Astra Linux – Vulnerability in Chromium

Inappropriate implementations of WebAuthentication in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to bypass the same-origin policy through a crafted HTML page...

Astra Linux – Vulnerability in Chromium

The inappropriate implementation of the HTML parser in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to leak cross-origin data through a crafted HTML page...

Astra Linux – Vulnerability in Chromium

Inappropriate implementations of Blink in Google Chrome prior to version 93.0.4577.82 allowed a remote attacker who had compromised the renderer process to leak cross-origin data through a crafted HTML page...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Web Contents in Google Chrome prior to 101.0.4951.64 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

Astra Linux – Vulnerability in Firefox

A race condition involving requestPointerLock and setTimeout could have allowed a user to interact with one tab while believing they were on a different tab. Combined with certain elements such as , this could lead to an attack where the user became confused about the origin of the webpage and...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in the iFrame Sandbox in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to leak cross-origin data through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in PictureInPicture in Google Chrome prior to 113.0.5672.63 allowed an attacker who convinced a user to install a malicious extension to perform an origin spoof in the security UI via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Thunderbird, Firefox

Navigation was allowed when dragging a URL from a cross-origin iframe into the same tab, which could lead to website spoofing attacks. This vulnerability affects Firefox 109, Firefox ESR 102.7, and Thunderbird 102.7...

Astra Linux – Vulnerability in Firefox and Thunderbird

A phishing website could have re-used an about: dialog box to display phishing content with an incorrect origin in the address bar. This vulnerability affects Firefox 122 and Thunderbird 115.7...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Autofill in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...

PT-2026-91759

Name of the Vulnerable Software and Affected Versions DocsGPT versions prior to 0.20.1 Description The software posts OAuth connector session tokens to a wildcard target origin in the 'callback-status' endpoint without validating the sender origin. An attacker can act as the window.opener during...

PT-2026-91439

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to improper validation of the WebSocket origin...

CVE-2026-13272: Missing Origin Validation in WebSockets

IBM Verify Identity Access is missing origin validation which could allow a remote attacker to perform operations as the victim and potentially launch further attacks against the systems...

PT-2026-95190

Name of the Vulnerable Software and Affected Versions SOGo versions prior to 5.12.11 Description Unauthenticated attackers can redirect password recovery tokens to domains under their control. This occurs because the software constructs password-reset links using the client-supplied Origin header...

CVE-2026-82438: Origin Validation Error

Description Three separate mechanisms allowed a web page on an unrelated origin to read responses that Storm's HTTP components served to an authenticated user. The Logviewer reflected the request's Origin header back in Access-Control-Allow-Origin while also sending...

CVE-2026-23792: Origin Validation Error

An issue was discovered in NR RRC in Samsung Mobile Processor and Modem Exynos 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, W1000, Modem 5300, Modem 5400, and Modem 5410. Incorrect handling of unauthenticated downlink RRC Setup messages can cause the baseband to crash...

PT-2026-91233

Description Three separate mechanisms allowed a web page on an unrelated origin to read responses that Storm's HTTP components served to an authenticated user. The Logviewer reflected the request's Origin header back in Access-Control-Allow-Origin while also sending...

PT-2026-91463

Name of the Vulnerable Software and Affected Versions IBM Verify Identity Access affected versions not specified Description IBM Verify Identity Access lacks origin validation, which may enable a remote attacker to perform operations on behalf of a victim and potentially launch subsequent attacks...

CVE-2026-18251: Missing Origin Validation in WebSockets

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to improper validation of the WebSocket origin...

CVE-2026-91201: Origin Validation Error

DocsGPT through 0.20.0 posts OAuth connector session tokens to a wildcard target origin in the callback-status endpoint without validating sender origin. Attackers can obtain session tokens and provider account emails by acting as window.opener during OAuth authorization, then use tokens to...