# CWE-346. Every Advisory and CVE whose sources give the weakness CWE-346, newest first. ## Records, newest first (an older page) - [@misskey-dev/summaly allows IP Filter Bypass via Redirect](https://agentprime.io/advisories/GHSA-jqx4-9gpq-rppm.md) `GHSA-jqx4-9gpq-rppm` · npm `@misskey-dev/summaly`: affected `>=5.1.0, <5.2.1`, fixed in `5.2.1` · CVSS 5.3 Medium · Not analysed yet · Published 6 May 2025 · Tags: CWE-346 - [Origin validation error in kitty](https://agentprime.io/advisories/CVE-2025-43929.md) `CVE-2025-43929` · CVE record: kitty project kitty · CVSS 4.1 Medium · Not analysed yet · Published 20 Apr 2025 · Tags: CWE-346 - [Command Injection in iManage Work Desktop for Mac's Agent Service](https://agentprime.io/advisories/CVE-2025-3651.md) `CVE-2025-3651` · CVE record: iManage Work Desktop for Mac · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Apr 2025 · Tags: Information disclosure, CWE-346 - [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2025-3071.md) `CVE-2025-3071` · CVE record: Google Chrome · CVSS 5.4 Medium · Not analysed yet · Published 2 Apr 2025 · Tags: CWE-346 - [xiaomi shop application Webview has code execution vulnerability](https://agentprime.io/advisories/CVE-2024-45354.md) `CVE-2024-45354` · CVE record: Xiaomi Xiaomi shop application · CVSS 4.3 Medium · Not analysed yet · Published 27 Mar 2025 · Tags: CWE-346 - [quick App has intent redriction vulnerability](https://agentprime.io/advisories/CVE-2024-45353.md) `CVE-2024-45353` · CVE record: Xiaomi quick app framework · CVSS 4.3 Medium · Not analysed yet · Published 27 Mar 2025 · Tags: CWE-346 - [Xiaomi smarthome application Webview has code execution vulnerability](https://agentprime.io/advisories/CVE-2024-45352.md) `CVE-2024-45352` · CVE record: Xiaomi Xiaomi smarthome application · CVSS 8.8 High · Not analysed yet · Published 27 Mar 2025 · Tags: CWE-346 - [Prefect CORS (Cross-Origin Resource Sharing) misconfiguration](https://agentprime.io/advisories/GHSA-4v9f-r55g-g6hc.md) `GHSA-4v9f-r55g-g6hc`, `CVE-2024-8183`, `PYSEC-2026-1800` · PyPI `prefect`: affected `<2.20.17 || >=3.0.0rc1, <3.0.3`, fixed in `2.20.17`, `3.0.3` · CVSS 7.6 High · Not analysed yet · Published 20 Mar 2025 · Tags: CWE-346 - [Flask-CORS allows for inconsistent CORS matching](https://agentprime.io/advisories/GHSA-8vgw-p6qm-5gr7.md) `GHSA-8vgw-p6qm-5gr7`, `CVE-2024-6844`, `PYSEC-2026-1385` · PyPI `flask-cors`: affected `<6.0.0`, fixed in `6.0.0` · CVSS 5.3 Medium · Not analysed yet · Published 20 Mar 2025 · Tags: CWE-346 - [Feast Cross-Origin Resource Sharing vulnerability](https://agentprime.io/advisories/GHSA-wxpc-2674-rxvw.md) `GHSA-wxpc-2674-rxvw`, `CVE-2024-11602`, `PYSEC-2026-1367` · PyPI `feast`: affected `<=0.40.0`, no fixed version yet · CVSS 7.4 High · Not analysed yet · Published 20 Mar 2025 · Tags: CWE-346 - [A Cross-Origin Resource Sharing (CORS) vulnerability exists in modelscope/agentscope version v0.0.4. The CORS configuration on the agentscope server does not properly restrict access to only truste...](https://agentprime.io/advisories/GHSA-75v5-6885-59f9.md) `GHSA-75v5-6885-59f9`, `CVE-2024-8487`, `PYSEC-2025-81` · PyPI `agentscope`: affected `<=0.0.4`, no fixed version yet · CVSS 7.4 High · Not analysed yet · Published 20 Mar 2025 · Tags: CWE-346 - [Cross-Site WebSocket Hijacking in binary-husky/gpt_academic](https://agentprime.io/advisories/CVE-2024-10956.md) `CVE-2024-10956` · CVE record: binary-husky binary-husky/gpt_academic · CVSS 7.6 High · Not analysed yet · Published 20 Mar 2025 · Tags: CWE-346 - [CORS Misconfiguration in netease-youdao/qanything](https://agentprime.io/advisories/CVE-2024-8024.md) `CVE-2024-8024` · CVE record: netease-youdao netease-youdao/qanything · CVSS 7.5 High · Not analysed yet · Published 20 Mar 2025 · Tags: CWE-346 - [CORS Misconfiguration in danswer-ai/danswer](https://agentprime.io/advisories/CVE-2024-7819.md) `CVE-2024-7819` · CVE record: danswer-ai danswer-ai/danswer · CVSS 7.4 High · Not analysed yet · Published 20 Mar 2025 · Tags: CWE-346 - [IROAD Dash Cam X5/Dash Cam X6 Domain origin validation](https://agentprime.io/advisories/CVE-2025-2346.md) `CVE-2025-2346` · CVE record: IROAD Dash Cam X5 and 1 more · CVSS 6.3 Medium · Not analysed yet · Published 16 Mar 2025 · Tags: CWE-345, CWE-346 - [Misskey's Incomplete Patch of CVE-2024-52591 Leads to Forgery of Federated Notes](https://agentprime.io/advisories/CVE-2025-25306.md) `CVE-2025-25306` · CVE record: misskey-dev misskey · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Mar 2025 · Tags: CWE-346, CWE-441, CWE-1025 - [Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the CORS middleware is setup incorrectly. All origins are reflected, which allows any website to send cross site requests t...](https://agentprime.io/advisories/GHSA-59qh-fmm7-3g9q.md) `GHSA-59qh-fmm7-3g9q`, `CVE-2025-25302`, `PYSEC-2025-25` · PyPI `rembg`: affected `<2.0.58`, fixed in `2.0.58` · CVSS 8.7 High · Not analysed yet · Published 3 Mar 2025 · Tags: CWE-346 - [Origin validation error in Ubiquiti Inc UniFi Protect Cameras](https://agentprime.io/advisories/CVE-2025-23117.md) `CVE-2025-23117` · CVE record: Ubiquiti Inc UniFi Protect Cameras · CVSS 6.8 Medium · Not analysed yet · Published 1 Mar 2025 · Tags: CWE-346 - [Origin validation error in Q-Free MaxTime](https://agentprime.io/advisories/CVE-2025-1102.md) `CVE-2025-1102` · CVE record: Q-Free MaxTime · CVSS 5.5 Medium · Not analysed yet · Published 12 Feb 2025 · Tags: CWE-346 - [esbuild enables any website to send any requests to the development server and read the response](https://agentprime.io/advisories/GHSA-67mh-4wv8-2f99.md) `GHSA-67mh-4wv8-2f99` · npm `esbuild`: affected `<0.25.0`, fixed in `0.25.0` · CVSS 5.3 Medium · Not analysed yet · Published 10 Feb 2025 · Tags: CWE-346 - [Mindskip xzs-mysql 学之思开源考试系统 CORS cross-domain policy](https://agentprime.io/advisories/CVE-2025-1083.md) `CVE-2025-1083` · CVE record: Mindskip xzs-mysql 学之思开源考试系统 · CVSS 2.3 Low · Not analysed yet · Published 6 Feb 2025 · Tags: CWE-346, CWE-942 - [Anonymous cache poisoning via XHR requests in Discourse](https://agentprime.io/advisories/CVE-2024-55948.md) `CVE-2024-55948` · CVE record: discourse discourse · CVSS 8.2 High · Not analysed yet · Published 4 Feb 2025 · Tags: CWE-346 - [Anonymous cache poisoning via request headers in Discourse](https://agentprime.io/advisories/CVE-2025-23023.md) `CVE-2025-23023` · CVE record: discourse discourse · CVSS 8.2 High · Not analysed yet · Published 4 Feb 2025 · Tags: CWE-346 - [Origin validation error in axios](https://agentprime.io/advisories/CVE-2024-57965.md) `CVE-2024-57965` · CVE record: axios axios · CVSS 0.0 None · Not analysed yet · Published 29 Jan 2025 · Tags: CWE-346 - [Origin validation error in Oracle Corporation Oracle Communications Order and Service Management](https://agentprime.io/advisories/CVE-2025-21542.md) `CVE-2025-21542` · CVE record: Oracle Corporation Oracle Communications Order and Service Management · CVSS 6.3 Medium · Not analysed yet · Published 21 Jan 2025 · Tags: CWE-346 - [Origin validation error in Oracle Corporation JD Edwards EnterpriseOne Tools](https://agentprime.io/advisories/CVE-2025-21511.md) `CVE-2025-21511` · CVE record: Oracle Corporation JD Edwards EnterpriseOne Tools · CVSS 7.5 High · Not analysed yet · Published 21 Jan 2025 · Tags: CWE-346 - [Origin validation error in Oracle Corporation MySQL Server](https://agentprime.io/advisories/CVE-2025-21497.md) `CVE-2025-21497` · CVE record: Oracle Corporation MySQL Server · CVSS 5.5 Medium · Not analysed yet · Published 21 Jan 2025 · Tags: CWE-346 - [Origin validation error in Oracle Corporation JD Edwards EnterpriseOne Tools](https://agentprime.io/advisories/CVE-2024-21245.md) `CVE-2024-21245` · CVE record: Oracle Corporation JD Edwards EnterpriseOne Tools · CVSS 5.4 Medium · Not analysed yet · Published 21 Jan 2025 · Tags: CWE-346 - [Websites were able to send any requests to the development server and read the response in vite](https://agentprime.io/advisories/GHSA-vg6x-rcgg-rjx6.md) `GHSA-vg6x-rcgg-rjx6`, `CVE-2025-24010` · npm `vite`: affected `<4.5.6 || >=5.0.0, <5.4.12 || >=6.0.0, <6.0.9`, fixed in `4.5.6`, `5.4.12`, `6.0.9` · CVSS 6.5 Medium · Not analysed yet · Published 21 Jan 2025 · Tags: CWE-346, CWE-350, CWE-1385 - [Origin validation error in Fortinet FortiProxy and others](https://agentprime.io/advisories/CVE-2023-46715.md) `CVE-2023-46715` · CVE record: Fortinet FortiProxy and 1 more · CVSS 4.7 Medium · Not analysed yet · Published 14 Jan 2025 · Tags: CWE-346 - [Address bar spoofing on iOS using long hostnames](https://agentprime.io/advisories/CVE-2025-23109.md) `CVE-2025-23109` · CVE record: Mozilla Firefox for iOS · CVSS 6.5 Medium · Not analysed yet · Published 11 Jan 2025 · Tags: CWE-346 - [Origin validation error in Trend Micro, Inc. Trend Micro Apex One and others](https://agentprime.io/advisories/CVE-2024-55917.md) `CVE-2024-55917` · CVE record: Trend Micro, Inc. Trend Micro Apex One and 1 more · CVSS 7.8 High · Not analysed yet · Published 31 Dec 2024 · Tags: CWE-346 - [Origin validation error in Oracle Corporation Oracle Linux](https://agentprime.io/advisories/CVE-2022-21505.md) `CVE-2022-21505` · CVE record: Oracle Corporation Oracle Linux · CVSS 6.7 Medium · Not analysed yet · Published 24 Dec 2024 · Tags: CWE-346 - [Improper input validation in Huawei CV81-WDM FW](https://agentprime.io/advisories/CVE-2022-32144.md) `CVE-2022-32144` · CVE record: Huawei CV81-WDM FW · CVSS 8.6 High · Not analysed yet · Published 20 Dec 2024 · Tags: CWE-20, CWE-346 - [A validation integrity issue was discovered in Fort through 1.6.4 before 2.0.0.](https://agentprime.io/advisories/CVE-2024-56170.md) `CVE-2024-56170` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 18 Dec 2024 · Tags: CWE-346 - [Origin validation error in Apple Safari and others](https://agentprime.io/advisories/CVE-2024-44212.md) `CVE-2024-44212` · CVE record: Apple Safari and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 11 Dec 2024 · Tags: CWE-346 - [Origin validation error in Apple macOS](https://agentprime.io/advisories/CVE-2024-54490.md) `CVE-2024-54490` · CVE record: Apple macOS · CVSS 5.5 Medium · Not analysed yet · Published 11 Dec 2024 · Tags: CWE-346 - [pnpm no-script global cache poisoning via overrides / \`ignore-scripts\` evasion](https://agentprime.io/advisories/GHSA-vm32-9rqf-rh3r.md) `GHSA-vm32-9rqf-rh3r`, `CVE-2024-53866` · npm `pnpm`: affected `<9.15.0`, fixed in `9.15.0` · CVSS 5.8 Medium · Not analysed yet · Published 10 Dec 2024 · Tags: CWE-346, CWE-426 - [MSA FieldServer Gateway 5.0.0 through 6.5.2 allows cross-origin WebSocket hijacking.](https://agentprime.io/advisories/CVE-2024-45495.md) `CVE-2024-45495` · CVE record · CVSS 4.3 Medium · Not analysed yet · Published 29 Nov 2024 · Tags: CWE-346 - [An issue in KIA Seltos vehicle instrument cluster with software and hardware v1.0 allows attackers to cause a Denial of Service (DoS) via ECU reset UDS service.](https://agentprime.io/advisories/CVE-2024-51072.md) `CVE-2024-51072` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 22 Nov 2024 · Tags: CWE-346 - [Improper Access Control in Dataprom Informatics' PACS-ACSS](https://agentprime.io/advisories/CVE-2024-10534.md) `CVE-2024-10534` · CVE record: Dataprom Informatics Personnel Attendance Control Systems (PACS) / Access Control Security Systems (ACSS) · CVSS 8.6 High · Not analysed yet · Published 15 Nov 2024 · Tags: CWE-346 - [An issue in kodbox v.1.52.04 and before allows a remote attacker to obtain sensitive information via the captcha feature in the password reset function.](https://agentprime.io/advisories/CVE-2024-51037.md) `CVE-2024-51037` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 15 Nov 2024 · Tags: CWE-346 - [lilishop <=4.2.4 is vulnerable to Incorrect Access Control, which can allow attackers to obtain coupons beyond the quantity limit by capturing and sending the data packets for coupon collection in hi…](https://agentprime.io/advisories/CVE-2024-50654.md) `CVE-2024-50654` · CVE record · CVSS 7.5 High · Not analysed yet · Published 15 Nov 2024 · Tags: CWE-346 - [Data Leak through CORS Misconfiguration in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-6674.md) `CVE-2024-6674` · CVE record: parisneo parisneo/lollms-webui · CVSS 8.1 High · Not analysed yet · Published 29 Oct 2024 · Tags: CWE-346 - [Origin validation error in Mozilla Firefox and others](https://agentprime.io/advisories/CVE-2024-10460.md) `CVE-2024-10460` · CVE record: Mozilla Firefox and 2 more · CVSS 5.4 Medium · Not analysed yet · Published 29 Oct 2024 · Tags: CWE-346 - [Incorrect access control in Mirotalk before commit 9de226 allows attackers to arbitrarily change usernames via sending a crafted roomAction request to the server.](https://agentprime.io/advisories/CVE-2024-44734.md) `CVE-2024-44734` · CVE record · CVSS 7.5 High · Not analysed yet · Published 11 Oct 2024 · Tags: CWE-346 - [Gradio's CORS origin validation accepts the null origin](https://agentprime.io/advisories/GHSA-89v2-pqfv-c5r9.md) `GHSA-89v2-pqfv-c5r9`, `CVE-2024-47165`, `PYSEC-2024-214` · PyPI `gradio`: affected `<5.0.0`, fixed in `5.0.0` · CVSS 6.9 Medium · Not analysed yet · Published 10 Oct 2024 · Tags: Broken access control, CWE-346 - [Gradios's CORS origin validation is not performed when the request has a cookie](https://agentprime.io/advisories/GHSA-3c67-5hwx-f6wx.md) `GHSA-3c67-5hwx-f6wx`, `CVE-2024-47084`, `PYSEC-2024-196` · PyPI `gradio`: affected `<4.44.0`, fixed in `4.44.0` · CVSS 6.9 Medium · Not analysed yet · Published 10 Oct 2024 · Tags: Broken access control, CWE-346 - [Origin validation error in Mozilla Firefox and others](https://agentprime.io/advisories/CVE-2024-9393.md) `CVE-2024-9393` · CVE record: Mozilla Firefox and 2 more · CVSS 7.5 High · Not analysed yet · Published 1 Oct 2024 · Tags: CWE-346 - [Origin validation error in Mozilla Firefox and others](https://agentprime.io/advisories/CVE-2024-9392.md) `CVE-2024-9392` · CVE record: Mozilla Firefox and 2 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2024 · Tags: CWE-346 - [Origin validation error in Apple Safari and others](https://agentprime.io/advisories/CVE-2024-44187.md) `CVE-2024-44187` · CVE record: Apple Safari and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 16 Sept 2024 · Tags: CWE-346 - [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2024-7978.md) `CVE-2024-7978` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 21 Aug 2024 · Tags: CWE-346 - [Tailscale Windows daemon is vulnerable to RCE via CSRF in tailscale.com](https://agentprime.io/advisories/GHSA-vqp6-rc3h-83cp.md) `GHSA-vqp6-rc3h-83cp`, `CVE-2022-41924`, `GO-2022-1120` · Go `tailscale.com`: affected `<1.32.3`, fixed in `1.32.3` · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Aug 2024 · Tags: Cross-site request forgery (CSRF), CWE-346 - [Gnuboard g6 6.0.7 is vulnerable to Session hijacking due to a CORS misconfiguration.](https://agentprime.io/advisories/CVE-2024-41475.md) `CVE-2024-41475` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Aug 2024 · Tags: CWE-346 - [Local Privilege Escalation on Zscaler Client Connector on Windows](https://agentprime.io/advisories/CVE-2024-23458.md) `CVE-2024-23458` · CVE record: Zscaler Client Connector · CVSS 7.3 High · Not analysed yet · Published 6 Aug 2024 · Tags: CWE-346 - [Flowise Cors Misconfiguration in packages/server/src/index.ts](https://agentprime.io/advisories/GHSA-66f2-xxgm-f6xp.md) `GHSA-66f2-xxgm-f6xp`, `CVE-2024-36421` · npm `flowise`: affected `<=1.4.3`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 5 Aug 2024 · Tags: CWE-346 - [Origin validation error in Sky Co.,LTD. SKYSEA Client View](https://agentprime.io/advisories/CVE-2024-41143.md) `CVE-2024-41143` · CVE record: Sky Co.,LTD. SKYSEA Client View · CVSS 7.8 High · Not analysed yet · Published 29 Jul 2024 · Tags: CWE-346 - [Permissions and Access Control Vulnerability in ZTE ZXCLOUD IRAI](https://agentprime.io/advisories/CVE-2024-22062.md) `CVE-2024-22062` · CVE record: ZTE ZXCLOUD IRAI · CVSS 6.3 Medium · Not analysed yet · Published 9 Jul 2024 · Tags: CWE-346 - [Data leak through CORS misconfiguration in stitionai/devika](https://agentprime.io/advisories/CVE-2024-5549.md) `CVE-2024-5549` · CVE record: stitionai stitionai/devika · CVSS 8.1 High · Not analysed yet · Published 9 Jul 2024 · Tags: CWE-346 - [Gin mishandles a wildcard at the end of an origin string](https://agentprime.io/advisories/GHSA-869c-j7wc-8jqv.md) `GHSA-869c-j7wc-8jqv`, `CVE-2019-25211`, `GO-2024-2955` · Go `github.com/gin-contrib/cors` and 1 more: affected `<1.6.0`, fixed in `1.6.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2024 · Tags: CWE-346 Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .