CVE-2026-85682 YOP Poll <= 7.0.10 - Unauthenticated Origin Validation Error to Administrator Account Takeover via '/auth/wp-login-redirect' REST Route

The YOP Poll plugin for WordPress is vulnerable to Origin Validation Error in all versions up to, and including, 7.0.10. This is due to the plugin transmitting a wprest nonce to window.opener via postMessage with a wildcard targetOrigin. This makes it possible for unauthenticated attackers to ste...

CVE-2026-85682

The YOP Poll plugin for WordPress (versions up to and including 7.0.10 ) is vulnerable to an Origin Validation Error . The root cause is the plugin transmitting a wp_rest nonce to window.opener via postMessage() using a wildcard targetOrigin . This allows an unauthenticated attacker to steal a RE...

CVE-2026-85682: Origin Validation Error

The YOP Poll plugin for WordPress is vulnerable to Origin Validation Error in all versions up to, and including, 7.0.10. This is due to the plugin transmitting a wprest nonce to window.opener via postMessage with a wildcard targetOrigin. This makes it possible for unauthenticated attackers to ste...

CVE-2026-97155: Origin Validation Error

Fabasoft Folio Client before 2026, a locally installed component that communicates with the Fabasoft browser extension via web messaging, does not restrict which web origins may invoke its functions by default. The registry value VALIDDOMAINS, which limits permitted origins, was optional and empt...

PT-2026-97734

Name of the Vulnerable Software and Affected Versions YOP Poll versions prior to 7.0.11 Description The plugin contains an origin validation error where it transmits a wp rest nonce to window.opener using the postMessage function with a wildcard targetOrigin. This allows unauthenticated attackers...

CVE-2026-91132: Origin Validation Error

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, sites using wildcard patterns in the allowediframes setting could accept a crafted iframe URL whose allowlisted suffix appeared after a URL authority separator. The wildcard origin check matched...

WordPress YOP Poll plugin <= 7.0.10 - Unauthenticated Origin Validation Error to Administrator Account Takeover vulnerability

Unauthenticated Origin Validation Error to Administrator Account Takeover vulnerability discovered by Supakiad S. m3ez in WordPress Plugin YOP Poll versions = 7.0.10...

Origin Validation Error

Overview Affected versions of this package are vulnerable to Origin Validation Error in the RefererFilter process. An attacker can bypass security checks by providing weaker-than-origin evidence in HTTP requests. Remediation Upgrade org.apache.sling:org.apache.sling.security to version 1.3.2 or...

CVE-2026-94243: Origin Validation Error

A vulnerability in Apache Sling Security Bundle: the ReferrerFilter accepts weaker-than-orgin evidence. This issue affects Apache Sling Security Bundle: before 1.3.2. Users are recommended to upgrade to version 1.3.2, which fixes the issue...

Origin Validation Error

Overview org.jboss.resteasy:resteasy-core-spi is a JBoss.org project aimed at providing productivity frameworks for developing client and server RESTful applications and services in Java. Affected versions of this package are vulnerable to Origin Validation Error via the response and preflight...

Origin Validation Error

Overview org.jboss.resteasy:resteasy-core is a JBoss.org project aimed at providing productivity frameworks for developing client and server RESTful applications and services in Java. Affected versions of this package are vulnerable to Origin Validation Error via the response and preflight handli...

CVE-2026-92702: Origin Validation Error

Cocos AI is a confidential computing system for running AI workloads inside trusted execution environments. In versions up to and including 0.8.2, the intra-handshake attested TLS aTLS AMD SEV-SNP verification path does not enforce attestation freshness when the expected reportData value is nil,...

dotnet10.0: dotnet9.0: dotnet8.0: .NET Information Disclosure Vulnerability

Origin validation error in .NET allows an unauthorized attacker to disclose information over a network...

CVE-2026-12284: Origin Validation Error

Mattermost Desktop App versions =6.2 6.2.2.0 fails to validate the IPC sender in the leaveCall handler which allows a malicious or compromised Mattermost server or a user with script access to a connected server view to disconnect an active call belonging to a different connected server via the...

dotnet10.0: dotnet9.0: dotnet8.0: .NET Information Disclosure Vulnerability

Origin validation error in .NET allows an unauthorized attacker to disclose information over a network...

CVE-2026-92360

A weakness has been identified in ag-ui-protocol ag-ui 1.0. The impacted element is the function prepareRunAgentInput of the file agent/agent.ts of the component Event Application Layer. This manipulation of the argument TEXTMESSAGESTART causes origin validation error. Remote exploitation of the...

CVE-2026-92360 ag-ui-protocol ag-ui Event Application Layer agent.ts prepareRunAgentInput origin validation

A weakness has been identified in ag-ui-protocol ag-ui 1.0. The impacted element is the function prepareRunAgentInput of the file agent/agent.ts of the component Event Application Layer. This manipulation of the argument TEXTMESSAGESTART causes origin validation error. Remote exploitation of the...

Origin Validation Error

Overview apache-airflow-providers-fab is a Provider package apache-airflow-providers-fab for Apache Airflow Affected versions of this package are vulnerable to Origin Validation Error in the idtoken validation. An attacker can gain unauthorized access by presenting a valid token issued for a...

CVE-2026-77119: Origin Validation Error

A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged unsigned answer through. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through...

CVE-2026-77119: Origin Validation Error

A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged unsigned answer through. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through...