29404 matches found
CVE-2026-13272
IBM Verify Identity Access is missing origin validation which could allow a remote attacker to perform operations as the victim and potentially launch further attacks against the systems...
CVE-2026-18251
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to improper validation of the WebSocket origin...
EUVD-2026-78074
IBM Verify Identity Access is missing origin validation which could allow a remote attacker to perform operations as the victim and potentially launch further attacks against the systems...
CVE-2026-13272
The software IBM Verify Identity Access and IBM Security Verify Access are vulnerable to a security flaw due to missing origin validation in WebSockets. This vulnerability could allow a remote attacker to perform operations as the victim, potentially facilitating further attacks against the syste...
CVE-2026-13272 Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access
IBM Verify Identity Access is missing origin validation which could allow a remote attacker to perform operations as the victim and potentially launch further attacks against the systems...
CVE-2026-13272 Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access
IBM Verify Identity Access is missing origin validation which could allow a remote attacker to perform operations as the victim and potentially launch further attacks against the systems...
CVE-2026-18251 IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i.
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to improper validation of the WebSocket origin...
CVE-2026-18251
IBM i (versions 7.3, 7.4, 7.5, and 7.6 ) is affected by a vulnerability in Navigator for i where improper validation of the WebSocket origin allows a remote, unauthenticated attacker to obtain sensitive information. The underlying cause is classified as CWE-1385: Missing Origin Validation in WebS...
EUVD-2026-77779
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to improper validation of the WebSocket origin...
CVE-2026-18251 IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i.
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to improper validation of the WebSocket origin...
Origin Validation Error
Overview Affected versions of this package are vulnerable to Origin Validation Error via the handling of HTTP responses in the UI, Logviewer, and DRPC components. An attacker can access sensitive cluster, topology, and log data by enticing an authenticated user to visit a malicious web page that...
CVE-2026-82438
Description Three separate mechanisms allowed a web page on an unrelated origin to read responses that Storm's HTTP components served to an authenticated user. The Logviewer reflected the request's Origin header back in Access-Control-Allow-Origin while also sending...
CVE-2026-57123 PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, ToolsMCPServer.runsse and launchtoolsmcpserver bind to 0.0.0.0 and create /sse and /messages/ routes without invoking the available SecurityConfig authentication, origin-validation, or DNS-rebinding controls. Any reachable...
CVE-2026-57123 PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, ToolsMCPServer.runsse and launchtoolsmcpserver bind to 0.0.0.0 and create /sse and /messages/ routes without invoking the available SecurityConfig authentication, origin-validation, or DNS-rebinding controls. Any reachable...
CVE-2026-57123
PraisonAI (praisonaiagents), a multi-agent teams system, is affected in its MCP SSE transport (ToolsMCPServer.run_sse() / launch_tools_mcp_server(transport="sse")). The server binds to 0.0.0.0 by default and builds its Starlette app without authentication middleware or Origin-header validation. T...
CVE-2026-57123 PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, ToolsMCPServer.runsse and launchtoolsmcpserver bind to 0.0.0.0 and create /sse and /messages/ routes without invoking the available SecurityConfig authentication, origin-validation, or DNS-rebinding controls. Any reachable...
CVE-2026-82019 TripleLift video-bundle.js DOM-based XSS via postMessage
TripleLift's ad rendering script video-bundle.js contains a DOM-based cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a publisher's domain by sending crafted postMessage payloads without origin validation. Attackers can cause a victim to...
EUVD-2026-77514
Description Three separate mechanisms allowed a web page on an unrelated origin to read responses that Storm's HTTP components served to an authenticated user. The Logviewer reflected the request's Origin header back in Access-Control-Allow-Origin while also sending...
CVE-2026-82438
This vulnerability exists in Apache Storm 's HTTP components, where three distinct mechanisms allowed web pages from unrelated origins to access authenticated user responses. Specifically, the Logviewer reflected the Origin header in Access-Control-Allow-Origin while sending Access-Control-Allow-...
CVE-2026-82438 Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins
Description Three separate mechanisms allowed a web page on an unrelated origin to read responses that Storm's HTTP components served to an authenticated user. The Logviewer reflected the request's Origin header back in Access-Control-Allow-Origin while also sending...