Skip to content
BackEsc
Sign in

CWE-346 · weakness in Access Control

Origin Validation Error

781 CVEs · 2 exploited

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

exploited in the wild
2
check available
3
likely to be exploited
5

Every one of the 781 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. Langflow AI <= 1.6.9 - CORS MisconfigurationCVE-2025-34291Langflow · CVSS 9.4 · 93% likelycovered by CyberSIXT

    Langflow

  2. The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbit…CVE-2015-4495Mozilla · CVSS 8.8 · 69% likely

    Mozilla

  3. Microsoft SharePoint - Remote Code ExecutionCVE-2020-16952Microsoft · CVSS 8.6 · 71% likely

    Microsoft

  4. SiYuan Note <= 3.6.5 - Authentication BypassCVE-2026-54069siyuan-note · CVSS 9.2 · 7.5% likely

    Siyuan-Note

  5. mcp-chrome-bridge (hangwin/mcp-chrome) <= 1.0.31 - CORS Origin Bypass (CSWSH)CVE-2026-102878hangwin · CVSS 8.1 · 0.8% likely
  6. udev before 1.4.1 does not verify whether a NETLINK message originates from kernel space, which allows local users to gain privileges by sending a NETLINK message from user space.CVE-2009-118581% likely
  7. An incorrect access control issue was discovered in Interlink PSG-5124 version 1.0.4, allows attackers to execute arbitrary code via crafted GET request.CVE-2023-29711CVSS 9.8 · 70% likely
  8. Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint,…CVE-2024-23898Jenkins Project · CVSS 8.8 · 67% likely

    Jenkins

  9. Inappropriate implementation in Performance API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to leak cross-origin data via a crafted HTML page.CVE-2021-21135Google · 21% likely

    Google

  10. Plex media server 1.21 and before is vulnerable to ddos reflection attack via plex service.CVE-2021-33959CVSS 7.5 · 15% likely
  11. By default, DNS servers on Windows NT 4.0 and Windows 2000 Server cache glue records received from non-delegated name servers, which allows remote attackers to poison the DNS cach…CVE-2001-14529.4% likely
  12. block repositories using http by defaultCVE-2021-26291Apache Software Foundation · 8.7% likely

    Apache

  13. GHSL-2023-234: Flowise Cors Misconfiguration in packages/server/src/index.tsCVE-2024-36421FlowiseAI · CVSS 7.5 · 8.5% likely

    FlowiseAI

  14. In Sipwise rtpengine before 13.4.1.1, an origin-validation error in the endpoint-learning logic of the media-relay core allows remote attackers to inject or intercept RTP/SRTP med…CVE-2025-53399Sipwise · CVSS 6.9 · 7.2% likely
  15. The default configuration for the domain name resolver for Microsoft Windows 98, NT 4.0, 2000, and XP sets the QueryIpMatching parameter to 0, which causes Windows to accept DNS u…CVE-2000-12186.2% likely
  16. A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka 'Microsoft Graphics Remote Code Execution Vulne…CVE-2020-1408Microsoft · 5.6% likely

    Microsoft

  17. Parity Browser 1.6.10 and earlier allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by requesting other websites via the Parity web proxy e…CVE-2017-180165.5% likely
  18. CORS Origin Validation Bypass in jupyter-serverCVE-2026-6657jupyter · CVSS 6.1 · 5.2% likely

    Jupyter

  19. The Solarwinds Dameware Mini Remote Client agent v12.1.0.89 supports smart card authentication which can allow a user to upload an executable to be executed on the DWRCS.exe host.…CVE-2019-3980SolarWinds Dameware Remote Mini Remote Client Agent Service · 5.2% likely
  20. An issue was discovered in the CardGate Payments plugin through 3.1.15 for WooCommerce. Lack of origin authentication in the IPN callback processing function in cardgate/cardgate.…CVE-2020-88194.9% likely
  21. A remote code execution vulnerability exists in Microsoft Project software when the software fails to check the source markup of a file, aka 'Microsoft Project Remote Code Executi…CVE-2020-1449Microsoft · 4.6% likely

    Microsoft

  22. Insufficient policy enforcement in WebView in Google Chrome on Android prior to 88.0.4324.96 allowed a remote attacker to leak cross-origin data via a crafted HTML page.CVE-2021-21136Google · 4.5% likely

    Google

  23. Adobe Flash Player 32.0.0.238 and earlier versions, 32.0.0.207 and earlier versions have a Same Origin Method Execution vulnerability. Successful exploitation could lead to Arbitr…CVE-2019-8069Adobe · 4.3% likely

    Adobe

  24. An issue was discovered in the CardGate Payments plugin through 2.0.30 for Magento 2. Lack of origin authentication in the IPN callback processing function in Controller/Payment/C…CVE-2020-88184.2% likely
  25. The Logitech Harmony Hub before version 4.15.206 is vulnerable to application level command injection via crafted HTTP request. An unauthenticated remote attacker can leverage thi…CVE-2018-15723Logitech · 3.7% likely

    Logitech

  26. Incorrect access control in the administrative functionalities of BES--6024PB-I50H1 VideoPlayTool v2.0.1.0 allow attackers to execute arbitrary administrative commands via a craft…CVE-2023-33443CVSS 9.8 · 3.5% likely

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in