# CWE-346.

Every Advisory and CVE whose sources give the weakness CWE-346, newest first.

## Records, newest first (an older page)

- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-17753.md)
  `CVE-2026-17753` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 30 Jul 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-17748.md)
  `CVE-2026-17748` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 30 Jul 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-17743.md)
  `CVE-2026-17743` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 30 Jul 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-17742.md)
  `CVE-2026-17742` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 30 Jul 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-17733.md)
  `CVE-2026-17733` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 30 Jul 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-17731.md)
  `CVE-2026-17731` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 30 Jul 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-17732.md)
  `CVE-2026-17732` · CVE record: Google Chrome · CVSS 3.1 Low · Not analysed yet · Published 30 Jul 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-17720.md)
  `CVE-2026-17720` · CVE record: Google Chrome · CVSS 3.1 Low · Not analysed yet · Published 30 Jul 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-17715.md)
  `CVE-2026-17715` · CVE record: Google Chrome · CVSS 3.1 Low · Not analysed yet · Published 30 Jul 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-17702.md)
  `CVE-2026-17702` · CVE record: Google Chrome · CVSS 3.1 Low · Not analysed yet · Published 30 Jul 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-17693.md)
  `CVE-2026-17693` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 30 Jul 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-17662.md)
  `CVE-2026-17662` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 30 Jul 2026 · Tags: CWE-346
- [MSI Center NTIOLib_X64 Origin Validation Error Local Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2026-6102.md)
  `CVE-2026-6102` · CVE record: MSI MSI Center · CVSS 7.8 High · Not analysed yet · Published 29 Jul 2026 · Tags: CWE-346
- [OAuth: Cross-origin token-request redirects can expose signed request metadata](https://agentprime.io/advisories/GHSA-prq8-7wvh-44qh.md)
  `GHSA-prq8-7wvh-44qh`, `CVE-2026-54605` · RubyGems `oauth`: affected `>=0.5.5, <1.1.6`, fixed in `1.1.6` · CVSS 7.2 High · Not analysed yet · Published 28 Jul 2026 · Tags: Information disclosure, Server-side request forgery (SSRF), CWE-346
- [Microsoft Edge (Chromium-based) Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-57989.md)
  `CVE-2026-57989` · CVE record: Microsoft Microsoft Edge (Chromium-based) · CVSS 7.4 High · Not analysed yet · Published 26 Jul 2026 · Tags: CWE-346
- [Microsoft Edge (Chromium-based) Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2026-57978.md)
  `CVE-2026-57978` · CVE record: Microsoft Microsoft Edge (Chromium-based) · CVSS 5.4 Medium · Not analysed yet · Published 26 Jul 2026 · Tags: CWE-346
- [Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them](https://agentprime.io/advisories/GHSA-x445-f3h2-j279.md)
  `GHSA-x445-f3h2-j279`, `CVE-2026-73419` · npm `@auth/core` and 1 more: affected `<0.41.3`, fixed in `0.41.3` · CVSS 6.8 Medium · Not analysed yet · Published 23 Jul 2026 · Tags: CWE-345, CWE-346, CWE-940
- [Odh-dashboard: odh-dashboard: backend port 8080 trusts x-forwarded-access-token without origin validation](https://agentprime.io/advisories/CVE-2026-16745.md)
  `CVE-2026-16745` · CVE record: Red Hat Red Hat OpenShift AI 2.25 and 2 more · CVSS 8.8 High · Not analysed yet · Published 23 Jul 2026 · Tags: CWE-346
- [n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution](https://agentprime.io/advisories/GHSA-mq3m-f8x3-579w.md)
  `GHSA-mq3m-f8x3-579w`, `CVE-2026-59208` · npm `n8n`: affected `<2.27.4 || >=2.28.0, <2.28.1`, fixed in `2.27.4`, `2.28.1` · CVSS 7.6 High · Not analysed yet · Published 22 Jul 2026 · Tags: Authentication bypass, CWE-346
- [DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field](https://agentprime.io/advisories/CVE-2026-13321.md)
  `CVE-2026-13321` · CVE record: ISC BIND 9 · CVSS 8.6 High · Not analysed yet · Published 22 Jul 2026 · Tags: CWE-346
- [Site isolation issue in the DOM: Navigation component](https://agentprime.io/advisories/CVE-2026-16399.md)
  `CVE-2026-16399` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 21 Jul 2026 · Tags: CWE-346
- [Site isolation issue in the Graphics component](https://agentprime.io/advisories/CVE-2026-16398.md)
  `CVE-2026-16398` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 21 Jul 2026 · Tags: Information disclosure, CWE-346
- [Site isolation issue in the Networking component](https://agentprime.io/advisories/CVE-2026-16387.md)
  `CVE-2026-16387` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: Information disclosure, Broken access control, CWE-346
- [Same-origin policy bypass in the Networking: DNS component](https://agentprime.io/advisories/CVE-2026-16381.md)
  `CVE-2026-16381` · CVE record: Mozilla Firefox and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: CWE-346
- [Site isolation issue in the Graphics: WebRender component](https://agentprime.io/advisories/CVE-2026-16358.md)
  `CVE-2026-16358` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: CWE-346
- [Site isolation issue in the Networking: HTTP component](https://agentprime.io/advisories/CVE-2026-16375.md)
  `CVE-2026-16375` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: CWE-346
- [Same-origin policy bypass in the DOM: Navigation component](https://agentprime.io/advisories/CVE-2026-16349.md)
  `CVE-2026-16349` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: CWE-346
- [Guzzle: Cookie Disclosure and Injection via IP-Address Domains](https://agentprime.io/advisories/GHSA-g446-98w2-8p5w.md)
  `GHSA-g446-98w2-8p5w`, `CVE-2026-59883`, `PKSA-bcdd-5xc7-gwfb` · Packagist `guzzlehttp/guzzle`: affected `<7.12.3`, fixed in `7.12.3` · CVSS 4.7 Medium · Not analysed yet · Published 20 Jul 2026 · Tags: Information disclosure, Authentication bypass, CWE-346
- [WhatsApp MCP: Unauthenticated bridge API allows message sending and arbitrary file exfiltration](https://agentprime.io/advisories/CVE-2026-46555.md)
  `CVE-2026-46555` · CVE record: verygoodplugins whatsapp-mcp · CVSS 7.7 High · Not analysed yet · Published 20 Jul 2026 · Tags: Path traversal, Authentication bypass, CWE-346
- [MCP Python SDK: WebSocket server transport does not support Host/Origin validation](https://agentprime.io/advisories/GHSA-vj7q-gjh5-988w.md)
  `GHSA-vj7q-gjh5-988w`, `CVE-2026-59950`, `PYSEC-2026-3483` · PyPI `mcp`: affected `<1.28.1`, fixed in `1.28.1` · CVSS 7.6 High · Not analysed yet · Published 16 Jul 2026 · Tags: CWE-346, CWE-1385
- [Origin Validation Error in X-Rite MA-T6](https://agentprime.io/advisories/CVE-2023-49899.md)
  `CVE-2023-49899` · CVE record: X-Rite MA-T6 · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jul 2026 · Tags: CWE-346
- [FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: \*), enabling cross-origin reads of local server data](https://agentprime.io/advisories/GHSA-q78p-hj9h-5466.md)
  `GHSA-q78p-hj9h-5466`, `CVE-2026-53656`, `PYSEC-2026-3465` · PyPI `fiftyone`: affected `<1.17.0`, fixed in `1.17.0` · CVSS 6.3 Medium · Not analysed yet · Published 15 Jul 2026 · Tags: CWE-346, CWE-942
- [Lightpanda:URL parser misidentifies page origin for URLs containing @ in the path - Same-Origin Policy bypass](https://agentprime.io/advisories/CVE-2026-52842.md)
  `CVE-2026-52842` · CVE record: lightpanda-io browser · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jul 2026 · Tags: CWE-346
- [Lightpanda: fetch() and XMLHttpRequest attach session cookies to cross-origin requests regardless of credentials mode](https://agentprime.io/advisories/CVE-2026-52843.md)
  `CVE-2026-52843` · CVE record: lightpanda-io browser · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jul 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-15775.md)
  `CVE-2026-15775` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 14 Jul 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-15768.md)
  `CVE-2026-15768` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 14 Jul 2026 · Tags: CWE-346
- [Windows Network Address Translation (NAT) Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2026-56181.md)
  `CVE-2026-56181` · CVE record: Microsoft Windows 11 Version 24H2 and 4 more · CVSS 8.3 High · Not analysed yet · Published 14 Jul 2026 · Tags: CWE-346
- [Information disclosure in Eclipse Foundation Eclipse Vert.x](https://agentprime.io/advisories/CVE-2026-15075.md)
  `CVE-2026-15075` · CVE record: Eclipse Foundation Eclipse Vert.x · CVSS 8.2 High · Not analysed yet · Published 14 Jul 2026 · Tags: Information disclosure, CWE-346
- [Origin validation error in Eclipse Foundation Eclipse Vert.x](https://agentprime.io/advisories/CVE-2026-15076.md)
  `CVE-2026-15076` · CVE record: Eclipse Foundation Eclipse Vert.x · CVSS 8.2 High · Not analysed yet · Published 14 Jul 2026 · Tags: CWE-346
- [SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist](https://agentprime.io/advisories/GHSA-hvr9-72v2-fff3.md)
  `GHSA-hvr9-72v2-fff3`, `CVE-2026-54069`, `GO-2026-5961` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260628153353-2d5d72223df4`, fixed in `0.0.0-20260628153353-2d5d72223df4` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Jul 2026 · Tags: CWE-346
- [Coolify: Password reset link poisoning via X-Forwarded-Host header spoofing](https://agentprime.io/advisories/CVE-2026-34198.md)
  `CVE-2026-34198` · CVE record: coollabsio coolify · CVSS 5.3 Medium · Not analysed yet · Published 7 Jul 2026 · Tags: CWE-346, CWE-640
- [Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing](https://agentprime.io/advisories/GHSA-5wg6-jmq2-53pw.md)
  `GHSA-5wg6-jmq2-53pw`, `CVE-2026-55438`, `GO-2026-5918` · Go `github.com/coder/coder/v2`: affected `<2.29.17 || >=2.30.0, <2.32.7 || >=2.33.0, <2.33.8 || >=2.34.0, <2.34.2`, fixed in `2.29.17`, `2.32.7`, `2.33.8`, `2.34.2` · CVSS 5.8 Medium · Not analysed yet · Published 6 Jul 2026 · Tags: CWE-346
- [FOSSBilling has an unauthenticated payment bypass via IPN callback forgery](https://agentprime.io/advisories/CVE-2026-42341.md)
  `CVE-2026-42341` · CVE record: FOSSBilling FOSSBilling · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Jul 2026 · Tags: Authentication bypass, CWE-346
- [Dapr - OIDC Discovery Issuer and JWKS URI Injection via Unvalidated X-Forwarded-Host](https://agentprime.io/advisories/CVE-2026-59096.md)
  `CVE-2026-59096` · CVE record: dapr dapr · CVSS 8.2 High · Not analysed yet · Published 2 Jul 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-14105.md)
  `CVE-2026-14105` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-14079.md)
  `CVE-2026-14079` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-14057.md)
  `CVE-2026-14057` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-14053.md)
  `CVE-2026-14053` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-14046.md)
  `CVE-2026-14046` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-14039.md)
  `CVE-2026-14039` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-13913.md)
  `CVE-2026-13913` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-346
- [Cross-site request forgery in Google Chrome](https://agentprime.io/advisories/CVE-2026-13887.md)
  `CVE-2026-13887` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: Cross-site request forgery (CSRF), CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-13881.md)
  `CVE-2026-13881` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-13868.md)
  `CVE-2026-13868` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-13840.md)
  `CVE-2026-13840` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-13839.md)
  `CVE-2026-13839` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-13838.md)
  `CVE-2026-13838` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-346
- [Cross-site request forgery in Google Chrome](https://agentprime.io/advisories/CVE-2026-13826.md)
  `CVE-2026-13826` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: Cross-site request forgery (CSRF), CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-13822.md)
  `CVE-2026-13822` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-13793.md)
  `CVE-2026-13793` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-346

Newest: <https://agentprime.io/advisories/tag/cwe-346.md>
Older: <https://agentprime.io/advisories/tag/cwe-346.md?cursor=WyIyMDI2LTA2LTMwVDIyOjM3OjM1LjA4MDAwMFoiLCJDVkUtMjAyNi0xMzc5MyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-346&cursor=WyIyMDI2LTA3LTMwVDAwOjE5OjEyLjQ1MjAwMFoiLCJDVkUtMjAyNi0xNzc1NCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-346/?cursor=WyIyMDI2LTA3LTMwVDAwOjE5OjEyLjQ1MjAwMFoiLCJDVkUtMjAyNi0xNzc1NCJd>. Everything for agents: <https://agentprime.io/llms.txt>.