CVE-2026-82121 is an origin validation error vulnerability affecting Hitachi HiRDB Server versions 9 and 10 prior to 10-12-01. The flaw allows an attacker to bypass origin checks, potentially leading to unauthorized data disclosure. The vulnerability has a high severity with a CVSS score of 7.5, indicating network exploitable conditions without privileges or user interaction. A fix is available in HiRDB Server version 10-12-01.
Twisted versions prior to 26.7.0rc1 have a vulnerability in twisted.names.dns.DNSDatagramProtocol where UDP DNS responses are accepted based only on matching transaction IDs without verifying the source host and port. This allows an attacker who can send packets to the resolver's listening port with a correct transaction ID to inject forged DNS answers. The issue is fixed in version 26.7.0rc1.
Uni-CLI versions prior to 0.225.2 exposed a legacy JSON-RPC-over-HTTP transport on localhost without validating browser Origin headers. This allowed malicious web pages to send CORS POST requests to the local /mcp endpoint and execute JSON-RPC commands against the local Uni-CLI server if the MCP HTTP transport was active. The issue was due to inconsistent enforcement of the browser-to-localhost boundary between two HTTP transports. This vulnerability has been fixed in version 0.225.2.
A vulnerability in webpack-dev-server versions before 5.2.7 and in 6.0.0 allows malicious web pages visited by developers to open cross-origin WebSocket connections through the dev server. This occurs because the server forwards non-HMR WebSocket upgrade requests to the proxy target without validating Host or Origin headers, bypassing allowedHosts protections. The issue is fixed in versions 5.2.7 and 6.1.0.
CVE-2026-114125 is a code injection vulnerability in Storybook, a frontend UI component development tool. Versions from 8.0.0 up to but not including 8.6.19, 9.0.0 up to 9.1.21, 10.0.0 up to 10.6.2, and 11.0.0-alpha.0 up to 11.0.0-alpha.6 are affected. The flaw allows a malicious website to interact with the preview iframe of a running Storybook development server due to insufficient iframe embedding and message-origin restrictions. An attacker can cause unauthorized changes to story files if a developer visits and interacts with the malicious site, potentially leading to arbitrary code execution with the developer's privileges when the modified files are executed locally. Fixed versions include 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.
A vulnerability in Electron prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5 allows external protocol URL requests to be misattributed to a different document than the one initiating them. This causes the requestingUrl in session.setPermissionRequestHandler to incorrectly identify trusted content for launches requested by untrusted content. Applications that grant openExternal permissions based on the requesting origin and allow untrusted content to open or navigate windows may be exploited to launch OS-registered external applications.
CVE-2026-113800 is an origin validation error in the Electron framework affecting versions prior to 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5. The flaw causes permission checks for HID and USB devices made from an iframe to incorrectly use the top-level frame's origin instead of the requesting iframe's origin. This can allow a cross-origin untrusted iframe to gain device access intended only for the top-level page. The issue is fixed in the specified versions.
A vulnerability in Electron prior to versions 42.11.9, 43.7.6, 44.5.0, and 45.0.0-alpha.13 allows pointerLock permission requests from some cross-origin iframes to be incorrectly attributed to the top-level frame. This can cause applications embedding untrusted iframe content to grant pointer lock permissions based on the top-level page's identity rather than the actual requesting iframe's origin. Applications that deny pointerLock permissions to untrusted embedded content are not affected. The issue is fixed in the specified versions.
CVE-2026-108372 is an origin validation error in the huangruiteng loopx project affecting versions from 0.0.1 up to but not including 0.4.5. The vulnerability allows a remote attacker to induce an operator visiting attacker-controlled web content to perform cross-origin requests to certain endpoints on the local loopx control plane. This can expose control-plane state, goal and run information, local absolute paths, private Markdown files under registered goal roots, and dry-run configuration projections. The affected endpoints do not allow cross-origin writes or arbitrary file access. The issue is fixed in version 0.4.5.
CVE-2026-109461 is an origin validation error vulnerability in the Microsoft Authentication Library (MSAL) for Node.js. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability affects versions 5.0.0 up to but not including 7.1.0. Microsoft has released an official fix in version 7.1.0. The CVSS 3.1 base score is 5.9, indicating a medium severity level.
CVE-2026-55842 is an origin validation error in the Scoold Q&A platform prior to version 1.69.1. The vulnerability arises from the apiCorsConfiguration() method allowing any origin with credentials, enabling malicious websites to perform authenticated API requests on behalf of logged-in users. This can lead to unauthorized reading of user data and triggering of state-changing operations. The issue is fixed in version 1.69.1.
AliasVault browser extension versions prior to 0.29.4 have a vulnerability where passkey requests are not properly bound to the actual webpage origin or verified against the relying-party identifier. This allows a malicious website to forge these values and, with user approval, obtain a valid passkey assertion for a different site. Exploitation requires the extension to be installed, unlocked, configured as a passkey provider, and the victim to have a stored passkey for the impersonated site. The issue is fixed in version 0.29.4.
A vulnerability in Angular DevTools versions 1.20.0 up to but not including 1.21.1 allows untrusted web pages or third-party content scripts to send messages to the background service worker without proper origin validation. This can let an attacker who knows a valid victim tabId cause the extension to attach the debugger to another browser tab and trigger breakpoints, resulting in JavaScript execution pauses and blocking UI interactions. The issue does not permit remote code execution, privilege escalation, or access to sensitive data. The vulnerability is fixed in Angular versions 1.21.1 and 22.2.0-rc.0.
CVE-2026-96238 is an origin validation error vulnerability in the Microsoft .NET 10.0 runtime and related versions. This flaw allows an unauthorized attacker to bypass a security feature over a network, potentially leading to integrity impact. The vulnerability affects multiple versions of .NET including 8.0, 9.0, 10.0, 11.0, 17.14, and 18.10 branches prior to their respective fixed releases. An official fix is available from Microsoft.
CVE-2026-96234 is an origin validation error vulnerability in the Microsoft .NET 10.0 runtime that allows unauthorized attackers to disclose information over a network. The flaw affects multiple versions of the .NET runtime prior to their respective fixed releases. The vulnerability has a medium severity rating with a CVSS score of 5.3. An official fix is available from Microsoft.
CVE-2026-88132 is an origin validation error vulnerability in Microsoft Azure Key Vault Administration. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability affects multiple versions of the azure-keyvault-administration package prior to fixed releases. A patch is available and has been officially released by Microsoft. The vulnerability has a medium severity rating with a CVSS score of 5.9.
CVE-2026-70213 is an origin validation error vulnerability in Microsoft Power Apps for Android that allows an authorized attacker to execute code over a network. The flaw affects versions from 1.0.0 up to but not including 3.26085.7. A patch is available in version 3.26085.7. The vulnerability has a high severity rating with a CVSS score of 8. Exploitation requires low privileges and user interaction.
CVE-2026-69877 is an origin validation error vulnerability in Microsoft Azure CLI's Azure DevOps component. This flaw allows an unauthorized attacker to disclose sensitive information over a network. The vulnerability has a CVSS v3.1 base score of 6.5, indicating a medium severity level. An official fix is available in version 1.0.7 of Azure CLI. The vendor manages remediation for this cloud-hosted service, and users should apply the update to mitigate the issue.
CVE-2026-108362 is a critical origin validation error in Privasys ra-tls-clients prior to version 0.11.0. The vulnerability allows acceptance of TEE attestation evidence without verifying an explicitly authorized platform identity. This flaw enables an attacker who can forge evidence or extract attestation secrets from a compromised but unrevoked platform to impersonate the attested TLS endpoint. The issue is fixed in version 0.11.0.
CVE-2026-77363 is a high-severity vulnerability in obsidian-tc, a Model Context Protocol server for Obsidian vaults. Versions prior to 1.3.1 do not validate the Host or Origin HTTP headers and lack DNS-rebinding protection in the Streamable HTTP transport. When configured with auth.mode set to none in the documented loopback setup, this allows a malicious web page to send requests to the local MCP endpoint and gain unrestricted access to the vault via the http-local caller. Version 1.3.1 addresses this issue by enabling proper host, origin, and DNS-rebinding validation.