Search Vulnerabilities

Jan Local API Server CORS Origin Reflection via 0.0.0.0 Binding

Improper CORS handling in MOVEit Transfer

CORS Misconfiguration in DevOps Loop

HCL Aftermarket EPC is vulnerable to attack as the application implements an HTML5 cross-origin resource sharing (CORS) policy for this request tha...

Grav < 1.0.0-rc.16 CORS Misconfiguration via API Plugin

LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests

Permissive Cross-domain Security Policy with Untrusted Domains in ASUS GameSDK allows a remote user to obtain a local user’s NTLM hash by convincin...

Mockoon: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft

Ruflo: Unauthenticated RCE in MCP bridge default docker-compose deployment

HCL DevOps Deploy is susceptible to a Permissive Cross-domain Security Policy with Untrusted Domains

A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Origin Resource Sharing (CORS) misconfiguration found i...

IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to a Permissive Cross-domain Security Policy with Untrusted Domains

Papermark 0.22.0 - CORS Misconfiguration in Viewer Upload Endpoint

Nx: `nx graph` dev server permissive CORS policy

Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)

Hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard

PraisonAI - Cross-Origin Agent Execution via Hardcoded Wildcard CORS and Missing Authentication on AGUI Endpoint

Aqara Developer Portal cross-origin resource sharing

Aqara IAM/SSO Gateway cross-origin resource sharing

CORS misconfiguration in Nx Witness VMS allows session token exfiltration via cross-origin request