Threats Tagged 'ghsa-q78p-hj9h-5466'
View all threats tagged with 'ghsa-q78p-hj9h-5466'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'ghsa-q78p-hj9h-5466'
Click on any threat for detailed analysis and mitigation recommendations
GHSA-q78p-hj9h-5466: FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server dataCVE-2026-53656 0 The FiftyOne App server versions prior to 1.17.0 use a wildcard CORS header (Access-Control-Allow-Origin: *) on local server responses, including an unauthenticated /media endpoint that serves local files by path. This allows any website visited by the user to make cross-origin requests to the local FiftyOne server and read arbitrary files accessible to the server process, enabling drive-by data exfiltration without user interaction. The vulnerability is mitigated in FiftyOne 1.17.0 by removing the wildcard CORS header and restricting access to same-origin by default, with cross-origin access requiring explicit configuration. Join the discussion | GCVE Database | 07/15/2026, 21:57:29 UTC Added: 07/16/2026, 10:36:04 UTC |
Showing 1 to 1 of 1 result