Permissive Cross-domain Security Policy with Untrusted Domains

Every one of the 122 is a mark on the map. Named now: 1 to 26, most at risk first.

1. LightRAG <= 1.5.3 - Credentialed CORS WildcardCVE-2026-61736HKUDS · CVSS 9.3 · 1.4% likely
2. Transmission 4.0.0-4.1.2 - Permissive CORS Exposes RPC Session IDCVE-2026-116748transmission · CVSS 8.8 · 1.2% likely
3. Inductive Automation Ignition OPC UA Quick Client Permissive Cross-domain Policy Remote Code Execution VulnerabilityCVE-2023-38122Inductive Automation · CVSS 7.2 · 1.9% likely
4. Windows ML CLI: CORS misconfig enables localhost RCECVE-2026-84452microsoft · CVSS 8.6 · 1.6% likely
5. Softing edgeAggregator Permissive Cross-domain Policy with Untrusted Domains Remote Code Execution VulnerabilityCVE-2023-38125Softing · CVSS 7.5 · 1.3% likely
6. It was found that the Syndesis configuration for Cross-Origin Resource Sharing was set to allow all origins. An attacker could use this lack of protection to conduct phishing atta…CVE-2019-14860syndesis · CVSS 7.4 · 1.2% likely
7. A malicious website could have learned the size of a cross-origin resource that supported Range requests. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefo…CVE-2022-31736Mozilla · CVSS 9.8 · 1.1% likely
8. In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true.CVE-2022-26969CVSS 9.8 · 1.0% likely
9. A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All versions < V4.1), SINEC…CVE-2023-46281Siemens · CVSS 7.1 · 0.9% likely
10. Microsoft Edge for Android Information Disclosure VulnerabilityCVE-2024-21382Microsoft · CVSS 4.3 · 0.9% likely
11. Rob--W cors-anywhere Misconfigured CORS Proxy Allows SSRFCVE-2020-36851Rob--W / cors-anywhere · CVSS 9.5 · 0.8% likely
12. GHSL-2024-035: Casdoor CORS misconfigurationCVE-2024-41657casdoor · CVSS 8.1 · 0.8% likely
13. Azure Arc SQL Server Extension Elevation of Privilege VulnerabilityCVE-2026-62895Microsoft · CVSS 8.8 · 0.8% likely
14. A permissive cross-domain policy vulnerability has been identified in the SonicOS management interface, which in specific conditions could potentially enable a remote unauthentica…CVE-2026-107155SonicWall · CVSS 8.8 · 0.8% likely

    3 articles1 article this week: SonicWall patches SonicOS flaw that can bypass SAML MFA

15. Last Yard 22.09.8-1 is vulnerable to Cross-origin resource sharing (CORS).CVE-2022-47717CVSS 7.5 · 0.7% likely
16. Sentry CORS misconfiguration vulnerabilityCVE-2023-36829getsentry · CVSS 6.8 · 0.7% likely
17. GHSL-2024-034: memos CORS Misconfiguration in server.goCVE-2024-41659usememos · CVSS 8.1 · 0.6% likely
18. PraisonAI - Cross-Origin Agent Execution via Hardcoded Wildcard CORS and Missing Authentication on AGUI EndpointCVE-2026-56076PraisonAI · CVSS 8.1 · 0.6% likely
19. A vulnerability has been identified in SIMATIC PCS neo (All versions < V4.1). When accessing the Information Server from affected products, the products use an overly permissive C…CVE-2023-46098Siemens · CVSS 8 · 0.6% likely
20. In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside the IDE. But with the way it is made it is possible for a pre…CVE-2021-34435The Eclipse Foundation · 0.6% likely
21. HCL OneTest Server is vulnerable to Cross Origin Resource Sharing: Arbitrary Origin TrustedCVE-2021-27786HCL Software · CVSS 4.6 · 0.6% likely
22. Apache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Origin ReflectionCVE-2026-84176Apache Software Foundation · CVSS 6.5 · 0.6% likely
23. GHSL-2024-092: Open CORS policy in home-galleryCVE-2024-53276xemle · CVSS 6.3 · 0.6% likely
24. HeyForm Reflects Any Origin in CORS Responses While Allowing CredentialsCVE-2026-82291heyform · CVSS 8.1 · 0.6% likely
25. PlexRipper allows API leak due to open CORS policyCVE-2024-49763PlexRipper · CVSS 8.7 · 0.5% likely
26. Dell SupportAssist for Home PCs (version 3.11.2 and prior) contain Overly Permissive Cross-domain Whitelist vulnerability. An authenticated non-admin user could potentially exploi…CVE-2022-34366Dell · CVSS 6.5 · 0.5% likely

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.