29596 matches found
CVE-2026-82811: Origin Validation Error
A security vulnerability has been detected in Toggl OÜ Toggl Track Extension 4.11.16. This affects an unknown function of the component postMessage Handler. The manipulation leads to origin validation error. It is possible to initiate the attack remotely. The exploit has been disclosed publicly a...
CVE-2026-81267: User Interface (UI) Misrepresentation of Critical Information
A malicious webpage could stall a popup's cross-origin navigation after commit, causing the address bar to display the destination origin while continuing to render attacker-controlled content. This vulnerability was fixed in Firefox for iOS 155.0...
CVE-2026-81315: Origin Validation Error
Origin Validation Error vulnerability in ash-project ashai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor. In AshAi.Mcp.Server, with the default allowedorigins: nil, originallowed?/3...
PT-2026-83644
Origin Validation Error vulnerability in ash-project ash ai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor. In AshAi.Mcp.Server, with the default allowed origins: nil, origin...
Security Vulnerabilities fixed in Firefox for iOS 155.0 — Mozilla
A malicious webpage could stall a popup's cross-origin navigation after commit, causing the address bar to display the destination origin while continuing to render attacker-controlled content...
CVE-2026-82647
WWBN AVideo contains a cross-site request forgery (CSRF) vulnerability in sendEmail.json.php . The root cause is the bypass of origin checks and captcha validation , allowing an attacker to craft a malicious web page that, when visited by an authenticated admin, sends emails from the site's conta...
CVE-2026-82647 WWBN AVideo Cross-Site Request Forgery via sendEmail.json.php
WWBN AVideo contains a cross-site request forgery vulnerability in sendEmail.json.php that allows authenticated administrators to send mail from the site's contact address by bypassing origin checks and captcha validation. Attackers can craft a malicious web page that, when visited by an...
CVE-2026-82647 WWBN AVideo Cross-Site Request Forgery via sendEmail.json.php
WWBN AVideo contains a cross-site request forgery vulnerability in sendEmail.json.php that allows authenticated administrators to send mail from the site's contact address by bypassing origin checks and captcha validation. Attackers can craft a malicious web page that, when visited by an...
PT-2026-83573
WWBN AVideo contains a cross-site request forgery vulnerability in sendEmail.json.php that allows authenticated administrators to send mail from the site's contact address by bypassing origin checks and captcha validation. Attackers can craft a malicious web page that, when visited by an...
CVE-2026-82647: Cross-Site Request Forgery (CSRF)
WWBN AVideo contains a cross-site request forgery vulnerability in sendEmail.json.php that allows authenticated administrators to send mail from the site's contact address by bypassing origin checks and captcha validation. Attackers can craft a malicious web page that, when visited by an...
Origin Validation Error
Overview org.pac4j:pac4j-saml is an is PAC4J package for the SAML Protocol. Affected versions of this package are vulnerable to Origin Validation Error via the validateLogoutRequest function. An attacker can terminate a victim's session by submitting an unsigned LogoutRequest with a guessed...
Origin Validation Error
Overview Affected versions of this package are vulnerable to Origin Validation Error in the OIDC callback handling. An attacker can gain unauthorized access by substituting an access token minted for another client, thereby creating authenticated sessions without proper issuer, audience, nonce, o...
CVE-2026-82468
Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the JSON request content type validation. Attackers can craft cross-origin form posts with content types containing application/json substrings to bypass CSRF token validation and force victims to...
CVE-2026-82468 Rodauth before 2.47.0 CSRF Protection Bypass via Content-Type
Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the JSON request content type validation. Attackers can craft cross-origin form posts with content types containing application/json substrings to bypass CSRF token validation and force victims to...
CVE-2026-82468
Rodauth versions before 2.47.0 contain a cross-site request forgery (CSRF) protection bypass in the JSON request content type validation. An attacker can craft cross-origin form posts with content types containing application/json substrings to bypass CSRF token validation, forcing victims to aut...
CVE-2026-55696
PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, AttachmentViewer.setAttachment in js/privatebin.js uses getAttachmentMimeType to accept attacker-controlled MIME types and uses getBlobUrl to create a same-origin blob before setting...
CVE-2026-55696
PrivateBin versions prior to 2.0.5 contain a stored XSS vulnerability in the attachment download link. The root cause is that DOMPurify sanitization in AttachmentViewer.setAttachment only applies to image/*svg MIME types, and the resulting sanitized blob is assigned to a local variable used for t...
CVE-2026-82287
Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions by reflecting any request origin in Access-Control-Allow-Origin responses while credentials are enabled. Attackers can issue credentialed cross-origin requests from any website t...
CVE-2026-82291
HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users to access workspaces, projects, forms,...