# CWE-346.

Every Advisory and CVE whose sources give the weakness CWE-346, newest first.

## Records, newest first (an older page)

- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-11133.md)
  `CVE-2026-11133` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-11132.md)
  `CVE-2026-11132` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-11084.md)
  `CVE-2026-11084` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: Cross-site request forgery (CSRF), CWE-346
- [Cross-site request forgery in Google Chrome](https://agentprime.io/advisories/CVE-2026-11083.md)
  `CVE-2026-11083` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: Cross-site request forgery (CSRF), CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-11081.md)
  `CVE-2026-11081` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-11048.md)
  `CVE-2026-11048` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-11036.md)
  `CVE-2026-11036` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-11032.md)
  `CVE-2026-11032` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: CWE-346
- [Cross-site request forgery in Google Chrome](https://agentprime.io/advisories/CVE-2026-11020.md)
  `CVE-2026-11020` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: Cross-site request forgery (CSRF), CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-10996.md)
  `CVE-2026-10996` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-10937.md)
  `CVE-2026-10937` · CVE record: Google Chrome · CVSS 8.1 High · Not analysed yet · Published 4 Jun 2026 · Tags: CWE-346
- [AdGuard Home: DoQ-to-UDP State Reduction and Source-Port Oracle](https://agentprime.io/advisories/GHSA-xgx4-4h9w-53pv.md)
  `GHSA-xgx4-4h9w-53pv`, `CVE-2026-47703`, `GO-2026-5756` · Go `github.com/AdguardTeam/AdGuardHome` and 1 more: affected `<0.107.75`, fixed in `0.107.75` · CVSS 6.3 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: Weak cryptography or TLS, Race condition, CWE-346, CWE-662
- [AIOHTTP is vulnerable to cross-origin redirect with per-request cookies](https://agentprime.io/advisories/GHSA-hg6j-4rv6-33pg.md)
  `GHSA-hg6j-4rv6-33pg`, `CVE-2026-47265`, `PYSEC-2026-2105` · PyPI `aiohttp`: affected `<3.14.0`, fixed in `3.14.0` · CVSS 6.6 Medium · Not analysed yet · Published 3 Jun 2026 · Tags: CWE-346
- [Duplicate Advisory: jupyter-server is vulnerable to CORS origin validation bypass when the \`allow_origin_pat\` configuration is used](https://agentprime.io/advisories/GHSA-v42x-x7jp-845h.md)
  `GHSA-v42x-x7jp-845h`, `CVE-2026-6657`, `PYSEC-2026-3472` · PyPI `jupyter-server`: affected `>=1.12.0, <=2.17.0`, no fixed version yet · CVSS 6.1 Medium · Withdrawn · Not analysed yet · Published 3 Jun 2026 · Tags: CWE-346
- [NamelessMC: OAuth callback \`state\` is not validated, allowing login CSRF / session swapping](https://agentprime.io/advisories/CVE-2026-34460.md)
  `CVE-2026-34460` · CVE record: NamelessMC Nameless · CVSS 5.4 Medium · Not analysed yet · Published 2 Jun 2026 · Tags: Cross-site request forgery (CSRF), CWE-302, CWE-346
- [Home Assistant: Cross-origin iframe access token exfiltration via WebView JS bridge callback injection](https://agentprime.io/advisories/CVE-2026-44698.md)
  `CVE-2026-44698` · CVE record: home-assistant core and 2 more · CVSS 8.3 High · Not analysed yet · Published 29 May 2026 · Tags: Code injection, CWE-346, CWE-749, CWE-940
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-10010.md)
  `CVE-2026-10010` · CVE record: Google Chrome · CVSS 5.0 Medium · Not analysed yet · Published 28 May 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-9989.md)
  `CVE-2026-9989` · CVE record: Google Chrome · CVSS 6.3 Medium · Not analysed yet · Published 28 May 2026 · Tags: CWE-346
- [RustFS: Reflective CORS with credentials on S3 listener; unauthenticated license metadata endpoint on console](https://agentprime.io/advisories/CVE-2026-46685.md)
  `CVE-2026-46685` · CVE record: rustfs rustfs · CVSS 6.0 Medium · Not analysed yet · Published 28 May 2026 · Tags: Authentication bypass, CWE-346, CWE-942
- [Origin validation error in Synology Assistant](https://agentprime.io/advisories/CVE-2025-66593.md)
  `CVE-2025-66593` · CVE record: Synology Synology Assistant · CVSS 6.1 Medium · Not analysed yet · Published 27 May 2026 · Tags: CWE-346
- [Origin validation error in Synology Active Backup for Business Agent](https://agentprime.io/advisories/CVE-2025-66592.md)
  `CVE-2025-66592` · CVE record: Synology Synology Active Backup for Business Agent · CVSS 6.1 Medium · Not analysed yet · Published 27 May 2026 · Tags: CWE-346
- [Origin validation error in Synology ActiveProtect Agent](https://agentprime.io/advisories/CVE-2025-13593.md)
  `CVE-2025-13593` · CVE record: Synology ActiveProtect Agent · CVSS 6.1 Medium · Not analysed yet · Published 27 May 2026 · Tags: CWE-346
- [Microsoft Entra ID Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-42901.md)
  `CVE-2026-42901` · CVE record: Microsoft Microsoft Entra · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 May 2026 · Tags: CWE-346
- [Network-AI: Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret](https://agentprime.io/advisories/GHSA-j3vx-cx2r-pvg8.md)
  `GHSA-j3vx-cx2r-pvg8`, `CVE-2026-46701` · npm `network-ai`: affected `<5.4.5`, fixed in `5.4.5` · CVSS 7.6 High · Not analysed yet · Published 21 May 2026 · Tags: CWE-346
- [Origin validation error in Trend Micro, Inc. TrendAI Apex One and others](https://agentprime.io/advisories/CVE-2026-45207.md)
  `CVE-2026-45207` · CVE record: Trend Micro, Inc. TrendAI Apex One and 1 more · CVSS 7.8 High · Not analysed yet · Published 21 May 2026 · Tags: CWE-346
- [Origin validation error in Trend Micro, Inc. TrendAI Apex One and others](https://agentprime.io/advisories/CVE-2026-45206.md)
  `CVE-2026-45206` · CVE record: Trend Micro, Inc. TrendAI Apex One and 1 more · CVSS 7.8 High · Not analysed yet · Published 21 May 2026 · Tags: CWE-346
- [Origin validation error in Trend Micro, Inc. TrendAI Apex One and others](https://agentprime.io/advisories/CVE-2026-34930.md)
  `CVE-2026-34930` · CVE record: Trend Micro, Inc. TrendAI Apex One and 1 more · CVSS 7.8 High · Not analysed yet · Published 21 May 2026 · Tags: CWE-346
- [Origin validation error in Trend Micro, Inc. TrendAI Apex One and others](https://agentprime.io/advisories/CVE-2026-34929.md)
  `CVE-2026-34929` · CVE record: Trend Micro, Inc. TrendAI Apex One and 1 more · CVSS 7.8 High · Not analysed yet · Published 21 May 2026 · Tags: CWE-346
- [Origin validation error in Trend Micro, Inc. TrendAI Apex One and others](https://agentprime.io/advisories/CVE-2026-34928.md)
  `CVE-2026-34928` · CVE record: Trend Micro, Inc. TrendAI Apex One and 1 more · CVSS 7.8 High · Not analysed yet · Published 21 May 2026 · Tags: CWE-346
- [Origin validation error in Trend Micro, Inc. TrendAI Apex One and others](https://agentprime.io/advisories/CVE-2026-34927.md)
  `CVE-2026-34927` · CVE record: Trend Micro, Inc. TrendAI Apex One and 1 more · CVSS 7.8 High · Not analysed yet · Published 21 May 2026 · Tags: CWE-346
- [Origin validation error in Trend Micro, Inc. TrendAI Apex One (Mac)](https://agentprime.io/advisories/CVE-2025-71217.md)
  `CVE-2025-71217` · CVE record: Trend Micro, Inc. TrendAI Apex One (Mac) · CVSS 7.8 High · Not analysed yet · Published 21 May 2026 · Tags: CWE-346
- [Origin validation error in Trend Micro, Inc. TrendAI Apex One (Mac)](https://agentprime.io/advisories/CVE-2025-71214.md)
  `CVE-2025-71214` · CVE record: Trend Micro, Inc. TrendAI Apex One (Mac) · CVSS 7.8 High · Not analysed yet · Published 21 May 2026 · Tags: CWE-346
- [Origin validation error in Trend Micro, Inc. TrendAI Apex One and others](https://agentprime.io/advisories/CVE-2025-71213.md)
  `CVE-2025-71213` · CVE record: Trend Micro, Inc. TrendAI Apex One and 1 more · CVSS 7.8 High · Not analysed yet · Published 21 May 2026 · Tags: CWE-346
- [Flowise: Hardcoded CORS wildcard on TTS endpoint enables cross-origin credential abuse from any webpage](https://agentprime.io/advisories/GHSA-m837-xvxr-vqwg.md)
  `GHSA-m837-xvxr-vqwg`, `CVE-2026-56277` · npm `flowise`: affected `<3.1.2`, fixed in `3.1.2` · CVSS 6.9 Medium · Not analysed yet · Published 20 May 2026 · Tags: CWE-346, CWE-942
- [Another 'ghost domain names' attack variant](https://agentprime.io/advisories/CVE-2026-40622.md)
  `CVE-2026-40622` · CVE record: NLnet Labs Unbound · CVSS 6.6 Medium · Not analysed yet · Published 20 May 2026 · Tags: CWE-346
- [MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path](https://agentprime.io/advisories/GHSA-g53w-w6mj-hrpp.md)
  `GHSA-g53w-w6mj-hrpp`, `GO-2026-5390` · Go `github.com/Kuadrant/mcp-gateway`: affected `<0.7.0`, fixed in `0.7.0` · CVSS 4.0, no score published · Not analysed yet · Published 19 May 2026 · Tags: Authentication bypass, Broken access control, CWE-346
- [MLflow: Improper Origin Validation in MLflow Assistant /ajax-api Endpoints Enables Browser-Mediated Local Command Execution](https://agentprime.io/advisories/GHSA-67c5-x5mf-rppq.md)
  `GHSA-67c5-x5mf-rppq`, `BIT-mlflow-2026-2611`, `CVE-2026-2611`, `PYSEC-2026-418` · PyPI `mlflow`: affected `>=3.9.0, <3.10.0`, fixed in `3.10.0` · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 May 2026 · Tags: CWE-346, CWE-940
- [Same-origin policy bypass in the Networking: JAR component](https://agentprime.io/advisories/CVE-2026-8971.md)
  `CVE-2026-8971` · CVE record: Mozilla Firefox and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 19 May 2026 · Tags: CWE-346
- [Same-origin policy bypass in the Networking: HTTP component](https://agentprime.io/advisories/CVE-2026-8950.md)
  `CVE-2026-8950` · CVE record: Mozilla Firefox and 1 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 May 2026 · Tags: CWE-346
- [Mattermost doesn't validate the X-Requested-With header on the burn-on-read reveal endpoint](https://agentprime.io/advisories/GHSA-xvcx-mgpc-5xh3.md)
  `GHSA-xvcx-mgpc-5xh3`, `CVE-2026-6339`, `GO-2026-5769` · Go `github.com/mattermost/mattermost-server` and 1 more: affected `<5.3.2-0.20260327001745-7a339a6438f5`, fixed in `5.3.2-0.20260327001745-7a339a6438f5` · CVSS 4.3 Medium · Not analysed yet · Published 18 May 2026 · Tags: CWE-346
- [Origin validation error in denx U-Boot](https://agentprime.io/advisories/CVE-2026-46728.md)
  `CVE-2026-46728` · CVE record: denx U-Boot · CVSS 8.2 High · Not analysed yet · Published 16 May 2026 · Tags: CWE-346
- [Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin](https://agentprime.io/advisories/GHSA-3vcp-chfh-f6r2.md)
  `GHSA-3vcp-chfh-f6r2`, `CVE-2026-18676`, `CVE-2026-45021`, `GO-2026-5102` · Go `github.com/kumahq/kuma`: affected `<2.7.25 || >=2.9.0, <2.9.15 || >=2.11.0, <2.11.13 || >=2.12.0, <2.12.10 || >=2.13.0, <2.13.5`, fixed in `2.7.25`, `2.9.15`, `2.11.13`, `2.12.10`, `2.13.5` · CVSS 5.1 Medium · Not analysed yet · Published 14 May 2026 · Tags: CWE-346, CWE-942
- [stale custom cookie host causes cookie leak](https://agentprime.io/advisories/CVE-2026-6276.md)
  `CVE-2026-6276` · CVE record: curl curl · CVSS 7.5 High · Not analysed yet · Published 13 May 2026 · Tags: CWE-346
- [SillyTavern has Authentication Bypass via SSO Header Injection](https://agentprime.io/advisories/GHSA-gxx6-h3g6-vwjh.md)
  `GHSA-gxx6-h3g6-vwjh`, `CVE-2026-44649` · npm `sillytavern`: affected `<1.18.0`, fixed in `1.18.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 May 2026 · Tags: Authentication bypass, CWE-346, CWE-807
- [Cleanuparr: Reflective CORS combined with trusted-network auth allows cross-origin admin API reads](https://agentprime.io/advisories/CVE-2026-44184.md)
  `CVE-2026-44184` · CVE record: Cleanuparr Cleanuparr · CVSS 8.0 High · Not analysed yet · Published 12 May 2026 · Tags: CWE-346, CWE-942
- [Unity Catalog has a JWT Issuer Validation Bypass tht Allows Complete User Impersonation](https://agentprime.io/advisories/GHSA-qqcj-rghw-829x.md)
  `GHSA-qqcj-rghw-829x`, `CVE-2026-27478` · Maven `io.unitycatalog:unitycatalog-server`: affected `<0.4.1`, fixed in `0.4.1` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 May 2026 · Tags: Authentication bypass, CWE-346
- [Dozzle's Cross-Site WebSocket Hijacking (CSWSH) on exec/attach endpointsbypasses authentication](https://agentprime.io/advisories/GHSA-j643-x8pv-8m67.md)
  `GHSA-j643-x8pv-8m67`, `CVE-2026-44985`, `GO-2026-5449` · Go `github.com/amir20/dozzle`: affected `<=10.5.1`, no fixed version yet · CVSS 8.7 High · Not analysed yet · Published 11 May 2026 · Tags: CWE-346
- [@cyclonedx/cdxgen: Docker registry auth substring match forwards credentials to a different registry](https://agentprime.io/advisories/GHSA-qhh4-458h-xwh2.md)
  `GHSA-qhh4-458h-xwh2` · npm `@cyclonedx/cdxgen`: affected `>=9.9.5, <12.3.3`, fixed in `12.3.3` · CVSS 4.0, no score published · Not analysed yet · Published 8 May 2026 · Tags: Hard-coded credentials, CWE-346
- [RCE in TUBITAK BILGEM's Liderahenk](https://agentprime.io/advisories/CVE-2026-6508.md)
  `CVE-2026-6508` · CVE record: TUBITAK BILGEM Software Technologies Research Institute Liderahenk · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 May 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-7986.md)
  `CVE-2026-7986` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 6 May 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-7979.md)
  `CVE-2026-7979` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 6 May 2026 · Tags: CWE-346
- [Origin validation error in Oracle Corporation Oracle Macaron Tool of Oracle Open Source Projects](https://agentprime.io/advisories/CVE-2026-35253.md)
  `CVE-2026-35253` · CVE record: Oracle Corporation Oracle Macaron Tool of Oracle Open Source Projects · CVSS 4.7 Medium · Not analysed yet · Published 6 May 2026 · Tags: CWE-346
- [Apache Thrift vulnerable to Path Traversal, HTTP Request/Response Splitting, Uncontrolled Resource Consumption](https://agentprime.io/advisories/GHSA-526f-jxpj-jmg2.md)
  `GHSA-526f-jxpj-jmg2`, `BIT-thrift-2026-43870`, `CVE-2026-43870` · npm `thrift`: affected `<=0.22.0`, no fixed version yet · CVSS 7.3 High · Not analysed yet · Published 5 May 2026 · Tags: Path traversal, Other injection, Denial of service, CWE-346
- [OpenClaw: Slack thread context could include messages from non-allowlisted senders](https://agentprime.io/advisories/GHSA-qm77-8qjp-4vcm.md)
  `GHSA-qm77-8qjp-4vcm`, `CVE-2026-41358` · npm `openclaw`: affected `<2026.4.2`, fixed in `2026.4.2` · CVSS 2.3 Low · Not analysed yet · Published 4 May 2026 · Tags: CWE-346
- [ChatGPTNextWeb NextChat API Endpoint Next.js cross-domain policy](https://agentprime.io/advisories/CVE-2026-7643.md)
  `CVE-2026-7643` · CVE record: ChatGPTNextWeb NextChat · CVSS 5.3 Medium · Not analysed yet · Published 2 May 2026 · Tags: CWE-346, CWE-942
- [alexta69 MeTube CORS Policy main.py on_prepare cross-domain policy](https://agentprime.io/advisories/CVE-2026-7581.md)
  `CVE-2026-7581` · CVE record: alexta69 MeTube · CVSS 5.3 Medium · Not analysed yet · Published 1 May 2026 · Tags: CWE-346, CWE-942
- [AgentFlow Local Web API Content-Type Validation Bypass](https://agentprime.io/advisories/CVE-2026-7439.md)
  `CVE-2026-7439` · CVE record: berabuddies AgentFlow · CVSS 4.8 Medium · Not analysed yet · Published 29 Apr 2026 · Tags: CWE-346
- [DNS rebinding vulnerability in rmcp Streamable HTTP server transport](https://agentprime.io/advisories/GHSA-fvh2-gm75-j4j7.md)
  `GHSA-fvh2-gm75-j4j7`, `CVE-2026-42559`, `GHSA-89vp-x53w-74fx`, `RUSTSEC-2026-0140`, `RUSTSEC-2026-0189` · crates.io `rmcp`: affected `>=0.0.0-0, <1.4.0`, fixed in `1.4.0` · CVSS 8.8 High · Not analysed yet · Published 29 Apr 2026 · Tags: CWE-346, CWE-350
- [Sensitive Information Disclosure Vulnerability Caused by Trusted Domain Bypass in OPPO Wallet](https://agentprime.io/advisories/CVE-2026-22077.md)
  `CVE-2026-22077` · CVE record: OPPO OPPO Wallet APP · CVSS 5.6 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: CWE-346
- [Duplicate Advisory: OpenClaw: Slack thread context could include messages from non-allowlisted senders](https://agentprime.io/advisories/GHSA-7hrg-5w46-5r2x.md)
  `GHSA-7hrg-5w46-5r2x` · npm `openclaw`: affected `<2026.4.2`, fixed in `2026.4.2` · CVSS 5.4 Medium · Withdrawn · Not analysed yet · Published 24 Apr 2026 · Tags: CWE-346

Newest: <https://agentprime.io/advisories/tag/cwe-346.md>
Older: <https://agentprime.io/advisories/tag/cwe-346.md?cursor=WyIyMDI2LTA0LTI0VDAwOjMxOjUyLjAwMDAwMFoiLCJHSFNBLTdocmctNXc0Ni01cjJ4Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-346&cursor=WyIyMDI2LTA2LTA0VDIzOjA1OjI1LjI1NzAwMFoiLCJDVkUtMjAyNi0xMTE2MSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-346/?cursor=WyIyMDI2LTA2LTA0VDIzOjA1OjI1LjI1NzAwMFoiLCJDVkUtMjAyNi0xMTE2MSJd>. Everything for agents: <https://agentprime.io/llms.txt>.