# CWE-346.

Every Advisory and CVE whose sources give the weakness CWE-346, newest first.

## Records, newest first (an older page)

- [React Router has CSRF issue in Action/Server Action Request Processing](https://agentprime.io/advisories/GHSA-h5cw-625j-3rxh.md)
  `GHSA-h5cw-625j-3rxh`, `CVE-2026-22030` · npm `react-router` and 1 more: affected `>=7.0.0, <7.12.0`, fixed in `7.12.0` · CVSS 6.5 Medium · Not analysed yet · Published 8 Jan 2026 · Tags: Cross-site request forgery (CSRF), CWE-346
- [Origin validation error in Trend Micro, Inc. Trend Micro Apex Central](https://agentprime.io/advisories/CVE-2025-69260.md)
  `CVE-2025-69260` · CVE record: Trend Micro, Inc. Trend Micro Apex Central · CVSS 7.5 High · Not analysed yet · Published 8 Jan 2026 · Tags: Memory corruption, CWE-346
- [Origin validation error in Trend Micro, Inc. Trend Micro Apex Central](https://agentprime.io/advisories/CVE-2025-69259.md)
  `CVE-2025-69259` · CVE record: Trend Micro, Inc. Trend Micro Apex Central · CVSS 7.5 High · Not analysed yet · Published 8 Jan 2026 · Tags: Memory corruption, CWE-346
- [Authentication bypass by spoofing in Trend Micro, Inc. Trend Micro Apex Central](https://agentprime.io/advisories/CVE-2025-69258.md)
  `CVE-2025-69258` · CVE record: Trend Micro, Inc. Trend Micro Apex Central · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Jan 2026 · Tags: Memory corruption, Authentication bypass, CWE-346
- [An issue was discovered in Nitro PDF Pro for Windows before 14.42.0.34.](https://agentprime.io/advisories/CVE-2025-67825.md)
  `CVE-2025-67825` · CVE record · CVSS 5.5 Medium · Not analysed yet · Published 8 Jan 2026 · Tags: CWE-346
- [Origin validation error in Fujitsu Client Computing Limited Fujitsu Security Solution AuthConductor Client…](https://agentprime.io/advisories/CVE-2026-20893.md)
  `CVE-2026-20893` · CVE record: Fujitsu Client Computing Limited Fujitsu Security Solution AuthConductor Client Basic V2 · CVSS 8.5 High · Not analysed yet · Published 7 Jan 2026 · Tags: CWE-346
- [Origin validation error in NAVER Whale browser](https://agentprime.io/advisories/CVE-2025-69235.md)
  `CVE-2025-69235` · CVE record: NAVER NAVER Whale browser · CVSS 7.5 High · Not analysed yet · Published 30 Dec 2025 · Tags: CWE-346
- [Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG Origin Validation Error](https://agentprime.io/advisories/CVE-2025-61740.md)
  `CVE-2025-61740` · CVE record: Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG · CVSS 7.2 High · Not analysed yet · Published 22 Dec 2025 · Tags: CWE-346
- [A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/system-features endpoint.](https://agentprime.io/advisories/CVE-2025-63388.md)
  `CVE-2025-63388` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Dec 2025 · Tags: CWE-346
- [A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/setup endpoint.](https://agentprime.io/advisories/CVE-2025-63386.md)
  `CVE-2025-63386` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Dec 2025 · Tags: CWE-346
- [Same-origin policy bypass in the Request Handling component](https://agentprime.io/advisories/CVE-2025-14331.md)
  `CVE-2025-14331` · CVE record: Mozilla Firefox and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: CWE-346
- [Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='\*' with ...](https://agentprime.io/advisories/GHSA-577h-p2hh-v4mv.md)
  `GHSA-577h-p2hh-v4mv`, `CVE-2025-34291`, `PYSEC-2025-78` · PyPI `langflow`: affected `<1.7.0`, fixed in `1.7.0` · CVSS 9.4 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.93 · Not analysed yet · Published 5 Dec 2025 · Tags: CWE-346
- [Origin validation error in Synology BeeDrive for desktop](https://agentprime.io/advisories/CVE-2025-8074.md)
  `CVE-2025-8074` · CVE record: Synology BeeDrive for desktop · CVSS 5.6 Medium · Not analysed yet · Published 4 Dec 2025 · Tags: CWE-346
- [Host header poisoning allows account takeover via password reset email](https://agentprime.io/advisories/CVE-2024-32642.md)
  `CVE-2024-32642` · CVE record: MasaCMS MasaCMS · CVSS 8.8 High · Not analysed yet · Published 3 Dec 2025 · Tags: CWE-346, CWE-640
- [Webkit: webkitgtk: remote user-assisted information disclosure via file drag-and-drop](https://agentprime.io/advisories/CVE-2025-13947.md)
  `CVE-2025-13947` · CVE record: The WebKitGTK Team webkitgtk and 4 more · CVSS 7.4 High · Not analysed yet · Published 3 Dec 2025 · Tags: CWE-346
- [Kibana Origin Validation Error](https://agentprime.io/advisories/CVE-2025-37734.md)
  `CVE-2025-37734` · CVE record: Elastic Kibana · CVSS 4.3 Medium · Not analysed yet · Published 12 Nov 2025 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2025-12905.md)
  `CVE-2025-12905` · CVE record: Google Chrome · CVSS 5.4 Medium · Not analysed yet · Published 7 Nov 2025 · Tags: CWE-346
- [Nagios XI < 2024R1.2.2 Host Header Injection](https://agentprime.io/advisories/CVE-2024-14006.md)
  `CVE-2024-14006` · CVE record: Nagios XI · CVSS 8.8 High · Not analysed yet · Published 30 Oct 2025 · Tags: CWE-346
- [chatwoot Widget IFrameHelper.js initPostMessageCommunication origin validation](https://agentprime.io/advisories/CVE-2025-12245.md)
  `CVE-2025-12245` · CVE record: chatwoot · CVSS 6.9 Medium · Not analysed yet · Published 27 Oct 2025 · Tags: CWE-345, CWE-346
- [Liferay Portal fails to verify messages from the cluster network is trusted](https://agentprime.io/advisories/GHSA-6pgj-w687-9c8c.md)
  `GHSA-6pgj-w687-9c8c`, `CVE-2025-62250` · Maven `com.liferay:com.liferay.portal.cluster.multiple`: affected `<5.0.35`, fixed in `5.0.35` · CVSS 6.9 Medium · Not analysed yet · Published 21 Oct 2025 · Tags: CWE-346
- [Origin validation error in NAVER Whale browser](https://agentprime.io/advisories/CVE-2025-62584.md)
  `CVE-2025-62584` · CVE record: NAVER NAVER Whale browser · CVSS 7.5 High · Not analysed yet · Published 16 Oct 2025 · Tags: CWE-346
- [API Authentication Bypass via Header Spoofing vulnerability in Kiloview NDI N30 Products](https://agentprime.io/advisories/CVE-2025-9265.md)
  `CVE-2025-9265` · CVE record: Kiloview NDI · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2025 · Tags: Authentication bypass, CWE-346
- [IBM Engineering Requirements Management Doors Next spoofing](https://agentprime.io/advisories/CVE-2025-2140.md)
  `CVE-2025-2140` · CVE record: IBM Engineering Requirements Management Doors Next · CVSS 5.7 Medium · Not analysed yet · Published 12 Oct 2025 · Tags: CWE-346
- [Junos OS: EX4600 Series and QFX5000 Series: An attacker with physical access can open a persistent backdoor](https://agentprime.io/advisories/CVE-2025-59957.md)
  `CVE-2025-59957` · CVE record: Juniper Networks Junos OS · CVSS 7.0 High · Not analysed yet · Published 9 Oct 2025 · Tags: CWE-346
- [CrowdStrike Falcon Sensor for Windows Logic Error](https://agentprime.io/advisories/CVE-2025-42706.md)
  `CVE-2025-42706` · CVE record: CrowdStrike Falcon sensor for Windows · CVSS 6.5 Medium · Not analysed yet · Published 8 Oct 2025 · Tags: CWE-346
- [SillyTavern Web Interface Vulnerable DNS Rebinding](https://agentprime.io/advisories/GHSA-7cxj-w27x-x78q.md)
  `GHSA-7cxj-w27x-x78q`, `CVE-2025-59159` · npm `sillytavern`: affected `<1.13.4`, fixed in `1.13.4` · CVSS 9.7 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2025 · Tags: CWE-346, CWE-940
- [CodeCanyon/ui-lib Mentor LMS API cross-domain policy](https://agentprime.io/advisories/CVE-2025-11304.md)
  `CVE-2025-11304` · CVE record: CodeCanyon Mentor LMS and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 5 Oct 2025 · Tags: CWE-346, CWE-942
- [Apollo Embedded Sandbox and Explorer vulnerable to CSRF via window.postMessage origin-validation bypass](https://agentprime.io/advisories/GHSA-w87v-7w53-wwxv.md)
  `GHSA-w87v-7w53-wwxv`, `CVE-2025-59845` · npm `@apollo/explorer` and 1 more: affected `<3.7.3`, fixed in `3.7.3` · CVSS 8.2 High · Not analysed yet · Published 26 Sept 2025 · Tags: Cross-site request forgery (CSRF), CWE-346
- [Origin validation error in Cisco Aironet Access Point Software (IOS XE Controller)](https://agentprime.io/advisories/CVE-2025-20364.md)
  `CVE-2025-20364` · CVE record: Cisco Cisco Aironet Access Point Software (IOS XE Controller) · CVSS 4.3 Medium · Not analysed yet · Published 24 Sept 2025 · Tags: CWE-346
- [Parcel has an Origin Validation Error vulnerability](https://agentprime.io/advisories/GHSA-qm9p-f9j5-w83w.md)
  `GHSA-qm9p-f9j5-w83w`, `CVE-2025-56648` · npm `@parcel/reporter-dev-server`: affected `>=1.6.1, <2.16.4`, fixed in `2.16.4` · CVSS 6.5 Medium · Not analysed yet · Published 17 Sept 2025 · Tags: CWE-346
- [Neo4j Cypher MCP server is vulnerable to DNS rebinding](https://agentprime.io/advisories/GHSA-vcqx-v2mg-7chx.md)
  `GHSA-vcqx-v2mg-7chx`, `CVE-2025-10193`, `PYSEC-2026-1620` · PyPI `mcp-neo4j-cypher`: affected `>=0.2.2, <0.4.0`, fixed in `0.4.0` · CVSS 7.4 High · Not analysed yet · Published 11 Sept 2025 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2025-10201.md)
  `CVE-2025-10201` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 10 Sept 2025 · Tags: Broken access control, CWE-346
- [pgadmin4 is affected by a Cross-Origin Opener Policy (COOP) vulnerability](https://agentprime.io/advisories/GHSA-6859-2qxq-ffv2.md)
  `GHSA-6859-2qxq-ffv2`, `CVE-2025-9636`, `PYSEC-2026-1769` · PyPI `pgadmin4`: affected `<9.8`, fixed in `9.8` · CVSS 7.9 High · Not analysed yet · Published 5 Sept 2025 · Tags: CWE-346
- [Host Header Injection in Akinsoft's LimonDesk](https://agentprime.io/advisories/CVE-2024-13068.md)
  `CVE-2024-13068` · CVE record: Akinsoft LimonDesk · CVSS 7.3 High · Not analysed yet · Published 3 Sept 2025 · Tags: CWE-346
- [Host Header Injection in Akinsoft's OctoCloud](https://agentprime.io/advisories/CVE-2024-12973.md)
  `CVE-2024-12973` · CVE record: Akinsoft OctoCloud · CVSS 4.7 Medium · Not analysed yet · Published 2 Sept 2025 · Tags: CWE-346
- [github.com/gorilla/csrf improperly validates TrustedOrigins allowing CSRF attacks](https://agentprime.io/advisories/GHSA-82ff-hg59-8x73.md)
  `GHSA-82ff-hg59-8x73`, `CVE-2025-47909`, `GO-2025-3884` · Go `github.com/gorilla/csrf`: affected `<=1.7.3`, no fixed version yet · CVSS 7.3 High · Not analysed yet · Published 29 Aug 2025 · Tags: Cross-site request forgery (CSRF), CWE-346, CWE-807
- [An issue was discovered in Shopizer 3.2.7.](https://agentprime.io/advisories/CVE-2025-51605.md)
  `CVE-2025-51605` · CVE record · CVSS 8.1 High · Not analysed yet · Published 22 Aug 2025 · Tags: CWE-346
- [elysia-cors Origin Validation Error](https://agentprime.io/advisories/GHSA-f9qj-4c5x-cpcw.md)
  `GHSA-f9qj-4c5x-cpcw`, `CVE-2025-50864` · npm `@elysiajs/cors`: affected `<1.3.1`, fixed in `1.3.1` · CVSS 6.5 Medium · Not analysed yet · Published 20 Aug 2025 · Tags: CWE-178, CWE-346
- [Same-origin policy bypass in the Graphics: Canvas2D component](https://agentprime.io/advisories/CVE-2025-9180.md)
  `CVE-2025-9180` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 19 Aug 2025 · Tags: CWE-346
- [HCL BigFix SaaS Authentication Service is vulnerable to cache poisoning](https://agentprime.io/advisories/CVE-2025-52621.md)
  `CVE-2025-52621` · CVE record: HCL Software BigFix SaaS Remediate · CVSS 5.3 Medium · Not analysed yet · Published 15 Aug 2025 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2025-8881.md)
  `CVE-2025-8881` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 13 Aug 2025 · Tags: Authentication bypass, CWE-346
- [Origin validation error in Sipwise rtpengine](https://agentprime.io/advisories/CVE-2025-53399.md)
  `CVE-2025-53399` · CVE record: Sipwise rtpengine · CVSS 6.9 Medium · Not analysed yet · Published 1 Aug 2025 · Tags: CWE-346
- [Keycloak phishing attack via email verification step in first login flow](https://agentprime.io/advisories/GHSA-xhpr-465j-7p9q.md)
  `GHSA-xhpr-465j-7p9q`, `CVE-2025-7365` · Maven `org.keycloak:keycloak-services`: affected `<26.0.13 || >=26.2.0, <26.2.6`, fixed in `26.0.13`, `26.2.6` · CVSS 7.1 High · Not analysed yet · Published 30 Jul 2025 · Tags: CWE-346
- [Duplicate Advisory: Keycloak phishing attack via email verification step in first login flow](https://agentprime.io/advisories/GHSA-gj52-35xm-gxjh.md)
  `GHSA-gj52-35xm-gxjh` · Maven `org.keycloak:keycloak-services`: affected `<26.3.0`, fixed in `26.3.0` · CVSS 5.4 Medium · Withdrawn · Not analysed yet · Published 10 Jul 2025 · Tags: CWE-346
- [Origin validation error in NAVER Whale browser](https://agentprime.io/advisories/CVE-2025-53600.md)
  `CVE-2025-53600` · CVE record: NAVER NAVER Whale browser · CVSS 7.5 High · Not analysed yet · Published 4 Jul 2025 · Tags: CWE-346
- [Autel MaxiCharger AC Wallbox Commercial Origin Validation Error Authentication Bypass Vulnerability](https://agentprime.io/advisories/CVE-2025-5824.md)
  `CVE-2025-5824` · CVE record: Autel Autel MaxiCharger AC Wallbox Commercial · CVSS 5.0 Medium · Not analysed yet · Published 25 Jun 2025 · Tags: CWE-346
- [Security misconfiguration vulnerability in SAP Business One Integration Framework](https://agentprime.io/advisories/CVE-2025-42998.md)
  `CVE-2025-42998` · CVE record: SAP_SE SAP Business One Integration Framework · CVSS 5.3 Medium · Not analysed yet · Published 10 Jun 2025 · Tags: CWE-346
- [webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser](https://agentprime.io/advisories/GHSA-9jgg-88mc-972h.md)
  `GHSA-9jgg-88mc-972h`, `CVE-2025-30360` · npm `webpack-dev-server`: affected `<5.2.1`, fixed in `5.2.1` · CVSS 6.5 Medium · Not analysed yet · Published 4 Jun 2025 · Tags: CWE-346
- [MacOS Zscaler Client Connector Local Privilege Escalation](https://agentprime.io/advisories/CVE-2024-31127.md)
  `CVE-2024-31127` · CVE record: Zscaler Client Connector · CVSS 7.3 High · Not analysed yet · Published 4 Jun 2025 · Tags: CWE-346
- [Origin validation error in Apple Safari and others](https://agentprime.io/advisories/CVE-2025-30466.md)
  `CVE-2025-30466` · CVE record: Apple Safari and 3 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 May 2025 · Tags: CWE-346
- [Gradio CORS Origin Validation Bypass Vulnerability](https://agentprime.io/advisories/GHSA-wmjh-cpqj-4v6x.md)
  `GHSA-wmjh-cpqj-4v6x`, `CVE-2025-5320`, `PYSEC-2026-1423` · PyPI `gradio`: affected `>=5.0.0, <=5.29.1`, no fixed version yet · CVSS 6.3 Medium · Not analysed yet · Published 29 May 2025 · Tags: CWE-345, CWE-346
- [Error handling for script execution was incorrectly isolated from web content](https://agentprime.io/advisories/CVE-2025-5263.md)
  `CVE-2025-5263` · CVE record: Mozilla Firefox and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 27 May 2025 · Tags: CWE-346
- [itwanger paicoding CrossUtil.java cross-domain policy](https://agentprime.io/advisories/CVE-2025-4839.md)
  `CVE-2025-4839` · CVE record: itwanger paicoding · CVSS 2.3 Low · Not analysed yet · Published 17 May 2025 · Tags: CWE-346, CWE-942
- [Origin Validation Error](https://agentprime.io/advisories/CVE-2025-46737.md)
  `CVE-2025-46737` · CVE record: Schweitzer Engineering Laboratories SEL-5037 Grid Configurator · CVSS 7.4 High · Not analysed yet · Published 12 May 2025 · Tags: CWE-346
- [Freeebird Hotel 酒店管理系统 API SessionInterceptor.java cross-domain policy](https://agentprime.io/advisories/CVE-2025-4542.md)
  `CVE-2025-4542` · CVE record: Freeebird Hotel 酒店管理系统 API · CVSS 2.3 Low · Not analysed yet · Published 11 May 2025 · Tags: CWE-346, CWE-942
- [Zylon PrivateGPT settings.yaml cross-domain policy](https://agentprime.io/advisories/CVE-2025-4515.md)
  `CVE-2025-4515` · CVE record: Zylon PrivateGPT · CVSS 5.3 Medium · Not analysed yet · Published 10 May 2025 · Tags: CWE-346, CWE-942
- [Origin validation error in ASUS DriverHub](https://agentprime.io/advisories/CVE-2025-3462.md)
  `CVE-2025-3462` · CVE record: ASUS DriverHub · CVSS 8.4 High · Not analysed yet · Published 9 May 2025 · Tags: CWE-346
- [@misskey-dev/summaly allows IP Filter Bypass via Redirect](https://agentprime.io/advisories/GHSA-jqx4-9gpq-rppm.md)
  `GHSA-jqx4-9gpq-rppm` · npm `@misskey-dev/summaly`: affected `>=5.1.0, <5.2.1`, fixed in `5.2.1` · CVSS 5.3 Medium · Not analysed yet · Published 6 May 2025 · Tags: CWE-346
- [Origin validation error in kitty](https://agentprime.io/advisories/CVE-2025-43929.md)
  `CVE-2025-43929` · CVE record: kitty project kitty · CVSS 4.1 Medium · Not analysed yet · Published 20 Apr 2025 · Tags: CWE-346
- [Command Injection in iManage Work Desktop for Mac's Agent Service](https://agentprime.io/advisories/CVE-2025-3651.md)
  `CVE-2025-3651` · CVE record: iManage Work Desktop for Mac · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Apr 2025 · Tags: Information disclosure, CWE-346

Newest: <https://agentprime.io/advisories/tag/cwe-346.md>
Older: <https://agentprime.io/advisories/tag/cwe-346.md?cursor=WyIyMDI1LTA0LTE3VDE0OjU4OjAwLjUyMDAwMFoiLCJDVkUtMjAyNS0zNjUxIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-346&cursor=WyIyMDI2LTAxLTEyVDA5OjMwOjMxLjAwMDAwMFoiLCJHSFNBLXBncXAtOGg0Ni02eDRqIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-346/?cursor=WyIyMDI2LTAxLTEyVDA5OjMwOjMxLjAwMDAwMFoiLCJHSFNBLXBncXAtOGg0Ni02eDRqIl0>. Everything for agents: <https://agentprime.io/llms.txt>.