mcp-chrome-bridge (hangwin/mcp-chrome) <= 1.0.31 - CORS Origin Bypass (CSWSH)

mcp-chrome-bridge =1.0.31 uses origin.startsWith for CORS, so origins like http://127.0.0.1.evil.com are wrongly allowed, letting attackers bypass CORS and access the local server. id: CVE-2026-102878 info: name: mcp-chrome-bridge hangwin/mcp-chrome = 1.0.31 - CORS Origin Bypass CSWSH author:...

CVE-2026-92704: sharpemu: SharpEmu is an experimental PlayStation 5 emulator for Windows and Linux

SharpEmu is an experimental PlayStation 5 emulator for Windows and Linux. In version 0.0.3-release.3 and earlier, the repository-provided debugger frontend tooling is vulnerable while running. This tooling is not included in the release archives. The frontend exposes an HTTP API on 127.0.0.1:8765...

VLLM: Permissive Default CORS Origins Allow Cross-origin Requests To The VLLM HTTP Server

Summary The OpenAI-compatible server registers Starlette "CORSMiddleware" with "allowedorigins" defaulting to """", and performs no authentication unless "--api-key" or "VLLMAPIKEY" is configured. A web page on any origin can send requests to a vLLM server that the victim's browser can reach for...

GHSA-VVPG-RRWW-WPMH vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server

Summary The OpenAI-compatible server registers Starlette CORSMiddleware with allowedorigins defaulting to "", and performs no authentication unless --api-key or VLLMAPIKEY is configured. A web page on any origin can send requests to a vLLM server that the victim's browser can reach for example...

vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server

Summary The OpenAI-compatible server registers Starlette CORSMiddleware with allowedorigins defaulting to "", and performs no authentication unless --api-key or VLLMAPIKEY is configured. A web page on any origin can send requests to a vLLM server that the victim's browser can reach for example...

Permissive Cross-domain Policy with Untrusted Domains

Overview com.vaadin:vaadin is a Java framework for modern Java web applications. Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains via the push endpoint reflecting the request Origin into the Access-Control-Allow-Origin response header and...

Vaadin input validation error vulnerability

Security vulnerabilities exist in Vaadin versions ranging from 14.14.0 to 14.14.7, 23.6.0 to 23.6.16, 24.4.0 to 24.4.25, 24.5.0 to 24.5.15, 24.6.0 to 24.6.13, 24.7.0 to 24.7.16, 24.8.0 to 24.8.17, 24.9.0 to 24.9.23, 24.10.0 to 24.10.11, 25.0.0 to 25.0.13, 25.1.0 to 25.1.13, 25.2.0 to 25.2.10, and...

Permissive Cross-domain Policy with Untrusted Domains

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains via the default CORS configuration, which sets allowedorigins to "", permitting any origin to...

CVE-2026-115917

The vLLM inference and serving engine for large language models is vulnerable to a Cross-Origin Resource Sharing (CORS) flaw in versions prior to 0.32.0 . The OpenAI-compatible server incorrectly configures Starlette CORSMiddleware with allowed_origins set to a wildcard by default. A remote attac...

CVE-2026-115917 vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compatible server configures Starlette CORSMiddleware with allowedorigins set to a wildcard by default. A malicious web page can use a victim's browser to reach an unauthenticated vLLM server on...

CVE-2026-115917 vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compatible server configures Starlette CORSMiddleware with allowedorigins set to a wildcard by default. A malicious web page can use a victim's browser to reach an unauthenticated vLLM server on...

CVE-2026-115917 vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compatible server configures Starlette CORSMiddleware with allowedorigins set to a wildcard by default. A malicious web page can use a victim's browser to reach an unauthenticated vLLM server on...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview i18next-http-backend is an i18next-http-backend is a backend layer for i18next using in Node.js, in the browser and for Deno. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' via the...

EUVD-2026-103186

LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files...

Permissive Cross-domain Policy with Untrusted Domains

Overview org.apache.camel:camel-jetty-common is a versatile open-source integration framework based on known Enterprise Integration Patterns. Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains via the enableCORS configuration in the Jetty...

Permissive Cross-domain Policy with Untrusted Domains

Overview Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains via the createCorsHandler method in the Platform HTTP Vertx component. When CORS is enabled and camel.server.cors.origins is unset, an attacker can make a page on any origin send...

CVE-2026-84176

Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Platform HTTP Vertx component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. createCorsHandler set Access-Control-Allow-Credentials: true outside the origin check, so the...

CVE-2026-84176

Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Platform HTTP Vertx component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. createCorsHandler set Access-Control-Allow-Credentials: true outside the origin check, so the...

EUVD-2026-104211

Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Platform HTTP Vertx component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. createCorsHandler set Access-Control-Allow-Credentials: true outside the origin check, so the...

PT-2026-117341

Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Platform HTTP Vertx component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. createCorsHandler set Access-Control-Allow-Credentials: true outside the origin check, so the...