CWE-346
CVEs classified under CWE-346, newest first.
256 CVEsRSS
CVE-2026-112085High· 8.2webpack-dev-server vulnerable to cross-origin WebSocket access via proxied upgrades
webpack-dev-server is a development server that provides live reloading for webpack projects. In versions before 5.2.7 and in version 6.0.0, when a proxy entry is configured to forward WebSockets, the server forwards non-HMR WebSocket up…
CVE-2026-114125High· 8.6Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites
Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook develop…
CVE-2026-113798Medium· 5.4Electron: Pointer lock permission requests can be attributed to the wrong frame
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.9, 43.7.6, 44.5.0, and 45.0.0-alpha.13, pointerLock permission requests from some cross-origin iframes caused…
CVE-2026-113800Medium· 5.4Electron: HID and USB permission checks can be attributed to the wrong origin
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, hid and usb permission checks made from an iframe caused setPermission…
CVE-2026-114121Medium· 5.4Electron: openExternal permission requests can be attributed to the wrong origin
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, requests to open external protocol URLs could be attributed to a docum…
CVE-2026-113075High· 8.8Origin validation error in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page
Origin validation error in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-112377High· 7.4CCC Attestation SIG attested-tls-poc through commit 731ca82 Attestation Relay Attack
CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to bind early attestation Evidence to the TLS connection, allowing attackers to relay valid Evidence from a genuine attester. Attackers holding an extracted attested TLS p…
CVE-2026-112101Medium· 4.3PoCBlackBeltTechnology pi-agent-dashboard WebSocket Gateway origin validation
A vulnerability was determined in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. The affected element is an unknown function of the file /BlackBeltTechnology/pi-agent-dashboard of the component WebSocket Gateway. Executing a manipul…
CVE-2026-108372High· 7.1PoCLoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files
Open and provider-neutral, LoopX is a lightweight state kernel and local-first control plane for loop engineering. From version 0.0.1 until 0.4.5, `loopx serve-status` in `loopx/status_server.py` uses `StatusRequestHandler._send_json()` …
CVE-2026-109461Medium· 5.9Microsoft Authentication Library (MSAL) for Node.js Information Disclosure Vulnerability
Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network.
CVE-2026-55842Medium· 5.4Scoold is a Q&A and a knowledge sharing platform for teams
Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, the apiCorsConfiguration() method in src/main/java/com/erudika/scoold/ScooldServer.java combines addAllowedOriginPattern("*") with setAllowCredentials(true), ca…
CVE-2026-55587High· 8.1AliasVault is a privacy-first password manager with built-in email aliasing
AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.29.4, the AliasVault browser extension passkey provider does not bind passkey requests to the actual webpage origin or verify that the requested rely…
CVE-2026-109829High· 7.4undici is an HTTP client library for Node.js
undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its …
CVE-2026-101897Medium· 5.1Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 1.20.0 until 1.21.1, the Angular DevTools background service worker accepts chrome.runtime.sendMessa…
CVE-2026-97381Critical· 9.9Legacy Update is a tool for activating and installing updates on legacy Windows PCs
Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 contains an origin validation error in the IsPermitted method of its ActiveX control. After successfully reading the…
CVE-2026-96238Medium· 6.5Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network.
Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-96234Medium· 5.3Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.
Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.
CVE-2026-88132Medium· 5.9Origin validation error in Azure Key Vault allows an unauthorized attacker to disclose information over a network.
Origin validation error in Azure Key Vault allows an unauthorized attacker to disclose information over a network.
CVE-2026-70213High· 8.0Origin validation error in Microsoft Power Apps allows an authorized attacker to execute code over a network.
Origin validation error in Microsoft Power Apps allows an authorized attacker to execute code over a network.
CVE-2026-69877Medium· 6.5Origin validation error in Azure DevOps allows an unauthorized attacker to disclose information over a network.
Origin validation error in Azure DevOps allows an unauthorized attacker to disclose information over a network.
CVE-2026-103417Medium· 5.5Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation occurred while the saved-login UI was open
Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation occurred while the saved-login UI was open. Autofill was not bound to the originating page or rejected when its origin changed. This vulnerabilit…
CVE-2026-108362Critical· 9.1Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections
Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.11.0, TEE attestation evidence in Privasys attested TLS is accepted without requiring an explicitly authorized p…
CVE-2026-77363High· 8.8obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, the Streamable HTTP transport does not validate the Host or Origin header or enable DNS-rebinding protection. When the documented l…
CVE-2026-109332Low· 3.1PoCNetwork-AI (npm network-ai) before 5.15.2 contains an origin validation error in McpSseServer._handleRequest in lib/mcp-transport-sse.ts that reflects localhost Origins into Access-Control-Allow-Origin regardless of bind interface
Network-AI (npm network-ai) before 5.15.2 contains an origin validation error in McpSseServer._handleRequest in lib/mcp-transport-sse.ts that reflects localhost Origins into Access-Control-Allow-Origin regardless of bind interface. When …
CVE-2026-109286High· 8.1Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user's session token by posting unvalidated verify:chat messages
Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user's session token by posting unvalidated verify:chat messages. Attackers can sup…
CVE-2026-9191Critical· 9.6Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently isolate user-supplied code executed through certain REST and XDBC evaluation paths from HTTP request, response, and session state
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently isolate user-supplied code executed through certain REST and XDBC evaluation paths from HTTP request, response, and session state. …
CVE-2026-108269Critical· 9.1Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections
Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.5.0, the Rust and Go RA-TLS challenge verifiers accepted quote ReportData that was bound to the certificate public key an…
CVE-2026-108268Critical· 9.1Enclave OS Virtual runs container workloads inside confidential virtual machines with end-to-end attestation
Enclave OS Virtual runs container workloads inside confidential virtual machines with end-to-end attestation. Prior to tdx-v0.2.43 and tdx-gpu-v0.6.27, the TDX/GPU RA-TLS certificate issuer placed the certificate public-key hash and clie…
CVE-2026-108267Critical· 9.1Privasys Go is a maintained fork of the Go programming language that adds RA-TLS support to crypto/tls
Privasys Go is a maintained fork of the Go programming language that adds RA-TLS support to crypto/tls. Prior to privasys-v0.5.1-go1.26.5, challenge-mode RA-TLS certificates bound quote ReportData to the certificate public key and client…
CVE-2026-108266Critical· 9.1Privasys rustls is a maintained fork of the rustls TLS library that adds RA-TLS challenge and channel-binding support
Privasys rustls is a maintained fork of the rustls TLS library that adds RA-TLS challenge and channel-binding support. Prior to privasys-v0.8.1, the fork emitted RA-TLS challenge certificates whose quote ReportData was bound to the certi…