EUVD-2026-44670

LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests...

CVE-2026-61736

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, the server defaults to CORSORIGINS= combined with allowcredentials=True in lightrag/api/lightragserver.py, causing Starlette CORSMiddleware to effectively whitelist every origin for credentialed cross-origin request...

Shopify: Store Deletion or Sell without authentication

In order for an owner to "close or sell" the store, a password is required in order to confirm the decision, when the action is applied in the web application. It was identified that the mobile application doesn't require credentials in order to perform the same action, thus by navigating to the...

FAQ: Can the Store Name be Renamed on StoreFront?

Q: Can the store name be renamed on StoreFront? A : Renaming the StoreFront Store name is not supported. To workaround this issue create a new Store. Note : It is also not recommended to delete the Default Store.There have been issues reported with authentication when the default store is deleted...