected by a vulnerability involving a missing or insecure Cross-Origin-Opener-Policy (COOP) header. This configuration flaw allows cross-origin documents to share a browsing context with the application, which may facilitate cross-window attacks . Such attacks could lea...

EUVD-2026-118246

HCL AION is affected by a vulnerability where the Cross-Origin-Resource-Policy CORP header was missing or insecure, allowing application resources to be loaded by other origins. This may expose resources to cross-origin data leakage, potentially resulting in unintended behavior or security impact...

CVE-2026-35111

HCL AION is affected by a vulnerability where the Cross-Origin-Resource-Policy (CORP) header is either missing or insecure. This flaw allows application resources to be loaded by external origins, which may lead to cross-origin data leakage and unintended security impacts. While the technical det...

CVE-2026-35111 HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where the Cross-Origin-Resource-Policy CORP header was missing or insecure, allowing application resources to be loaded by other origins. This may expose resources to cross-origin data leakage, potentially resulting in unintended behavior or security impact...

CVE-2026-120415

undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, the redirect interceptor strips sensitive headers such as Authorization, Cookie, Proxy-Authorization, and Host when a request is redirected to a different origin, but when request headers are supplied...

CVE-2026-116630 undici vulnerable to cross-user information disclosure via cross-origin redirect revalidation

undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when an Agent composes the redirect and shared cache interceptors, a cached response that is revalidated with a conditional request can be validated by a 304 Not Modified from a different origin. When...

CVE-2026-116630

The undici HTTP client for Node.js (versions 7.0.0-7.30.1 and 8.0.0-8.12.3 ) is vulnerable to cross-user information disclosure . When an Agent uses both redirect and shared cache interceptors, a cached response can be revalidated via a conditional request. If a redirect occurs, the handler strip...

CVE-2026-120415

The undici HTTP client for Node.js (versions 7.0.0–7.30.1 and 8.0.0–8.12.3) contains a vulnerability where the redirect interceptor fails to strip sensitive headers—such as Authorization , Cookie , Proxy-Authorization , and Host —during cross-origin redirects when headers are provided as an array...

CVE-2026-120415 undici vulnerable to cross-origin credential disclosure via array-of-tuples headers bypassing redirect stripping

undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, the redirect interceptor strips sensitive headers such as Authorization, Cookie, Proxy-Authorization, and Host when a request is redirected to a different origin, but when request headers are supplied...