Lucene search
+L

12720 matches found

OSV
OSV
•added 2026/08/29 4:35 p.m.•21 views

CVE-2026-82468 Rodauth before 2.47.0 CSRF Protection Bypass via Content-Type

Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the JSON request content type validation. Attackers can craft cross-origin form posts with content types containing application/json substrings to bypass CSRF token validation and force victims to...

4.9CVSS5.8AI score
SaveExploits0References6
NVD
NVD
•added 2026/08/28 8:20 p.m.•17 views

CVE-2026-82291

HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users to access workspaces, projects, forms,...

8.1CVSS0.00553EPSS
SaveExploits0References5
EUVD
EUVD
•added 2026/08/28 4:19 p.m.•14 views

EUVD-2026-67822

HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users to access workspaces, projects, forms,...

8.1CVSS5.9AI score0.00553EPSS
SaveExploits0References5
Vulnrichment
Vulnrichment
•added 2026/08/28 4:19 p.m.•10 views

CVE-2026-82291 HeyForm Reflects Any Origin in CORS Responses While Allowing Credentials

HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users to access workspaces, projects, forms,...

8.1CVSS5.9AI score0.00553EPSS
SaveExploits0References5
CVE
CVE
•added 2026/08/28 4:19 p.m.•17 views

CVE-2026-82291

HeyForm versions before 3.0.0-rc.8 reflect the request Origin header in CORS responses while simultaneously allowing credentials. This misconfiguration enables attackers to execute authenticated GraphQL queries from a malicious page visited by a logged-in user, granting access to workspaces, proj...

8.1CVSS5.9AI score0.00553EPSS
SaveExploits0References5
OSV
OSV
•added 2026/08/28 4:19 p.m.•11 views

CVE-2026-82291 HeyForm Reflects Any Origin in CORS Responses While Allowing Credentials

HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users to access workspaces, projects, forms,...

8.1CVSS5.9AI score
SaveExploits0References7
EUVD
EUVD
•added 2026/08/28 4:19 p.m.•18 views

EUVD-2026-67818

Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions by reflecting any request origin in Access-Control-Allow-Origin responses while credentials are enabled. Attackers can issue credentialed cross-origin requests from any website t...

8.6CVSS5.9AI score0.00513EPSS
SaveExploits0References5
CVE
CVE
•added 2026/08/28 4:19 p.m.•23 views

CVE-2026-82287

Rybbit before 2.7.0 contains a CORS misconfiguration in its server that reflects any request origin in the Access-Control-Allow-Origin response header while credentials remain enabled. This allows an attacker on any website to issue credentialed cross-origin requests against a victim's session, r...

8.6CVSS5.9AI score0.00513EPSS
SaveExploits0References5
Vulnrichment
Vulnrichment
•added 2026/08/28 4:19 p.m.•11 views

CVE-2026-82287 Rybbit Reflects Any Origin in CORS Responses While Allowing Credentials

Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions by reflecting any request origin in Access-Control-Allow-Origin responses while credentials are enabled. Attackers can issue credentialed cross-origin requests from any website t...

8.6CVSS5.9AI score0.00513EPSS
SaveExploits0References5
Cvelist
Cvelist
•added 2026/08/28 4:19 p.m.•39 views

CVE-2026-82287 Rybbit Reflects Any Origin in CORS Responses While Allowing Credentials

Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions by reflecting any request origin in Access-Control-Allow-Origin responses while credentials are enabled. Attackers can issue credentialed cross-origin requests from any website t...

8.6CVSS0.00513EPSS
SaveExploits0References5
OSV
OSV
•added 2026/08/28 4:19 p.m.•21 views

CVE-2026-82287 Rybbit Reflects Any Origin in CORS Responses While Allowing Credentials

Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions by reflecting any request origin in Access-Control-Allow-Origin responses while credentials are enabled. Attackers can issue credentialed cross-origin requests from any website t...

8.6CVSS5.9AI score
SaveExploits0References7
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/08/28 12:00 a.m.•1 views

CVE-2026-82291: Permissive Cross-domain Policy with Untrusted Domains

HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users to access workspaces, projects, forms,...

8.1CVSS5.9AI score0.00553EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/08/28 12:00 a.m.•22 views

PT-2026-83314

HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users to access workspaces, projects, forms,...

8.1CVSS5.9AI score0.00553EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
•added 2026/08/28 12:00 a.m.•18 views

PT-2026-83310

Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions by reflecting any request origin in Access-Control-Allow-Origin responses while credentials are enabled. Attackers can issue credentialed cross-origin requests from any website t...

8.6CVSS5.9AI score0.00513EPSS
SaveExploits0References6
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/08/28 12:00 a.m.•1 views

CVE-2026-82287: Permissive Cross-domain Policy with Untrusted Domains

Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions by reflecting any request origin in Access-Control-Allow-Origin responses while credentials are enabled. Attackers can issue credentialed cross-origin requests from any website t...

8.6CVSS5.8AI score0.00513EPSS
SaveExploits0References2
IBM Security Bulletins
IBM Security Bulletins
•added 2026/08/27 7:43 p.m.•6 views

Security Bulletin:IBM SPSS Analytic Server is affected by an Eclipse Vert.x vulnerability that could expose credentials through cross-origin HTTP redirects

Summary IBM SPSS Analytic Server is affected by an Eclipse Vert.x vulnerability that could expose credentials through cross-origin HTTP redirects. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-15075 DESCRIPTION: In Eclipse Vert.x versions up to and...

8.2CVSS5.6AI score0.00197EPSS
SaveExploits0Affected Software1
EUVD
EUVD
•added 2026/08/27 5:57 p.m.•12 views

EUVD-2026-67177

The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the victim's browser might leak confidential information to the attacker's website. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0...

5.3AI score0.00374EPSS
SaveExploits0References1
NVD
NVD
•added 2026/08/27 5:20 p.m.•19 views

CVE-2026-80210

FrontAccounting through 2.4.20 generates a CSRF token in endform in includes/ui/uicontrols.inc and embeds it as the token hidden field in every form it renders, but only admin/users.php and admin/changecurrentuserpassword.php call checkcsrftoken to validate it. No financial transaction handler...

7.1CVSS0.00219EPSS
SaveExploits0References4
UbuntuCve
UbuntuCve
•added 2026/08/27 5:20 p.m.•16 views

CVE-2026-80210

FrontAccounting through 2.4.20 generates a CSRF token in endform in includes/ui/uicontrols.inc and embeds it as the token hidden field in every form it renders, but only admin/users.php and admin/changecurrentuserpassword.php call checkcsrftoken to validate it. No financial transaction handler...

7.1CVSS6AI score0.00219EPSS
SaveExploits0References5
EUVD
EUVD
•added 2026/08/27 2:50 p.m.•13 views

EUVD-2026-67027

tiger-slack started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. mcp/src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, and a page i...

7.6CVSS5.2AI score0.00216EPSS
SaveExploits0References3
Rows per page
Query Builder