CWE-346

A CORS misconfiguration vulnerability exists in netease-youdao/qanything version 1.4.1. This vulnerability allows an att

Autel MaxiCharger AC Wallbox Commercial Origin Validation Error Authentication Bypass Vulnerability. This vulnerability

Whale browser before 4.32.315.22 allow an attacker to bypass the Same-Origin Policy in a dual-tab environment.

Whale browser before 4.33.325.17 allows an attacker to bypass the Same-Origin Policy in a dual-tab environment.

Whale browser before 4.35.351.12 allows an attacker to bypass the Same-Origin Policy in a sidebar environment.

A Cross-Origin Resource Sharing (CORS) vulnerability exists in feast-dev/feast version 0.40.0. The CORS configuration on

A CORS misconfiguration in danswer-ai/danswer v1.4.1 allows attackers to steal sensitive information such as chat conten

SEL-5037 Grid Configurator contains an overly permissive Cross Origin Resource Sharing (CORS) configuration for a data g

A flaw was found in WebKitGTK. This vulnerability allows remote, user-assisted information disclosure that can reveal an

An improper verification of a loaded library in Zscaler Client Connector on Mac < 4.2.0.241 may allow a local attacker t

Hosts listed in TrustedOrigins implicitly allow requests from the corresponding HTTP origins, allowing network MitMs to

Origin Validation Error vulnerability in Akinsoft LimonDesk allows Forceful Browsing. This issue affects LimonDesk: fro

GPT Academy version 3.83 in the binary-husky/gpt_academic repository is vulnerable to Cross-Site WebSocket Hijacking (CS

A flaw was found in Keycloak. When an authenticated attacker attempts to merge accounts with another existing account du

An Insufficient Firmware Update Validation vulnerability could allow an authenticated malicious actor with access to Uni

An Origin Validation Error vulnerability in an insufficient protected file of Juniper Networks Junos OS on EX4600 Series

Long hostnames in URLs could be leveraged to obscure the actual host of the website or spoof the website address. This v

Vite is a frontend tooling framework for javascript. Vite allowed any websites to send any requests to the development s

Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the CORS middleware is setup incorrectly. All

webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version

Inappropriate implementation in File Picker in Google Chrome prior to 139.0.7258.127 allowed a remote attacker who convi

npm parcel 2.0.0-alpha and before has an Origin Validation Error vulnerability. Malicious websites can send XMLHTTPReque

A logic error exists in the Falcon sensor for Windows that could allow an attacker, with the prior ability to execute co

Improper Authentication in Liferay Portal 7.4.0 through 7.4.3.132, and older unsupported versions, and Liferay DXP 2023.

Same-origin policy bypass in the Request Handling component. This vulnerability was fixed in Firefox 146, Firefox ESR 11

Vulnerability in the Oracle Communications Order and Service Management product of Oracle Communications Applications (c

A flaw has been found in CodeCanyon/ui-lib Mentor LMS up to 1.1.1. Affected by this vulnerability is an unknown function

Nagios XI versions prior to 2024R1.2.2 contain a host header injection vulnerability. The application trusts the user-su

IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the networ

A vulnerability has been found in IROAD Dash Cam X5 and Dash Cam X6 up to 20250308 and classified as problematic. This v

Origin validation error vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.3-13973 allows local users

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are

A CWE-346 "Origin Validation Error" in the CORS configuration in Q-Free MaxTime less than or equal to version 2.11.0 all

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC).

Inappropriate implementation in Navigations in Google Chrome prior to 135.0.7049.52 allowed a remote attacker who convin

Inappropriate implementation in Downloads in Google Chrome on Windows prior to 140.0.7339.80 allowed a remote attacker t

A vulnerability in corydolphin/flask-cors version 4.0.1 allows for inconsistent CORS matching due to the handling of the

The security settings in the SAP Business One Integration Framework are not adequately checked, allowing attackers to by

HCL BigFix SaaS Authentication Service is vulnerable to cache poisoning.  The BigFix SaaS's HTTP responses were observe

A vulnerability was identified in chatwoot up to 4.7.0. This vulnerability affects the function initPostMessageCommunica

An origin validation error [CWE-346] vulnerability in Fortinet FortiOS IPSec VPN version 7.4.0 through 7.4.1 and versio

Origin Validation Error vulnerability in Akinsoft OctoCloud allows HTTP Response Splitting, CAPEC - 87 - Forceful Browsi

An intent redriction vulnerability exists in the Xiaomi quick App framework application product. The vulnerability is ca

A code execution vulnerability exists in the Xiaomi shop applicationproduct. The vulnerability is caused by improper inp

A vulnerability, which was classified as problematic, was found in Zylon PrivateGPT up to 0.6.2. This affects an unknown

Error handling for script execution was incorrectly isolated from web content, which could have allowed cross-origin lea

A vulnerability in the Device Analytics action frame processing of Cisco Wireless Access Point (AP) Software could allow

Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by t

open_actions.py in kitty before 0.41.0 does not ask for user confirmation before running a local executable file that ma

A vulnerability classified as problematic has been found in gradio-app gradio up to 5.29.1. This affects the function is