CVE-2026-9191 is a critical origin validation vulnerability in Progress Software Corporation's MarkLogic Server. Versions 11.0.0 up to but not including 11.3.7, and 12.0.0 up to but not including 12.1.0, do not properly isolate user-supplied code executed through certain REST and XDBC evaluation paths from HTTP request, response, and session state. This flaw could allow an attacker who can execute code via these paths to perform unauthorized actions or compromise authenticated sessions.
CVE-2026-108269 is a critical origin validation error in Privasys ra-tls-clients prior to version 0.5.0. The vulnerability involves the Rust and Go RA-TLS challenge verifiers accepting attestation quotes that are bound to the certificate public key and client nonce but not to the active TLS session. This flaw allows an attacker who has obtained an enclave TLS private key to relay a genuine quote onto a different connection, causing the client to mistakenly accept an attacker-terminated connection as a valid attested enclave. The issue is fixed in version 0.5.0.
CVE-2026-108268 is an origin validation error in Privasys enclave-os-virtual affecting versions prior to tdx-v0.2.43 and tdx-gpu-v0.6.27. The vulnerability involves the TDX/GPU RA-TLS certificate issuer omitting a value bound to the active TLS session in the quote ReportData, allowing an attacker with the enclave TLS private key to relay a genuine quote onto another connection. This could cause a relying party to accept an attacker-terminated connection as if it were the attested enclave. The issue is fixed in versions tdx-v0.2.43 and tdx-gpu-v0.6.27.
CVE-2026-108267 is an origin validation error in Privasys Go, a fork of the Go programming language with RA-TLS support. Before version 0.5.1-go1.26.5, the RA-TLS certificates in challenge mode did not bind the quote ReportData to the active TLS session, allowing an attacker with an enclave TLS private key to relay a genuine quote onto another connection. This could cause a relying party to mistakenly accept a handshake as an attested enclave connection. The issue is fixed in version 0.5.1-go1.26.5.
CVE-2026-108266 is a critical origin validation error in the Privasys rustls library prior to version 0.8.1. The vulnerability involves RA-TLS challenge certificates whose quote ReportData was bound to the certificate public key and client nonce but not to the active TLS session. This flaw allows an attacker with access to an enclave TLS private key to relay a genuine quote onto another connection, causing a relying party to mistakenly accept an attacker-terminated connection as if it were from the attested enclave. The issue is fixed in Privasys rustls version 0.8.1.
CVE-2026-108265 is a critical origin validation error in Privasys enclave-os-mini, a Rust-based runtime for Intel SGX enclaves. Before version 0.40.0, the SGX runtime's RA-TLS challenge certificate path omitted a value bound to the active TLS session, allowing an attacker with the enclave TLS private key to relay a genuine quote onto another connection. This could cause a relying party to mistakenly accept an attacker-terminated connection as if it were from the attested enclave. The issue is fixed in version 0.40.0.
## Summary
In Nginx UI versions 2.2.0 through 2.5.x, the official bundled reverse-proxy topology did not preserve the external client identity used by Gin. The backend treated the local proxy peer as the client because no trusted proxy was configured, while the proxy supplied the actual address in forwarding headers.
## Impact
This has two distinct effects in bundled-proxy deployments:
* **IP allowlist enforcement:** management API requests forwarded by the bundled proxy were identified as loopback and could pass the loopback exception even when the external source was not in the configured allowlist. Protected management operations still required valid credentials; this did not grant unauthenticated administrator access.
* **Login availability:** failed login attempts from different external sources were attributed to one loopback address. An unauthenticated attacker could therefore trigger the shared temporary login-ban threshold and deny password or OTP login to other users behind the proxy until the ban expired. Existing authenticated sessions were not invalidated.
## Remediation
Upgrade to Nginx UI 2.6.0 or later. The fix explicitly trusts only the intended bundled proxy, validates configured trusted proxies, uses the resolved client address consistently, and fails closed when an IP allowlist is enabled but the client address is invalid.
Fix commit: https://github.com/0xJacky/nginx-ui/commit/e30e331303fc21cf077a2bea724bd79e66892eaf
CVE-2026-107292 is an origin validation error in pydantic-ai affecting versions from 1.34.0 up to but not including 2.30.0. The vulnerability allows DNS rebinding attacks via the Host header in the Agent.to_web() and clai web chat server, enabling a malicious website to interact with a loopback-hosted agent as a same-origin service. This can lead to unauthorized execution of agent tools with local process privileges, causing data disclosure and unwanted side effects. The issue is fixed in versions 1.107.5 and 2.30.0.
Missing Host header validation and missing throttling of failed administrator sign-ins in the REST API listener of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a remote attacker to brute-force the server administrator's password through the administrator's own browser by DNS rebinding. The listener, which is off by default and bound to the loopback when enabled, answered requests whatever their Host header named, and a failed sign-in with the administrator's password from the loopback was neither auto-banned nor delayed. A web page whose host name the attacker rebinds to 127.0.0.1, opened in a browser on the server, can therefore send authenticated requests to the listener, read the answers and try administrator passwords at full speed until one is accepted, giving the attacker full administrative control of the mail server.
Eclipse Ditto Explorer UI versions 3.6.0 to 3.8.13 and 3.9.0 to 3.9.7 have a vulnerability where the UI loads environment configuration from an attacker-controlled URL without user confirmation. This allows an attacker to set malicious OpenID Connect (OIDC) provider settings or API URIs, leading to theft of access and refresh tokens or bearer credentials. The vulnerability is fixed in versions 3.8.14 and 3.9.8.
AsyncHttpClient versions prior to 3.0.13 and 2.16.1 contain an origin validation error affecting connection pooling with NTLM and Negotiate authentication. The connection pool key does not include the authenticated principal, allowing a pooled socket authenticated for one user to be reused by another, causing the server to execute requests under the wrong identity. Basic and Digest authentication methods are not affected. This vulnerability is fixed in versions 3.0.13 and 2.16.1.
AsyncHttpClient versions from 2.0.0 up to 2.16.1 and from 3.0.0 up to but not including 3.0.14 contain an origin validation error related to connection-pool partitioning. This flaw allows reuse of sockets authenticated as different identities in Kerberos, SPNEGO, NTLM, and proxy connections, potentially exposing one user's data or authority to another. The issue is fixed in version 3.0.14.
## Impact
Under certain external upload configurations, Payload could send authentication data to a destination that was not verified as trusted. If the affected request contained a valid session, this could expose that session to an unintended recipient.
**You are affected if:**
- You have enabled external URL-based upload retrieval, where authenticated requests can trigger it.
## Patches
Payload now validates the destination before forwarding authentication data and reapplies that validation when a request changes destination.
Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.
## Workarounds
It is recommended to update all Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.
If you cannot, a valid workaround exists:
- Disable external URL-based upload retrieval where practical.
- If you cannot disable it, configure the upload header filter to remove authentication data from outbound file requests.
- Restrict access to the affected upload functionality.
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with the opt-in Web Clipper server enabled, the server in packages/lib/ClipperServer.ts sends Access-Control-Allow-Origin: * and allows an arbitrary website to call POST /auth and GET /auth/check because the pairing endpoints do not reject HTTP or HTTPS origins. The desktop confirmation dialog does not identify the requesting origin, so a victim who approves the generic prompt authorizes the attacking page, which then receives the permanent API token. The token provides ongoing read and write access to notes, folders, tags, resources, and master keys. This issue is fixed in version 3.7.13.
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the `next dev` development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read the project's disk location, source code snippets from error reports, route inventory, and development logs. Production deployments do not serve this endpoint. This issue is fixed in version 16.3.8.
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read the project's disk location, source code snippets from error reports, route inventory, and development logs. Production deployments do not serve this endpoint. This issue is fixed in version 16.3.8.
Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its path, allowing a victim who activates an untrusted link to navigate a frame to /_capacitor_http_interceptor_. The native proxy can fetch an attacker-selected URL and return the response as a document at the application's own origin, allowing script in that response to access same-origin storage, cookies, and registered Capacitor plugin capabilities. Applications remain affected when CapacitorHttp is disabled because affected releases serve the proxy path regardless of that setting. This issue is fixed in versions 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1.
CVE-2026-102675 is an origin validation error in the Electron framework affecting certain versions prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5. The vulnerability allows responses served through custom protocols with supportFetchAPI enabled but corsEnabled disabled to remain script-readable across origins, potentially exposing sensitive data. This issue completes the remediation of a previous vulnerability (CVE-2026-70604). Applications are only affected if they expose such custom schemes and load untrusted content in the same session. The issue is fixed in the specified versions.
CVE-2026-18825 is a medium severity vulnerability in the connect-cors npm package maintained by github.com/antono. It involves an origin validation error in the middleware that allows attackers to bypass origin verification and perform cross-domain authenticated requests. The affected versions are from 0 up to and including 0.5.6. No patch or fix information is provided in the available data.
DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Versions prior to 0.22.5 expose an unauthenticated HTTP MCP endpoint when started with the documented HTTP transport mode, for example `--transport http --port 8080`. The HTTP server attempts to protect browser-origin access by checking whether the `Origin` hostname equals the `Host` hostname, then reflecting the validated `Origin` into `Access-Control-Allow-Origin`. This does not stop DNS rebinding. After an attacker-controlled hostname rebinds to a victim-accessible DBHub HTTP server, both `Origin` and `Host` can contain the attacker-controlled hostname, so DBHub accepts the request and dispatches MCP tool calls. As a result, a malicious website can deterministically invoke DBHub MCP tools from the victim's browser without prompt injection or model involvement. With the default demo configuration this can read and write the demo SQLite database; with a real configured database, the same primitive can read, enumerate, and potentially write database contents depending on DBHub's configured tool permissions and database credentials. Version 0.22.5 fixes the issue.