CVE-2026-95289: Incorrect Authorization

Incorrect authorization in Scroll in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted HTML page. Chromium security severity: Medium...

FreeBSD: VID-bd24bc14-b9a9-11f1-bf98-a8a1599412c6 (CVE-2026-95374): chromium -- security fixes

Incorrect authorization in Network in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-95342: Missing Authorization

Missing authorization in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

CVE-2026-95361: Unintended Proxy or Intermediary

Confused deputy in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

CVE-2026-95374: Incorrect Authorization

Incorrect authorization in Network in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-102878: Origin Validation Error

mcp-chrome-bridge through 1.0.31 contains an origin validation error in the native-server HTTP API that allows attackers to bypass CORS restrictions. Attackers can craft malicious web pages that make cross-origin requests to the local server and invoke browser automation tools including script...

CVE-2026-101278: Origin Validation Error

A weakness has been identified in Trusted Domain Project OpenDMARC up to 1.4.2. This affects the function opendmarcgettld of the file libopendmarc/opendmarctld.c : of the component PSL Wildcard Handler. Executing a manipulation can lead to origin validation error. The attack may be launched...

PT-2026-102415

Name of the Vulnerable Software and Affected Versions OpenDMARC versions prior to 1.4.3 Description A weakness exists in the PSL Wildcard Handler component within the opendmarc get tld function of the libopendmarc/opendmarc tld.c file. A remote attacker can perform a manipulation that leads to an...

Amazon Linux 2023 : aspnetcore-runtime-8.0, aspnetcore-runtime-dbg-8.0, aspnetcore-targeting-pack-8.0 (ALAS2023-2026-3114)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3114 advisory. Origin validation error in .NET allows an unauthorized attacker to disclose information over a network. CVE-2026-58649 Integer overflow or wraparound in .NET allows an unauthorized attacker to...

CVE-2026-87517

A flaw was found in Google Chrome on iOS. A race condition in the mobile browser component allows a remote attacker to bypass the same-origin policy by tricking a user into opening a specially crafted HTML page. Successful exploitation enables unauthorized access to sensitive cross-origin web dat...

CVE-2026-18825

An Origin Validation Error in the middleware of the connect-xcors npm package allows an attacker to bypass origin verification and perform a cross domain authenticated request...

CVE-2026-18825 Origin validation error in the connect-xcors npm package

An Origin Validation Error in the middleware of the connect-xcors npm package allows an attacker to bypass origin verification and perform a cross domain authenticated request...

EUVD-2026-88239

An Origin Validation Error in the middleware of the connect-xcors npm package allows an attacker to bypass origin verification and perform a cross domain authenticated request...

CVE-2026-18825 Origin validation error in the connect-xcors npm package

An Origin Validation Error in the middleware of the connect-xcors npm package allows an attacker to bypass origin verification and perform a cross domain authenticated request...

CVE-2026-18825

The connect-xcors npm package contains an Origin Validation Error within its middleware. This flaw allows an attacker to bypass origin verification , potentially enabling the execution of cross-domain authenticated requests . The vulnerability has a CVSS 4.0 base score of 5.3 (MEDIUM) . No specif...

PT-2026-99874

Name of the Vulnerable Software and Affected Versions connect-xcors npm package affected versions not specified Description An origin validation error in the middleware allows an attacker to bypass origin verification. This flaw enables the execution of cross-domain authenticated requests, which...

CVE-2026-18825: Origin Validation Error

An Origin Validation Error in the middleware of the connect-xcors npm package allows an attacker to bypass origin verification and perform a cross domain authenticated request...

CVE-2026-100642

SiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery vulnerability in the CheckAuth lock-screen pass-through branch that grants administrator access to loopback requests without validating Origin headers. Attackers can craft malicious web pages that force victims to...

CVE-2026-100646 SiYuan before v3.8.4 Authentication Bypass via Missing Origin Header

SiYuan is a self-hosted personal knowledge management system. In versions up to and including 3.8.3, the kernel's authentication guards CheckAuth in kernel/model/session.go and IsSessionOriginAllowed in kernel/util/net.go fail open when the HTTP Origin header is absent, on the incorrect assumptio...

CVE-2026-100646 SiYuan before v3.8.4 Authentication Bypass via Missing Origin Header

SiYuan is a self-hosted personal knowledge management system. In versions up to and including 3.8.3, the kernel's authentication guards CheckAuth in kernel/model/session.go and IsSessionOriginAllowed in kernel/util/net.go fail open when the HTTP Origin header is absent, on the incorrect assumptio...