CVE-2026-76977

SAP UI5 does not sufficiently validate the parent frame's origin against the configured allowlist. An unauthenticated attacker could host a malicious page to bypass framing restrictions. If an authenticated victim visits the attacker's page and interacts with it, the attacker could trick the vict...

CVE-2026-76977

SAP UI5 is affected by a clickjacking vulnerability in its Frame Options Allowlist mechanism. The framework does not sufficiently validate the parent frame's origin against the configured allowlist, allowing an unauthenticated attacker to host a malicious page that bypasses framing restrictions. ...

CVE-2026-76977 Clickjacking vulnerability in SAPUI5(Frame Options Allowlist)

SAP UI5 does not sufficiently validate the parent frame's origin against the configured allowlist. An unauthenticated attacker could host a malicious page to bypass framing restrictions. If an authenticated victim visits the attacker's page and interacts with it, the attacker could trick the vict...

CVE-2026-76977 Clickjacking vulnerability in SAPUI5(Frame Options Allowlist)

SAP UI5 does not sufficiently validate the parent frame's origin against the configured allowlist. An unauthenticated attacker could host a malicious page to bypass framing restrictions. If an authenticated victim visits the attacker's page and interacts with it, the attacker could trick the vict...

PT-2026-86963

SAP UI5 does not sufficiently validate the parent frame's origin against the configured allowlist. An unauthenticated attacker could host a malicious page to bypass framing restrictions. If an authenticated victim visits the attacker's page and interacts with it, the attacker could trick the vict...

CVE-2025-43929

CVE-2025-43929 Proof-of-concept for CVE-2025-43929, a high-severity vulnerability in KiTTY allowing for local executables to be ran without user confirmation under certain circumstances Vulnerability Type CWE-346: CWE-346 Origin Validation Error Vulnerability Description openactions.py in kitty...

BIT-JOOMLA-2026-71573 Joomla! Core - [20260802] - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2

Joomla! Core - 20260802 - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper implementation prevented configured CORS origins from being properly validated in CORS requests...

langflow-cors-scanner

CVE-2025-34291 — Langflow 来源验证 / CORS 概述 过度宽松的 CORS 配置与刷新令牌 Cookie 配置相结合，可导致凭据被盗。 字段| 值 ---|--- CVE| CVE-2025-34291 严重性| HIGH 产品| Langflow CISA KEV| 2026-05-21 攻击类型| 来源验证 / CORS 是否需要认证| 无 受影响版本 状态| 版本 ---|--- ❌ 存在漏洞| Langflow 1.3.5 之前的版本 ✅ 已修复| 已在 Langflow 1.3.5+ 中修复 安装 root@kitploit: Clone git...

CVE-2026-49455

Waku (a minimal React framework, npm package) prior to 1.0.0-beta.1 is vulnerable to cross-origin CSRF on its RSC server action dispatch. The root cause is the absence of any Origin or Sec-Fetch-Site validation in the RSC dispatch branch of request.ts, allowing a cross-origin attacker to invoke a...

CVE-2026-39363

CVE-2026-39363 — Vite Dev Server WebSocket 任意文件读取批量检测 免责声明： 本工具仅用于授权的安全测试和教育研究。使用者应遵守当地法律法规，未经授权扫描或攻击他人系统属于违法行为。作者不对任何滥用行为承担责任。 漏洞描述 Vite 开发服务器（6.0.0 6.4.1, 7.0.0 7.3.1, 8.0.0 8.0.4）的 HMR WebSocket 未校验 Origin 头，攻击者可通过 vite:invoke 事件调用 fetchModule，使用 file:// 协议配合 ?raw 参数绕过 server.fs.allow...

CVE-2026-25604-PoC

CVE-2026-25604 PoC Apache Airflow 的 AWS Auth Manager 中，Host 头注入导致 SAML 身份验证绕过 攻击者可以在 SAML 登录流程中注入恶意的 Host 头，使断言使用者服务（ACS）URL 指向攻击者控制的服务器。这使攻击者能够捕获有效的 SAML 响应 并重放这些响应以未授权访问 受害者的 Airflow 实例——或在不同访问控制的多个 Airflow 实例间重用令牌。 受影响版本 软件包| 受影响版本| 修复版本 ---|---|--- apache-airflow-providers-amazon| 8.0.0 –...

CVE-2026-82811

A security vulnerability has been detected in Toggl OÜ Toggl Track Extension 4.11.16. This affects an unknown function of the component postMessage Handler. The manipulation leads to origin validation error. It is possible to initiate the attack remotely. The exploit has been disclosed publicly a...

CVE-2026-82811

CVE-2026-82811 affects the Toggl Track Chrome extension (version 4.11.16 ). The vulnerability resides in the extension's postMessage Handler , which fails to properly validate message origins, allowing an attacker to accept forged session-state messages through an unauthenticated handler. The att...

EUVD-2026-68679

A security vulnerability has been detected in Toggl OÜ Toggl Track Extension 4.11.16. This affects an unknown function of the component postMessage Handler. The manipulation leads to origin validation error. It is possible to initiate the attack remotely. The exploit has been disclosed publicly a...

CVE-2026-82811 Toggl OÜ Toggl Track Extension postMessage origin validation

A security vulnerability has been detected in Toggl OÜ Toggl Track Extension 4.11.16. This affects an unknown function of the component postMessage Handler. The manipulation leads to origin validation error. It is possible to initiate the attack remotely. The exploit has been disclosed publicly a...

CVE-2026-81315

Origin Validation Error vulnerability in ash-project ashai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor. In AshAi.Mcp.Server, with the default allowedorigins: nil, originallowed?/3...

EUVD-2026-68304

Origin Validation Error vulnerability in ash-project ashai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor. In AshAi.Mcp.Server, with the default allowedorigins: nil, originallowed?/3...

CVE-2026-81315 MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header

Origin Validation Error vulnerability in ash-project ashai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor. In AshAi.Mcp.Server, with the default allowedorigins: nil, originallowed?/3...

EEF-CVE-2026-81315 MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header

Summary Origin Validation Error vulnerability in ash-project ashai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor. In AshAi.Mcp.Server, with the default allowedorigins: nil,...

CVE-2026-81315 MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header

Origin Validation Error vulnerability in ash-project ashai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor. In AshAi.Mcp.Server, with the default allowedorigins: nil, originallowed?/3...