The product does not properly verify that the source of data or communication is valid.
692 vulnerabilities with CWE-346
CVE-2025-9636
HIGH
pgAdmin <= 9.7 - Cross-Origin Opener Policy Bypass via OAuth Flow Manipulation
CVSS 7.9
CVE-2025-47909
HIGH
gorilla/csrf < 1.7.3 - Origin Validation Error in TrustedOrigins
CVSS 7.3
CVE-2025-51605
HIGH
Shopizer 3.2.7 - Origin Validation Error in CORS Implementation
CVSS 8.1
CVE-2025-9180
HIGH
Firefox and Thunderbird - Same-Origin Policy Bypass in Canvas2D
CVSS 8.1
CVE-2025-52621
MEDIUM
HCL BigFix SaaS < 8.1.14 - Cache Poisoning via Origin Header Reflection
CVSS 5.3
CVE-2025-8881
MEDIUM
Google Chrome < 139.0.7258.127 - Cross-Origin Data Leak via File Picker
CVSS 6.5
CVE-2025-53399
MEDIUM
Sipwise rtpengine <13.4.1.1 - Command Injection
CVE-2025-7365
HIGH
Keycloak - Authenticated Account Takeover via Identity Provider Login Email Verification
CVSS 7.1
CVE-2025-53600
HIGH
Whale < 4.32.315.22 - Same-Origin Policy Bypass in Dual-Tab Environment
CVSS 7.5
CVE-2025-5824
HIGH
Autel MaxiCharger AC Wallbox Commercial - Auth Bypass
CVSS 7.5
CVE-2025-42998
MEDIUM
SAP Business One Integration Framework - Auth Bypass
CVSS 5.3
CVE-2025-30360
MEDIUM
webpack-dev-server < 5.2.1 - Origin Validation Error via IP Address Origin Header
CVSS 6.5
CVE-2025-30466
CRITICAL
Safari < 18.4 - Same Origin Policy Bypass via State Management Issue
CVSS 9.8
CVE-2025-5320
LOW
gradio-app gradio <= 5.29.1 - Insufficient Verification of Data Authenticity in CORS Handler
CVSS 3.7
CVE-2025-5263
MEDIUM
Firefox < 115.24.0, 115.24-115.*, 128.11-128.*, >=139 - Origin Validation Error
CVSS 4.3
CVE-2025-4839
LOW
itwanger paicoding 1.0.0-1.0.3 - Permissive Cross-domain Security Policy in CrossUtil.java
CVSS 3.1
CVE-2025-46737
HIGH
SEL-5037 Grid Configurator < 6.4.0.58 - Unauthenticated Origin Validation Error in Data Gateway Service
CVSS 7.4
CVE-2025-4542
LOW
Freeebird Hotel < 1.2 - Permissive Cross-domain Security Policy with Untrusted Domains
CVSS 3.1
CVE-2025-4515
MEDIUM
pribai/privategpt < 0.6.2 - Permissive Cross-domain Security Policy via allow_origins Argument
CVSS 4.3
CVE-2025-3462
HIGH
ASUS DriverHub - Unauthorized Feature Interaction via Crafted HTTP Requests
CVE-2025-43929
MEDIUM
kitty < 0.41.0 - Unauthenticated Arbitrary Code Execution via Untrusted Document Link
CVSS 4.1
CVE-2025-3651
CRITICAL
Work Desktop for Mac <10.8.2.33 - RCE
CVE-2025-3071
MEDIUM
Google Chrome < 135.0.7049.52 - Same Origin Policy Bypass via Navigation UI Gestures
CVSS 5.4
CVE-2025-2346
MEDIUM
IROAD Dash Cam X5-X6 <20250308 - Origin Validation Error
CVSS 5.6
CVE-2025-25306
CRITICAL
Misskey < 2025.2.1 - Unintended Proxy via ActivityPub Object Field Validation Bypass
CVSS 9.3
Details
Vulnerabilities
692