Frappe: Host header poisoning can redirect magic login links to an attacker-controlled domain
CVE-2026-47194
Frappe is a full-stack web application framework. Prior to 15.108.0 and 16.18.3, temporary magic login link generation c
#cwe-346
共收录 336 条相关情报。
← 返回所有主题Sonic 3 A.I.R. before commit 2492d18 contains a missing source address validation vulnerability in ConnectionManager where established connections are resolved by a two-byte loc...
CVE-2026-66732
Sonic 3 A.I.R. before commit 2492d18 contains a missing source address validation vulnerability in ConnectionManager whe
Origin Validation Error vulnerability in livebook-dev livebook allows untrusted notebook output JavaScript to trigger session-wide keyboard shortcuts, including forced evaluatio...
CVE-2026-66298
Origin Validation Error vulnerability in livebook-dev livebook allows untrusted notebook output JavaScript to trigger se
A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single...
CVE-2026-16442
A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authenti
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to...
CVE-2026-66317
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering over a n
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to...
CVE-2026-66318
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to...
CVE-2026-66316
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a ne
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to...
CVE-2026-66322
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a ne
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to...
CVE-2026-66313
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering locally.
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-66322
CVE-2026-66322 是微软基于 Chromium 的 Edge 浏览器中存在的一个源验证错误（Origin validation error）漏洞。该漏洞允许未授权的攻击者通过网络进行欺骗（spoofing）攻击。根据 NVD 提
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
CVE-2026-66318
CVE-2026-66318 是 Microsoft Edge（基于 Chromium）中存在的一个源验证错误（Origin validation error）漏洞。该漏洞允许未经授权的攻击者通过网络泄露信息。根据 CVSS 3.1 评分，
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering over a network.
CVE-2026-66317
CVE-2026-66317 是 Microsoft Edge（基于 Chromium）中存在的一个源验证（origin validation）错误漏洞。该漏洞源于浏览器在处理跨源请求时，未能正确验证请求的来源（origin）。在正常情况下
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-66316
CVE-2026-66316 是 Microsoft Edge（基于 Chromium 内核）中的一个源验证错误（Origin validation error）漏洞。该漏洞源于浏览器在处理某些网络请求或页面资源时，未能正确验证来源（Ori
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering locally.
CVE-2026-66313
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering locally.
Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, SetCookie::matchesDomain() gives every subdomain of a cookie Domain that cookie unless SetCookie::matchesDoma...
CVE-2026-69245
Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, SetCookie::matchesDomain() gives every subdomain of
Baileys is a cocket-based TS/JavaScript API for WhatsApp Web. In versions prior to both 6.7.22 and 7.0.0-rc12, any Baileys session can be sent a malicious payload via the place...
CVE-2026-48063
Baileys is a cocket-based TS/JavaScript API for WhatsApp Web. In versions prior to both 6.7.22 and 7.0.0-rc12, any Baile
Guzzle: Noncanonical cookie domain keeps subdomain scope
CVE-2026-69245
### Impact `SetCookie::matchesDomain()` gives every subdomain of a cookie `Domain` that cookie unless it recognizes the
MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass vulnerability that allows unauthenticated remote attackers to hijack authenticated administrator s...
CVE-2026-66420
MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass vulnerability that allows unauthenticated
MeshCentral Cross-Site WebSocket Hijacking via Origin Validation Bypass on Self-Signed Certificate Deployments
CVE-2026-66420
MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass vulnerability that allows unauthenticated
MSI Center NTIOLib_X64 Origin Validation Error Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installatio...
CVE-2026-6102
MSI Center NTIOLib_X64 Origin Validation Error Local Privilege Escalation Vulnerability. This vulnerability allows local