13702 matches found
CVE-2026-56746
Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, are vulnerable to security control bypass during the origin evaluation process. CorsHandler provides a shortCircuit...
CVE-2026-56746 Netty has a Security Control Bypass via CORS Short-Circuit Failure
Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, are vulnerable to security control bypass during the origin evaluation process. CorsHandler provides a shortCircuit...
CVE-2026-56746 Netty has a Security Control Bypass via CORS Short-Circuit Failure
Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, are vulnerable to security control bypass during the origin evaluation process. CorsHandler provides a shortCircuit...
EUVD-2026-46409
djangoSIGE through 1.10 commit a6fe7e8 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to cancel sales or purchase orders on behalf of authenticated users by exploiting order-cancellation logic implemented inside HTTP GET method handlers in...
CVE-2026-64821
The issue CVE-2026-64821 affects djangoSIGE up to version 1.10. The vulnerability arises in order-cancellation logic (CancelarOrcamentoVendaView, CancelarPedidoVendaView, CancelarOrcamentoCompraView, CancelarPedidoCompraView) implemented in HTTP GET handlers, allowing unauthenticated attackers to...
CVE-2026-47671 Nhost CLI local configserver allows cross-origin unauthenticated read/write access to local development configuration and secrets
Nhost is an open source Firebase alternative with GraphQL. In versions of Nhost CLI prior to 1.46.0, the hidden nhost configserver used by nhost dev exposes the Mimir GraphQL API with dummy authorization directives and permissive CORS. When a developer is running the local development environment...
CVE-2026-47671 Nhost CLI local configserver allows cross-origin unauthenticated read/write access to local development configuration and secrets
Nhost is an open source Firebase alternative with GraphQL. In versions of Nhost CLI prior to 1.46.0, the hidden nhost configserver used by nhost dev exposes the Mimir GraphQL API with dummy authorization directives and permissive CORS. When a developer is running the local development environment...
CVE-2026-47671 Nhost CLI local configserver allows cross-origin unauthenticated read/write access to local development configuration and secrets
Nhost is an open source Firebase alternative with GraphQL. In versions of Nhost CLI prior to 1.46.0, the hidden nhost configserver used by nhost dev exposes the Mimir GraphQL API with dummy authorization directives and permissive CORS. When a developer is running the local development environment...
PT-2026-62100
djangoSIGE through 1.10 commit a6fe7e8 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to cancel sales or purchase orders on behalf of authenticated users by exploiting order-cancellation logic implemented inside HTTP GET method handlers in...
EulerOS Virtualization 2.12.1 (EulerOS-SA-2026-2755)
According to the versions of the package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via...
ROS-20260721-73-0025
The vulnerability of the CORS Cross-Origin Resource Sharing mechanism in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to bypass existing security measures through a specially created HTML page...
ROS-20260721-73-0003
The vulnerability of the Cross-Origin-Opener-Policy COOP function in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to bypass existing security measures...
PT-2026-63246
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.182 Description An uninitialized use in Skia allows a remote attacker who has compromised the renderer process to leak cross-origin data through a crafted HTML page. Recommendations Update Google Chro...
CVE-2026-16417: Use of Uninitialized Variable
Uninitialized Use in Skia in Google Chrome prior to 150.0.7871.182 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: High...
EulerOS Virtualization 2.12.0 : python-urllib3 (EulerOS-SA-2026-2801)
According to the versions of the python-urllib3 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level...
Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered
Summary In the composable astro/hono pipeline, the security.checkOrigin protection is only installed by the middleware primitive. The actions and pages primitives each dispatch to user code independently, so a pipeline that mounts either primitive before or without middleware will bypass the orig...
EUVD-2026-41558
webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints...
GHSA-6X6H-QQR7-855W LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests
Summary The server defaults to CORSORIGINS= combined with allowcredentials=True. Starlette's CORSMiddleware echoes the requesting origin in preflight responses when credentials are enabled, meaning every origin is effectively whitelisted for credentialed cross-origin requests. Any malicious websi...
LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests
Summary The server defaults to CORSORIGINS= combined with allowcredentials=True. Starlette's CORSMiddleware echoes the requesting origin in preflight responses when credentials are enabled, meaning every origin is effectively whitelisted for credentialed cross-origin requests. Any malicious websi...