13613 matches found
CVE-2026-49996: URL Redirection to Untrusted Site
SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. Prior to version 1.3.1, a malicious SecureDrop Server could bypass securedrop-proxy's origin limitation by responding with cross-origin redirects. SecureDr...
GHSA-RGR9-R7MJ-MF6X Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root
Summary A browser-based cross-origin request flaw in the Tina dev server allows an attacker-controlled website to cause arbitrary file creation inside the configured media upload directory on a developer machine running tinacms dev. No manual file upload is required. The attacker page builds the...
Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root
Summary A browser-based cross-origin request flaw in the Tina dev server allows an attacker-controlled website to cause arbitrary file creation inside the configured media upload directory on a developer machine running tinacms dev. No manual file upload is required. The attacker page builds the...
CVE-2026-63123 Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root
Tina is a headless content management system. Prior to 2.5.2, the TinaCMS CLI package's Vite dev server packages/@tinacms/cli/src/next/vite/cors.ts origin callback returns false for a disallowed origin but does not reject the request, and packages/@tinacms/cli/src/next/vite/plugins.ts still route...
CVE-2026-63123 Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root
Tina is a headless content management system. Prior to 2.5.2, the TinaCMS CLI package's Vite dev server packages/@tinacms/cli/src/next/vite/cors.ts origin callback returns false for a disallowed origin but does not reject the request, and packages/@tinacms/cli/src/next/vite/plugins.ts still route...
CVE-2026-63407
The Grav API Plugin (getgrav/grav-plugin-api) for Grav CMS had a CORS misconfiguration in its CorsMiddleware. Prior to version 1.0.0-rc.16 , the middleware returned Access-Control-Allow-Origin: * and permissive OPTIONS responses on authenticated /api/v1 endpoints. Because authentication uses the ...
CVE-2026-76033
A flaw was found in Google Chrome's handling of Cross-Origin Resource Sharing CORS. A remote attacker, who has already compromised the browser's renderer process, could exploit this vulnerability by using a specially crafted HTML page. This could allow the attacker to bypass site isolation, a...
curl: Domainless COOKIEFILE cookie leaks to unrelated IP-literal hosts
When curl loads a cookie file written as raw HTTP Set-Cookie: header lines and a line has no Domain attribute, the cookie is stored with co-domain == NULL, because a file import has no request-host to scope it to. On the send side, Curlcookiegetlist accepts any cookie in the bucket whose domain i...
PT-2026-80310
Summary A browser-based cross-origin request flaw in the Tina dev server allows an attacker-controlled website to cause arbitrary file creation inside the configured media upload directory on a developer machine running tinacms dev. No manual file upload is required. The attacker page builds the...
CVE-2026-71573
Joomla! Core - 20260802 - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper implementation prevented configured CORS origins from being properly validated in CORS requests...
CVE-2026-71573
Joomla! Core - 20260802 - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper implementation prevented configured CORS origins from being properly validated in CORS requests...
CVE-2026-71573 Joomla! Core - [20260802] - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2
Joomla! Core - 20260802 - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper implementation prevented configured CORS origins from being properly validated in CORS requests...
CVE-2026-74986
Site isolation issue in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...
UBUNTU-CVE-2026-74934
Site isolation issue in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...
CVE-2026-74970
Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...
UBUNTU-CVE-2026-74968
Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...
CVE-2026-74934
Site isolation issue in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...
CVE-2026-74986
A site isolation issue exists in the CSS Parsing and Computation component of Mozilla Firefox and Thunderbird . This vulnerability is fixed in the following versions: Firefox 154 , Firefox ESR 153.1 , Thunderbird 154 , and Thunderbird 153.1 . No specific exploit information or practical consequen...
CVE-2026-74986 Site isolation issue in the CSS Parsing and Computation component
Site isolation issue in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...
