live-server-evil-crawler

Live Server Evil Crawler A GitHub Pages site for demonstrating the Live Server VSCode extension vulnerability CVE-2025-65717. Overview This tool demonstrates a vulnerability where Live Server allows requests from any origin, enabling malicious web pages to access the Live Server running on...

CVE-2026-34200

Nhost MCP Server: One-Click Infrastructure Compromise Official Advisory: This vulnerability was acknowledged and published by Nhost: GHSA-6c5x-3h35-vvw2 This repository documents a vulnerability in the Nhost Local MCP Server. The service lacks inbound authentication and implements a permissive CO...

CVE-2026-7005

WIT SynApps Runtime through 1.4.11 contains a browser-mediated cross-origin request forgery vulnerability that allows attackers to supply an arbitrary target address during controller onboarding, causing the victim's browser to issue discovery requests to attacker-specified hosts at paths such as...

EUVD-2026-114362

WIT SynApps Runtime through 1.4.11 contains a browser-mediated cross-origin request forgery vulnerability that allows attackers to supply an arbitrary target address during controller onboarding, causing the victim's browser to issue discovery requests to attacker-specified hosts at paths such as...

CVE-2026-7005

WIT SynApps Runtime versions through 1.4.11 are vulnerable to a browser-mediated cross-origin request forgery (CRof) . This flaw allows an attacker to provide an arbitrary target address during controller onboarding, forcing the victim's browser to issue discovery requests to attacker-specified h...

PT-2026-134133

WIT SynApps Runtime through 1.4.11 contains a browser-mediated cross-origin request forgery vulnerability that allows attackers to supply an arbitrary target address during controller onboarding, causing the victim's browser to issue discovery requests to attacker-specified hosts at paths such as...

CVE-2026-7005: WIT SynApps Runtime: WIT SynApps Runtime through 1.4.11 contains a browser-mediated cross-origin request forgery vulnerability that allows…

WIT SynApps Runtime through 1.4.11 contains a browser-mediated cross-origin request forgery vulnerability that allows attackers to supply an arbitrary target address during controller onboarding, causing the victim's browser to issue discovery requests to attacker-specified hosts at paths such as...

resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins "", reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to...

CVE-2026-110737

The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because Flow configures Atmosphere with DROPACCESSCONTROLALLOWORIGINHEADER set to false and its CorsInterceptor then echoes...

CVE-2026-110737 Push Endpoint Returns Permissive CORS Headers

The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because Flow configures Atmosphere with DROPACCESSCONTROLALLOWORIGINHEADER set to false and its CorsInterceptor then echoes...

CVE-2026-110737 Push Endpoint Returns Permissive CORS Headers

The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because Flow configures Atmosphere with DROPACCESSCONTROLALLOWORIGINHEADER set to false and its CorsInterceptor then echoes...

CVE-2026-110737

The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because Flow configures Atmosphere with DROPACCESSCONTROLALLOWORIGINHEADER set to false and its CorsInterceptor then echoes...

CVE-2026-110737

The push endpoint in Vaadin applications using server push is vulnerable to a cross-origin request forgery (CSRF) style attack. Because Flow configures Atmosphere with DROP_ACCESS_CONTROL_ALLOW_ORIGIN_HEADER set to false, the CorsInterceptor echoes the request's Origin into the Access-Control-All...

EUVD-2026-110721

The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because Flow configures Atmosphere with DROPACCESSCONTROLALLOWORIGINHEADER set to false and its CorsInterceptor then echoes...

PT-2026-126330

The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because Flow configures Atmosphere with DROP ACCESS CONTROL ALLOW ORIGIN HEADER set to false and its CorsInterceptor then echoes...

Push endpoint returns permissive CORS headers

The push endpoint of a Vaadin application using server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, so a malicious site can make a cross origin request to it on behalf of a signed in user and read the response. This vulnerability ha...

Push endpoint returns permissive CORS headers

The push endpoint of a Vaadin application using server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, so a malicious site can make a cross origin request to it on behalf of a signed in user and read the response. This vulnerability ha...

Cross-site Request Forgery (CSRF)

Overview locust is a Developer friendly load testing framework Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the /stop and /stats/reset endpoints, which accepted GET requests, allowing an attacker to trick an authenticated user into visiting a malicious...

resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins "", reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to...

CVE-2026-107618

POST /owner/repo/topics was registered without the sign-in middleware that provides the cross-origin protection, so a request issued by a third-party site was not rejected. A repository administrator who visited a malicious page could have the topics of their repository changed. No other reposito...