Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted

Summary Vikunja ships with cors.origins defaulting to http://127.0.0.1: and http://localhost:, and sends Access-Control-Allow-Credentials: true, so a page served from any port on the user's own machine may make credentialed cross-origin requests to the API and read the responses. The mandatory...

GHSA-M687-P538-R5HP Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted

Summary Vikunja ships with cors.origins defaulting to http://127.0.0.1: and http://localhost:, and sends Access-Control-Allow-Credentials: true, so a page served from any port on the user's own machine may make credentialed cross-origin requests to the API and read the responses. The mandatory...

CVE-2026-107295

A flaw was found in pydantic-ai-slim. The local development chat interface does not properly validate request content types, allowing a malicious website visited by a developer to send cross-origin requests to the locally hosted server. A remote attacker can exploit this vulnerability to trigger...

GHSA-C6RP-P8XM-4Q9F Mechanize sends credential headers to another origin after a meta refresh

Summary mechanize applied no trust boundary to a meta refresh, so credentials set through Mechanizerequestheaders= followed a refresh that pointed at another origin. Details Mechanize::HTTP::Agentresponsefollowmetarefresh fetched the refresh target with no notion of a crossed origin, so...

EUVD-2026-43176

PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosure...

CVE-2026-107295 `pydantic-ai-slim` web UI `/api/chat` accepts browser-simple cross-origin requests that can trigger agent tool execution

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 1.107.4 and 2.28.0, the Agent.toweb and clai web development chat endpoint has missing request content-type validation. A website visited by a developer can submit a...

CVE-2026-107295 `pydantic-ai-slim` web UI `/api/chat` accepts browser-simple cross-origin requests that can trigger agent tool execution

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 1.107.4 and 2.28.0, the Agent.toweb and clai web development chat endpoint has missing request content-type validation. A website visited by a developer can submit a...

CVE-2026-107295 `pydantic-ai-slim` web UI `/api/chat` accepts browser-simple cross-origin requests that can trigger agent tool execution

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 1.107.4 and 2.28.0, the Agent.toweb and clai web development chat endpoint has missing request content-type validation. A website visited by a developer can submit a...

GHSA-JMQQ-X5G9-9P2W AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host

Impact When a request is replayed onto a different host, the client updates only the current request and leaves the target request pointing at the original host. Four consumers read that stale value, and each one sends the first host's request, credentials, or both to the second host. A replay...

EulerOS 2.0 SP15 : perl-HTTP-Tiny (EulerOS-SA-2026-3938)

According to the versions of the perl-HTTP-Tiny packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.x000D x000D When the server returns ...

EulerOS 2.0 SP15 : perl-HTTP-Tiny (EulerOS-SA-2026-4004)

According to the versions of the perl-HTTP-Tiny packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.x000D x000D When the server returns ...

EUVD-2026-92802

Docling: Configured HTTP headers sent to every remote image host named by a document...

Security Bulletin:urllib3: Cross-Origin Redirects Vulnerability in 1.23 to 2.7.0 Fixed in 2.7.0

Summary urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connectionfromurl.urlopen..., assertsamehost=False still forward these sensitive headers. This vulnerability is fixed in 2.7.0. Vulnerability...

CVE-2025-70522

The request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce any cross-origin resource protection for any state-changing request performed against the applications. Due to the lack of protection, cross-origin boundary can be completely bypassed, allowing for Cross-Site Request...

Linux Distros Unpatched Vulnerability : CVE-2026-106354

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper resource exposure in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-106325

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect reference resolution in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak cross-origin data...

Linux Distros Unpatched Vulnerability : CVE-2026-106184

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uninitialized resource in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium...

Linux Distros Unpatched Vulnerability : CVE-2026-106360

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information leak in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium...

Linux Distros Unpatched Vulnerability : CVE-2026-106180

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Observable discrepancy in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially obtain cross-origin data via a crafted HTML...

Linux Distros Unpatched Vulnerability : CVE-2026-106253

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted Chrome...