CVE-2026-82811: Origin Validation Error

A security vulnerability has been detected in Toggl OÜ Toggl Track Extension 4.11.16. This affects an unknown function of the component postMessage Handler. The manipulation leads to origin validation error. It is possible to initiate the attack remotely. The exploit has been disclosed publicly a...

PT-2026-83644

Origin Validation Error vulnerability in ash-project ash ai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor. In AshAi.Mcp.Server, with the default allowed origins: nil, origin...

CVE-2026-81315: Origin Validation Error

Origin Validation Error vulnerability in ash-project ashai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor. In AshAi.Mcp.Server, with the default allowedorigins: nil, originallowed?/3...

CVE-2026-81322 Cloaked plaintext leaks through a non-sensitive action argument in AshCloak

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ashcloak allows anyone with access to logs, error trackers, or crash reports, or anyone who can trigger a validation error, to recover the plaintext of a field the library encrypts...

EUVD-2026-68282

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ashcloak allows anyone with access to logs, error trackers, or crash reports, or anyone who can trigger a validation error, to recover the plaintext of a field the library encrypts...

CVE-2026-81322: Exposure of Sensitive Information to an Unauthorized Actor

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ashcloak allows anyone with access to logs, error trackers, or crash reports, or anyone who can trigger a validation error, to recover the plaintext of a field the library encrypts...

CVE-2026-70309: Origin Validation Error

Origin validation error in Microsoft Edge Chromium-based allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-81100: Origin Validation Error

tiger-gh-mcp-server started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, making t...

CVE-2026-59297: Origin Validation Error

Implementation of isSecure call of ServerlessHttpServletRequest does not verify the actual scheme. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7...

CVE-2026-81099: Origin Validation Error

tiger-slack started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. mcp/src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, and a page i...

CVE-2026-81092: Origin Validation Error

mcp-go accepted requests on its HTTP transports without checking the Host header. StreamableHTTPServer.ServeHTTP in server/streamablehttp.go and SSEServer.ServeHTTP in server/sse.go served any request arriving over a loopback connection regardless of the host it named, and the SSE transport's...

CVE-2026-81095: Origin Validation Error

pg-aiguide started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named. A page in a brows...

CVE-2026-81102: Origin Validation Error

The Dash MCP server bound its listener to the loopback address but never checked the host a request named. src/mcpserverdash.py constructed the server for its network mode with the interface restricted to loopback and no transport-security settings, so a name that had been pointed at the loopback...

GO-2026-6288 MCP Toolbox for Databases has an Origin Validation Error in github.com/googleapis/genai-toolbox

MCP Toolbox for Databases has an Origin Validation Error in github.com/googleapis/genai-toolbox...

Origin Validation Error

Overview PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent...

PT-2026-82037

MCP Toolbox for Databases has an Origin Validation Error in github.com/googleapis/genai-toolbox...

CVE-2026-55637: Origin Validation Error

genieacs-mcp is an MCP server for GenieACS written in Go. Prior to 0.3.2, the Streamable HTTP transport in cmd/server/main.go creates an unauthenticated /mcp listener on the default MCPLISTENADDR value 127.0.0.1:8080 when MCPAUTHTOKEN is unset and the httpSrv.Startaddr branch does not validate th...

CVE-2026-55532: Origin Validation Error

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, MCP HTTP Stream validateorigin uses requestorigin.startswithallowed, allowing the attacker-controlled localhost.attacker.com HTTP origin to satisfy the localhost allowlist. A webpage can send Content-Type: text/plain requests...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Validates NIX’s maximum number of LFs correctly. NIX’s maximum number of LFs can be set using the devlink command. However, this can be done before assigning any LFs to a PF/VF. The condition used to check whether a...

Linux Distros Unpatched Vulnerability : CVE-2026-53499

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FORT Validator is a Resource Public Key Infrastructure RPKI relying-party validator that produces validated route-origin data. FORT Validator versions through...