CWE-346: Origin Validation Error
The product does not properly verify that the source of data or communication is valid.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- mervinpraison praisonaiPraisonAI: Origin validation bypass in MCP HTTP Stream transport allows browser-mediated unauthenticated tool execution on local MCP server6.9 Medium
- getgrav gravGrav CMS before 2.0.16 Origin Validation Bypass via Referer9.3 Critical
- nicmx fort-validatorFORT-validator Vulnerable to RRDP Shared Snapshot Cache Poisoning7.2 High
- microsoft ufoMicrosoft UFO: DNS Rebinding → Unauthenticated File Read / Command Execution8.8 High
- axllent mailpitMailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)6.5 Medium
- oracle siebel crm, oracle corporation siebel crm cloud applications +1 moreVulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component:...8.1 High
- oracle siebel apps - marketingVulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing)....7.5 High
- mozilla firefox, thunderbird +1 moreSite isolation issue in the Audio/Video: Web Codecs component8.1 High
- mozilla firefox, thunderbird +1 moreSite isolation issue in the Graphics component5.4 Medium
- mozilla firefox, thunderbird +1 moreSite isolation issue in the Graphics: WebRender component5.4 Medium
- mozilla firefox, thunderbird +1 moreSame-origin policy bypass in the Graphics: ImageLib component5.4 Medium
- mozilla firefox, thunderbird +1 moreSame-origin policy bypass in the Audio/Video: Playback component5.4 Medium
- mozilla firefox, thunderbird +1 moreSame-origin policy bypass in the Networking: Cookies component5.4 Medium
- mozilla firefox, thunderbird +1 moreSite isolation issue in the Networking: Cookies component8.1 High
- mozilla firefox, thunderbird +1 moreSite isolation issue in the WebExtensions component8.1 High
- mozilla firefox, thunderbird +1 moreSite isolation issue in the Graphics: CanvasWebGL component7.5 High
- siyuan-note siyuanSiYuan 3.7.3 Cross-Site WebSocket Hijacking via network proxy7.1 High
- nodejs undiciundici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors7.4 High
- tp-link tl-wr820n firmware, tp-link systems inc. tl-wr820n v2 +1 moreReferer Validation Bypass in TL-WR820N Web Management Interface5.3 Medium
- ibm iIBM i is Affected By Multiple Vulnerabilities in Navigator for i8.8 High
- ibm iIBM i is Affected By XML injection flaw in Navigator for i8.1 High
- microsoft windows 11 version 24h2, windows 11 version 25h2, windows 11 version 26h1 +5 more +7 moreWindows Network Address Translation (NAT) Spoofing Vulnerability8.3 High
- typo3 cmsTYPO3 CMS - Broken Access Control in Backend and Install Tool7.3 High
- openyakOpenYak local API: unauthenticated CSRF chain leads to Remote Code Execution9.6 Critical
- elated-themes frappeFrappe: Host header poisoning can redirect magic login links to an attacker-controlled domain8.6 High
- eukaryot sonic3airSonic 3 A.I.R. Missing Source Address Validation in ConnectionManager8.3 High
- livebookJS-view sandboxed output can synthesize keyboard events to trigger unconfirmed global shortcuts8.6 High
- electronElectron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin5.9 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.14, build of keycloak 26.6 +5 more +7 moreKeycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction7.4 High
- google cloud secops (chronicle soar)Privilege Escalation in Google SecOps (Chronicle SOAR) via Crafted Authentication Header9.4 Critical
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Spoofing Vulnerability7.1 High
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Tampering Vulnerability5.4 Medium
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Spoofing Vulnerability5.4 Medium
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Tampering Vulnerability6.8 Medium
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Information Disclosure Vulnerability8.1 High
- guzzleGuzzle: Noncanonical cookie domain keeps subdomain scope6.5 Medium
- ylianst meshcentralMeshCentral Cross-Site WebSocket Hijacking via Origin Validation Bypass on Self-Signed Certificate Deployments8.6 High
- google chromeInsufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72...4.3 Medium
- google chromeInsufficient policy enforcement in USB in Google Chrome on Android prior to 151.0.7922.72 allowed...3.1 Low
- google chromeInappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a...3.1 Low
- google chromeInappropriate implementation in Browser in Google Chrome on Android prior to 151.0.7922.72...3.3 Low
- google chromeInappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote...4.3 Medium
- google chromePolicy bypass in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak...4.3 Medium
- google chromeInappropriate implementation in SVG in Google Chrome prior to 151.0.7922.72 allowed a remote...4.3 Medium
- google chromeInappropriate implementation in Network in Google Chrome prior to 151.0.7922.72 allowed a remote...4.3 Medium
- google chromeInappropriate implementation in CORS in Google Chrome prior to 151.0.7922.72 allowed a remote...3.1 Low
- google chromePolicy bypass in MHTML in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak...4.3 Medium
- google chromeInappropriate implementation in DOMStorage in Google Chrome prior to 151.0.7922.72 allowed a...4.3 Medium
- google chromeInsufficient policy enforcement in DevTools in Google Chrome prior to 151.0.7922.72 allowed an...4.3 Medium
- google chromeInappropriate implementation in Cast in Google Chrome on Android prior to 151.0.7922.72 allowed a...4.3 Medium
- Show moreLoading…