Advisories · Weakness

CWE-346.

Every Advisory and CVE whose sources give the weakness CWE-346, newest first.

CVE-2026-17753 CVE record

CVSS 4.3 Medium

Origin validation error in Google Chrome
- Google Chrome
- CWE-346
Not analysed yet 30 Jul 2026
CVE-2026-17748 CVE record

CVSS 6.5 Medium

Origin validation error in Google Chrome
- Google Chrome
- CWE-346
Not analysed yet 30 Jul 2026
CVE-2026-17743 CVE record

CVSS 6.5 Medium

Origin validation error in Google Chrome
- Google Chrome
- CWE-346
Not analysed yet 30 Jul 2026
CVE-2026-17742 CVE record

CVSS 4.3 Medium

Origin validation error in Google Chrome
- Google Chrome
- CWE-346
Not analysed yet 30 Jul 2026
CVE-2026-17733 CVE record

CVSS 4.3 Medium

Origin validation error in Google Chrome
- Google Chrome
- CWE-346
Not analysed yet 30 Jul 2026
CVE-2026-17731 CVE record

CVSS 4.3 Medium

Origin validation error in Google Chrome
- Google Chrome
- CWE-346
Not analysed yet 30 Jul 2026
CVE-2026-17732 CVE record

CVSS 3.1 Low

Origin validation error in Google Chrome
- Google Chrome
- CWE-346
Not analysed yet 30 Jul 2026
CVE-2026-17720 CVE record

CVSS 3.1 Low

Origin validation error in Google Chrome
- Google Chrome
- CWE-346
Not analysed yet 30 Jul 2026
CVE-2026-17715 CVE record

CVSS 3.1 Low

Origin validation error in Google Chrome
- Google Chrome
- CWE-346
Not analysed yet 30 Jul 2026
CVE-2026-17702 CVE record

CVSS 3.1 Low

Origin validation error in Google Chrome
- Google Chrome
- CWE-346
Not analysed yet 30 Jul 2026
CVE-2026-17693 CVE record

CVSS 4.3 Medium

Origin validation error in Google Chrome
- Google Chrome
- CWE-346
Not analysed yet 30 Jul 2026
CVE-2026-17662 CVE record

CVSS 4.3 Medium

Origin validation error in Google Chrome
- Google Chrome
- CWE-346
Not analysed yet 30 Jul 2026
CVE-2026-6102 CVE record

CVSS 7.8 High

MSI Center NTIOLib_X64 Origin Validation Error Local Privilege Escalation Vulnerability
- MSI Center
- CWE-346
Not analysed yet 29 Jul 2026
oauth RubyGems

CVSS 7.2 High

OAuth: Cross-origin token-request redirects can expose signed request metadata
- Information disclosure
- Server-side request forgery (SSRF)
>=0.5.5, <1.1.6 · fixed in 1.1.6

GHSA-prq8-7wvh-44qh · CVE-2026-54605 Not analysed yet 28 Jul 2026
CVE-2026-57989 CVE record

CVSS 7.4 High

Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
- Microsoft Edge (Chromium-based)
- CWE-346
Not analysed yet 26 Jul 2026
CVE-2026-57978 CVE record

CVSS 5.4 Medium

Microsoft Edge (Chromium-based) Spoofing Vulnerability
- Microsoft Edge (Chromium-based)
- CWE-346
Not analysed yet 26 Jul 2026
@auth/core +1 npm

CVSS 6.8 Medium

Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them
- CWE-345
- CWE-346
<0.41.3 · fixed in 0.41.3

GHSA-x445-f3h2-j279 · CVE-2026-73419 Not analysed yet 23 Jul 2026
CVE-2026-16745 CVE record

CVSS 8.8 High

Odh-dashboard: odh-dashboard: backend port 8080 trusts x-forwarded-access-token without origin validation
- Red Hat OpenShift AI 2.25
- Red Hat OpenShift AI 3.3
- CWE-346
Not analysed yet 23 Jul 2026
n8n npm

CVSS 7.6 High

n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution
- Authentication bypass
- CWE-346
<2.27.4 || >=2.28.0, <2.28.1 · fixed in 2.27.4, 2.28.1

GHSA-mq3m-f8x3-579w · CVE-2026-59208 Not analysed yet 22 Jul 2026
CVE-2026-13321 CVE record

CVSS 8.6 High

DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field
- ISC BIND 9
- CWE-346
Not analysed yet 22 Jul 2026
CVE-2026-16399 CVE record

CVSS 7.5 High

Site isolation issue in the DOM: Navigation component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 21 Jul 2026
CVE-2026-16398 CVE record

CVSS 7.5 High

Site isolation issue in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
- CWE-346
Not analysed yet 21 Jul 2026
CVE-2026-16387 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Site isolation issue in the Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
- Broken access control
Not analysed yet 21 Jul 2026
CVE-2026-16381 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Same-origin policy bypass in the Networking: DNS component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 21 Jul 2026
CVE-2026-16358 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Site isolation issue in the Graphics: WebRender component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 21 Jul 2026
CVE-2026-16375 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Site isolation issue in the Networking: HTTP component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 21 Jul 2026
CVE-2026-16349 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Same-origin policy bypass in the DOM: Navigation component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 21 Jul 2026
guzzlehttp/guzzle Packagist

CVSS 4.7 Medium

Guzzle: Cookie Disclosure and Injection via IP-Address Domains
- Information disclosure
- Authentication bypass
<7.12.3 · fixed in 7.12.3

GHSA-g446-98w2-8p5w · CVE-2026-59883 Not analysed yet 20 Jul 2026
CVE-2026-46555 CVE record

CVSS 7.7 High

WhatsApp MCP: Unauthenticated bridge API allows message sending and arbitrary file exfiltration
- verygoodplugins whatsapp-mcp
- Path traversal
- Authentication bypass
Not analysed yet 20 Jul 2026
mcp PyPI

CVSS 7.6 High

MCP Python SDK: WebSocket server transport does not support Host/Origin validation
- CWE-346
- CWE-1385
<1.28.1 · fixed in 1.28.1

GHSA-vj7q-gjh5-988w · CVE-2026-59950 Not analysed yet 16 Jul 2026
CVE-2023-49899 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Origin Validation Error in X-Rite MA-T6
- X-Rite MA-T6
- CWE-346
Not analysed yet 16 Jul 2026
fiftyone PyPI

CVSS 6.3 Medium

FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
- CWE-346
- CWE-942
<1.17.0 · fixed in 1.17.0

GHSA-q78p-hj9h-5466 · CVE-2026-53656 Not analysed yet 15 Jul 2026
CVE-2026-52842 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Lightpanda:URL parser misidentifies page origin for URLs containing @ in the path - Same-Origin Policy bypass
- lightpanda-io browser
- CWE-346
Not analysed yet 15 Jul 2026
CVE-2026-52843 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Lightpanda: fetch() and XMLHttpRequest attach session cookies to cross-origin requests regardless of credentials mode
- lightpanda-io browser
- CWE-346
Not analysed yet 15 Jul 2026
CVE-2026-15775 CVE record

CVSS 6.5 Medium

Origin validation error in Google Chrome
- Google Chrome
- CWE-346
Not analysed yet 14 Jul 2026
CVE-2026-15768 CVE record

CVSS 6.5 Medium

Origin validation error in Google Chrome
- Google Chrome
- CWE-346
Not analysed yet 14 Jul 2026
CVE-2026-56181 CVE record

CVSS 8.3 High

Windows Network Address Translation (NAT) Spoofing Vulnerability
- Microsoft Windows 11 Version 24H2
- Microsoft Windows 11 Version 25H2
- CWE-346
Not analysed yet 14 Jul 2026
CVE-2026-15075 CVE record

CVSS 8.2 High

Information disclosure in Eclipse Foundation Eclipse Vert.x
- Eclipse Foundation Eclipse Vert.x
- Information disclosure
- CWE-346
Not analysed yet 14 Jul 2026
CVE-2026-15076 CVE record

CVSS 8.2 High

Origin validation error in Eclipse Foundation Eclipse Vert.x
- Eclipse Foundation Eclipse Vert.x
- CWE-346
Not analysed yet 14 Jul 2026
github.com/siyuan-note/siyuan/kernel Go

CVSS 9.2 CriticalCritical · CVSS 9+

SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist
- CWE-346
<0.0.0-20260628153353-2d5d72223df4 · fixed in 0.0.0-20260628153353-2d5d72223df4

GHSA-hvr9-72v2-fff3 · CVE-2026-54069 Not analysed yet 10 Jul 2026
CVE-2026-34198 CVE record

CVSS 5.3 Medium

Coolify: Password reset link poisoning via X-Forwarded-Host header spoofing
- coollabsio coolify
- CWE-346
- CWE-640
Not analysed yet 7 Jul 2026
github.com/coder/coder/v2 Go

CVSS 5.8 Medium

Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing
- CWE-346
<2.29.17 || >=2.30.0, <2.32.7 || >=2.33.0, <2.33.8 || >=2.34.0, <2.34.2 · fixed in 2.29.17, 2.32.7, 2.33.8, 2.34.2

GHSA-5wg6-jmq2-53pw · CVE-2026-55438 Not analysed yet 6 Jul 2026
CVE-2026-42341 CVE record

CVSS 9.2 CriticalCritical · CVSS 9+

FOSSBilling has an unauthenticated payment bypass via IPN callback forgery
- FOSSBilling
- Authentication bypass
- CWE-346
Not analysed yet 6 Jul 2026
CVE-2026-59096 CVE record

CVSS 8.2 High

Dapr - OIDC Discovery Issuer and JWKS URI Injection via Unvalidated X-Forwarded-Host
- dapr
- CWE-346
Not analysed yet 2 Jul 2026
CVE-2026-14105 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Origin validation error in Google Chrome
- Google Chrome
- CWE-346
Not analysed yet 30 Jun 2026
CVE-2026-14079 CVE record

CVSS 4.3 Medium

Origin validation error in Google Chrome
- Google Chrome
- CWE-346
Not analysed yet 30 Jun 2026
CVE-2026-14057 CVE record

CVSS 4.3 Medium

Origin validation error in Google Chrome
- Google Chrome
- CWE-346
Not analysed yet 30 Jun 2026
CVE-2026-14053 CVE record

CVSS 4.3 Medium

Origin validation error in Google Chrome
- Google Chrome
- CWE-346
Not analysed yet 30 Jun 2026
CVE-2026-14046 CVE record

CVSS 4.3 Medium

Origin validation error in Google Chrome
- Google Chrome
- CWE-346
Not analysed yet 30 Jun 2026
CVE-2026-14039 CVE record

CVSS 4.3 Medium

Origin validation error in Google Chrome
- Google Chrome
- CWE-346
Not analysed yet 30 Jun 2026
CVE-2026-13913 CVE record

CVSS 6.5 Medium

Origin validation error in Google Chrome
- Google Chrome
- CWE-346
Not analysed yet 30 Jun 2026
CVE-2026-13887 CVE record

CVSS 6.5 Medium

Cross-site request forgery in Google Chrome
- Google Chrome
- Cross-site request forgery (CSRF)
- CWE-346
Not analysed yet 30 Jun 2026
CVE-2026-13881 CVE record

CVSS 6.5 Medium

Origin validation error in Google Chrome
- Google Chrome
- CWE-346
Not analysed yet 30 Jun 2026
CVE-2026-13868 CVE record

CVSS 6.5 Medium

Origin validation error in Google Chrome
- Google Chrome
- CWE-346
Not analysed yet 30 Jun 2026
CVE-2026-13840 CVE record

CVSS 6.5 Medium

Origin validation error in Google Chrome
- Google Chrome
- CWE-346
Not analysed yet 30 Jun 2026
CVE-2026-13839 CVE record

CVSS 6.5 Medium

Origin validation error in Google Chrome
- Google Chrome
- CWE-346
Not analysed yet 30 Jun 2026
CVE-2026-13838 CVE record

CVSS 6.5 Medium

Origin validation error in Google Chrome
- Google Chrome
- CWE-346
Not analysed yet 30 Jun 2026
CVE-2026-13826 CVE record

CVSS 6.5 Medium

Cross-site request forgery in Google Chrome
- Google Chrome
- Cross-site request forgery (CSRF)
- CWE-346
Not analysed yet 30 Jun 2026
CVE-2026-13822 CVE record

CVSS 6.5 Medium

Origin validation error in Google Chrome
- Google Chrome
- CWE-346
Not analysed yet 30 Jun 2026
CVE-2026-13793 CVE record

CVSS 6.5 Medium

Origin validation error in Google Chrome
- Google Chrome
- CWE-346
Not analysed yet 30 Jun 2026