Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)

CVE-2026-46608

### Summary The Glances XML-RPC server (`glances -s`) introduced a configurable CORS origin list in version 4.5.3 as a

历史摘要 · 未重新核验 · GitHub Advisory

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, with credentials: true and no explicit origin (the default wildcard), the...

CVE-2026-54290

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, with credentials

历史摘要 · 未重新核验 · NVD

PraisonAI before 1.5.128 contains a cross-origin agent execution vulnerability in the AGUI...

CVE-2026-56076

PraisonAI before 1.5.128 contains a cross-origin agent execution vulnerability in the AGUI endpoint that allows remote a

历史摘要 · 未重新核验 · GitHub Advisory

PraisonAI before 1.5.128 contains a cross-origin agent execution vulnerability in the AGUI endpoint that allows remote attackers to trigger arbitrary agent execution. The POST /...

CVE-2026-56076

PraisonAI 1.5.128 之前版本存在一个跨源代理执行漏洞。该漏洞位于 /agui 端点，允许远程攻击者触发任意代理执行。具体来说，POST /agui 端点缺乏身份验证，并硬编码了 Access-Control-Allow-Or

历史摘要 · 未重新核验 · NVD

The Aqara Developer Portal (developer.aqara.com) and shared test environments (developer-test.aqara.com, aiot-test.aqara.com) exhibit cross-origin request sharing, which is an i...

CVE-2026-50088

The Aqara Developer Portal (developer.aqara.com) and shared test environments (developer-test.aqara.com, aiot-test.aqara

历史摘要 · 未重新核验 · NVD

The Aqara IAM/SSO gateway (gw-builder.aqara.com) exhibits a cross-origin request sharing vulnerability, which is an instance of "CWE-942: Permissive Cross-domain Policy with Unt...

CVE-2026-50087

The Aqara IAM/SSO gateway (gw-builder.aqara.com) exhibits a cross-origin request sharing vulnerability, which is an inst

历史摘要 · 未重新核验 · NVD

CORS misconfiguration in the REST API of Network Optix Nx Witness VMS before version 6.1.2, when running in the default Standard security mode, on Linux and Windows allows an un...

CVE-2026-10056

CORS misconfiguration in the REST API of Network Optix Nx Witness VMS before version 6.1.2, when running in the default

历史摘要 · 未重新核验 · NVD

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, when RUSTFS_CORS_ALLOWED_ORIGINS is unset, the RustFS S3 listener's ConditionalCorsLayer refl...

CVE-2026-46685

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, when RUSTFS_CORS_ALLOWED_ORIGINS is

历史摘要 · 未重新核验 · NVD

Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790). During the beta phase,...

CVE-2026-9739

Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790). During the beta phase, we implemented `allowed-

历史摘要 · 未重新核验 · GitHub Advisory

Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790). During the beta phase, we implemented `allowed-origins` and `allowed-hosts` flags to align with MCP secu...

CVE-2026-9739

CVE-2026-9739 是一个影响使用 Server-Sent Events (SSE) 的应用程序的 DNS 重新绑定漏洞。在产品的 beta 阶段，开发人员为了遵循 MCP 安全指南，实现了 `allowed-origins` 和

历史摘要 · 未重新核验 · NVD

GitLab MCP Server lets an AI agent talk directly to GitLab. Prior to 0.6.0, the HTTP transport in src/transport.ts ships with no authentication layer at all and a wildcard Acces...

CVE-2026-44895

GitLab MCP Server lets an AI agent talk directly to GitLab. Prior to 0.6.0, the HTTP transport in src/transport.ts ships

历史摘要 · 未重新核验 · NVD

Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, the SSE event server's Access-Control-Allow-Origin response header was hardcoded to the wildcard * regard...

CVE-2026-46431

Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, the SSE event server's Access-Control-Allow-Orig

历史摘要 · 未重新核验 · NVD

Flowise: Hardcoded CORS wildcard on TTS endpoint enables cross-origin credential abuse from any webpage

### Summary The TTS generation endpoint sets `Access-Control-Allow-Origin: *` as a hardcoded response header, independe

历史摘要 · 未重新核验 · GitHub Advisory

Algernon: Auto-refresh SSE event server sets Access-Control-Allow-Origin: *

CVE-2026-46431

### Summary The SSE event server's `Access-Control-Allow-Origin` response header was hardcoded to the wildcard `*` rega

历史摘要 · 未重新核验 · GitHub Advisory

Same-origin policy bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

CVE-2026-8948

Same-origin policy bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 151 and Thunderbird

历史摘要 · 未重新核验 · NVD

Inappropriate implementation in CORS in Google Chrome on Linux and ChromeOS prior to 148.0.7778.168 allowed a remote attacker to leak cross-origin data via a crafted HTML page. ...

CVE-2026-8576

Inappropriate implementation in CORS in Google Chrome on Linux and ChromeOS prior to 148.0.7778.168 allowed a remote att

历史摘要 · 未重新核验 · NVD

Insufficient policy enforcement in ViewTransitions in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromiu...

CVE-2026-8537

Insufficient policy enforcement in ViewTransitions in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to

历史摘要 · 未重新核验 · NVD

Cleanuparr is a tool for automating the cleanup of unwanted or blocked files in Sonarr, Radarr, and supported download clients like qBittorrent. Prior to 2.9.10, Cleanuparr's g...

CVE-2026-44184

Cleanuparr is a tool for automating the cleanup of unwanted or blocked files in Sonarr, Radarr, and supported download c

历史摘要 · 未重新核验 · NVD

@yoda.digital/gitlab-mcp-server's SSE transport has no authentication and wildcard CORS, exposing all 86 GitLab tools

CVE-2026-44895

## SSE Transport Has No Authentication and Wildcard CORS, Exposing All 86 GitLab Tools Including Destructive Operations

历史摘要 · 未重新核验 · GitHub Advisory

A flaw has been found in ChatGPTNextWeb NextChat up to 2.16.1. This impacts an unknown function of the file Next.js of the component API Endpoint. Executing a manipulation can l...

CVE-2026-7643

CVE-2026-7643 影响 ChatGPTNextWeb NextChat 至 2.16.1 版本。漏洞位于 API 端点的 Next.js 文件中，由于不安全的跨域策略配置，攻击者可利用该漏洞发起远程攻击，导致与不可信域名之间的跨域

历史摘要 · 未重新核验 · NVD