CVE-2026-69559: Origin Validation Error

Origin validation error in Microsoft Teams for Android allows an authorized attacker to disclose information over a network...

CVE-2026-75156: Origin Validation Error

Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD idtokens during OAuth login. Deployments are affected only when the FAB auth manager is configured with Azure AD as an OAuth provider. Because the signing keys are fetched from Microsoft's...

UBUNTU-CVE-2026-58649

Origin validation error in .NET allows an unauthorized attacker to disclose information over a network...

PT-2026-88663

Origin validation error in Paint in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: Medium...

PT-2026-87651

Origin validation error in Windows DNS allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-58649

Origin validation error in .NET allows an unauthorized attacker to disclose information over a network...

CVE-2026-58649: Origin Validation Error

Origin validation error in .NET allows an unauthorized attacker to disclose information over a network...

PT-2026-87202

Weeraphat Srisutham discovered that the .NET watch BrowserRefreshServer did not properly validate cross-origin WebSocket connections. An attacker could possibly use this issue to expose sensitive information. CVE-2026-58649 Rajesh Chada discovered that the .NET watch AspireServerService improperl...

PT-2026-88152

Impact Instance AI credential setup accepted a credential test/verification URL without checking it matched the workflow node's origin. Exfiltration required the user to actively inject an attacker-controlled URL into the setup flow. The patch derives the credential destination from the node's ow...

PT-2026-87565

Origin validation error in Microsoft Teams for Android allows an authorized attacker to disclose information over a network...

CVE-2026-69680: Origin Validation Error

Origin validation error in Windows DNS allows an unauthorized attacker to perform spoofing over a network...

Linux Distros Unpatched Vulnerability : CVE-2026-58649

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Origin validation error in .NET allows an unauthorized attacker to disclose information over a network. CVE-2026-58649 Note that Nessus relies on the presence o...

SUSE CVE-2026-11624

The Model Context Protocol has a security warning advising servers to validate the "Origin" header on all incoming connections to prevent DNS rebinding attacks. Prior to the v0.25.0 release, users had no way to validate the origin's host. In v0.25.0, a new "--allowed-hosts" flag was introduced...

Origin Validation Error

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Origin Validation Error leading to cache poisoning in the interceptors.cache and interceptors.deduplicate interceptors, which build cache and deduplication keys without t...

BIT-JOOMLA-2026-71573 Joomla! Core - [20260802] - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2

Joomla! Core - 20260802 - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper implementation prevented configured CORS origins from being properly validated in CORS requests...

CVE-2026-49455

Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku's RSC request dispatcher invokes server actions without validating the request's Origin or Sec-Fetch-Site header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated POST to a registere...

CVE-2026-49455 Waku: Cross-Origin CSRF on RSC Server Action Dispatch

Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku's RSC request dispatcher invokes server actions without validating the request's Origin or Sec-Fetch-Site header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated POST to a registere...

CVE-2026-49455

Waku (a minimal React framework, npm package) prior to 1.0.0-beta.1 is vulnerable to cross-origin CSRF on its RSC server action dispatch. The root cause is the absence of any Origin or Sec-Fetch-Site validation in the RSC dispatch branch of request.ts, allowing a cross-origin attacker to invoke a...

EUVD-2026-70654

Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku's RSC request dispatcher invokes server actions without validating the request's Origin or Sec-Fetch-Site header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated POST to a registere...

CVE-2026-85183: Missing Origin Validation in WebSockets

Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to establish credentialed WebSocket connections to victim applications. Attackers can open socket.io sessions from arbitrary domains and invoke state variable modifications and actio...