langflow-cors-scanner

CVE-2025-34291 — التحقق من الأصل / CORS في Langflow نظرة عامة يسمح إعداد CORS المتساهل بشكل مفرط، جنبًا إلى جنب مع إعداد ملفات تعريف الارتباط الخاصة برمز التحديث، بسرقة بيانات الاعتماد...

CVE-2026-49455

Waku (a minimal React framework, npm package) prior to 1.0.0-beta.1 is vulnerable to cross-origin CSRF on its RSC server action dispatch. The root cause is the absence of any Origin or Sec-Fetch-Site validation in the RSC dispatch branch of request.ts, allowing a cross-origin attacker to invoke a...

CVE-2026-39363

CVE-2026-39363 — قراءة تعسفية للملفات عبر WebSocket في خادم تطوير Vite إخلاء مسؤولية: هذه الأداة مخصصة فقط لاختبارات الأمان المصرح بها والأبحاث التعليمية. يجب على المستخدمين الالتزام بالقوانين واللوائح المحلية، ويُعد فحص أو مهاجمة أنظمة الآخرين دون إذن عملاً غير قانوني. لا يتحمل المؤلف أي مسؤولية...

CVE-2026-25604-PoC

CVE-2026-25604 PoC Injection d'en-tête Host menant à un contournement de l'authentification SAML dans AWS Auth Manager d'Apache Airflow Un attaquant peut injecter un en-tête Host malveillant dans le flux de connexion SAML, ce qui entraîne le pointage de l'URL du service de consommation d'assertio...

CVE-2026-82811

A security vulnerability has been detected in Toggl OÜ Toggl Track Extension 4.11.16. This affects an unknown function of the component postMessage Handler. The manipulation leads to origin validation error. It is possible to initiate the attack remotely. The exploit has been disclosed publicly a...

CVE-2026-82811

CVE-2026-82811 affects the Toggl Track Chrome extension (version 4.11.16 ). The vulnerability resides in the extension's postMessage Handler , which fails to properly validate message origins, allowing an attacker to accept forged session-state messages through an unauthenticated handler. The att...

EUVD-2026-68679

A security vulnerability has been detected in Toggl OÜ Toggl Track Extension 4.11.16. This affects an unknown function of the component postMessage Handler. The manipulation leads to origin validation error. It is possible to initiate the attack remotely. The exploit has been disclosed publicly a...

CVE-2026-82811 Toggl OÜ Toggl Track Extension postMessage origin validation

A security vulnerability has been detected in Toggl OÜ Toggl Track Extension 4.11.16. This affects an unknown function of the component postMessage Handler. The manipulation leads to origin validation error. It is possible to initiate the attack remotely. The exploit has been disclosed publicly a...

CVE-2026-81315

Origin Validation Error vulnerability in ash-project ashai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor. In AshAi.Mcp.Server, with the default allowedorigins: nil, originallowed?/3...

EUVD-2026-68304

Origin Validation Error vulnerability in ash-project ashai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor. In AshAi.Mcp.Server, with the default allowedorigins: nil, originallowed?/3...

CVE-2026-81315 MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header

Origin Validation Error vulnerability in ash-project ashai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor. In AshAi.Mcp.Server, with the default allowedorigins: nil, originallowed?/3...

CVE-2026-81315 MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header

Origin Validation Error vulnerability in ash-project ashai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor. In AshAi.Mcp.Server, with the default allowedorigins: nil, originallowed?/3...

CVE-2026-81315

CVE-2026-81315 is an origin validation error in ash-project ash_ai (affecting AshAi.Mcp.Server), allowing a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server using that user's actor. The root cause lies in origin_allo...

CVE-2025-43929

CVE-2025-43929 Prova di concetto per CVE-2025-43929, una vulnerabilità ad alta severità in KiTTY che permette l'esecuzione di eseguibili locali senza conferma dell'utente in determinate circostanze Tipo di vulnerabilità CWE-346: CWE-346 Origin Validation Error Descrizione della vulnerabilità...

CVE-2026-70309

Origin validation error in Microsoft Edge Chromium-based allows an unauthorized attacker to bypass a security feature over a network...

EUVD-2026-67853

Origin validation error in Microsoft Edge Chromium-based allows an unauthorized attacker to bypass a security feature over a network...

Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability

Origin validation error in Microsoft Edge Chromium-based allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-55532

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, MCP HTTP Stream validateorigin uses requestorigin.startswithallowed, allowing the attacker-controlled localhost.attacker.com HTTP origin to satisfy the localhost allowlist. A webpage can send Content-Type: text/plain requests...

CVE-2026-73423

A flaw was found in Astro. The composable astro/hono pipeline can bypass origin checks, which are designed to prevent unauthorized cross-site requests. This occurs because the security.checkOrigin mechanism is not consistently applied when middleware is absent or misordered in the pipeline. A...

PraisonAI has a Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)

Summary praisonai/browser/server.py validates incoming WebSocket connections using a Chrome extension Origin check. The regex chrome-extension://a-z0-932 is applied with re.match, which only anchors at the start of the string, not the end. Any Origin header with more than 32 alphanumeric characte...