CVE-2026-89058High· 7.4▾ MidnightPoC availableA flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. Thi…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 40.7 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 18.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Exploit / PoC code exists
0.3% → 0.5%
Last analysed / modified upstream
A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to make credentialed cross-origin requests and read authenticated responses from a victim's session, resulting in a loss of confidentiality.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-89059High· 7.5A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count
CVE-2026-116194Medium· 6.8github.com/rclone/rclone: rclone: Sensitive data disclosure via CSRF in pCloud OAuth callback (CVE-2026-116194)
CVE-2026-16745High· 8.8A flaw was found in odh-dashboard, the web console component of Red Hat OpenShift AI (RHOAI)
CVE-2024-1249High· 7.4A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin messages
CVE-2026-106071Low· 3.6nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)
CVE-2026-106072Medium· 6.7nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)