CWE-942

CWE-942 · 17 records · 13 with a public proof-of-concept

Records the NVD classes under CWE-942, highest CVSS first.

  1. CRITICAL 9.6CVE-2026-62863public PoC2026-10-30

    MoLing is a computer-use and browser-use based MCP server. Prior to 0.5.0, when MoLing runs in SSE mode using `-l`, its `/sse` and `/message` HTTP endpoints do not authenticate requests and the `mcp-go` dependency sets `Access-Control-Allow-Origin: *`. A malic…

    AI risk analysis on Exploit-DB.ai →

  2. HIGH 8.8CVE-2026-1071552026-11-06

    A permissive cross-domain policy vulnerability has been identified in the SonicOS management interface, which in specific conditions could potentially enable a remote unauthenticated attacker to perform unauthorized operations.

    AI risk analysis on Exploit-DB.ai →

  3. HIGH 8.8CVE-2026-116748public PoC2026-10-26

    Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handle_request() in rpc-server.cc that exposes the X-Transmission-Session-Id anti-CSRF token to any web origin. Malicious web pages can read the token from the 409 handshake response a…

    AI risk analysis on Exploit-DB.ai →

  4. MEDIUM 6.5CVE-2026-84176public PoC2026-10-19

    Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Platform HTTP Vertx component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. createCorsHandler() set Access-Control-Allow-Credentia…

    AI risk analysis on Exploit-DB.ai →

  5. MEDIUM 6.3CVE-2026-111922public PoC2026-10-17

    Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every localhost and 127.0.0.1 port with credentials, even when service.publicurl is set. Attackers controlling a page on any localhost port can send a credentialed request to …

    AI risk analysis on Exploit-DB.ai →

  6. MEDIUM 5.9CVE-2026-119285public PoC2026-10-29

    Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware's validateDomain wildcard matcher in middleware/cors/utils.go strips the scheme and checks only a host suffix without requiring a dot boundary. An applicati…

    AI risk analysis on Exploit-DB.ai →

  7. MEDIUM 5.4CVE-2026-55842public PoC2026-10-15

    Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, the apiCorsConfiguration() method in src/main/java/com/erudika/scoold/ScooldServer.java combines addAllowedOriginPattern("*") with setAllowCredentials(true), causing Spring to reflect…

    AI risk analysis on Exploit-DB.ai →

  8. MEDIUM 4.3CVE-2026-85313public PoC2026-10-19

    Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Jetty component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Setting enableCORS on a Jetty endpoint installed Jetty's CrossOriginFil…

    AI risk analysis on Exploit-DB.ai →

  9. MEDIUM 4.3CVE-2026-662472026-10-01

    iControl is affected by an insecure Cross-Origin Resource Sharing (CORS) policy vulnerability, which could allow a malicious website to execute cross-origin requests with included credentials, enabling an attacker to access and exfiltrate sensitive data within…

    AI risk analysis on Exploit-DB.ai →

  10. LOW 3.7CVE-2026-33032026-10-19

    IBM Concert 1.0 through 3.0.0 uses cross-origin resource sharing (CORS) which could allow an attacker to carry out privileged actions as the domain name is not being limited to only trusted domains.

    AI risk analysis on Exploit-DB.ai →

  11. LOW 3.4CVE-2026-115917public PoC2026-10-26

    vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compatible server configures Starlette CORSMiddleware with allowed_origins set to a wildcard by default. A malicious web page can use a victim's browser to reach an …

    vllm

    AI risk analysis on Exploit-DB.ai →

  12. LOW 3.1CVE-2026-92359public PoC2026-09-16

    A security flaw has been discovered in ag-ui-protocol ag-ui 0.3.0. The affected element is the function create_strands_app of the file integrations/aws-strands/python/src/ag_ui_strands/utils.py of the component CORSMiddleware. The manipulation results in permi…

    AI risk analysis on Exploit-DB.ai →

  13. UNSCOREDCVE-2026-110737public PoC2026-10-27

    The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because Flow configures Atmosphere with DROP_ACCESS_CONTROL_ALLOW_ORIGIN_HEADER set to fals…

    AI risk analysis on Exploit-DB.ai →

  14. UNSCOREDCVE-2026-107858public PoC2026-10-23

    Missing Origin Validation in WebSockets (CWE-1385) and Permissive Cross-domain Policy with Untrusted Domains (CWE-942) in the development web server (ADK Web) in Google Agent Development Kit (ADK) for Java (com.google.adk:google-adk-dev versions 0.1.0 before 1…

    AI risk analysis on Exploit-DB.ai →

  15. UNSCOREDCVE-2026-108372public PoC2026-10-16

    Open and provider-neutral, LoopX is a lightweight state kernel and local-first control plane for loop engineering. From version 0.0.1 until 0.4.5, `loopx serve-status` in `loopx/status_server.py` uses `StatusRequestHandler._send_json()` and `do_OPTIONS()` to s…

    AI risk analysis on Exploit-DB.ai →

  16. UNSCOREDCVE-2026-66070public PoC2026-09-23

    RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, match_origin/1 returned the bare reflected Origin and allowed credentials even when the wildcard "" was configured, so the response echoed the attacker's origin…

    AI risk analysis on Exploit-DB.ai →

  17. UNSCOREDCVE-2026-908822026-09-22

    The open-vsx.org deployment returned Access-Control-Allow-Origin reflecting the requesting origin together with Access-Control-Allow-Credentials: true on the authenticated /user/ endpoints. A page on any origin could therefore issue credentialed requests to th…

    AI risk analysis on Exploit-DB.ai →