Lucene search
+L

12728 matches found

RedhatCVE
RedhatCVE
•added 2026/08/31 9:19 a.m.•10 views

CVE-2026-49853

A flaw was found in Tornado's SimpleAsyncHTTPClient. When following a redirect to a different origin, the client improperly retains and forwards sensitive authentication credentials, such as Authorization headers, to the new, potentially untrusted, destination. This vulnerability allows a remote...

7.7CVSS6AI score0.00452EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
•added 2026/08/31 12:00 a.m.•19 views

PT-2026-83973

A malicious webpage could stall a popup's cross-origin navigation after commit, causing the address bar to display the destination origin while continuing to render attacker-controlled content. This vulnerability was fixed in Firefox for iOS 155.0...

5.9AI score0.00257EPSS
SaveExploits0References3
Mozilla
Mozilla
•added 2026/08/31 12:00 a.m.•42 views

Security Vulnerabilities fixed in Firefox for iOS 155.0 — Mozilla

A malicious webpage could stall a popup's cross-origin navigation after commit, causing the address bar to display the destination origin while continuing to render attacker-controlled content...

5.4CVSS5.9AI score0.00257EPSS
SaveExploits0References1Affected Software1
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/08/31 12:00 a.m.•0 views

CVE-2026-81267: User Interface (UI) Misrepresentation of Critical Information

A malicious webpage could stall a popup's cross-origin navigation after commit, causing the address bar to display the destination origin while continuing to render attacker-controlled content. This vulnerability was fixed in Firefox for iOS 155.0...

5.4CVSS5.9AI score0.00257EPSS
SaveExploits0References3
UbuntuCve
UbuntuCve
•added 2026/08/29 5:17 p.m.•14 views

CVE-2026-82468

Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the JSON request content type validation. Attackers can craft cross-origin form posts with content types containing application/json substrings to bypass CSRF token validation and force victims to...

4.9CVSS5.8AI score0.00181EPSS
SaveExploits0References5
CVE
CVE
•added 2026/08/29 4:35 p.m.•29 views

CVE-2026-82468

Rodauth versions before 2.47.0 contain a cross-site request forgery (CSRF) protection bypass in the JSON request content type validation. An attacker can craft cross-origin form posts with content types containing application/json substrings to bypass CSRF token validation, forcing victims to aut...

4.9CVSS5.8AI score0.00181EPSS
SaveExploits0References4
OSV
OSV
•added 2026/08/29 4:35 p.m.•21 views

CVE-2026-82468 Rodauth before 2.47.0 CSRF Protection Bypass via Content-Type

Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the JSON request content type validation. Attackers can craft cross-origin form posts with content types containing application/json substrings to bypass CSRF token validation and force victims to...

4.9CVSS5.8AI score
SaveExploits0References6
NVD
NVD
•added 2026/08/28 8:20 p.m.•17 views

CVE-2026-82291

HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users to access workspaces, projects, forms,...

8.1CVSS0.00553EPSS
SaveExploits0References5
EUVD
EUVD
•added 2026/08/28 4:19 p.m.•15 views

EUVD-2026-67822

HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users to access workspaces, projects, forms,...

8.1CVSS5.9AI score0.00553EPSS
SaveExploits0References5
Vulnrichment
Vulnrichment
•added 2026/08/28 4:19 p.m.•10 views

CVE-2026-82291 HeyForm Reflects Any Origin in CORS Responses While Allowing Credentials

HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users to access workspaces, projects, forms,...

8.1CVSS5.9AI score0.00553EPSS
SaveExploits0References5
CVE
CVE
•added 2026/08/28 4:19 p.m.•17 views

CVE-2026-82291

HeyForm versions before 3.0.0-rc.8 reflect the request Origin header in CORS responses while simultaneously allowing credentials. This misconfiguration enables attackers to execute authenticated GraphQL queries from a malicious page visited by a logged-in user, granting access to workspaces, proj...

8.1CVSS5.9AI score0.00553EPSS
SaveExploits0References5
OSV
OSV
•added 2026/08/28 4:19 p.m.•11 views

CVE-2026-82291 HeyForm Reflects Any Origin in CORS Responses While Allowing Credentials

HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users to access workspaces, projects, forms,...

8.1CVSS5.9AI score
SaveExploits0References7
EUVD
EUVD
•added 2026/08/28 4:19 p.m.•18 views

EUVD-2026-67818

Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions by reflecting any request origin in Access-Control-Allow-Origin responses while credentials are enabled. Attackers can issue credentialed cross-origin requests from any website t...

8.6CVSS5.9AI score0.00513EPSS
SaveExploits0References5
CVE
CVE
•added 2026/08/28 4:19 p.m.•23 views

CVE-2026-82287

Rybbit before 2.7.0 contains a CORS misconfiguration in its server that reflects any request origin in the Access-Control-Allow-Origin response header while credentials remain enabled. This allows an attacker on any website to issue credentialed cross-origin requests against a victim's session, r...

8.6CVSS5.9AI score0.00513EPSS
SaveExploits0References5
Vulnrichment
Vulnrichment
•added 2026/08/28 4:19 p.m.•11 views

CVE-2026-82287 Rybbit Reflects Any Origin in CORS Responses While Allowing Credentials

Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions by reflecting any request origin in Access-Control-Allow-Origin responses while credentials are enabled. Attackers can issue credentialed cross-origin requests from any website t...

8.6CVSS5.9AI score0.00513EPSS
SaveExploits0References5
Cvelist
Cvelist
•added 2026/08/28 4:19 p.m.•39 views

CVE-2026-82287 Rybbit Reflects Any Origin in CORS Responses While Allowing Credentials

Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions by reflecting any request origin in Access-Control-Allow-Origin responses while credentials are enabled. Attackers can issue credentialed cross-origin requests from any website t...

8.6CVSS0.00513EPSS
SaveExploits0References5
OSV
OSV
•added 2026/08/28 4:19 p.m.•21 views

CVE-2026-82287 Rybbit Reflects Any Origin in CORS Responses While Allowing Credentials

Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions by reflecting any request origin in Access-Control-Allow-Origin responses while credentials are enabled. Attackers can issue credentialed cross-origin requests from any website t...

8.6CVSS5.9AI score
SaveExploits0References7
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/08/28 12:00 a.m.•1 views

CVE-2026-82291: Permissive Cross-domain Policy with Untrusted Domains

HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users to access workspaces, projects, forms,...

8.1CVSS5.9AI score0.00553EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/08/28 12:00 a.m.•22 views

PT-2026-83314

HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users to access workspaces, projects, forms,...

8.1CVSS5.9AI score0.00553EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
•added 2026/08/28 12:00 a.m.•18 views

PT-2026-83310

Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions by reflecting any request origin in Access-Control-Allow-Origin responses while credentials are enabled. Attackers can issue credentialed cross-origin requests from any website t...

8.6CVSS5.9AI score0.00513EPSS
SaveExploits0References6
Rows per page
Query Builder