125 matches found
live-server-evil-crawler
Live Server Evil Crawler A GitHub Pages site for demonstrating the Live Server VSCode extension vulnerability CVE-2025-65717. Overview This tool demonstrates a vulnerability where Live Server allows requests from any origin, enabling malicious web pages to access the Live Server running on...
CVE-2026-34200
Nhost MCP Server: One-Click Infrastructure Compromise Official Advisory: This vulnerability was acknowledged and published by Nhost: GHSA-6c5x-3h35-vvw2 This repository documents a vulnerability in the Nhost Local MCP Server. The service lacks inbound authentication and implements a permissive CO...
CVE-2026-110737
The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because Flow configures Atmosphere with DROPACCESSCONTROLALLOWORIGINHEADER set to false and its CorsInterceptor then echoes...
EUVD-2026-110721
The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because Flow configures Atmosphere with DROPACCESSCONTROLALLOWORIGINHEADER set to false and its CorsInterceptor then echoes...
CVE-2026-110737
The push endpoint in Vaadin applications using server push is vulnerable to a cross-origin request forgery (CSRF) style attack. Because Flow configures Atmosphere with DROP_ACCESS_CONTROL_ALLOW_ORIGIN_HEADER set to false, the CorsInterceptor echoes the request's Origin into the Access-Control-All...
CVE-2026-110737 Push Endpoint Returns Permissive CORS Headers
The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because Flow configures Atmosphere with DROPACCESSCONTROLALLOWORIGINHEADER set to false and its CorsInterceptor then echoes...
CVE-2026-110737
The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because Flow configures Atmosphere with DROPACCESSCONTROLALLOWORIGINHEADER set to false and its CorsInterceptor then echoes...
CVE-2026-110737 Push Endpoint Returns Permissive CORS Headers
The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because Flow configures Atmosphere with DROPACCESSCONTROLALLOWORIGINHEADER set to false and its CorsInterceptor then echoes...
Push endpoint returns permissive CORS headers
The push endpoint of a Vaadin application using server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, so a malicious site can make a cross origin request to it on behalf of a signed in user and read the response. This vulnerability ha...
PT-2026-126330
The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because Flow configures Atmosphere with DROP ACCESS CONTROL ALLOW ORIGIN HEADER set to false and its CorsInterceptor then echoes...
Cross-site Request Forgery (CSRF)
Overview locust is a Developer friendly load testing framework Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the /stop and /stats/reset endpoints, which accepted GET requests, allowing an attacker to trick an authenticated user into visiting a malicious...
resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config
A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins "", reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to...
CVE-2026-107618
POST /owner/repo/topics was registered without the sign-in middleware that provides the cross-origin protection, so a request issued by a third-party site was not rejected. A repository administrator who visited a malicious page could have the topics of their repository changed. No other reposito...
CVE-2026-55183
RClone Manager is a cross-platform GUI application designed to help users manage Rclone remotes efficiently. Prior to 0.2.7, RClone Manager starts the local rclone rcd service on 127.0.0.1:51900 with --rc-no-auth, --rc-allow-origin , and --rc-serve. A malicious web page opened by a user while the...
CVE-2026-107295 `pydantic-ai-slim` web UI `/api/chat` accepts browser-simple cross-origin requests that can trigger agent tool execution
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 1.107.4 and 2.28.0, the Agent.toweb and clai web development chat endpoint has missing request content-type validation. A website visited by a developer can submit a...
CVE-2026-85289
The open-source application InvoicePlane (prior to version 1.7.2) is vulnerable to Cross-Site Request Forgery (CSRF) due to missing CSRF token validation on specific delete methods. Specifically, the Payments::delete(), Recurring::delete(), and User_clients::delete() functions omit the ensure_val...
CVE-2026-89058
A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins "", reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to...
PT-2026-95296
Name of the Vulnerable Software and Affected Versions RESTEasy affected versions not specified Description A flaw exists in the CorsFilter component. When configured to allow all origins using the "" wildcard, the filter reflects the request's Origin header in the Access-Control-Allow-Origin...
CVE-2026-92582
AVideo WWBN/AVideo through 29.0 commit e01e41ecc is vulnerable to cross-site request forgery. objects/videoAddNew.json.php disables AVideo's automatic CSRF guard $global'skipAutoCSRFCheck' and the untrusted-request check $global'bypassSameDomainCheck' merely because 'user' and 'pass' parameters a...