共收录 81 条相关情报。
← 返回所有主题CVE-2026-12962
A Permissive Cross-domain Security Policy with Untrusted Domains in Armoury Crate allows a remote user to obtain a local
CVE-2026-84452
Windows ML CLI is a command line tool for building portable, performant, and high-quality AI models for Windows ML. Prio
CVE-2026-84452
Windows ML CLI is a command line tool for building portable, performant, and high-quality AI models for Windows ML. Prio
CVE-2026-53649
Joro is a web exploitation framework. Prior to version 1.1.1, Joro's default proxy mode exposes a local API on 127.0.0.1
CVE-2026-53649
Joro is a web exploitation framework. Prior to version 1.1.1, Joro's default proxy mode exposes a local API on 127.0.0.1
CVE-2026-82291
HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cros
CVE-2026-82287
Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions b
CVE-2026-82291
HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cros
CVE-2026-82287
Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions b
CVE-2026-53656
FiftyOne is an open-source platform for refining high-quality datasets and visual AI models. Prior to 1.17.0, the FiftyO
CVE-2026-63407
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-
CVE-2026-68517
Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, the cors_origins guard in glances/outpu
CVE-2026-18676
The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the ope
CVE-2026-46409
OpenYak 是一款本地优先的智能体运行时，专门用于可靠地调用工具的模型，并在此基础上提供桌面工作区。在 1.1.3 版本之前，OpenYak 的桌面后端存在一个严重安全缺陷：其 HTTP API 被绑定在 127.0.0.1 的随机端口
CVE-2026-54753
## Summary The local HTTP server started by `nx graph` sent `Access-Control-Allow-Origin: *` on every response, letting
CVE-2026-65310
ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration of affected versions, exposes its data and configu
CVE-2026-15966
Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer. This issue af
CVE-2026-61736
### Summary The server defaults to CORS_ORIGINS=* combined with allow_credentials=True. Starlette's CORSMiddleware echoe
CVE-2026-21761
HCL DevOps Loop is affected by a Cross-Origin Resource Sharing (CORS) misconfiguration. Improper CORS configuration may
CVE-2026-21761
HCL DevOps Loop is affected by a Cross-Origin Resource Sharing (CORS) misconfiguration. Improper CORS configuration may