PT-2026-88698

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Incorrect authorization in the ServiceWorker allows a remote attacker to bypass the web origin policy, which is a security mechanism that restricts how a document or script loaded from...

PT-2026-88663

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description An origin validation error in the Paint component allows a remote attacker to obtain cross-origin data by using a crafted HTML page. Origin validation is a security mechanism that ensur...

PT-2026-88732

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Cross-site scripting in the SanitizerAPI allows a remote attacker to bypass the web origin policy through the use of a crafted HTML page. Cross-site scripting is a technique where...

PT-2026-88534

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in Cross-Origin Resource Sharing CORS, a mechanism that allows restricted resources on a web page to be requested from another domain, enables a remote attacker wh...

PT-2026-88650

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Improper encoding or escaping of output in CSS allows a remote attacker to potentially bypass the web origin policy, which is a security mechanism that restricts how a document or scrip...

PT-2026-88673

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Improper input validation in the Network component allows a remote attacker to bypass the web origin policy, which is a security mechanism that restricts how a document or script loaded...

PT-2026-88608

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Incorrect authorization in the Loader component allows a remote attacker to bypass the web origin policy, which is a security mechanism that restricts how a document or script loaded fr...

CVE-2026-69680: Origin Validation Error

Origin validation error in Windows DNS allows an unauthorized attacker to perform spoofing over a network...

EulerOS 2.0 SP12 : perl-HTTP-Tiny (EulerOS-SA-2026-3369)

According to the versions of the perl-HTTP-Tiny packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server returns a 3xx...

EulerOS 2.0 SP12 : perl-HTTP-Tiny (EulerOS-SA-2026-3294)

According to the versions of the perl-HTTP-Tiny packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server returns a 3xx...

PT-2026-88719

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description An observable discrepancy in the Prefetch mechanism allows a remote attacker to leak cross-origin data by using a crafted HTML page. Prefetch is a technique used by browsers to load...

EulerOS 2.0 SP12 : perl-libwww-perl (EulerOS-SA-2026-3372)

According to the versions of the perl-libwww-perl package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross- origin redirects. On a 3xx...

WordPress IPGP Visitors Origin plugin < 1.6 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Vuln Seeker Cyber Security Team in WordPress Plugin IPGP Visitors Origin versions 1.6...

uBlock v1.74.1b3

!Badge CommitsCommit Rate !Badge IssuesIssues !Badge LocalizationCrowdin !Badge LicenseLicense !Badge NPMNPM !Badge MozillaMozilla !Badge ChromeChrome !Badge EdgeEdge uBlock Origin uBO Browser| Install from ...| Status ---|---|--- | Firefox Add-ons| uBO works best on Firefox | Edge Add-ons| "Movi...

CVE-2026-81404

The IPGP Visitors Origin WordPress plugin before 1.6 does not sanitise or escape user input before reflecting it back in the HTTP response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who are tricked into submitting a crafted request...

CVE-2026-81404 IPGP Visitors Origin < 1.6 - Reflected XSS

The IPGP Visitors Origin WordPress plugin before 1.6 does not sanitise or escape user input before reflecting it back in the HTTP response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who are tricked into submitting a crafted request...

CVE-2026-81404 IPGP Visitors Origin < 1.6 - Reflected XSS

The IPGP Visitors Origin WordPress plugin before 1.6 does not sanitise or escape user input before reflecting it back in the HTTP response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who are tricked into submitting a crafted request...

CVE-2026-81404

The IPGP Visitors Origin WordPress plugin in versions before 1.6 is vulnerable to a Reflected Cross-Site Scripting (XSS) attack. The root cause is the failure to properly sanitise or escape user input before it is reflected back in the HTTP response. This allows unauthenticated attackers to execu...

EUVD-2026-71853

The IPGP Visitors Origin WordPress plugin before 1.6 does not sanitise or escape user input before reflecting it back in the HTTP response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who are tricked into submitting a crafted request...

SUSE CVE-2026-11624

The Model Context Protocol has a security warning advising servers to validate the "Origin" header on all incoming connections to prevent DNS rebinding attacks. Prior to the v0.25.0 release, users had no way to validate the origin's host. In v0.25.0, a new "--allowed-hosts" flag was introduced...