CWE-942.

Google Chrome: Inappropriate implementation in CORS in Google Chrome on Linux and ChromeOS prior to…

• Google Chrome
• CWE-942

Google Chrome: Insufficient policy enforcement in ViewTransitions in Google Chrome prior to…

• Google Chrome
• CWE-942

Cleanuparr: Reflective CORS combined with trusted-network auth allows cross-origin admin API reads

• Cleanuparr
• CWE-346
• CWE-942

@yoda.digital/gitlab-mcp-server's SSE transport has no authentication and wildcard CORS, exposing all 86 GitLab tools

• Authentication bypass
• CWE-942

<0.6.0 · fixed in 0.6.0

ChatGPTNextWeb NextChat API Endpoint Next.js cross-domain policy

• ChatGPTNextWeb NextChat
• CWE-346
• CWE-942

alexta69 MeTube CORS Policy main.py on_prepare cross-domain policy

• alexta69 MeTube
• CWE-346
• CWE-942

engram: HTTP server CORS wildcard + auth-off-by-default enables CSRF graph exfiltration and persistent indirect prompt injection

• Authentication bypass
• Cross-site request forgery (CSRF)

<2.0.2 · fixed in 2.0.2

Glances: Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORS

• Information disclosure
• Authentication bypass

<4.5.4 · fixed in 4.5.4

ericc-ch copilot-api Token Endpoint server.ts cors cross-domain policy

• ericc-ch copilot-api
• CWE-346
• CWE-942

WWBN AVideo has CORS Origin Reflection with Credentials on Sensitive API Endpoints Enables Cross-Origin Account Takeover

• CWE-942

<=29.0 · no fixed version yet

farion1231 cc-switch ProxyServer server.rs cross-domain policy

• farion1231 cc-switch
• CWE-346
• CWE-942

PraisonAI: Cross-Origin Agent Execution via Hardcoded Wildcard CORS and Missing Authentication on AGUI Endpoint

• CWE-942

<4.5.128 · fixed in 4.5.128

Permissive Cross-domain Policy with Untrusted Domains in coolercontrold

• coolercontrold
• CWE-942

vanna-ai vanna FastAPI/Flask Server cross-domain policy

• vanna
• CWE-346
• CWE-942

openssl-encrypt has CORS wildcard with allow_credentials=True in standalone servers

• Broken access control
• CWE-942

<1.4.0 · fixed in 1.4.0

SiYuan is Vulnerable to Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection

• CWE-942

<3.6.2 · fixed in 3.6.2

Sliver One-Click Remote Access: Insecure CORS & Unauthenticated MCP Interface

• Authentication bypass
• CWE-942

<1.7.4 · fixed in 1.7.4

Nhost CLI MCP Server: Missing Inbound Authentication on Explicitly Bound Network Port

• nhost
• Authentication bypass
• CWE-942

Information disclosure via CORS misconfiguration

• PowerDNS DNSdist
• CWE-942

MCP Java SDK has a Hardcoded Wildcard CORS (Access-Control-Allow-Origin: *)

• CWE-942

>=1.0.0, <1.0.1 || >=1.1.0, <1.1.1 || <0.18.3 · fixed in 1.0.1, 1.1.1, 0.18.3

Glances Vulnerable to Cross-Origin System Information Disclosure via XML-RPC Server CORS Wildcard

• CWE-942

<4.5.3 · fixed in 4.5.3

HCL Aftermarket DPC is affected by Cross-Origin Resource Sharing vulnerability

• HCL Aftermarket DPC
• CWE-942

qui CORS Misconfiguration: Arbitrary Origins Trusted

• CWE-942

<1.15.0 · fixed in 1.15.0

AVideo affected by Session Hijacking via Unauthenticated Session ID Disclosure with Permissive CORS

• CWE-942

<=25.0 · no fixed version yet

Glances's Default CORS Configuration Allows Cross-Origin Credential Theft

• CWE-942

<4.5.2 · fixed in 4.5.2

AnythingLLM Permissable CORS policy

• Mintplex-Labs anything-llm
• CWE-942
• CWE-1188

TinaCMS CLI Dev Server Vulnerable to Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS

• Path traversal
• CWE-942

<2.1.8 · fixed in 2.1.8

mcp-memory-service's Wildcard CORS with Credentials Enables Cross-Origin Memory Theft

• CWE-942

<10.25.1 · fixed in 10.25.1

CollabPlatform : CORS Misconfiguration Allows Arbitrary Origin With Credentials Leading to Authenticated Account Data Exposure

• karnop realtime-collaboration-platform
• CWE-346
• CWE-942

Permissive Web Security Policy Allows Cross-Origin Access Control Bypass on Omada Cloud Controllers

• TP-Link Systems Inc. Omada Cloud Controller
• CWE-942

Litestar's CORS origin allowlist has a bypass due to unescaped regex metacharacters in allowed origins

• CWE-942

>=2.19.0, <2.20.0 · fixed in 2.20.0

Next.js - Critical - Access bypass - SA-CONTRIB-2025-122

• Drupal Next.js
• CWE-942

Tenda W30E V2 Permissive CORS Allows Cross-origin Data Access

• Shenzhen Tenda Technology Co., Ltd. W30E V2
• CWE-942

Altium 365 Over-Permissive CORS Configuration Allows Credentialed Cross-Origin Workspace Access

• Altium 365
• Broken access control
• CWE-942

OpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Execution

• Authentication bypass
• CWE-749

<1.0.216 · fixed in 1.0.216

A CORS misconfiguration in Eramba Community and Enterprise Editions v3.26.0 allows an attacker-controlled Origin header to be reflected in the Access-Control-Allow-Origin response along with Access-C…

• CWE-942

Same-origin policy bypass in the DOM: Workers component

• Mozilla Firefox
• Mozilla Thunderbird
• CWE-942

Same-origin policy bypass in the DOM: Notifications component

• Mozilla Firefox
• Mozilla Thunderbird
• CWE-942

The issue was addressed with improved checks.

• Apple Safari
• Apple iOS and iPadOS
• CWE-942

The issue was addressed with improved handling of caches.

• Apple Safari
• Apple iOS and iPadOS
• CWE-942

PILOS Misconfigured the Access-Control-Allow-Origin Header

• THM-Health PILOS
• CWE-942

Strapi core vulnerable to sensitive data exposure via CORS misconfiguration

• Information disclosure
• Broken access control

<5.20.0 · fixed in 5.20.0

IBM Aspera Faspex cross-origin resource sharing

• IBM Aspera Faspex
• CWE-942

CodeCanyon/ui-lib Mentor LMS API cross-domain policy

• CodeCanyon Mentor LMS
• ui-lib Mentor LMS
• CWE-346
• CWE-942

Cross-origin resource sharing (CORS) in Hiberus Sintra

• Hiberus Sintra
• CWE-942

cors-anywhere vulnerable to server-side request forgery

• Server-side request forgery (SSRF)
• CWE-942

<=0.4.4 · no fixed version yet

Same-origin policy bypass in the Layout component

• Mozilla Firefox
• Mozilla Thunderbird
• CWE-942

@musistudio/claude-code-router has improper CORS configuration

• Information disclosure
• CWE-942

<1.0.34 · fixed in 1.0.34

IBM Concert Software cross-origin resource sharing

• IBM Concert Software
• CWE-942

Overly Permissive CORS Policy in WAGO Device Manager

• WAGO CC100 0751-9x01
• WAGO PFC100 G1 0750-810x/xxxx-xxxx
• CWE-942

CORS vulnerability in IDF and ZLF

• ZIV IDF and ZLF
• CWE-942

CORS vulnerability in IDF and ZLF

• ZIV IDF and ZLF
• CWE-942

itwanger paicoding CrossUtil.java cross-domain policy

• itwanger paicoding
• CWE-346
• CWE-942

Freeebird Hotel 酒店管理系统 API SessionInterceptor.java cross-domain policy

• Freeebird Hotel 酒店管理系统 API
• CWE-346
• CWE-942

Zylon PrivateGPT settings.yaml cross-domain policy

• Zylon PrivateGPT
• CWE-346
• CWE-942

Omnissa UAG contains a Cross-Origin Resource Sharing (CORS) bypass vulnerability.

• Omnissa Unified Access Gateway (UAG)
• CWE-942

Improper Access Control In DestinyECM

• Cyberdigm DestinyECM
• Cross-site request forgery (CSRF)
• CWE-942

Bruno ignores Safe-Mode in Asserts expressions

• bruno
• CWE-942

Reflected Cross-Site Scripting (XSS) vulnerability in saTECH BCU

• Arteche saTECH BCU
• CWE-942

Mindskip xzs-mysql 学之思开源考试系统 CORS cross-domain policy

• Mindskip xzs-mysql 学之思开源考试系统
• CWE-346
• CWE-942