651 matches found
CVE-2025-68930
🔍 Analysis of CVE-2025-68930: WebSocket Hijacking Vulnerability in Traccar The CVE-2025-68930 exposes a critical Cross-Site WebSocket Hijacking CSWSH vulnerability in Traccar , the open-source GPS tracking system. Below are the key details: 🛡️ Vulnerability Details Affected endpoint : /api/socket...
CVE-2026-22794-POC
CVE-2026-22794 - Appsmith Origin Header Injection 🔴 Critical Security Vulnerability Password Reset Link Hijacking via Origin Header Manipulation This repository contains a Proof of Concept PoC exploit for CVE-2026-22794, a critical vulnerability in Appsmith that allows attackers to hijack passwor...
CVE-2026-93453
CVE-2026-93453 — SOGo Password Reset Link Poisoning via Origin Header An exploit for a flaw where SOGo assembles the password-reset link it emails to users straight from the client-supplied Origin header. An anonymous attacker who knows a victim's login POSTs a recovery request with a controlled...
CVE-2023-47014-Sticky-Notes-App-Using-PHP-with-Source-Code-v1.0-CSRF-to-CORS
CVE-2023-47014-Sticky-Notes-App-Using-PHP-with-Source-Code-v1.0-CSRF-to-CORS Exploit Author: emirhanerdogu Vendor Homepage https://www.sourcecodester.com/php/16928/sticky-notes-app-using-php-source-code.html Software Link...
CVE-2026-112137
A vulnerability has been identified in Mendix Studio Pro 11 All versions = V11.15.0 = V11.12.6 V11.12.7. The affected products MCP Server does not properly validate Content-Type and Origin headers on incoming HTTP requests, leaving it vulnerable to Cross-Site Request Forgery CSRF. This could allo...
CVE-2026-112137
A vulnerability exists in Mendix Studio Pro 11 (versions >= V11.15.0 = V11.12.6
CVE-2026-112137
A vulnerability has been identified in Mendix Studio Pro 11 All versions = V11.15.0 = V11.12.6 V11.12.7. The affected products MCP Server does not properly validate Content-Type and Origin headers on incoming HTTP requests, leaving it vulnerable to Cross-Site Request Forgery CSRF. This could allo...
EUVD-2026-120891
A vulnerability has been identified in Mendix Studio Pro 11 All versions = V11.15.0 = V11.12.6 V11.12.7. The affected products MCP Server does not properly validate Content-Type and Origin headers on incoming HTTP requests, leaving it vulnerable to Cross-Site Request Forgery CSRF. This could allo...
CVE-2026-112137: Siemens: A vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix Studio Pro…
A vulnerability has been identified in Mendix Studio Pro 11 All versions = V11.15.0 = V11.12.6 V11.12.7. The affected products MCP Server does not properly validate Content-Type and Origin headers on incoming HTTP requests, leaving it vulnerable to Cross-Site Request Forgery CSRF. This could allo...
PT-2026-141591
A vulnerability has been identified in Mendix Studio Pro 11 All versions = V11.15.0 = V11.12.6 V11.12.7. The affected products MCP Server does not properly validate Content-Type and Origin headers on incoming HTTP requests, leaving it vulnerable to Cross-Site Request Forgery CSRF. This could allo...
CVE-2026-114456
Multiple Snowflake client drivers implementing the authenticator=externalbrowser single sign-on flow could have allowed an attacker to interfere with a user's login attempt through weaknesses in the local loopback callback listener used to receive the identity provider's response. The listener...
CLEANSTART-2024-WS80649 Remote Agent, used in WebDriver, did not validate the Host or Origin headers
Security vulnerability affects the librewolf package. Remote Agent, used in WebDriver, did not validate the Host or Origin headers...
CLEANSTART-2024-CV65399 Remote Agent, used in WebDriver, did not validate the Host or Origin headers
Security vulnerability affects the firefox package. Remote Agent, used in WebDriver, did not validate the Host or Origin headers...
Updated sogo package fixes a security vulnerability
SOGo before 5.12.11 Password Reset Token Interception via Origin Header. CVE-2026-93453...
MGASA-2026-0557 Updated sogo package fixes a security vulnerability
SOGo before 5.12.11 Password Reset Token Interception via Origin Header. CVE-2026-93453...
Linux Distros Unpatched Vulnerability : CVE-2026-112085
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - webpack-dev-server is a development server that provides live reloading for webpack projects. In versions before 5.2.7 and in version 6.0.0, when a proxy entry ...
UBUNTU-CVE-2026-112085
webpack-dev-server is a development server that provides live reloading for webpack projects. In versions before 5.2.7 and in version 6.0.0, when a proxy entry is configured to forward WebSockets, the server forwards non-HMR WebSocket upgrade requests to the proxy target without validating the Ho...
boneIO Black cross-site request forgery vulnerability
In boneIO Black versions 1.2.0 through 1.6.0, there is a cross-site request forgery vulnerability. This vulnerability arises because all API endpoints that modify state lack CSRF tokens and do not validate the Origin or Referer headers. As a result, remote attackers can craft malicious web pages...
Obsidian-tc HTTP Transport Lacks Origin/DNS-rebinding Protection, Enabling Drive-by Vault Access On Loopback
Impact The Streamable HTTP transport was constructed without "enableDnsRebindingProtection"/"allowedHosts"/"allowedOrigins" and performed no "Origin"-header validation. With the documented "auth.mode: "none"" loopback default, a drive-by web page could "POST http://127.0.0.1/mcp" and receive call...