CVE-2026-110737

The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because Flow configures Atmosphere with DROPACCESSCONTROLALLOWORIGINHEADER set to false and its CorsInterceptor then echoes...

CVE-2026-110737 Push Endpoint Returns Permissive CORS Headers

The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because Flow configures Atmosphere with DROPACCESSCONTROLALLOWORIGINHEADER set to false and its CorsInterceptor then echoes...

EUVD-2026-110721

The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because Flow configures Atmosphere with DROPACCESSCONTROLALLOWORIGINHEADER set to false and its CorsInterceptor then echoes...

CVE-2026-110737

The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because Flow configures Atmosphere with DROPACCESSCONTROLALLOWORIGINHEADER set to false and its CorsInterceptor then echoes...

CVE-2026-110737

The push endpoint in Vaadin applications using server push is vulnerable to a cross-origin request forgery (CSRF) style attack. Because Flow configures Atmosphere with DROP_ACCESS_CONTROL_ALLOW_ORIGIN_HEADER set to false, the CorsInterceptor echoes the request's Origin into the Access-Control-All...

PT-2026-126330

The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because Flow configures Atmosphere with DROP ACCESS CONTROL ALLOW ORIGIN HEADER set to false and its CorsInterceptor then echoes...

EUVD-2026-103186

LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files...

CVE-2026-108372

Open and provider-neutral, LoopX is a lightweight state kernel and local-first control plane for loop engineering. From version 0.0.1 until 0.4.5, "loopx serve-status" in "loopx/statusserver.py" uses "StatusRequestHandler.sendjson" and "doOPTIONS" to send "Access-Control-Allow-Origin: " for...

EUVD-2026-97634

Network-AI npm network-ai before 5.15.2 contains an origin validation error in McpSseServer.handleRequest in lib/mcp-transport-sse.ts that reflects localhost Origins into Access-Control-Allow-Origin regardless of bind interface. When the server binds a non-loopback address, an attacker page with ...

CVE-2026-109332

Network-AI npm network-ai before 5.15.2 contains an origin validation error in McpSseServer.handleRequest in lib/mcp-transport-sse.ts that reflects localhost Origins into Access-Control-Allow-Origin regardless of bind interface. When the server binds a non-loopback address, an attacker page with ...

PT-2026-110749

Network-AI npm network-ai before 5.15.2 contains an origin validation error in McpSseServer. handleRequest in lib/mcp-transport-sse.ts that reflects localhost Origins into Access-Control-Allow-Origin regardless of bind interface. When the server binds a non-loopback address, an attacker page with...

CVE-2026-109332: Origin Validation Error

Network-AI npm network-ai before 5.15.2 contains an origin validation error in McpSseServer.handleRequest in lib/mcp-transport-sse.ts that reflects localhost Origins into Access-Control-Allow-Origin regardless of bind interface. When the server binds a non-loopback address, an attacker page with ...

PT-2026-108451

Security vulnerability affects the wildfly package. A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins "", reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true...

PT-2026-97558

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 3.13.17 RabbitMQ versions prior to 4.0.22 RabbitMQ versions prior to 4.1.13 RabbitMQ versions prior to 4.2.6 Description In the management plugin, the match origin/1 function within rabbit mgmt cors.erl incorrectly...

PT-2026-96694

Name of the Vulnerable Software and Affected Versions open-vsx.org affected versions not specified Description The deployment of the service returned an Access-Control-Allow-Origin header that reflected the requesting origin combined with Access-Control-Allow-Credentials: true on authenticated...

SUSE CVE-2026-89058

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins "", reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to...

CVE-2026-89058: Origin Validation Error

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins "", reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to...

PT-2026-95296

Name of the Vulnerable Software and Affected Versions RESTEasy affected versions not specified Description A flaw exists in the CorsFilter component. When configured to allow all origins using the "" wildcard, the filter reflects the request's Origin header in the Access-Control-Allow-Origin...

CVE-2026-67200

Perspective 5.0.0 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files from the server filesystem by including literal ../ segments in HTTP request URL paths. Attackers can bypass the insufficient query-string-stripping sanitization to...

CVE-2026-67200: Improper Limitation of a Pathname to a Restricted Directory

Perspective 5.0.0 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files from the server filesystem by including literal ../ segments in HTTP request URL paths. Attackers can bypass the insufficient query-string-stripping sanitization to...