CVE-2026-102878 mcp-chrome-bridge through 1.0.31 CORS Origin Bypass

mcp-chrome-bridge through 1.0.31 contains an origin validation error in the native-server HTTP API that allows attackers to bypass CORS restrictions. Attackers can craft malicious web pages that make cross-origin requests to the local server and invoke browser automation tools including script...

CVE-2026-102878 mcp-chrome-bridge through 1.0.31 CORS Origin Bypass

mcp-chrome-bridge through 1.0.31 contains an origin validation error in the native-server HTTP API that allows attackers to bypass CORS restrictions. Attackers can craft malicious web pages that make cross-origin requests to the local server and invoke browser automation tools including script...

EUVD-2026-89413

mcp-chrome-bridge through 1.0.31 contains an origin validation error in the native-server HTTP API that allows attackers to bypass CORS restrictions. Attackers can craft malicious web pages that make cross-origin requests to the local server and invoke browser automation tools including script...

CVE-2026-102831

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.5.0 until 4.5.11 and 4.6.4, from Notebook 7.5.0 until 7.6.3, and from JupyterLite Core 0.7.0 until 0.8.4, the system clipboard cell-paste path accepts...

poc-cribl-rce

면책 조항 본 문서는 정보 제공 및 교육 목적으로만 제공됩니다. 본 문서는 공급업체가 수정 사항을 검증할 수 있도록 도구의 보안 취약점을 시연하기 위해 작성되었습니다. 정보 Cribl v1.5.0에서 테스트됨 - 이전 버전은 테스트되지 않았지만 취약할 가능성이 높습니다. 유효한 JWT 토큰을 다른 Cribl 인스턴스의 세션으로 전송하고 주입할 수 있어, 사용자에게 인증되지 않은 접근 권한을 부여합니다. 또한, JWT/세션 생성에 사용된 암호화 키를 사용하면 만료 기간이 연장된 유효한 세션을 임의의 사용자 이름으로 생성할 수...

CVE-2020-14882-WebLogic-Analysis

취약점 연구: Oracle WebLogic Server의 CVE-2020-14882 및 CVE-2020-14883 체인 익스플로잇 이 저장소는 Oracle WebLogic Server 관리 콘솔 구성 요소에서 인증 우회Authentication Bypass 및 원격 코드 실행RCE 취약점 체인을 시연하기 위한 기술 보고서Write-up와 개념 증명Proof of Concept, PoC을 포함합니다. 🛑 경고 및 면책 조항: 본 자료는 교육 목적과 합법적인 보안 감사Pentest 수행을 위해서만 준비되었습니다. 소유자의 사전 서...

CVE-2026-102878: Origin Validation Error

mcp-chrome-bridge through 1.0.31 contains an origin validation error in the native-server HTTP API that allows attackers to bypass CORS restrictions. Attackers can craft malicious web pages that make cross-origin requests to the local server and invoke browser automation tools including script...

PT-2026-102816

Name of the Vulnerable Software and Affected Versions JupyterLab versions 4.5.0 through 4.5.10 JupyterLab versions 4.6.0 through 4.6.3 Notebook versions 7.5.0 through 7.6.2 JupyterLite Core versions 0.7.0 through 0.8.3 Description The system clipboard cell-paste path accepts attacker-controlled...

CVE-2023-49987

CVE-2023-49987 School Fees Management System v1.0 - "tname" 매개변수 및 "newterm"에서의 크로스 사이트 스크립팅XSS 취약점 설명 : 구성 요소 “newterm”의 School Fees Management System 1.0에 있는 크로스 사이트 스크립팅XSS 취약점으로 인해 공격자가 “tname” 매개변수에 주입된 조작된 페이로드를 통해 임의의 웹 스크립트나 HTML을 실행할 수 있습니다. 취약한 제품 버전 : School Fees Management System v1.0...

CVE-2023-43339-CMSmadesimple-Reflected-XSS---Installation

Cmsmadesimple CMS 반사형 XSS v2.2.18 작성자: Sergio 설명: cmsmadesimple v.2.2.18 설치 과정의 다중 XSSCross-Site Scripting 취약점으로 인해 로컬 공격자가 데이터베이스 이름Database Name, 데이터베이스 사용자DataBase User 또는 데이터베이스 포트Database Port에 주입된 조작된 페이로드를 통해 임의의 웹 스크립트를 실행할 수 있습니다. 공격 벡터: 데이터베이스 이름, 사용자 이름 및 포트의 설치 입력 검증 과정 취약점으로 인해...

CVE-2023-49986

CVE-2023-49986 School Fees Management System v1.0 - 'name' 매개변수의 'addnewparent'에서 발생하는 크로스 사이트 스크립팅XSS 취약점 설명 : School Fees Management System 1.0의 “addnewparent” 구성 요소에서 발생하는 크로스 사이트 스크립팅XSS 취약점으로, 공격자가 “name” 매개변수에 주입된 조작된 페이로드를 통해 임의의 웹 스크립트나 HTML을 실행할 수 있습니다. 취약한 제품 버전 : School Fees Management...

CVE-2026-82381

Apache Roller version 6.1.5 is vulnerable to a Stored Cross-Site Scripting (XSS) flaw due to improper neutralization of input during web page generation. An attacker with authoring rights on a weblog can store crafted content that is injected into the authoring UI's JavaScript string literals and...

CVE-2026-100646 SiYuan before v3.8.4 Authentication Bypass via Missing Origin Header

SiYuan is a self-hosted personal knowledge management system. In versions up to and including 3.8.3, the kernel's authentication guards CheckAuth in kernel/model/session.go and IsSessionOriginAllowed in kernel/util/net.go fail open when the HTTP Origin header is absent, on the incorrect assumptio...

CVE-2026-100521 Cotonti through 1.0.0 Reflected XSS via search highlight parameter

Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in the search plugin highlight parameter that performs no HTML or JavaScript escaping. Attackers can craft malicious links with injected JavaScript in the highlight parameter that executes in the browser of any visitor...

CVE-2026-100646: Origin Validation Error

SiYuan is a self-hosted personal knowledge management system. In versions up to and including 3.8.3, the kernel's authentication guards CheckAuth in kernel/model/session.go and IsSessionOriginAllowed in kernel/util/net.go fail open when the HTTP Origin header is absent, on the incorrect assumptio...

CVE-2026-48482

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a form administrator can use Form import with a crafted illustration or scene identifier that traverses outside the intended custom-asset directory. The imported file can be written to an executable server location...

CVE-2026-97863 misp-modules: Shell Command Injection in MISP cisco_firesight_manager_ACL_rule_export Module via Unescaped Attribute Values

The ciscofiresightmanagerACLruleexport module in misp-modules generates a shell script .sh that authenticates to and calls the Cisco fireSIGHT Manager API. The module interpolates configuration values IP address, login, password, domain ID, policy ID and MISP attribute values destination IPs, URL...

CVE-2026-97863 misp-modules: Shell Command Injection in MISP cisco_firesight_manager_ACL_rule_export Module via Unescaped Attribute Values

The ciscofiresightmanagerACLruleexport module in misp-modules generates a shell script .sh that authenticates to and calls the Cisco fireSIGHT Manager API. The module interpolates configuration values IP address, login, password, domain ID, policy ID and MISP attribute values destination IPs, URL...

CVE-2026-48482: Improper Limitation of a Pathname to a Restricted Directory

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a form administrator can use Form import with a crafted illustration or scene identifier that traverses outside the intended custom-asset directory. The imported file can be written to an executable server location...

EUVD-2026-86337

Mailspring is a fast, cross-platform, open-source email client. Prior to 1.17.0, attachment quick preview converts Markdown, DOCX, and XLSX attachments with Snarkdown, Mammoth, and SheetJS and inserts the resulting HTML into the preview document through innerHTML without sanitization. A remote...