2218 matches found
CVE-2025-43929
CVE-2025-43929 Proof-of-concept for CVE-2025-43929, a high-severity vulnerability in KiTTY allowing for local executables to be ran without user confirmation under certain circumstances Vulnerability Type CWE-346: CWE-346 Origin Validation Error Vulnerability Description openactions.py in kitty...
CVE-2026-109461
Origin validation error in Microsoft Authentication Library MSAL for Node.js allows an unauthorized attacker to disclose information over a network...
EUVD-2026-102952
Origin validation error in Microsoft Authentication Library MSAL for Node.js allows an unauthorized attacker to disclose information over a network...
CVE-2026-109461
An origin validation error exists in the Microsoft Authentication Library (MSAL) for Node.js . This vulnerability allows an unauthorized attacker to perform information disclosure over a network. The CVSS 3.1 base score is 5.9 (Medium), with a high impact on confidentiality and high attack comple...
China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers
The China-nexus cyber espionage group tracked as Armory Castle previously UNC5221 or Warp Panda exploited a newly disclosed security flaw in BeyondTrust Remote Support formerly Bomgar as a zero-day in late August 2026. The vulnerability, tracked as CVE-2026-102764 CVSS score: 9.3, is a case of...
ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)
The MCP Apps UI resource an interactive DataStore table rendered in the host's webview/iframe communicates with its parent via postMessage. Its inbound message listener performs no event.origin validation, and its outbound messages are sent with target origin ''. Any window/frame able to reach th...
PT-2026-115975
Origin validation error in Microsoft Authentication Library MSAL for Node.js allows an unauthorized attacker to disclose information over a network...
CVE-2026-25604-PoC
CVE-2026-25604 PoC Host Header Injection leading to SAML authentication bypass in Apache Airflow's AWS Auth Manager An attacker can inject a malicious Host header into the SAML login flow, causing the Assertion Consumer Service ACS URL to point to an attacker-controlled server. This allows the...
CVE-2026-102764 Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support
The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance...
CVE-2026-102764
BeyondTrust Remote Support versions prior to 26.2.3 are vulnerable to an unauthenticated file upload flaw caused by insufficient validation of message origins within internal components. This allows a remote attacker to perform arbitrary file operations, potentially leading to full host compromis...
CVE-2026-39363
CVE-2026-39363 — Vite Dev Server WebSocket Arbitrary File Read Batch Detection Disclaimer: This tool is intended for authorized security testing and educational research only. Users must comply with local laws and regulations; unauthorized scanning or attacking others' systems is illegal. The...
Microsoft Authentication Library (MSAL) for Node.js Information Disclosure Vulnerability
Origin validation error in Microsoft Authentication Library MSAL for Node.js allows an unauthorized attacker to disclose information over a network...
Security Updates for Azure DevOps CLI Extension (October 2026)
The Azure DevOps CLI extension for Microsoft Azure CLI installed on the remote Windows host is missing a security update. It is, therefore, affected by an information disclosure vulnerability: - Origin validation error in Azure DevOps allows an unauthorized attacker to disclose information over a...
CVE-2026-97381
Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 contains an origin validation error in the IsPermitted method of its ActiveX control. After successfully reading the hosting document's hostname, a hostname that is not on the...
CVE-2026-97381 Legacy Update ActiveX control accepts unauthorized hosting origins
Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 contains an origin validation error in the IsPermitted method of its ActiveX control. After successfully reading the hosting document's hostname, a hostname that is not on the...
CVE-2026-97381 Legacy Update ActiveX control accepts unauthorized hosting origins
Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 contains an origin validation error in the IsPermitted method of its ActiveX control. After successfully reading the hosting document's hostname, a hostname that is not on the...
CVE-2026-97381
Legacy Update versions 1.12.0 through 1.13.1 are vulnerable to an origin validation error in the IsPermitted method of its ActiveX control. Due to a logic flaw, hostnames not on the permitted list fail to trigger an E_ACCESSDENIED error, causing the method to incorrectly return S_OK. An attacker ...
CVE-2026-88132
Origin validation error in Azure Key Vault allows an unauthorized attacker to disclose information over a network...