CVE-2026-39363

CVE-2026-39363 — Vite Dev Server WebSocket Arbitrary File Read Batch Detection Disclaimer: This tool is intended for authorized security testing and educational research only. Users must comply with local laws and regulations; unauthorized scanning or attacking others' systems is illegal. The...

BeyondTrust Remote Support <= 26.2.3 - Origin Validation File Upload

The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance. id: CVE-2026-102764...

CVE-2026-126355: honojs hono: Hono is a Web application framework that provides support for any JavaScript runtime

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.16, csrf limits origin validation to the content types normally sent by HTML forms and therefore does not validate text/ping requests generated by Chromium hyperlink auditing. Chrome and Edge can...

CVE-2025-43929

CVE-2025-43929 Proof-of-concept for CVE-2025-43929, a high-severity vulnerability in KiTTY allowing for local executables to be ran without user confirmation under certain circumstances Vulnerability Type CWE-346: CWE-346 Origin Validation Error Vulnerability Description openactions.py in kitty...

CVE-2026-126355

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.16, csrf limits origin validation to the content types normally sent by HTML forms and therefore does not validate text/ping requests generated by Chromium hyperlink auditing. Chrome and Edge can...

curl: libcurl: Information disclosure due to cookie leak when reusing connections with custom Host headers

A flaw was found in libcurl. This vulnerability allows for information disclosure when a custom Host: header is used in an initial HTTP request, and a subsequent request reuses the same connection without specifying a new Host: header. This can lead to libcurl incorrectly sending cookies intended...

CVE-2026-25604-PoC

CVE-2026-25604 PoC Host Header Injection leading to SAML authentication bypass in Apache Airflow's AWS Auth Manager An attacker can inject a malicious Host header into the SAML login flow, causing the Assertion Consumer Service ACS URL to point to an attacker-controlled server. This allows the...

CVE-2026-89326

Origin Validation Error vulnerability in Apache XML Graphics Batik: the external resource same-origin check does not compare the URL protocol This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue...

Vulnerabilities fixed in Fortinet FortiClient and FortiClientEMS

Fortinet has patched vulnerabilities in FortiClient and FortiClientEMS. In FortiClientEMS, authenticated local users with administrative privileges can escalate their access to a root shell by executing CLI commands with excessive privileges. This occurs because the commands are granted more righ...

langflow-cors-scanner

CVE-2025-34291 — Langflow Origin Validation / CORS Overview Overly permissive CORS config combined with refresh token cookie config allows credential theft. Field| Value ---|--- CVE| CVE-2025-34291 Severity| HIGH Product| Langflow CISA KEV| 2026-05-21 Attack Type| Origin Validation / CORS Auth...

PT-2026-146064

Name of the Vulnerable Software and Affected Versions @hono/node-server versions 2.0.0 through 2.1.5 Description The WebSocket upgrade path resolves a raw request-target starting with // against a base URL constructed from the Host header. This causes the WHATWG URL parser to treat the...

SUSE CVE-2026-89326

Origin Validation Error vulnerability in Apache XML Graphics Batik: the external resource same-origin check does not compare the URL protocol This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue...

Critical Zoom Workplace Flaw Could Allow Unauthenticated Remote Privilege Escalation

Zoom has released software updates to address two security flaws impacting Zoom Workplace for Windows, including a critical bug that could result in privilege escalation on affected systems. The vulnerabilities are listed below - CVE-2026-108186 CVSS score: 9.6 - An improper input validation...

DEBIAN-CVE-2026-89326

Origin Validation Error vulnerability in Apache XML Graphics Batik: the external resource same-origin check does not compare the URL protocol This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue...

CVE-2026-89326

Origin Validation Error vulnerability in Apache XML Graphics Batik: the external resource same-origin check does not compare the URL protocol This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue...

CVE-2026-102589

When independent Grafana instances share the same rendering renderertoken, an image renderer key issued by one instance is accepted by the others, so a user on one instance could act as the user with the same ID on another origin validation error. This affects instances with the renderAuthJWT...

CVE-2026-102589 Cross-instance user impersonation through image renderer JWTs

When independent Grafana instances share the same rendering renderertoken, an image renderer key issued by one instance is accepted by the others, so a user on one instance could act as the user with the same ID on another origin validation error. This affects instances with the renderAuthJWT...

CVE-2026-102589

Independent Grafana instances are vulnerable to cross-instance user impersonation due to an origin validation error . When instances share the same renderer_token, an image renderer key issued by one instance is accepted by others, allowing a user on one instance to act as a user with the same ID...

CVE-2026-102589

When independent Grafana instances share the same rendering renderertoken, an image renderer key issued by one instance is accepted by the others, so a user on one instance could act as the user with the same ID on another origin validation error. This affects instances with the renderAuthJWT...

EUVD-2026-123545

When independent Grafana instances share the same rendering renderertoken, an image renderer key issued by one instance is accepted by the others, so a user on one instance could act as the user with the same ID on another origin validation error. This affects instances with the renderAuthJWT...