An origin validation error vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations.
Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Same-origin policy bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote attacker to exploit cross-origin requests from a malicious webpage to interact with the MLflow Assistant running on a victim's local machine. By bypassing the loopback-only restriction, the attacker can modify the Assistant's configuration to enable full access, which in turn allows the execution of arbitrary commands via the Claude Code sub-agent. This issue is resolved in version 3.10.0.
CVE-2026-42559 is a high-severity vulnerability in the modelcontextprotocol Rust SDK (rmcp crate) prior to version 1.4.0. The Streamable HTTP server transport did not validate the incoming Host header, enabling a DNS rebinding attack. This flaw could allow a malicious website to send authenticated requests to an MCP server running on a victim's loopback or private network interface. The vulnerability is fixed in version 1.4.0. No known exploits in the wild have been reported.
A cross-site scripting (XSS) vulnerability exists in locize client SDK versions prior to 4.0.21. The vulnerability arises because the SDK's message event handler does not validate the origin of postMessage events, relying instead on a sender value within the message payload that can be controlled by an attacker. This allows a malicious web page embedded or embedding a locize-enabled host to send crafted messages that trigger internal handlers, potentially leading to script injection. The issue is fixed in version 4.0.21.
Origin Validation Error vulnerability in TUBITAK BILGEM Software Technologies Research Institute Liderahenk allows Accessing Functionality Not Properly Constrained by ACLs.
This issue affects Liderahenk: from 2.0.1 before 2.0.2.
CVE-2026-43870 is a high-severity vulnerability in Apache Thrift before version 0.23.0 involving multiple security weaknesses: origin validation errors (CWE-346), path traversal (CWE-22), HTTP request/response splitting (CWE-113), and uncontrolled resource consumption (CWE-400). These issues can lead to limited confidentiality, integrity, and availability impacts. The Apache Software Foundation recommends upgrading to version 0.23.0 to address these vulnerabilities.
AgentFlow's local web API accepts non-JSON content types on POST /api/runs and POST /api/runs/validate endpoints without enforcing application/json validation, allowing attackers to bypass trust-boundary enforcement on sensitive operations. Attackers can exploit this content-type validation weakness through browser-driven or local cross-origin requests to abuse the localhost API and enable attack chains against the local control plane.
The LabOne Web Server, backing the LabOne User Interface, contains insufficient input validation in its file access functionality. An unauthenticated attacker could exploit this vulnerability to read arbitrary files on the host system that are accessible to the operating system user running the LabOne software.
Additionally, the Web Server does not sufficiently restrict cross-origin requests, which could allow a remote attacker to trigger file access from a victim's browser by directing the victim to a malicious website.
The vulnerability is only exploitable when the LabOne Web Server is running. Installations using only the LabOne APIs without starting the Web Server are not exposed.
WWBN AVideo versions 29.0 and below have an origin validation vulnerability in their CORS implementation. The incomplete fix for CORS origin validation allows arbitrary Origin headers with credentials to be accepted on all /api/* endpoints. This enables an attacker to perform cross-origin credentialed requests and read authenticated responses containing sensitive user information such as PII, email, admin status, and session data. A fix is available in commit 5e2b897ccac61eb6daca2dee4a6be3c4c2d93e13, but no official patch release information is provided yet.
Apollo MCP Server is a Model Context Protocol server that exposes GraphQL operations as MCP tools. Prior to version 1.7.0, the Apollo MCP Server did not validate the Host header on incoming HTTP requests when using StreamableHTTP transport. In configurations where an HTTP-based MCP server is run on localhost without additional authentication or network-level controls, this could potentially allow a malicious website—visited by a user running the server locally—to use DNS rebinding techniques to bypass same-origin policy restrictions and issue requests to the local MCP server. If successfully exploited, this could allow an attacker to invoke tools or access resources exposed by the MCP server on behalf of the local user. This issue is limited to HTTP-based transport modes (StreamableHTTP). It does not affect servers using stdio transport. The practical risk is further reduced in deployments that use authentication, network-level access controls, or are not bound to localhost. This vulnerability is fixed in 1.7.0.
CVE-2026-35568 is a high-severity vulnerability in the Model Context Protocol (MCP) Java SDK versions prior to 1.0.0. It is a DNS rebinding vulnerability that allows an attacker to access a locally or network-private MCP server through a victim's browser that is local or network adjacent. This enables the attacker to perform any tool call to the MCP server as if they were a locally running MCP-connected AI agent. The vulnerability is fixed in version 1.0.0 of the java-sdk.
SignalK Server versions prior to 2.24.0 contain a vulnerability in the OIDC login and logout handlers where the HTTP Host header is not validated. This allows an attacker to spoof the Host header to manipulate the OAuth2 redirect_uri, potentially stealing OAuth authorization codes and hijacking user sessions. The issue arises because the redirectUri configuration is unset by default, enabling injection of arbitrary domains. This vulnerability has been patched in version 2.24.0.
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.4, ManagedWebAccessUtils.getServer() uses String.startsWith() to match request URLs against configured server URLs for authentication credential dispatch. Because configured server URLs (e.g., http://tx.fhir.org) lack a trailing slash or host boundary check, an attacker-controlled domain like http://tx.fhir.org.attacker.com matches the prefix and receives Bearer tokens, Basic auth credentials, or API keys when the HTTP client follows a redirect to that domain. This issue has been patched in version 6.9.4.
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.66 and 9.7.0-alpha.10, the GraphQL API endpoint does not respect the allowOrigin server option and unconditionally allows cross-origin requests from any website. This bypasses origin restrictions that operators configure to control which websites can interact with the Parse Server API. The REST API correctly enforces the configured allowOrigin restriction. This issue has been patched in versions 8.6.66 and 9.7.0-alpha.10.
CVE-2026-33697 is a high-severity vulnerability in the attested TLS (aTLS) implementation of the CoCoS confidential computing system for AI, affecting versions 0.4.0 through 0.8.2. The vulnerability allows a relay attack due to the extraction of the ephemeral TLS private key during the intra-handshake attestation. This key extraction enables an attacker to impersonate an attested CoCoS service, undermining authentication guarantees and potentially exposing sensitive data or operations. Exploitation requires physical access or advanced side-channel or transient execution attacks. The vulnerability is architectural and affects both AMD SEV-SNP and Intel TDX deployments. No patch or complete workaround is currently available, though some hardening measures can reduce risk.
HCL Traveler is susceptible to a weak default HTTP header validation vulnerability, which could allow an attacker to bypass additional authentication checks.
CVE-2026-32317 is a high-severity vulnerability in Cryptomator for Android versions prior to 1.12.3. It stems from an origin validation error where the client trusted endpoints specified in the vault configuration file without verifying host authenticity. This flaw allows an attacker who can tamper with the vault.cryptomator file to mix legitimate authentication endpoints with malicious API endpoints, leading to token exfiltration via a man-in-the-middle attack during the Hub key loading process. Exploitation requires the attacker to have the capability to alter the vault configuration file and the user to unlock a Hub-backed vault with a vulnerable client version. The vulnerability impacts confidentiality by exposing authentication tokens but does not affect availability. The issue has been patched in version 1.12.
CVE-2026-32318 is a high-severity vulnerability affecting Cryptomator for iOS versions prior to 2.8.3. It involves an origin validation error where the client improperly trusts endpoints specified in the vault configuration file without verifying host authenticity. This flaw allows an attacker who can modify the vault.cryptomator file to tamper with the vault configuration, enabling a man-in-the-middle attack during the Hub key loading process. The attacker could exfiltrate authentication tokens by mixing legitimate and malicious API endpoints. The vulnerability requires the attacker to have the capability to alter the vault file and the user to unlock a Hub-backed vault using an affected client version. The issue has been patched in version 2.8.