Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites
CVE-2026-114125
**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affect
#cwe-346
共收录 336 条相关情报。
← 返回所有主题Electron: HID and USB permission checks can be attributed to the wrong origin
CVE-2026-113800
### Impact For `hid` and `usb` permission checks made from an iframe, `session.setPermissionCheckHandler` was given the
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, requests t...
CVE-2026-114121
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to version
CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to bind early attestation Evidence to the TLS connection, allowing attackers to relay valid Evidence from a gen...
CVE-2026-112377
CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to bind early attestation Evidence to the TLS connecti
LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files
CVE-2026-108372
## Summary `loopx serve-status` sends `Access-Control-Allow-Origin: *` on **every** response, including its unauthentic
AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.29.4, the AliasVault browser extension passkey provider does not bind passkey requests to...
CVE-2026-55587
AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.29.4, the AliasVault browser ext
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 1.20.0 until 1.21.1, the Angular DevTool...
CVE-2026-101897
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other
Microsoft Security Advisory CVE-2026-96234 - .NET and Visual Studio Information Disclosure Vulnerability
CVE-2026-96234
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Micr
Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation occurred while the saved-login UI was open. Autofill was not bound to the originating...
CVE-2026-103417
Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation occurred while the saved-log
Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.11.0, TEE attestation evidence in Privasys attested ...
CVE-2026-108362
Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, the Streamable HTTP transport does not validate the Host or Origin head...
CVE-2026-77363
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, the Streamable
obsidian-tc Streamable HTTP transport permits cross-origin loopback vault access
CVE-2026-77363
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, the Streamable
Network-AI (npm network-ai) before 5.15.2 contains an origin validation error in McpSseServer._handleRequest in lib/mcp-transport-sse.ts that reflects localhost Origins into Acc...
CVE-2026-109332
Network-AI (npm network-ai) before 5.15.2 contains an origin validation error in McpSseServer._handleRequest in lib/mcp-
Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user's session token by...
CVE-2026-109286
Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently isolate user-supplied code executed through certain REST and XDBC evalu...
CVE-2026-9191
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently isolate user-s
Network-AI before 5.15.2 CORS Origin Validation Error in MCP SSE Transport
CVE-2026-109332
Network-AI (npm network-ai) before 5.15.2 contains an origin validation error in McpSseServer._handleRequest in lib/mcp-
Open WebUI 0.7.0 before 0.11.4 Session Token Theft via SyncStatsModal
CVE-2026-109286
Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows
Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.5.0, the Rust and Go RA-TLS challenge verifiers accepted quot...
CVE-2026-108269
Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.5.0,
Enclave OS Virtual runs container workloads inside confidential virtual machines with end-to-end attestation. Prior to tdx-v0.2.43 and tdx-gpu-v0.6.27, the TDX/GPU RA-TLS certif...
CVE-2026-108268
Enclave OS Virtual runs container workloads inside confidential virtual machines with end-to-end attestation. Prior to t
Privasys Go is a maintained fork of the Go programming language that adds RA-TLS support to crypto/tls. Prior to privasys-v0.5.1-go1.26.5, challenge-mode RA-TLS certificates bou...
CVE-2026-108267
Privasys Go is a maintained fork of the Go programming language that adds RA-TLS support to crypto/tls. Prior to privasy