EUVD-2026-114714

WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes. WebDyne::Session sets its session cookie with only a name, value and path. Browsers then send the session ID over plain HTTP and with cross-site requests, and expose it to...

CVE-2026-78188

The WebDyne Perl module (versions 2.014 before 3.022 ) is vulnerable due to WebDyne::Session generating session cookies that lack the Secure , HttpOnly , and SameSite attributes. Because the cookies are only configured with a name, value, and path, browsers may transmit session IDs over plain HTT...

ROS-20261023-73-0221

The vulnerability in Jenkins is related to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to perform CSRF attacks remotely...

DevTools Suite Compromise Protected Information

The vulnerability in Google Chrome and Microsoft Edge’s DevTools web development tools involves cross-site request forgery. Exploiting this vulnerability enables a remote attacker to compromise the integrity of protected information by using a specially crafted HTML page...

CVE-2026-94485

A flaw was found in Next.js. During local development, the development server exposes a Model Context Protocol MCP endpoint without properly restricting cross-site requests. If a developer visits a malicious website while running the development server, an attacker can issue unauthorized requests...

CVE-2026-94486

A flaw was found in Next.js. The local development server exposes a Model Context Protocol MCP endpoint without properly restricting cross-site requests. If a developer running the development server visits a malicious website, an attacker can issue unauthorized requests to this endpoint, leading...

CVE-2026-94485

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the "next dev" development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read...

CVE-2026-94486

The Next.js React framework contains a vulnerability in the next dev development server, specifically affecting versions 16.0.0 through 16.3.8 . The server exposes a Model Context Protocol (MCP) endpoint that fails to reliably restrict cross-site requests. This flaw allows an attacker to issue un...

CVE-2026-94485: Origin Validation Error

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read t...

AEM Platform Security Bypass

The vulnerability of the corporate platform for creating, managing, and processing electronic forms, documents, and business processes within Adobe Experience Manager AEM Forms on JEE is related to the exploitation of cross-site requests. Exploiting this vulnerability could allow a malicious acto...

PT-2026-104377

Name of the Vulnerable Software and Affected Versions Next.js versions 16.0.0 through 16.3.7 Description The next dev development server exposes a Model Context Protocol endpoint that does not reliably restrict cross-site requests. This allows a malicious website visited by a developer to access...

Linux Distros Unpatched Vulnerability : CVE-2026-94486

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protoco...

CVE-2026-90900

The Easy Store extension (versions 1.0.0-3.0.0 ) by joomshaper.com for Joomla is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The root cause is a missing CSRF token verification on the product review submission endpoint (index.php?option=com_easystore&task=product.addReview), where t...

ROS-20260915-73-0175

The vulnerability in Chromium is related to the manipulation of cross-site requests. Exploiting this vulnerability allows a remote attacker to execute a CSRF attack...

ROS-20260915-73-0095

The vulnerability of the Autofill component in Google Chrome and Microsoft Edge relates to the manipulation of cross-site requests. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data through a specially created HTML page...

PerformanceAPIs Component Sensitive Data Access

The vulnerability in the PerformanceAPIs component of Google Chrome and Microsoft Edge web browsers is related to cross-site request forgery. Exploitation of this vulnerability may allow a remote attacker to gain access to sensitive data via a specially crafted HTML page...

CVE-2026-81315

Origin Validation Error vulnerability in ash-project ashai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor. In AshAi.Mcp.Server, with the default allowedorigins: nil, originallowed?/3...

CVE-2026-81315

CVE-2026-81315 is an origin validation error in ash-project ash_ai (affecting AshAi.Mcp.Server), allowing a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server using that user's actor. The root cause lies in origin_allo...

CVE-2026-81315: Origin Validation Error

Origin Validation Error vulnerability in ash-project ashai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor. In AshAi.Mcp.Server, with the default allowedorigins: nil, originallowed?/3...

Autofill Component Confidential Data Access

The vulnerability of the Autofill component in Google Chrome and Microsoft Edge relates to the manipulation of cross-site requests. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data through a specially created HTML page...