CVE-2026-16349 Same-origin policy bypass in the DOM: Navigation component

Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13...

CVE-2026-16349

CVE-2026-16349 : Same-origin policy bypass in the DOM: Navigation component affects Mozilla Firefox and Firefox ESR. Root cause is a bypass vulnerability in the Navigation component that can impact confidentiality, integrity, and availability (CVSS v3.1: 9.8, high) with network attack vector and ...

CVE-2026-16349

Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13...

CVE-2026-16349

Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13...

PT-2026-62414

Name of the Vulnerable Software and Affected Versions Verba RAG application version 2.1.3 Description A server-side request forgery SSRF issue combined with a same-origin middleware bypass allows unauthenticated remote attackers to force the server to issue arbitrary HTTP requests. By providing a...

PT-2026-61893

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Firefox ESR versions prior to 140.13 Thunderbird versions prior to 153 Thunderbird versions prior to 140.13 Description A same-origin policy bypass exists in the Networking: DNS component. The same-origin policy i...

PT-2026-61861

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Firefox ESR versions prior to 115.38 Firefox ESR versions prior to 140.13 Thunderbird versions prior to 153 Thunderbird version prior to 140.13 Description A same-origin policy bypass exists in the DOM Navigation...

Linux Distros Unpatched Vulnerability : CVE-2026-15775

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to bypass same origin policy via a crafted HTML page...

GHSA-Q78P-HJ9H-5466 FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data

Impact The FiftyOne App/API server fiftyone/server/app.py and the /media route fiftyone/server/routes/media.py unconditionally set a permissive CORS header Access-Control-Allow-Origin: on their responses. Because the embedded App server runs locally and is unauthenticated, this allows any website...

SUSE CVE-2026-15768

Insufficient policy enforcement in HTML-in-Canvas in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to bypass same origin policy via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-15775

Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to bypass same origin policy via a crafted HTML page. Chromium security severity: High...

CVE-2026-52842

Lightpanda is a headless browser designed for AI and automation. Prior to 0.3.1, Lightpanda searched for @ across the entire URL string instead of only the authority component when computing a page origin, so a URL such as http://attacker.com/@victim.com/ was fetched from attacker.com but treated...

CVE-2026-52842

Lightpanda (headless browser) prior to version 0.3.1 incorrectly searched for the character @ across the entire URL when computing origin, rather than only the authority component. This caused a URL like http://attacker.com/@victim.com/ to be fetched from attacker.com but treated as http://victim...

CVE-2026-52842 Lightpanda:URL parser misidentifies page origin for URLs containing @ in the path - Same-Origin Policy bypass

Lightpanda is a headless browser designed for AI and automation. Prior to 0.3.1, Lightpanda searched for @ across the entire URL string instead of only the authority component when computing a page origin, so a URL such as http://attacker.com/@victim.com/ was fetched from attacker.com but treated...

CVE-2026-52842 Lightpanda:URL parser misidentifies page origin for URLs containing @ in the path - Same-Origin Policy bypass

Lightpanda is a headless browser designed for AI and automation. Prior to 0.3.1, Lightpanda searched for @ across the entire URL string instead of only the authority component when computing a page origin, so a URL such as http://attacker.com/@victim.com/ was fetched from attacker.com but treated...

firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Networking: Cookies component...

PT-2026-60371

Name of the Vulnerable Software and Affected Versions FiftyOne versions prior to 1.17.0 Description The FiftyOne App/API server and the /media endpoint unconditionally set a permissive Cross-Origin Resource Sharing CORS header, allowing any website visited by a user to make cross-origin requests ...

CVE-2026-49458

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitizenode, INPLACE: true accepted same-origin foreign-realm DOM nodes while follow-on checks used parent-realm constructors, causing instanceof checks for forms, named node maps, documen...

DEBIAN-CVE-2026-15775

Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to bypass same origin policy via a crafted HTML page. Chromium security severity: High...

CVE-2026-15775

Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to bypass same origin policy via a crafted HTML page. Chromium security severity: High...