CVE-2026-34200

Nhost MCP Server: One-Click Infrastructure Compromise Official Advisory: This vulnerability was acknowledged and published by Nhost: GHSA-6c5x-3h35-vvw2 This repository documents a vulnerability in the Nhost Local MCP Server. The service lacks inbound authentication and implements a permissive CO...

Dissecting-CVE-2026-0628-Chromium-Extension-Privilege-Escalation

= doi.org/10.5281/zenodo.18413764 = orcid.org/0009-0007-7728-256X README.md CVE-2026-0628: Chromium WebView Privilege Escalation Origin Spoofing – Technical Research & Proof-of-Concept Author: Sastra Adi Wiguna Purple Elite Teaming Research Date: January 2026 CVE ID: CVE-2026-0628 CVSS v3.1: 8.8...

CVE-2026-27579-CollabPlatform-Appwrite-CORS-Misconfiguration

Appwrite CORS Misconfiguration Exploit PoC CVE-2026-27579 – Credentialed Account Data Leak via Permissive CORS CVE-2026-27579 GHSA-qh5m-p8jh-hx88 A severe CORS misconfiguration in the Appwrite backend used by the realtime-collaboration-platform allows an attacker-controlled origin to read sensiti...

CVE-2026-104059 Lektor 3.3.14 CSRF via Admin API Endpoints

Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing actions by sending cross-origin requests without CSRF tokens, Origin/Referer validation, CORS configuration, or Host...

CVE-2026-103922

Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its path, allowing a victim who activates an untrusted link to navigate a frame ...

CVE-2026-103922 Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path

Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its path, allowing a victim who activates an untrusted link to navigate a frame ...

CVE-2026-103922

The Capacitor cross-platform native runtime (versions 6.0.0 up to 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1) contains a navigation guard vulnerability on Android and iOS . The guard validates the host and scheme of a target URL but fails to validate the path , allowing an attacker to navigate a frame...

CVE-2026-103922 Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path

Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its path, allowing a victim who activates an untrusted link to navigate a frame ...

CVE-2026-12295-UXXS-in-my-wasm

CVE-2026-12295 — srcdoc data on a non-about:srcdoc URI Firefox UXSS Proof of concept: a compromised content process forges a PDocumentChannel load whose nsDocShellLoadState carries SrcdocData together with an arbitrary URI. Vulnerable builds serve the attacker HTML as the document at the victim...

CVE-2026-95362

A flaw was found in chromium-browser. A Cross-Site Request Forgery CSRF vulnerability in the DevTools component allows a remote attacker to bypass web origin security policies. By tricking a user into opening a crafted HTML page, the attacker can execute unauthorized actions within the developer...

CVE-2026-32913

While reviewing the source code, I focused on how OpenClaw handles HTTP requests — specifically the fetchWithSsrFGuard function, which is responsible for making server-side fetch calls. I noticed something off. When a request followed a cross-origin redirect meaning the server sent a 3xx response...

CVE-2026-22794-POC

CVE-2026-22794 - Appsmith Origin Header Injection 🔴 Critical Security Vulnerability Password Reset Link Hijacking via Origin Header Manipulation This repository contains a Proof of Concept PoC exploit for CVE-2026-22794, a critical vulnerability in Appsmith that allows attackers to hijack passwor...

djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session

ImpactThe SSE client→server POST endpoints are @csrfexempt and the SSE GET stream endpoint had no Origin check, so a cross-origin page could drive a victim-cookie-authenticated SSE session: force the victim's browser to GET the stream URL which creates and mounts a LiveView as the victim and POST...

Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin

SummaryAny authenticated user with access to a shared terminal server could get script of their choosing to run in the Open WebUI origin itself. The in-app port preview rendered the content of a previewed port in an iframe whose sandbox always granted allow-same-origin alongside allow-scripts, an...

CVE-2026-102673

A flaw was found in Electron. When a popup window is opened from an embedded web frame iframe using navigation actions such as opening a link in a new tab, the popup fails to inherit the frame's sandbox security restrictions. A remote attacker controlling untrusted content within a sandboxed fram...

CVE-2026-23550

CVE-2026-23550 Modular DS header'User-Agent'; $userAgentMatches = $userAgent && Str::is'ModularConnector/ Linux', $userAgent; $originQuery = $request-has'origin' && $request-get'origin' === 'mo'; $isFromQuery = $originQuery || $userAgentMatches && $request-has'type'; // When is wp-load.php reques...

CVE-2026-2828-WebGPU-Cross-Origin-Pixel-Stealing-via-Timing

4. CVE-2026-2828 – WebGPU Cross‑Origin Pixel Stealing via Timing Overview A malicious website uses WebGPU compute shader timing to measure rendering time of a cross‑origin iframe, recovering pixel values of sensitive content e.g., banking details. Severity: High Information Disclosure...

CVE-2026-66247

iControl is affected by an insecure Cross-Origin Resource Sharing CORS policy vulnerability, which could allow a malicious website to execute cross-origin requests with included credentials, enabling an attacker to access and exfiltrate sensitive data within the context of the victim's active...

CVE-2026-66247

iControl is affected by an insecure Cross-Origin Resource Sharing CORS policy vulnerability, which could allow a malicious website to execute cross-origin requests with included credentials, enabling an attacker to access and exfiltrate sensitive data within the context of the victim's active...

CVE-2026-66247

The iControl software is affected by an insecure Cross-Origin Resource Sharing (CORS) policy vulnerability. This flaw could allow a malicious website to execute cross-origin requests that include the victim's credentials. If exploited, an attacker could access and exfiltrate sensitive data within...