mcp-chrome-bridge (hangwin/mcp-chrome) <= 1.0.31 - CORS Origin Bypass (CSWSH)

mcp-chrome-bridge =1.0.31 uses origin.startsWith for CORS, so origins like http://127.0.0.1.evil.com are wrongly allowed, letting attackers bypass CORS and access the local server. id: CVE-2026-102878 info: name: mcp-chrome-bridge hangwin/mcp-chrome = 1.0.31 - CORS Origin Bypass CSWSH author:...

Transmission 4.0.0-4.1.2 - Permissive CORS Exposes RPC Session ID

Transmission 4.0.0 through 4.1.2 sends Access-Control-Allow-Origin: on RPC responses and advertises X-Transmission-Session-Id via Access-Control-Expose-Headers on the 409 session handshake. Any website a user visits can read the session-id nonce that guards against CSRF, enabling cross-origin...

dns-rebind-toolkit

DNS Rebind Toolkit Demo | Security Advisory | Included Payloads | FAQ DISCLAIMER: This software is for educational purposes only. This software should not be used for illegal activity. The author is not responsible for its use. Don't be a dick. DNS Rebind Toolkit is a frontend JavaScript framewor...

toxssin

toxssin Purpose toxssin is an open-source penetration testing tool that automates the process of exploiting Cross-Site Scripting XSS vulnerabilities. It consists of an https server that works as an interpreter for the traffic generated by the malicious JavaScript payload that powers this tool...

theftfuzzer

┌┬┐┬ ┬┌─┐┌─┐┌┬┐┌─┐┬ ┬┌─┐┌─┐┌─┐┬─┐ │ ├─┤├┤ ├┤ │ ├┤ │ │┌─┘┌─┘├┤ ├┬┘ ┴ ┴ ┴└─┘└ ┴ └ └─┘└─┘└─┘└─┘┴└─ Introduction: TheftFuzzer is a tool that fuzzes Cross-Origin Resource Sharing implementations for common misconfigurations. Usage: python theftfuzzer.py -d 'http://example.com/api/data' Help: python...

resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins "", reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to...

CVE-2026-35113

HCL AION is affected by a vulnerability where the Cross-Origin-Opener-Policy COOP header was missing or insecure, allowing cross-origin documents to share a browsing context with the application. This may enable cross-window attacks, potentially resulting in unintended behavior or security impact...

CVE-2026-35111

HCL AION is affected by a vulnerability where the Cross-Origin-Resource-Policy CORP header was missing or insecure, allowing application resources to be loaded by other origins. This may expose resources to cross-origin data leakage, potentially resulting in unintended behavior or security impact...

CVE-2026-35112

HCL AION is affected by a vulnerability where the Cross-Origin-Embedder-Policy COEP header was missing or insecure, so embedded cross-origin resources were not required to explicitly grant permission. This weakens cross-origin isolation, potentially resulting in unintended behavior or security...

CVE-2026-35112 HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where the Cross-Origin-Embedder-Policy COEP header was missing or insecure, so embedded cross-origin resources were not required to explicitly grant permission. This weakens cross-origin isolation, potentially resulting in unintended behavior or security...

EUVD-2026-118235

HCL AION is affected by a vulnerability where the Cross-Origin-Embedder-Policy COEP header was missing or insecure, so embedded cross-origin resources were not required to explicitly grant permission. This weakens cross-origin isolation, potentially resulting in unintended behavior or security...

CVE-2026-35112

HCL AION is affected by a vulnerability involving a missing or insecure Cross-Origin-Embedder-Policy (COEP) header. This flaw prevents embedded cross-origin resources from being required to explicitly grant permission, which weakens cross-origin isolation and could lead to unintended behavior or ...

CVE-2026-35113 HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where the Cross-Origin-Opener-Policy COOP header was missing or insecure, allowing cross-origin documents to share a browsing context with the application. This may enable cross-window attacks, potentially resulting in unintended behavior or security impact...

EUVD-2026-118234

HCL AION is affected by a vulnerability where the Cross-Origin-Opener-Policy COOP header was missing or insecure, allowing cross-origin documents to share a browsing context with the application. This may enable cross-window attacks, potentially resulting in unintended behavior or security impact...

CVE-2026-35113

The software HCL AION is affected by a vulnerability involving a missing or insecure Cross-Origin-Opener-Policy (COOP) header. This configuration flaw allows cross-origin documents to share a browsing context with the application, which may facilitate cross-window attacks . Such attacks could lea...

EUVD-2026-118246

HCL AION is affected by a vulnerability where the Cross-Origin-Resource-Policy CORP header was missing or insecure, allowing application resources to be loaded by other origins. This may expose resources to cross-origin data leakage, potentially resulting in unintended behavior or security impact...

CVE-2026-35111

HCL AION is affected by a vulnerability where the Cross-Origin-Resource-Policy (CORP) header is either missing or insecure. This flaw allows application resources to be loaded by external origins, which may lead to cross-origin data leakage and unintended security impacts. While the technical det...

CVE-2026-35111 HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where the Cross-Origin-Resource-Policy CORP header was missing or insecure, allowing application resources to be loaded by other origins. This may expose resources to cross-origin data leakage, potentially resulting in unintended behavior or security impact...

CVE-2026-120415

undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, the redirect interceptor strips sensitive headers such as Authorization, Cookie, Proxy-Authorization, and Host when a request is redirected to a different origin, but when request headers are supplied...

CVE-2026-116630 undici vulnerable to cross-user information disclosure via cross-origin redirect revalidation

undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when an Agent composes the redirect and shared cache interceptors, a cached response that is revalidated with a conditional request can be validated by a 304 Not Modified from a different origin. When...