agentprime: CWE-942

Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads

Fri, 30 Oct 2026 22:58:05 GMT

github.com/gofiber/fiber/v2 >=2.52.1, <2.52.3, fixed in 2.52.3. CVSS 5.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-62863: MoLing: unauthenticated SSE and wildcard CORS expose tool sessions

Fri, 30 Oct 2026 20:33:14 GMT

CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server

Wed, 28 Oct 2026 21:15:49 GMT

vllm <0.32.0, fixed in 0.32.0. CVSS 3.4 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-110737: Push Endpoint Returns Permissive CORS Headers

Tue, 27 Oct 2026 10:26:37 GMT

CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-116748: Transmission 4.0.0 before 4.1.3 Permissive CORS Leaks RPC Anti-CSRF Token

Mon, 26 Oct 2026 21:52:45 GMT

CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-107858: Cross-Site WebSocket Hijacking and Permissive CORS in Google Agent Development Kit (ADK) for Java Development Server

Fri, 23 Oct 2026 05:08:46 GMT

CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-3303: IBM Concert Software Permissive Cross-domain Security Policy

Mon, 19 Oct 2026 17:17:45 GMT

CVSS 3.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.

LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files

Mon, 19 Oct 2026 16:11:57 GMT

loopx >=0.0.1, <0.4.5, fixed in 0.4.5. CVSS 7.1 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-85313: Apache Camel: Camel-Jetty Cross-Origin Credential Exposure via Allow-All CrossOriginFilter Defaults When enableCORS Is Set

Mon, 19 Oct 2026 10:40:58 GMT

CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-84176: Apache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Origin Reflection

Mon, 19 Oct 2026 10:30:00 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-55842: Scoold: CORS wildcard origin with credentials enabled allows cross-origin authenticated API access from any domain

Thu, 15 Oct 2026 18:30:57 GMT

CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted

Fri, 09 Oct 2026 20:57:50 GMT

code.vikunja.io/api >=2.2.0, <=2.6.0, no fixed version yet. CVSS 7.2 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain

Fri, 02 Oct 2026 22:44:26 GMT

vibe-trading-ai >=0.1.0, <0.1.7, fixed in 0.1.7. CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-66247: HCL Software iControl: iControl is affected by an insecure Cross-Origin Resource Sharing (CORS) policy…

Thu, 01 Oct 2026 13:25:13 GMT

CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-66070: RabbitMQ: CORS * reflects Origin with Allow-Credentials

Wed, 23 Sep 2026 19:59:58 GMT

CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-90882: Reflected arbitrary origins with credentials, allowing cross-origin reads of authenticated user data

Tue, 22 Sep 2026 09:27:34 GMT

CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-56595: HCL BigFix Service Management is affected by multiple security vulnerabilities.

Fri, 18 Sep 2026 08:25:39 GMT

CVSS 3.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-89058: Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config

Fri, 18 Sep 2026 07:20:29 GMT

CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-92359: ag-ui-protocol ag-ui CORSMiddleware utils.py create_strands_app cross-domain policy

Wed, 16 Sep 2026 12:00:16 GMT

CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-82438: Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins

Mon, 14 Sep 2026 14:02:07 GMT

CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

@Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft

Fri, 11 Sep 2026 22:04:42 GMT

@mockoon/cli <9.7.0, fixed in 9.7.0. CVSS 8.8 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Windows ML CLI: CORS misconfig enables localhost RCE

Tue, 08 Sep 2026 21:27:59 GMT

winml-cli <0.4.0, fixed in 0.4.0. CVSS 8.6 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-62895: Azure Arc SQL Server Extension Elevation of Privilege Vulnerability

Tue, 08 Sep 2026 17:10:31 GMT

CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-12962: ASUS Armoury Crate: A Permissive Cross-domain Security Policy with Untrusted Domains in Armoury Crate allows…

Tue, 08 Sep 2026 02:03:58 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-82291: HeyForm Reflects Any Origin in CORS Responses While Allowing Credentials

Fri, 28 Aug 2026 16:19:07 GMT

CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-82287: Rybbit Reflects Any Origin in CORS Responses While Allowing Credentials

Fri, 28 Aug 2026 16:19:05 GMT

CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-61163: Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with untrusted domains.

Wed, 26 Aug 2026 00:00:00 GMT

CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-63407: Grav API Plugin: CORS 'Access-Control-Allow-Origin: *' on Authenticated API Responses

Wed, 19 Aug 2026 15:51:36 GMT

CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.

Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard

Mon, 17 Aug 2026 17:04:51 GMT

glances <4.5.6, fixed in 4.5.6. CVSS 6.5 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-46409: OpenYak local API: unauthenticated CSRF chain leads to Remote Code Execution

Fri, 07 Aug 2026 22:11:57 GMT

CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads

Wed, 05 Aug 2026 15:59:45 GMT

electron <39.8.10 || >=40.0.0-alpha.1, <40.9.3 || >=41.0.0-alpha.1, <41.4.0 || >=42.0.0-alpha.1, <42.0.0, fixed in 39.8.10, 40.9.3, 41.4.0, 42.0.0. CVSS 7.4 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

`nx graph` dev server permissive CORS policy

Fri, 31 Jul 2026 16:50:24 GMT

nx >=17.0.4, <22.7.2 || >=23.0.0-beta.0, <23.0.0-beta.2, fixed in 22.7.2, 23.0.0-beta.2. CVSS 5.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-65310: Missing authentication and permissive CORS policy

Fri, 31 Jul 2026 07:26:29 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-66005: Jan Local API Server CORS Origin Reflection via 0.0.0.0 Binding

Fri, 24 Jul 2026 14:57:33 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-15966: Improper CORS handling in MOVEit Transfer

Thu, 23 Jul 2026 19:58:01 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests

Mon, 20 Jul 2026 21:45:25 GMT

lightrag-hku <1.5.4, fixed in 1.5.4. CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-21761: CORS Misconfiguration in DevOps Loop

Fri, 17 Jul 2026 17:10:02 GMT

CVSS 4.2 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2024-23578: HCLSoftware Aftermarket EPC: HCL Aftermarket EPC is vulnerable to attack as the application implements an HTML5…

Fri, 17 Jul 2026 13:50:08 GMT

CVSS 4.2 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-62387: Grav < 1.0.0-rc.16 CORS Misconfiguration via API Plugin

Fri, 17 Jul 2026 00:07:14 GMT

CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data

Wed, 15 Jul 2026 21:57:29 GMT

fiftyone <1.17.0, fixed in 1.17.0. CVSS 6.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-8919: ASUS GameSDK: Permissive Cross-domain Security Policy with Untrusted Domains in ASUS GameSDK allows a…

Wed, 15 Jul 2026 02:00:46 GMT

CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-59726: Ruflo: Unauthenticated RCE in MCP bridge default docker-compose deployment

Thu, 09 Jul 2026 17:31:20 GMT

CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-56458: HCL DevOps Deploy is susceptible to a Permissive Cross-domain Security Policy with Untrusted Domains

Thu, 09 Jul 2026 08:51:07 GMT

CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE

Wed, 08 Jul 2026 20:27:02 GMT

github.com/BishopFox/joro <0.0.0-20260601151442-5c0ca35db828, fixed in 0.0.0-20260601151442-5c0ca35db828. CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-55110: A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Origin Resource Sharing (CORS) misconfiguration found in UniFi OS to trigger actions in UniFi OS using that…

Thu, 02 Jul 2026 14:49:16 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-12084: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to a Permissive Cross-domain Security Policy with Untrusted Domains

Tue, 30 Jun 2026 19:39:24 GMT

CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-57957: Papermark 0.22.0 - CORS Misconfiguration in Viewer Upload Endpoint

Mon, 29 Jun 2026 17:23:10 GMT

CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.

Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)

Mon, 22 Jun 2026 21:27:24 GMT

glances <4.5.5, fixed in 4.5.5. CVSS 7.4 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-56076: PraisonAI - Cross-Origin Agent Execution via Hardcoded Wildcard CORS and Missing Authentication on AGUI Endpoint

Thu, 18 Jun 2026 22:12:24 GMT

CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.

hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard

Tue, 16 Jun 2026 14:15:39 GMT

hono <4.12.25, fixed in 4.12.25. CVSS 7.1 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.