Idira Identity Browser Extension (Chrome, Firefox, and Edge builds) versions prior to 26.8.1 exhibit an origin validation flaw within its internal web-page verification routines. If an authenticated user navigates to a specially crafted webpage, this interaction could potentially allow a remote attacker to trigger unauthorized application interaction or execution parameters within the context of that authenticated browser session. CyberArk Security Bulletin: CA26-21
Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking. An attacker can trick an authenticated user into visiting a malicious page, allowing the attacker to execute arbitrary GraphQL operations with the victim's credentials.
Affected versions:
Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.2, a vulnerability chain consisting of Stored XSS and Iframe Sandbox escape in the Xibo CMS allows users with DataSet permissions to use the Data Connector functionality to craft messages which escape the sandbox and facilitate XSS. Exploitation of the vulnerability is possible on behalf of an authorized user who has both of the following privileges, which are not granted to non-admins as standard: Include "Add DataSet" button to allow for additional DataSets to be created independently to Layouts Users should upgrade to version 4.4.2 which fixes this issue. Upgrading to a fixed version is necessary to remediate. Users unable to upgrade should revoke such privileges from users they do not trust.
NLnet Labs ldns 1.2.0 up to and including versions 1.9.0, when used in applications as (stub) resolver over UDP, lacks matching the query destination address and port with the response source address and port. Furthermore not the query ID, neither the question of the query is matched with that of the response. This makes applications, that use ldns for (stub) resolver functionality over UDP, vulnerable for off-path poisoning attacks. The drill tool, which is shipped with ldns, suffers from this vulnerability.
SAP Business Objects Business Intelligence Platform contains an origin validation error that allows authenticated users to supply email sending parameters insufficiently validated, leading to an email spoofing vulnerability. The impact is limited to integrity with no effect on confidentiality or availability. The vulnerability affects versions 2025 and 2027. There is no official patch or remediation level provided yet. The CVSS score is 4.3, indicating medium severity.
CVE-2026-43972 is an origin validation error vulnerability in the ninenines gun HTTP/2 module (gun_http2). It allows a malicious or compromised HTTP/2 server to inject cookies scoped to arbitrary third-party domains into the client's cookie store via unvalidated PUSH_PROMISE authority headers. This violates HTTP/2 protocol requirements and can enable session fixation and potential account takeover without user interaction. The issue affects gun versions from 2.0.0 up to but not including 2.4.0.
CVE-2026-6657 is a medium severity vulnerability in jupyter-server versions 1.12.0 through 2.17.0 that allows bypassing of CORS origin validation when the allow_origin_pat configuration is used. The issue stems from improper use of re.match() for Origin header validation, which only anchors at the start of the string, enabling attacker-controlled domains that mimic trusted domains to bypass checks. This affects multiple code locations including CORS headers, WebSocket connections, referer validation, and login redirects, potentially leading to phishing, unauthorized access, and arbitrary code execution.
### Summary
Cookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect.
### Impact
If a developer uses the `cookies` parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect.
### Workaround
If unable to upgrade, using a `Cookie` header in the `headers` parameter is not vulnerable.
-----
Patch: https://github.com/aio-libs/aiohttp/commit/f54c40851b0d6c4bbdab97ba518a223adda32478
NamelessMC is website software for Minecraft servers. In versions 2.2.4 and prior, the OAuth callback handling does not validate the state parameter server-side before exchanging the authorization code. This allows an attacker to capture a valid OAuth callback URL for their own account and cause a victim's browser to navigate to it, resulting in the victim's session being authenticated as the attacker-linked account (OAuth login CSRF / session swapping). This is patched in version 2.2.5.
SIP signaling stack in Verizon IMS (unspecified version) implements SIP signaling without IPsec integrity protection (missing Security-Client/Security-Server headers and ESP traffic), which allows an on-path attacker to compromise confidentiality, integrity, and authenticity of VoLTE signaling via passive monitoring and active manipulation of unsecured SIP messages over the radio and core network.
Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.4.1 for iOS and 2026.4.4 for Android, he Home Assistant Companion apps for Android and iOS expose a JavaScript bridge to the in-app WebView window.externalApp on Android and webkit.messageHandlers.getExternalAuth (alongside revokeExternalAuth and externalBus) on iOS. Two flaws expose the bridge to all frames (including cross-origin iframes) and unsanitized interpolation of the JavaScript callback identifier allows a cross-origin iframe rendered inside the Companion app to execute arbitrary JavaScript in the Home Assistant frontend's main-frame origin and exfiltrate the signed-in user's access token. This vulnerability is fixed in 2026.4.1 for iOS and 2026.4.4 for Android.
Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5, the default kuma-cp config leaks the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. CorsAllowedDomains: [".*"] reflects any Origin, and LocalhostIsAdmin: true promotes requests from 127.0.0.1 to mesh-system:admin. A cross-origin fetch() from a malicious page returns the admin JWT and signing material. This vulnerability is fixed in 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5.
Dozzle versions prior to 10.5.2 contain an origin validation vulnerability in the WebSocket upgrader for the /exec and /attach endpoints. The CheckOrigin function accepts requests from any origin, combined with a JWT cookie set with SameSite: Lax, enabling Cross-Site WebSocket Hijacking (CSWSH). An attacker on a same-site origin can exploit this to gain interactive shell access to containers accessible by the victim. This vulnerability is fixed in version 10.5.2.
CVE-2026-45207 is a high-severity origin validation vulnerability in the Trend Micro TrendAI Apex One agent (version 2019, 14.0). It allows a local attacker with low privileges to escalate their privileges on the affected system. Exploitation requires the attacker to already have the ability to execute low-privileged code locally. No official patch or remediation guidance has been provided by the vendor at this time. There are no known exploits reported in the wild.
CVE-2026-45206 is an origin validation vulnerability in Trend Micro's Apex One/SEP agent version 2019 (14.0) that allows a local attacker with low privileges to escalate their privileges. The vulnerability arises from improper origin validation in a process protection communication mechanism. It has a high severity rating with a CVSS score of 7.8. Exploitation requires prior ability to execute low-privileged code on the target system. No patch or official remediation has been confirmed yet.
CVE-2026-34930 is a high-severity origin validation vulnerability in Trend Micro's Apex One/SEP agent version 2019, 14.0. It allows a local attacker with limited code execution privileges to escalate their privileges by exploiting improper origin validation in a process protection mechanism. No official patch or remediation guidance is currently available, and no known exploits have been reported in the wild.
CVE-2026-34929 is a high-severity origin validation vulnerability in Trend Micro's Apex One 2019 (14.0) agent. It allows a local attacker with low privileges who can execute code on the system to escalate their privileges. This vulnerability involves improper origin validation in an inter-process communication mechanism distinct from a related CVE-2026-34927. No official patch or remediation guidance has been published yet, and no known exploits have been reported in the wild.
CVE-2026-34928 is a high-severity origin validation vulnerability in Trend Micro TrendAI Apex One/SEP agent version 2019 (14.0). It allows a local attacker with low-privileged code execution to escalate privileges via a named pipe communication mechanism. This issue is related to improper origin validation (CWE-346) and is similar to CVE-2026-34927 but involves a different named pipe. No official patch or remediation guidance is currently available, and no known exploits exist in the wild.
CVE-2026-34927 is an origin validation vulnerability in Trend Micro's TrendAI Apex One version 2019 (14.0) that allows a local attacker with low privileges to escalate privileges on the affected system. Exploitation requires the attacker to already have the ability to execute low-privileged code locally. The vulnerability has a high severity rating with a CVSS score of 7.8. No official patch or remediation guidance has been provided by the vendor. There are no known exploits in the wild at this time.