CWE-942

Permissive Cross-domain Security Policy with Untrusted Domains

Parent: CWE-863 - Incorrect Authorization

The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.

114 vulnerabilities with CWE-942
CVE-2026-8576 MEDIUM
Google Chrome < 148.0.7778.168 - Cross-Origin Data Leak via CORS Implementation
CVSS 4.3
CVE-2026-8537 MEDIUM
Google Chrome < 148.0.7778.168 - Cross-Origin Data Leak via ViewTransitions
CVSS 4.3
CVE-2026-44184 HIGH
Cleanuparr: Reflective CORS combined with trusted-network auth allows cross-origin admin API reads
CVSS 8.0
CVE-2026-7643 MEDIUM
ChatGPTNextWeb NextChat API Endpoint Next.js cross-domain policy
CVSS 4.3
CVE-2026-7581 MEDIUM
alexta69 MeTube CORS Policy main.py on_prepare cross-domain policy
CVSS 4.3
CVE-2026-41056 HIGH
AVideos has CORS Origin Reflection with Credentials on Sensitive API Endpoints that Enables Cross-Origin Account Takeover
CVSS 8.1
CVE-2026-34839 MEDIUM
Glances Vulnerable to Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORS
CVSS 6.5
CVE-2026-6662 HIGH
ericc-ch copilot-api Token Endpoint server.ts cors cross-domain policy
CVSS 7.3
CVE-2026-6143 MEDIUM
farion1231 cc-switch ProxyServer server.rs cross-domain policy
CVSS 6.3
CVE-2026-5302 MEDIUM
Permissive Cross-domain Policy with Untrusted Domains in coolercontrold
CVSS 6.3
CVE-2026-33533 MEDIUM
Glances Vulnerable to Cross-Origin System Information Disclosure via XML-RPC Server CORS Wildcard
CVSS 6.5
CVE-2026-5321 MEDIUM
vanna-ai vanna FastAPI/Flask Server cross-domain policy
CVSS 4.3
CVE-2026-34449 CRITICAL
SiYuan: Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection
CVSS 9.6
CVE-2026-34237 MEDIUM
MCP Java SDK HTTP Transports - Wildcard CORS
CVSS 6.1
CVE-2026-34227 HIGH
Sliver One-Click Remote Access: Insecure CORS & Unauthenticated MCP Interface
CVSS 8.8
CVE-2026-34200 HIGH
Nhost CLI MCP Server: Missing Inbound Authentication on Explicitly Bound Network Port
CVSS 7.5
CVE-2026-0397 LOW
Information disclosure via CORS misconfiguration
CVSS 3.1
CVE-2026-33010 HIGH
mcp-memory-service's Wildcard CORS with Credentials Enables Cross-Origin Memory Theft
CVSS 8.1
CVE-2026-33043 HIGH
AVideo affected by Session Hijacking via Unauthenticated Session ID Disclosure with Permissive CORS
CVSS 8.1
CVE-2026-30924 CRITICAL
qui CORS Misconfiguration: Arbitrary Origins Trusted
CVSS 9.6
CVE-2026-32610 HIGH
Glances's Default CORS Configuration Allows Cross-Origin Credential Theft
CVSS 8.1
CVE-2026-32617 HIGH
AnythingLLM <= 1.11.1 - Unauthenticated Cross-Origin Resource Sharing Misconfiguration
CVSS 7.1
CVE-2026-28792 CRITICAL
ssw/tinacms/cli < 2.1.8 - Unauthenticated Path Traversal and Arbitrary File Write via CORS Misconfiguration
CVSS 9.6
CVE-2026-27579 HIGH
karnop realtime-collaboration-platform - Origin Validation Error in CORS Configuration
CVSS 7.4
CVE-2026-25478 HIGH
Litestar < 2.20.0 - Permissive Cross-domain Security Policy via Unescaped Regex Metacharacters
CVSS 7.4
Details
Vulnerabilities 114