CVE-2026-100598: Origin Validation Error

OpenClaw npm package openclaw before 2026.7.1 incorrectly binds Signal approval reactions. In affected versions, a reaction intended to resolve a structured approval request could instead attach to ordinary outbound text when unrelated outbound messages and a pending approval are present in the...

PT-2026-99613

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 154.0.8037.57 Description Incorrect authorization in WebAPKs allows a local attacker to obtain cross-origin data through a co-installed application. Cross-origin data refers to information belonging t...

CVE-2026-91766 Cross-origin credential leak in HTTP stream wrapper redirects

When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore...

CVE-2026-49850 InvoicePlane: Missing CSRF Protection on State-Changing delete Actions

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane exposes Invoices::delete and Invoices::deleteinvoicetax as state-changing routes without requiring POST and validating a CSRF token. When an authenticated administrator...

EUVD-2026-87133

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane exposes Invoices::delete and Invoices::deleteinvoicetax as state-changing routes without requiring POST and validating a CSRF token. When an authenticated administrator...

CVE-2026-85289

The open-source application InvoicePlane (prior to version 1.7.2) is vulnerable to Cross-Site Request Forgery (CSRF) due to missing CSRF token validation on specific delete methods. Specifically, the Payments::delete(), Recurring::delete(), and User_clients::delete() functions omit the ensure_val...

CVE-2026-85289 InvoicePlane: Missing CSRF Token Validation on Multiple Delete Endpoints

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane omits ensurevalidpostrequest from delete methods including Payments::delete, Recurring::delete, and Userclients::delete. Although the routes require POST, they do not...

CVE-2026-79005

A flaw was found in Google Chrome's StorageAccessAPI. A remote attacker, after compromising the renderer process, could exploit an incorrect authorization vulnerability by using a specially crafted HTML page. This could allow the attacker to bypass the web origin policy, potentially leading to...

CVE-2026-84331

A flaw was found in chromium-browser. This incorrect authorization vulnerability allows a remote attacker, who has already compromised the renderer process, to bypass the web origin policy by using a specially crafted HTML page. This could lead to unauthorized access to data or functionality acro...

BIT-SEAWEEDFS-2026-58371 SeaweedFS < 4.30 - Cross-Origin Information Disclosure via Unvalidated JSONP callback Parameter

SeaweedFS before 4.30 reflects the callback query parameter verbatim into responses served with Content-Type application/javascript in the shared writeJson helper weed/server/common.go, with no callback-name validation, no X-Content-Type-Options: nosniff header, and no CORS allow-list. Every JSON...

CVE-2026-97875 DNS rebinding vulnerability in rojo serve HTTP API

Rojo's "rojo serve" HTTP API default port 34872 has no Host/Origin header validation, making it vulnerable to DNS rebinding. A malicious webpage can read all project source, write malicious code to files on disk, and launch local programs via opener::open with no user interaction beyond visiting...

CVE-2026-78947

A flaw was found in Chromium, a component of Google Chrome. This vulnerability, caused by incomplete cleanup, allows a remote attacker to bypass the web origin policy. By leveraging social engineering and a specially crafted Chrome extension, an attacker could gain unauthorized access to sensitiv...

CVE-2026-79152

A flaw was found in Google Chrome CustomTabs. A local attacker could exploit incorrect authorization to bypass the web origin policy through a co-installed application. This bypass could allow unauthorized access to web content...

CVE-2026-79006

A flaw was found in Google Chrome. This vulnerability, located in the HttpsUpgrades component, allows a remote attacker to bypass the web origin policy. By sending specially crafted network traffic, an attacker could circumvent security restrictions designed to isolate content from different...

CVE-2026-87608

A flaw was found in Chromium's Federated Credential Management FedCM component. A remote attacker, leveraging social engineering, could exploit improper certificate validation by sending crafted network traffic. This could allow the attacker to bypass the web origin policy, potentially leading to...

CVE-2026-87551

A flaw was found in chromium-browser. This vulnerability involves improper certificate validation within the Cross-Origin Resource Sharing CORS mechanism. A remote attacker, by leveraging social engineering tactics and crafted network traffic, could bypass the web origin policy. This could lead t...

CVE-2026-87571

A flaw was found in Google Chrome. Improper certificate validation in the Loader component allows a remote attacker, through social engineering and crafted network traffic, to bypass the web origin policy. This bypass could enable an attacker to circumvent security restrictions designed to isolat...

CVE-2026-87469

A flaw was found in Extensions in Google Chrome. Improper input validation allows a remote attacker to bypass the web origin policy. This can lead to unauthorized access to privileged pages through specially crafted network traffic...

CVE-2026-87577

A flaw was found in Chromium. A remote attacker could exploit an authorization vulnerability by creating a specially designed web page. This could allow the attacker to bypass security restrictions, known as the web origin policy, and access sensitive information or functionality on a privileged...

CVE-2026-87550

A flaw was found in Google Chrome. A remote attacker could exploit improper encoding or escaping of output within the browser's Cascading Style Sheets CSS component. By delivering a specially crafted HTML page, the attacker could potentially bypass the web origin policy. This policy is a critical...