Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,075

Export CSV
CVE-2026-126067

Action Pack: Missing SameSite attribute on session cookies from Action Pack session stores

Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack session stores other than ActionDispatch::Session::CookieStore (CacheStore, MemCacheStore, and third-party stores built on AbstractStore, AbstractSecureStore or the session mixins) write the session cookie without a SameSite attribute, regardless of config.action_dispatch.cookies_same_site_protection, which defaults to :lax. Only CookieStore applies the configured policy. In browsers that do not treat a cookie without the attribute as SameSite=Lax, a cross-site request could carry the session cookie, possibly leading to cross-site request forgery against actions that do not verify an authenticity token, such as those of API-only applications. Applications are affected when they use a session store other than CookieStore and do not pass same_site: to config.session_store. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Rails
Products
Rails
CVE-2026-89326

Apache XML Graphics Batik: Check url protocol when loading document

Origin Validation Error vulnerability in Apache XML Graphics Batik: the external resource same-origin check does not compare the URL protocol This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue.

CVSS n/a EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Xml Graphics Batik
CVE-2026-121529

Origin Validation Error Enabling Remote Code Execution in FortiClient

A origin validation error vulnerability in Fortinet FortiClientMac 7.4.0 through 7.4.7, FortiClientWindows 7.4.0 through 7.4.7, FortiClientWindows 7.2.0 through 7.2.14, FortiClientWindowsPAM 7.4.7, FortiClientWindowsPAM 7.2.14 may allow an unauthorized remote attacker to execute unauthorized code or commands. Successful exploitation requires interaction with the victim.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Fortinet
Products
Forticlientmac Forticlientwindows Forticlientwindowspam
CVE-2026-126268

NocoDB before 2026.08.0 IP Address Spoofing via Unconditional Proxy Trust

NocoDB before 2026.08.0 contains an IP address spoofing vulnerability that allows unauthenticated attackers to forge their recorded source IP by supplying X-Forwarded-For headers, because Express trust proxy is enabled unconditionally. Attackers can write arbitrary source addresses into audit and request logs to mislead investigations and evade the per-address public API rate limiter.

CVSS 4.0 · 6.9 Medium EPSS n/a KEV · Not listed
Vendors
Nocodb
Products
Nocodb
CVE-2026-128044

OpenMage magento-lts before 20.18.2 OAuth Callback URL Allowlist Bypass

OpenMage magento-lts before 20.18.2 and 21.x before 21.0.0-beta3 validates OAuth 1.0a oauth_callback URLs with a string-prefix check and falls back to accepting any well-formed URL. Attackers holding a leaked consumer key and secret can supply host-suffix, userinfo, or arbitrary callback URLs to capture an approving administrator's or customer's request token and verifier, then obtain an access token with the victim's API privileges.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-126903

chromium-browser: chromium-browser: Web origin policy bypass via improper state validation in ANGLE

Improper state validation in ANGLE in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-126875

chromium-browser: chromium-browser: Web origin policy bypass via crafted HTML page

Missing authorization in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-126896

chromium-browser: chromium-browser: Web origin policy bypass via crafted HTML page

Missing authorization in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-126862

chromium-browser: chromium-browser: Web origin policy bypass via co-installed application

Improper input validation in Core in Google Chrome on on Android prior to 157.0.8103.78 allowed a local attacker to bypass web origin policy via a co-installed app. (Chromium security severity: High)

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-126854

chromium-browser: chromium-browser: Incorrect authorization in Layout

Incorrect authorization in Layout in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-126855

chromium-browser: chromium-browser: Missing authorization in ImageCapture

Missing authorization in ImageCapture in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-69901

Microsoft Teams for Android Spoofing Vulnerability

Origin validation error in Microsoft Teams for Android allows an unauthorized attacker to perform spoofing over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Teams
CVE-2026-102589

Cross-instance user impersonation through image renderer JWTs

When independent Grafana instances share the same [rendering] renderer_token, an image renderer key issued by one instance is accepted by the others, so a user on one instance could act as the user with the same ID on another (origin validation error). This affects instances with the renderAuthJWT feature toggle enabled, the default from Grafana 13.0.0.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Grafana
Products
Grafana Grafana Enterprise
CVE-2026-65957

Helio: Dashboard sideband CORS origin allowlist matches hostnames by prefix, admitting attacker-controlled origins in open mode

Helio is an MCP proxy that sits between AI agents and the tools they use. Prior to version 0.8.0, the dashboard sideband (default 127.0.0.1:3100) validated CORS request origins by matching the hostname against a private-network string prefix (10., 172.16.–172.31., 192.168.) rather than validating an IP address. A public DNS name such as 192.168.attacker.com, 10.evil.io, or 172.16.pwn.example also satisfies that prefix, so the proxy echoed the attacker origin in Access-Control-Allow-Origin. This issue has been patched in version 0.8.0.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-123801

SuperTokens Core: SAML callback accepts a replayed RelayState + SAMLResponse, minting a fresh authorization code on each replay

SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, SAML.handleCallback does not consume RelayState, record assertion identifiers, or enforce Response.InResponseTo. In the SP-initiated flow, an attacker who obtains a legitimately issued, still-valid SAML response and its matching RelayState can resubmit the pair to /recipe/saml/callback before the assertion's NotOnOrAfter time; in the IdP-initiated flow, the assertion can be replayed without RelayState. The missing Response.InResponseTo check also permits an in-progress login to be completed with an assertion for a different identity and fails to enforce allowIDPInitiatedLogin=false. The callback does not validate Destination or SubjectConfirmationData Recipient and NotOnOrAfter, and each accepted callback mints a fresh, independently redeemable authorization code carrying the captured user's identity. This issue is fixed in versions 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Supertokens
Products
Supertokens
CVE-2026-89058

Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to make credentialed cross-origin requests and read authenticated responses from a victim's session, resulting in a loss of confidentiality.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Apache Camel Quarkus Apicurio Registry Build Keycloak and 24 more
CVE-2026-82811

Toggl OÜ Toggl Track Extension postMessage origin validation

A security vulnerability has been detected in Toggl OÜ Toggl Track Extension up to 4.11.21. This affects an unknown function of the component postMessage Handler. The manipulation leads to origin validation error. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 4.11.22 mitigates this issue. Upgrading the affected component is advised. The vendor confirms, that "[i]t was fixed in 4.11.21 on Chrome and 4.11.22 on Firefox."

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Toggl O
Products
Toggl Track Extension
CVE-2026-123499

Vikunja veans before 2.7.1 Credential Leak via Repo-Controlled .veans.yml Server

Vikunja veans before 2.7.1 contains a credential exposure vulnerability that allows malicious repository authors to capture API tokens by specifying an attacker-controlled server in .veans.yml. When veans runs in an untrusted checkout, it sends VEANS_TOKEN as a Bearer token, or login passwords, TOTP codes and tokens, to that server, granting attackers the victim's Vikunja access.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Vikunja
Products
Vikunja
CVE-2026-124931

Same-origin policy bypass in the DOM: Core & HTML component

Same-origin policy bypass in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—