CWE-346
CVEs classified under CWE-346, newest first.
234 CVEsRSS
CVE-2026-115413High· 7.8AWS API MCP Server OAuth Token Audience Validation Bypass
Missing token audience validation in the OAuth authentication mode of AWS API MCP Server before version 1.6.0 might allow local users to run AWS operations with the server's configured AWS credentials via an access token issued to anothe…
CVE-2026-82332Medium· 5.6Fireware OS Improper Authentication in AuthPoint MFA Verification Allows Session Hijacking
An improper authentication vulnerability in WatchGuard Fireware OS's AuthPoint multi-factor authentication process allows a local, unauthenticated attacker on the appliance to hijack another user's in-progress MFA session by supplying a …
CVE-2026-110737Low· 2.3Push Endpoint Returns Permissive CORS Headers
The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because Flow configures Atmosphere with DROP_ACCESS_CONTROL_ALLOW_OR…
CVE-2026-82121High· 7.5Origin Validation Error Vulnerability in HiRDB
Origin Validation Error Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 th…
CVE-2026-83813Low· 3.1Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation
Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation
CVE-2026-116254Medium· 6.5rathena FluxCP PayPal IPN PaymentNotifyRequest.php verifyiprange origin validation
A vulnerability was identified in rathena FluxCP up to 98cd4b8fd83228c11b36fb3d097b8e0f7c105a8d. This issue affects the function verifyiprange of the file lib/Flux/PaymentNotifyRequest.php of the component PayPal IPN Handler. The manipul…
CVE-2026-116194Medium· 6.8github.com/rclone/rclone: rclone: Sensitive data disclosure via CSRF in pCloud OAuth callback (CVE-2026-116194)
A flaw was found in rclone. A remote attacker could redirect file transfers and expose sensitive data by exploiting a Cross-Site Request Forgery (CSRF) vulnerability in the pCloud storage backend. During authorization, the local authentica…
CVE-2026-79977High· 8.2WireGuard peer endpoint learned from unauthenticated transport-data messages allows off-path tunnel hijack in Zephyr
The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endpoint from a message it could not authenticate. In handle_transport_data(), when the 32-bit receiver index of an incoming transport-data message matched no se…
CVE-2026-58497High· 8.6Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requests
Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, local tools, and MCP. Prior to version 0.225.2, Uni-CLI exposed the legacy JSON-RPC-over-HTTP MCP transport on loopback without validatin…
CVE-2026-115724Low· 2.9VLC for Android before 3.7.2 File Overwrite via Spoofed Mail Attachment Provider
VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri() that trusts content URIs based only on the com.fsck.k9.attachmentprovider or gmail-ls authority. A co-installed app without permis…
CVE-2026-112085High· 8.2webpack-dev-server vulnerable to cross-origin WebSocket access via proxied upgrades
webpack-dev-server is a development server that provides live reloading for webpack projects. In versions before 5.2.7 and in version 6.0.0, when a proxy entry is configured to forward WebSockets, the server forwards non-HMR WebSocket up…
CVE-2026-113798Medium· 5.4Electron: Pointer lock permission requests can be attributed to the wrong frame
Electron: Pointer lock permission requests can be attributed to the wrong frame
CVE-2026-114121Medium· 5.4Electron: openExternal permission requests can be attributed to the wrong origin
Electron: openExternal permission requests can be attributed to the wrong origin
CVE-2026-114125High· 8.8storybook: Storybook: Arbitrary code execution via insufficient message-origin restrictions (CVE-2026-114125)
A flaw was found in Storybook. Due to insufficient iframe embedding and message-origin restrictions, a remote attacker can achieve arbitrary code execution if a developer running a local development server visits a malicious website. By tr…
CVE-2026-113800Medium· 5.4Electron: HID and USB permission checks can be attributed to the wrong origin
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, hid and usb permission checks made from an iframe caused setPermission…
CVE-2026-112377High· 7.4CCC Attestation SIG attested-tls-poc through commit 731ca82 Attestation Relay Attack
CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to bind early attestation Evidence to the TLS connection, allowing attackers to relay valid Evidence from a genuine attester. Attackers holding an extracted attested TLS p…
CVE-2026-112101Medium· 4.3PoCBlackBeltTechnology pi-agent-dashboard WebSocket Gateway origin validation
A vulnerability was determined in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. The affected element is an unknown function of the file /BlackBeltTechnology/pi-agent-dashboard of the component WebSocket Gateway. Executing a manipul…
CVE-2026-108372High· 7.1PoCLoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files
Open and provider-neutral, LoopX is a lightweight state kernel and local-first control plane for loop engineering. From version 0.0.1 until 0.4.5, `loopx serve-status` in `loopx/status_server.py` uses `StatusRequestHandler._send_json()` …
CVE-2026-109461Medium· 5.9Microsoft Authentication Library (MSAL) for Node.js Information Disclosure Vulnerability
Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network.
CVE-2026-55842Medium· 5.4Scoold is a Q&A and a knowledge sharing platform for teams
Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, the apiCorsConfiguration() method in src/main/java/com/erudika/scoold/ScooldServer.java combines addAllowedOriginPattern("*") with setAllowCredentials(true), ca…
CVE-2026-55587High· 8.1AliasVault is a privacy-first password manager with built-in email aliasing
AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.29.4, the AliasVault browser extension passkey provider does not bind passkey requests to the actual webpage origin or verify that the requested rely…
CVE-2026-109829High· 7.4undici is an HTTP client library for Node.js
undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its …
CVE-2026-101897Medium· 5.1Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 1.20.0 until 1.21.1, the Angular DevTools background service worker accepts chrome.runtime.sendMessa…
CVE-2026-97381Critical· 9.9Legacy Update is a tool for activating and installing updates on legacy Windows PCs
Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 contains an origin validation error in the IsPermitted method of its ActiveX control. After successfully reading the…
CVE-2026-96238Medium· 6.5Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network.
Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-96234Medium· 5.3Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.
Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.
CVE-2026-88132Medium· 5.9Origin validation error in Azure Key Vault allows an unauthorized attacker to disclose information over a network.
Origin validation error in Azure Key Vault allows an unauthorized attacker to disclose information over a network.
CVE-2026-70213High· 8.0Origin validation error in Microsoft Power Apps allows an authorized attacker to execute code over a network.
Origin validation error in Microsoft Power Apps allows an authorized attacker to execute code over a network.
CVE-2026-69877Medium· 6.5Origin validation error in Azure DevOps allows an unauthorized attacker to disclose information over a network.
Origin validation error in Azure DevOps allows an unauthorized attacker to disclose information over a network.
CVE-2026-103417Medium· 5.5Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation occurred while the saved-login UI was open
Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation occurred while the saved-login UI was open. Autofill was not bound to the originating page or rejected when its origin changed. This vulnerabilit…