MoLing is a computer-use and browser-use based MCP server. Prior to 0.5.0, when MoLing runs in SSE mode using `-l`, its `/sse` and `/message` HTTP endpoints do not authenticate ...

CVE-2026-62863

MoLing is a computer-use and browser-use based MCP server. Prior to 0.5.0, when MoLing runs in SSE mode using `-l`, its

来源摘录 · NVD

Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware's validateDomain wildcard matcher in middleware/cors/utils.go strips the ...

CVE-2026-119285

Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware's validateDomain

来源摘录 · NVD / GitHub Advisory / OSV.dev

The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because ...

CVE-2026-110737

The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allo

历史摘要 · 未重新核验 · NVD

Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handle_request() in...

CVE-2026-116748

Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handle_request() in rpc-server.cc that expos

历史摘要 · 未重新核验 · GitHub Advisory

Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handle_request() in rpc-server.cc that exposes the X-Transmission-Session-Id anti-CSRF token to any w...

CVE-2026-116748

Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handle_request() in rpc-server.cc that expos

来源摘录 · NVD

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compatible server configures Starlette CORSMiddleware with allowed_origins set to ...

CVE-2026-115917

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compatible server configu

来源摘录 · NVD / OSV.dev

IBM Concert 1.0 through 3.0.0 uses cross-origin resource sharing (CORS) which could allow an attacker to carry out privileged actions as the domain name is not being limited to ...

CVE-2026-3303

IBM Concert 1.0 through 3.0.0 uses cross-origin resource sharing (CORS) which could allow an attacker to carry out privi

历史摘要 · 未重新核验 · NVD

LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files

CVE-2026-108372

## Summary `loopx serve-status` sends `Access-Control-Allow-Origin: *` on **every** response, including its unauthentic

历史摘要 · 未重新核验 · GitHub Advisory

Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every...

CVE-2026-111922

Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every localhost and 127.0.0.1 port

历史摘要 · 未重新核验 · GitHub Advisory

Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted

## Summary Vikunja ships with `cors.origins` defaulting to `http://127.0.0.1:*` and `http://localhost:*`, and sends `Ac

历史摘要 · 未重新核验 · GitHub Advisory

Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain

### Summary: 5 findings — unauthenticated full-API exposure (F1, lead Critical), read-side authorization gap that persi

历史摘要 · 未重新核验 · GitHub Advisory

iControl is affected by an insecure Cross-Origin Resource Sharing (CORS) policy vulnerability, which could allow a malicious website to execute cross-origin requests with includ...

CVE-2026-66247

iControl is affected by an insecure Cross-Origin Resource Sharing (CORS) policy vulnerability, which could allow a malic

历史摘要 · 未重新核验 · NVD

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, match_origin/1 returned the bare reflected Origin and allowed credentials eve...

CVE-2026-66070

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, match_origin/1 retur

历史摘要 · 未重新核验 · NVD

The open-vsx.org deployment returned Access-Control-Allow-Origin reflecting the requesting origin together with Access-Control-Allow-Credentials: true on the authenticated /user...

CVE-2026-90882

The open-vsx.org deployment returned Access-Control-Allow-Origin reflecting the requesting origin together with Access-C

历史摘要 · 未重新核验 · NVD

HCL BigFix Service Management is affected by a CORS Misconfiguration vulnerability due to improperly validated origin headers, which could allow an attacker to craft a malicious...

CVE-2026-56595

HCL BigFix Service Management is affected by a CORS Misconfiguration vulnerability due to improperly validated origin he

历史摘要 · 未重新核验 · NVD

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin respon...

CVE-2026-89058

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Ori

来源摘录 · NVD

@Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft

CVE-2026-59148

## Summary Mockoon's admin API ([`commons-server/src/libs/server/admin-api.ts`](https://github.com/mockoon/mockoon/blob

历史摘要 · 未重新核验 · GitHub Advisory

Windows ML CLI: CORS misconfig enables localhost RCE

CVE-2026-84452

Case Description: MSRC Notes: Attachments: 1 file(s) attached (1 mp4) Summary: The vulnerability lies in the 'serve/cli

历史摘要 · 未重新核验 · GitHub Advisory

Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-62895

Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate privileges

历史摘要 · 未重新核验 · NVD

A Permissive Cross-domain Security Policy with Untrusted Domains in Armoury Crate allows a remote...

CVE-2026-12962

A Permissive Cross-domain Security Policy with Untrusted Domains in Armoury Crate allows a remote user to obtain a local

历史摘要 · 未重新核验 · GitHub Advisory