CVE-2026-116108

A flaw in openbq-org OpenBB (versions up to 4.7.2/5.0.0 ) affects the Local API Server component. The vulnerability exists within the file openbb_platform/core/openbb_core/app/model/api_settings.py, where a flaw leads to improper access controls . This issue allows for remote exploitation , and t...

EUVD-2026-109600

A flaw has been found in openbq-org OpenBB up to 4.7.2/5.0.0. This affects an unknown part of the file openbbplatform/core/openbbcore/app/model/apisettings.py of the component Local API Server. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The...

CVE-2026-66005

Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS misconfiguration vulnerability in its local API server that allows network-adjacent attackers to bypass trusted host restrictions by exploiting the server's replacement of user-configured trusted hosts with a wildcard that reflects...

CVE-2026-66005 Jan Local API Server CORS Origin Reflection via 0.0.0.0 Binding

Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS misconfiguration vulnerability in its local API server that allows network-adjacent attackers to bypass trusted host restrictions by exploiting the server's replacement of user-configured trusted hosts with a wildcard that reflects...

CVE-2026-66005

Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS misconfiguration vulnerability in its local API server that allows network-adjacent attackers to bypass trusted host restrictions by exploiting the server's replacement of user-configured trusted hosts with a wildcard that reflects...

CVE-2026-66005 Jan Local API Server CORS Origin Reflection via 0.0.0.0 Binding

Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS misconfiguration vulnerability in its local API server that allows network-adjacent attackers to bypass trusted host restrictions by exploiting the server's replacement of user-configured trusted hosts with a wildcard that reflects...

CVE-2026-66005 Jan Local API Server CORS Origin Reflection via 0.0.0.0 Binding

Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS misconfiguration vulnerability in its local API server that allows network-adjacent attackers to bypass trusted host restrictions by exploiting the server's replacement of user-configured trusted hosts with a wildcard that reflects...

CVE-2026-66005

CVE-2026-66005 affects Jan up to version 0.8.4. The local API server has a CORS misconfiguration that replaces user-configured trusted hosts with a wildcard, reflecting arbitrary origins with credentials. This enables network-adjacent attackers to bypass trusted host restrictions and reach the un...

EUVD-2026-48611

Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS misconfiguration vulnerability in its local API server that allows network-adjacent attackers to bypass trusted host restrictions by exploiting the server's replacement of user-configured trusted hosts with a wildcard that reflects...

PT-2026-64318

Name of the Vulnerable Software and Affected Versions Jan versions prior to 0.8.4 Description A CORS Cross-Origin Resource Sharing misconfiguration in the local API server allows network-adjacent attackers to bypass trusted host restrictions. This occurs because the server replaces user-configure...

CVE-2026-66005: Permissive List of Allowed Inputs

Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS misconfiguration vulnerability in its local API server that allows network-adjacent attackers to bypass trusted host restrictions by exploiting the server's replacement of user-configured trusted hosts with a wildcard that reflects...

CVE-2026-58169 Vibe-Trading < 0.1.10 - Loopback Trust and Missing Host Validation Enable DNS-Rebinding Authentication Bypass and Remote Code Execution

Vibe-Trading before 0.1.10 contains a DNS rebinding authentication bypass vulnerability that allows remote attackers to bypass bearer-token authentication by exploiting the server's trust of TCP peer addresses for loopback clients combined with missing Host header validation while binding to...

CVE-2026-58169

CVE-2026-58169 — Vibe-Trading

EUVD-2024-54373

Malicious code in bioql PyPI...

CVE-2024-11071

Permissive Cross-domain Policy with Untrusted Domains vulnerability in local API server of DestinyECM solutionversions described below which is developed and maintained by Cyberdigm may allow Cross-Site Request Forgery CSRF attack, which probabilistically enables JSON Hijacking aka JavaScript...

CVE-2024-11071: Cross-Site Request Forgery (CSRF)

Permissive Cross-domain Policy with Untrusted Domains vulnerability in local API server of DestinyECM solutionversions described below which is developed and maintained by Cyberdigm may allow Cross-Site Request Forgery CSRF attack, which probabilistically enables JSON Hijacking aka JavaScript...