The product does not properly verify that the source of data or communication is valid.
686 vulnerabilities with CWE-346
CVE-2026-28861
MEDIUM
Safari < 26.4 - Cross-Site Scripting via Script Message Handler Origin Confusion
CVSS 4.3
CVE-2026-21790
MEDIUM
HCL Traveler is susceptible to a weak default HTTP header validation vulnerability
CVSS 6.3
CVE-2026-33314
MEDIUM
pyload-ng: Improper Authentication and Origin Validation Error
CVSS 6.5
CVE-2026-32318
HIGH
Cryptomator for IOS: Tampered vault configuration allows MITM attack on Hub API
CVSS 7.6
CVE-2026-32317
HIGH
Cryptomator for Android: Tampered vault configuration allows MITM attack on Hub API
CVSS 7.6
CVE-2026-32303
HIGH
Cryptomator: Tampered vault configuration allows MITM attack on Hub API
CVSS 7.6
CVE-2026-32634
HIGH
Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers
CVSS 8.1
CVE-2026-32632
MEDIUM
Glances's REST/WebUI Lacks Host Validation and Remains Exposed to DNS Rebinding
CVSS 5.9
CVE-2026-20643
MEDIUM
macOS < 26.3.2 - Same Origin Policy Bypass via Navigation API
CVSS 5.4
CVE-2026-2457
MEDIUM
WebSocket Message Spoofing via Permalink Embed Manipulation
CVSS 4.3
CVE-2026-32302
HIGH
OpenClaw < 2026.3.11 - Unauthenticated Privilege Escalation via WebSocket Origin Validation Bypass
CVSS 8.1
CVE-2026-27478
CRITICAL
Unity Catalog <=0.4.0 - Auth Bypass
CVSS 9.1
CVE-2026-3846
MEDIUM
Firefox < 148.0.2 - Same-Origin Policy Bypass in CSS Parsing and Computation
CVSS 6.5
CVE-2026-30964
MEDIUM
web-auth/webauthn-lib <5.2.4 - Auth Bypass
CVSS 5.4
CVE-2026-25604
MEDIUM
apache-airflow-providers-amazon < 9.22.0 - Origin Validation Error in AWS Auth Manager
CVSS 5.4
CVE-2026-28403
HIGH
Textream < 1.5.1 - Unauthenticated WebSocket Origin Validation Error
CVSS 7.6
CVE-2026-27824
MEDIUM
calibre < 9.4.0 - Brute-Force Protection Bypass via X-Forwarded-For Header Manipulation
CVSS 5.3
CVE-2026-26861
HIGH
CleverTap Web SDK < 1.15.2 - Cross-Site Scripting via PostMessage Origin Validation Bypass
CVSS 8.3
CVE-2026-27148
CRITICAL
Storybook <7.6.23/8.6.17/9.1.19/10.2.10 - WebSocket Hijacking
CVSS 9.6
CVE-2026-2790
CRITICAL
Firefox <148 & ESR <140.8 - Auth Bypass
CVSS 9.8
CVE-2026-23552
CRITICAL
Apache Camel 4.15.0-4.17.0 - Auth Bypass
CVSS 9.1
CVE-2026-27579
HIGH
karnop realtime-collaboration-platform - Origin Validation Error in CORS Configuration
CVSS 7.4
CVE-2026-27192
HIGH
Feathersjs < 5.0.40 - Origin Validation Bypass via Prefix Matching
CVSS 8.1
CVE-2026-27118
MEDIUM
@sveltejs/adapter-vercel <6.3.2 - Cache Poisoning
CVE-2026-27004
MEDIUM
OpenClaw <2026.2.15 - Privilege Escalation
CVSS 5.5
Details
Vulnerabilities
686