live-server-evil-crawler

Live Server Evil Crawler Live Server VSCode 拡張機能の脆弱性 CVE-2025-65717 を実証するための GitHub Pages サイトです。 概要 このツールは、Live Server が任意のオリジンからのリクエストを許可し、悪意のある Web ページが localhost で実行中の Live Server にアクセスしてファイルシステムの内容を読み取ることができる脆弱性を実証します。 機能 ポートスキャナー : 実行中の Live Server インスタンスを検出するためにポート範囲をスキャンします クローラー :...

CVE-2026-85289

The open-source application InvoicePlane (prior to version 1.7.2) is vulnerable to Cross-Site Request Forgery (CSRF) due to missing CSRF token validation on specific delete methods. Specifically, the Payments::delete(), Recurring::delete(), and User_clients::delete() functions omit the ensure_val...

CVE-2026-34200

Nhost MCP 服务器：一键基础设施沦陷 官方公告：此漏洞已由 Nhost 确认并发布：GHSA-6c5x-3h35-vvw2 本仓库记录了 Nhost 本地 MCP 服务器中的一个漏洞。该服务缺乏入站身份验证，并实施了宽松的 CORS 策略，从而允许未经身份验证的跨源请求执行。 当 nhost mcp 处于活动状态时，仅需访问一次攻击者控制的源即可实现对整个项目的接管。成功执行后，攻击者将获得未经授权的访问权限，可进行以下操作： 窃取生产数据库内容 通过原始 SQL 迁移删除表 重写 Hasura 权限 劫持你的云 PAT 和管理员密钥 有关完整的技术分析、根本原因分析、PoC...

CVE-2026-92582

AVideo WWBN/AVideo through 29.0 commit e01e41ecc is vulnerable to cross-site request forgery. objects/videoAddNew.json.php disables AVideo's automatic CSRF guard $global'skipAutoCSRFCheck' and the untrusted-request check $global'bypassSameDomainCheck' merely because 'user' and 'pass' parameters a...

EUVD-2026-73930

n8n: Instance AI Credential Setup Accepts Unvalidated Probe URL from Fetched Content...

CVE-2026-88061

career-ops is an open-source AI-assisted job search and application management tool. Prior to 0.8.0, the career-ops local web dashboard web/ exposed command-spawning and user-file-writing /api routes without validating request origin or restricting clients to loopback addresses. A malicious page ...

CVE-2026-88061 career-ops: Local dashboard API accepted cross-origin and non-loopback requests, allowing unauthenticated command execution

career-ops is an open-source AI-assisted job search and application management tool. Prior to 0.8.0, the career-ops local web dashboard web/ exposed command-spawning and user-file-writing /api routes without validating request origin or restricting clients to loopback addresses. A malicious page ...

EUVD-2026-75704

career-ops is an open-source AI-assisted job search and application management tool. Prior to 0.8.0, the career-ops local web dashboard web/ exposed command-spawning and user-file-writing /api routes without validating request origin or restricting clients to loopback addresses. A malicious page ...

CVE-2026-88061

career-ops (an open-source AI-assisted job search tool) prior to 0.8.0 exposed its local web dashboard (web/) /api routes for command-spawning and user-file-writing without validating request origin or restricting clients to loopback addresses. A malicious page in another browser tab could issue ...

PT-2026-89574

Name of the Vulnerable Software and Affected Versions career-ops versions prior to 0.8.0 Description The local web dashboard web/ exposes /api routes that allow command spawning and user-file writing without validating the request origin or restricting clients to loopback addresses. This allows...

PT-2026-88152

Impact Instance AI credential setup accepted a credential test/verification URL without checking it matched the workflow node's origin. Exfiltration required the user to actively inject an attacker-controlled URL into the setup flow. The patch derives the credential destination from the node's ow...

CVE-2026-85613 OpenPanel Unauthenticated XSS via SVG Favicon Proxy

OpenPanel before 2.3.0 contains a cross-site scripting vulnerability in the unauthenticated favicon proxy endpoint GET /misc/favicon that allows remote attackers to execute scripts by supplying an SVG file URL. Attackers can host malicious SVG files with embedded scripts that execute in the...

PT-2026-85509

OpenPanel before 2.3.0 contains a cross-site scripting vulnerability in the unauthenticated favicon proxy endpoint GET /misc/favicon that allows remote attackers to execute scripts by supplying an SVG file URL. Attackers can host malicious SVG files with embedded scripts that execute in the...

CVE-2026-49455 Waku: Cross-Origin CSRF on RSC Server Action Dispatch

Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku's RSC request dispatcher invokes server actions without validating the request's Origin or Sec-Fetch-Site header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated POST to a registere...

PT-2026-84865

Name of the Vulnerable Software and Affected Versions Windows ML CLI versions prior to 0.4.0 Description The src/winml/modelkit/serve/cli api.py component exposes commands through a localhost HTTP API without authentication and uses a wildcard for the allow origins setting. This allows a maliciou...

CVE-2026-55696

PrivateBin versions prior to 2.0.5 contain a stored XSS vulnerability in the attachment download link. The root cause is that DOMPurify sanitization in AttachmentViewer.setAttachment only applies to image/*svg MIME types, and the resulting sanitized blob is assigned to a local variable used for t...

CVE-2026-82291 HeyForm Reflects Any Origin in CORS Responses While Allowing Credentials

HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users to access workspaces, projects, forms,...

CVE-2026-82291

HeyForm versions before 3.0.0-rc.8 reflect the request Origin header in CORS responses while simultaneously allowing credentials. This misconfiguration enables attackers to execute authenticated GraphQL queries from a malicious page visited by a logged-in user, granting access to workspaces, proj...

CVE-2026-82287 Rybbit Reflects Any Origin in CORS Responses While Allowing Credentials

Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions by reflecting any request origin in Access-Control-Allow-Origin responses while credentials are enabled. Attackers can issue credentialed cross-origin requests from any website t...

CVE-2026-82291: Permissive Cross-domain Policy with Untrusted Domains

HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users to access workspaces, projects, forms,...