Skip to content
Noroxi

CWE-942 · 98 records

Permissive Cross-domain Security Policy with Untrusted Domains

CVEs in this class

98 records

  • CVE-2022-31736
    39Monitor

    A malicious website could have learned the size of a cross-origin resource that supported Range requests.

    CriticalCVSS 9.8No exploitEPSS 1%

    mozilla · firefoxDec 22, 2022

  • CVE-2022-26969
    39Monitor

    In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true.

    CriticalCVSS 9.8No exploitEPSS 0%

    monospace · directusDec 26, 2022

  • CVE-2021-27786
    39Monitor

    HCL OneTest Server is vulnerable to Cross Origin Resource Sharing: Arbitrary Origin Trusted

    CriticalCVSS 9.8No exploitEPSS 0%

    hcltech · onetest serverJun 9, 2022

  • CVE-2024-37131
    39Monitor

    SCG Policy Manager, all versions, contains an overly permissive Cross-Origin Resource Policy (CORP) vulnerability.

    CriticalCVSS 9.8No exploitEPSS 0%

    dell · policy manager for secure connect gatewayJun 13, 2024

  • CVE-2023-50940
    39Monitor

    IBM PowerSC cross-resource origin sharing

    CriticalCVSS 9.8No exploitEPSS 0%

    ibm · powerscFeb 1, 2024

  • CVE-2026-15966
    39Monitor

    Improper CORS handling in MOVEit Transfer

    CriticalCVSS 9.8No exploitEPSS 0%

    progress · moveit transferJul 23, 2026

  • CVE-2025-61163
    39Monitor

    Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with untrusted domains.

    CriticalCVSS 9.8No exploitEPSS 0%

    Aug 26, 2026

  • CVE-2025-27909
    39Monitor

    IBM Concert Software cross-origin resource sharing

    CriticalCVSS 9.8No exploitEPSS 0%

    ibm · concertAug 18, 2025

  • CVE-2026-34449
    38Monitor

    SiYuan: Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection

    CriticalCVSS 9.6No exploitEPSS 0%

    b3log · siyuanMar 31, 2026

  • CVE-2026-61736
    37Monitor

    LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests

    CriticalCVSS 9.3Proof of conceptEPSS 1%

    hkuds · lightragJul 15, 2026

  • CVE-2026-9739
    37Monitor

    Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790).

    CriticalCVSS 9.4No exploitEPSS 0%

    google · mcp toolbox for databasesMay 27, 2026

  • CVE-2026-30924
    36Monitor

    qui CORS Misconfiguration: Arbitrary Origins Trusted

    CriticalCVSS 9.0No exploitEPSS 0%

    getqui · quiMar 19, 2026

  • CVE-2026-8948
    36Monitor

    Same-origin policy bypass in the DOM: Networking component

    CriticalCVSS 9.1No exploitEPSS 0%

    mozilla · firefoxMay 19, 2026

  • CVE-2023-25603
    36Monitor

    A permissive cross-domain policy with untrusted domains vulnerability in Fortinet FortiADC 7.1.0 - 7.1.1, FortiDDoS-F 6.3.0 - 6.3.4 and 6.4.

    CriticalCVSS 9.1No exploitEPSS 0%

    fortinet · fortiadcNov 14, 2023

  • CVE-2023-38125
    35Monitor

    Softing edgeAggregator Permissive Cross-domain Policy with Untrusted Domains Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 1%

    softing · edgeaggregatorMay 2, 2024

  • CVE-2023-46281
    35Monitor

    A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATI

    HighCVSS 8.8No exploitEPSS 0%

    siemens · opcenter qualityDec 12, 2023

  • CVE-2024-41657
    35Monitor

    GHSL-2024-035: Casdoor CORS misconfiguration

    HighCVSS 8.8No exploitEPSS 0%

    casbin · casdoorAug 20, 2024

  • CVE-2023-46098
    35Monitor

    A vulnerability has been identified in SIMATIC PCS neo (All versions < V4.1).

    HighCVSS 8.8No exploitEPSS 0%

    siemens · simatic pcs neoNov 14, 2023

  • CVE-2021-34435
    35Monitor

    In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside the IDE.

    HighCVSS 8.8No exploitEPSS 0%

    eclipse · theiaSep 1, 2021

  • CVE-2026-33010
    35Monitor

    mcp-memory-service's Wildcard CORS with Credentials Enables Cross-Origin Memory Theft

    HighCVSS 8.8No exploitEPSS 0%

    doobidoo · mcp-memory-serviceMar 20, 2026

  • CVE-2026-56076
    34Monitor

    PraisonAI - Cross-Origin Agent Execution via Hardcoded Wildcard CORS and Missing Authentication on AGUI Endpoint

    HighCVSS 8.6No exploitEPSS 0%

    praisonai · praisonaiJun 18, 2026

  • CVE-2024-49763
    34Monitor

    PlexRipper allows API leak due to open CORS policy

    HighCVSS 8.7No exploitEPSS 0%

    plexripper · plexripperDec 2, 2024

  • CVE-2026-82287
    34Monitor

    Rybbit Reflects Any Origin in CORS Responses While Allowing Credentials

    HighCVSS 8.6No exploitEPSS 0%

    rybbit-io · rybbitAug 28, 2026

  • CVE-2026-90882
    34Monitor

    Reflected arbitrary origins with credentials, allowing cross-origin reads of authenticated user data

    HighCVSS 8.7No exploitEPSS 0%

    eclipse foundation · open-vsx.orgSep 22, 2026

  • CVE-2025-30354
    34Monitor

    Bruno ignores Safe-Mode in Asserts expressions

    HighCVSS 8.7No exploitEPSS 0%

    usebruno · brunoApr 1, 2025

All vulnerability classes