共收录 336 条相关情报。
← 返回所有主题CVE-2026-84482
WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the get_domain() and isSameDo
CVE-2026-19418
### Problem The referrer enforcement introduced with [TYPO3-CORE-SA-2020-006](https://news.typo3.com/security/advisory/t
CVE-2026-82811
A security vulnerability has been detected in Toggl OÜ Toggl Track Extension 4.11.16. This affects an unknown function o
CVE-2026-81315
Origin Validation Error vulnerability in ash-project ash_ai allows a malicious web page to bypass the MCP server's DNS-r
CVE-2026-81315
Origin Validation Error vulnerability in ash-project ash_ai allows a malicious web page to bypass the MCP server's DNS-r
CVE-2026-70309
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature
CVE-2026-59297
Implementation of isSecure() call of ServerlessHttpServletRequest does not verify the actual scheme. Spring Cloud Functi
CVE-2026-81102
The Dash MCP server bound its listener to the loopback address but never checked the host a request named. src/mcp_serve
CVE-2026-81100
tiger-gh-mcp-server started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src
CVE-2026-81099
tiger-slack started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. mcp/src/htt
CVE-2026-81095
pg-aiguide started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServ
CVE-2026-81092
mcp-go accepted requests on its HTTP transports without checking the Host header. StreamableHTTPServer.ServeHTTP in serv
CVE-2026-81095
pg-aiguide started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServ
CVE-2026-81092
mcp-go accepted requests on its HTTP transports without checking the Host header. StreamableHTTPServer.ServeHTTP in serv
CVE-2026-55637
genieacs-mcp is an MCP server for GenieACS written in Go. Prior to 0.3.2, the Streamable HTTP transport in cmd/server/ma
CVE-2026-55637
`genieacs-mcp` exposes a local Streamable HTTP MCP endpoint that accepts attacker-controlled `Host` and `Origin` headers
CVE-2026-55532
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, MCP HTTP Stream _validate_origin uses request_origin
CVE-2026-55529
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the MCP HTTP Stream _validate_origin method accepts
CVE-2026-72702
Grav CMS before 2.0.16 contains an origin validation bypass in the Uri::referrer() and Pages::referrerRoute() methods, w
CVE-2026-53499
CVE-2026-53499 影响 Fort Validator，一个用于资源公钥基础设施（RPKI）的依赖方验证器，版本直至 1.6.7。该漏洞源于 RRDP（RPKI 仓库增量协议）处理过程中的源验证缺陷。在同一个信任锚定位符（TAL）