CVE-2026-88648

Incomplete X.509 implementation in GnuTLS v3.8.13 allows attackers controlling a subordinate Certificate Authority to bypass cross-domain PKI restrictions and issue unauthorized certificates...

CVE-2026-104048

A flaw in SSSD allows for an authorization bypass within trust-enabled identity management environments. The root cause is that SSSD evaluates Host-Based Access Control (HBAC) rules by stripping domain qualifiers and comparing only short usernames. Consequently, an authenticated user from a trust...

CVE-2026-104048 Sssd: sssd: authorization bypass via cross-domain username collision in hbac evaluation

A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control HBAC rules by stripping domain qualifiers and comparing only short usernames. An authenticated user in a trusted domain who shares the same username as an authorized local account...

CVE-2025-51471-POC

CVE-2025-51471 - Exposición de Token entre Dominios de Ollama - PoC Autor: ajtazer 🔥 Resumen Este repositorio contiene una Prueba de Concepto PoC para CVE-2025-51471 , una vulnerabilidad de Exposición de Token de Autenticación entre Dominios que afecta a todas las versiones de Ollama incluyendo l...

CLEANSTART-2026-HM31104 HTTP client drops sensitive headers after following a cross-domain redirect

Security vulnerability affects the cri-tools package. The HTTP client drops sensitive headers after following a cross-domain redirect...

Rocky Linux 8 [CIQ] Security Update: delve / delve-debuginfo / delve-debugsource / go-toolset / golang / etc Multiple Vulnerabilities (crlsa-2025_3772)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20253772 advisory. golang: crypto/x509: crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints CVE-2024-45341 golang: net/http: net/http: sensitive headers...

golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect

A flaw was found in the net/http package of the Golang standard library. The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header redirected to b.com/ will not send that header to b.com. However, the...

golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect

A flaw was found in the net/http package of the Golang standard library. The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header redirected to b.com/ will not send that header to b.com. However, the...

CVE-2026-97508

A flaw was found in the Linux kernel's Thunderbolt subsystem. When a Thunderbolt domain is stopped, the driver fails to properly clear the root switch reference while handling active cross-domain requests. A connected host sending communication requests during domain shutdown can trigger an inval...

CVE-2026-18825

An Origin Validation Error in the middleware of the connect-xcors npm package allows an attacker to bypass origin verification and perform a cross domain authenticated request...

CVE-2026-18825 Origin validation error in the connect-xcors npm package

An Origin Validation Error in the middleware of the connect-xcors npm package allows an attacker to bypass origin verification and perform a cross domain authenticated request...

CVE-2026-18825

The connect-xcors npm package contains an Origin Validation Error within its middleware. This flaw allows an attacker to bypass origin verification , potentially enabling the execution of cross-domain authenticated requests . The vulnerability has a CVSS 4.0 base score of 5.3 (MEDIUM) . No specif...

EUVD-2026-88239

An Origin Validation Error in the middleware of the connect-xcors npm package allows an attacker to bypass origin verification and perform a cross domain authenticated request...

CVE-2026-18825 Origin validation error in the connect-xcors npm package

An Origin Validation Error in the middleware of the connect-xcors npm package allows an attacker to bypass origin verification and perform a cross domain authenticated request...

CVE-2026-18825: Origin Validation Error

An Origin Validation Error in the middleware of the connect-xcors npm package allows an attacker to bypass origin verification and perform a cross domain authenticated request...

PT-2026-99874

Name of the Vulnerable Software and Affected Versions connect-xcors npm package affected versions not specified Description An origin validation error in the middleware allows an attacker to bypass origin verification. This flaw enables the execution of cross-domain authenticated requests, which...

XPhysICS: Cross-Physical-Domain Threat Grounding for Industrial Control Systems Security

Industrial control system ICS threats documented for one plant can express cyber-physical effects relevant to another, but semantic similarity alone does not establish whether those effects are structurally admissible or evaluable on a target. We present XPhysICS, a provenance-aware,...

CVE-2026-66070: Permissive Cross-domain Policy with Untrusted Domains

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, matchorigin/1 returned the bare reflected Origin and allowed credentials even when the wildcard "" was configured, so the response echoed the attacker's origin together with...

CVE-2026-90882: Permissive Cross-domain Policy with Untrusted Domains

The open-vsx.org deployment returned Access-Control-Allow-Origin reflecting the requesting origin together with Access-Control-Allow-Credentials: true on the authenticated /user/ endpoints. A page on any origin could therefore issue credentialed requests to the service in a logged-in user's brows...

Security Bulletin: IBM Optim 1.0.0, 1.1.0 and 1.2.0 impacted by an information disclosure vulnerability in follow-redirects

Summary follow-redirects is used by IBM Optim as part of its front-end user interface Optim UI to handle HTTP and HTTPS redirect chains in the browser. CVE-2026-40895 is an information disclosure vulnerability in follow-redirects prior to version 1.16.0, where custom authentication headers e.g.,...