CWE-346 · Access Control
Origin Validation Error
781CVEs
2exploited
3with a public check
5likely (EPSS 10%+)
SortMost likely exploited
781 CVEs with CWE-346 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2025-34291In CISA KEVExploitedLangflow AI <= 1.6.9 - CORS MisconfigurationLangflow · Langflow · CVSS 9.4 · 2025-12-05 | 9.4 | 93% | 2025-12-05 |
| CVE-2015-4495In CISA KEVExploitedThe PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbit…Mozilla · Firefox · CVSS 8.8 · 2015-08-08 | 8.8 | 69% | 2015-08-08 |
| CVE-2020-16952CheckMicrosoft SharePoint - Remote Code ExecutionMicrosoft · Microsoft SharePoint Enterprise Server 2016 · CVSS 8.6 · 2020-10-16 | 8.6 | 71% | 2020-10-16 |
| CVE-2026-54069CheckSiYuan Note <= 3.6.5 - Authentication Bypasssiyuan-note · siyuan · CVSS 9.2 · 2026-06-24 | 9.2 | 7.5% | 2026-06-24 |
| CVE-2026-102878Checkmcp-chrome-bridge (hangwin/mcp-chrome) <= 1.0.31 - CORS Origin Bypass (CSWSH)hangwin · mcp-chrome-bridge · CVSS 8.1 · 2026-09-29 | 8.1 | 0.8% | 2026-09-29 |
| CVE-2009-1185udev before 1.4.1 does not verify whether a NETLINK message originates from kernel space, which allows local users to gain privileges by sending a NETLINK message from user space.Udev Project · Udev · 2009-04-17 | – | 81% | 2009-04-17 |
| CVE-2023-29711An incorrect access control issue was discovered in Interlink PSG-5124 version 1.0.4, allows attackers to execute arbitrary code via crafted GET request.Interlink · Psg-5124 Firmware · CVSS 9.8 · 2023-06-22 | 9.8 | 70% | 2023-06-22 |
| CVE-2024-23898Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint,…Jenkins Project · Jenkins · CVSS 8.8 · 2024-01-24 | 8.8 | 67% | 2024-01-24 |
| CVE-2021-21135Inappropriate implementation in Performance API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to leak cross-origin data via a crafted HTML page.Google · Chrome · 2021-02-09 | – | 21% | 2021-02-09 |
| CVE-2021-33959Plex media server 1.21 and before is vulnerable to ddos reflection attack via plex service.Plex · Media Server · CVSS 7.5 · 2023-01-18 | 7.5 | 15% | 2023-01-18 |
| CVE-2001-1452By default, DNS servers on Windows NT 4.0 and Windows 2000 Server cache glue records received from non-delegated name servers, which allows remote attackers to poison the DNS cach…Microsoft · Windows 2000 · 2005-04-21 | – | 9.4% | 2005-04-21 |
| CVE-2021-26291block repositories using http by defaultApache Software Foundation · Apache Maven · 2021-04-23 | – | 8.7% | 2021-04-23 |
| CVE-2024-36421GHSL-2023-234: Flowise Cors Misconfiguration in packages/server/src/index.tsFlowiseAI · Flowise · CVSS 7.5 · 2024-07-01 | 7.5 | 8.5% | 2024-07-01 |
| CVE-2025-53399In Sipwise rtpengine before 13.4.1.1, an origin-validation error in the endpoint-learning logic of the media-relay core allows remote attackers to inject or intercept RTP/SRTP med…Sipwise · rtpengine · CVSS 6.9 · 2025-08-01 | 6.9 | 7.2% | 2025-08-01 |
| CVE-2000-1218The default configuration for the domain name resolver for Microsoft Windows 98, NT 4.0, 2000, and XP sets the QueryIpMatching parameter to 0, which causes Windows to accept DNS u…Microsoft · Windows 98 · 2005-04-21 | – | 6.2% | 2005-04-21 |
| CVE-2020-1408A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka 'Microsoft Graphics Remote Code Execution Vulne…Microsoft · Windows 10 Version 2004 for 32-bit Systems · 2020-07-14 | – | 5.6% | 2020-07-14 |
| CVE-2017-18016Parity Browser 1.6.10 and earlier allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by requesting other websites via the Parity web proxy e…Parity · Browser · 2018-01-11 | – | 5.5% | 2018-01-11 |
| CVE-2026-6657CORS Origin Validation Bypass in jupyter-serverjupyter · jupyter/jupyter · CVSS 6.1 · 2026-06-03 | 6.1 | 5.2% | 2026-06-03 |
| CVE-2019-3980The Solarwinds Dameware Mini Remote Client agent v12.1.0.89 supports smart card authentication which can allow a user to upload an executable to be executed on the DWRCS.exe host.…Solarwinds · SolarWinds Dameware Remote Mini Remote Client Agent Service · 2019-10-08 | – | 5.2% | 2019-10-08 |
| CVE-2020-8819An issue was discovered in the CardGate Payments plugin through 3.1.15 for WooCommerce. Lack of origin authentication in the IPN callback processing function in cardgate/cardgate.…Cardgate · Cardgate Payments · 2020-02-25 | – | 4.9% | 2020-02-25 |
| CVE-2020-1449A remote code execution vulnerability exists in Microsoft Project software when the software fails to check the source markup of a file, aka 'Microsoft Project Remote Code Executi…Microsoft · Microsoft Office · 2020-07-14 | – | 4.6% | 2020-07-14 |
| CVE-2021-21136Insufficient policy enforcement in WebView in Google Chrome on Android prior to 88.0.4324.96 allowed a remote attacker to leak cross-origin data via a crafted HTML page.Google · Chrome · 2021-02-09 | – | 4.5% | 2021-02-09 |
| CVE-2019-8069Adobe Flash Player 32.0.0.238 and earlier versions, 32.0.0.207 and earlier versions have a Same Origin Method Execution vulnerability. Successful exploitation could lead to Arbitr…Adobe · Flash Player · 2019-09-12 | – | 4.3% | 2019-09-12 |
| CVE-2020-8818An issue was discovered in the CardGate Payments plugin through 2.0.30 for Magento 2. Lack of origin authentication in the IPN callback processing function in Controller/Payment/C…Cardgate · Cardgate Payments · 2020-02-25 | – | 4.2% | 2020-02-25 |
| CVE-2018-15723The Logitech Harmony Hub before version 4.15.206 is vulnerable to application level command injection via crafted HTTP request. An unauthenticated remote attacker can leverage thi…Logitech · Logitech Harmony Hub · 2018-12-20 | – | 3.7% | 2018-12-20 |
| CVE-2023-33443Incorrect access control in the administrative functionalities of BES--6024PB-I50H1 VideoPlayTool v2.0.1.0 allow attackers to execute arbitrary administrative commands via a craft…Besder · Videoplaytool · CVSS 9.8 · 2023-06-08 | 9.8 | 3.5% | 2023-06-08 |
| CVE-2017-6519avahi-daemon in Avahi through 0.6.32 and 0.7 inadvertently responds to IPv6 unicast queries with source addresses that are not on-link, which allows remote attackers to cause a de…Avahi · Avahi · CVSS 9.1 · 2017-05-01 | 9.1 | 3.2% | 2017-05-01 |
| CVE-2018-8235A security feature bypass vulnerability exists when Microsoft Edge improperly handles requests of different origins, aka "Microsoft Edge Security Feature Bypass Vulnerability." Th…Microsoft · Microsoft Edge · 2018-06-14 | – | 3.2% | 2018-06-14 |
| CVE-2018-8112A security feature bypass vulnerability exists when Microsoft Edge improperly handles requests of different origins, aka "Microsoft Edge Security Feature Bypass Vulnerability." Th…Microsoft · Microsoft Edge · 2018-05-09 | – | 2.8% | 2018-05-09 |
| CVE-2021-37705Improper Authorization and Origin Validation Error in OneFuzzmicrosoft · onefuzz · CVSS 10 · 2021-08-13 | 10.0 | 2.4% | 2021-08-13 |
| CVE-2014-1487The Web workers implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allows remote attackers to bypass t…Mozilla · Firefox · 2014-02-06 | – | 2.3% | 2014-02-06 |
| CVE-2019-9499The implementations of EAP-PWD in wpa_supplicant EAP Peer do not validate the scalar and element values in EAP-pwd-CommitWi-Fi Alliance · hostapd with EAP-pwd support · 2019-04-17 | – | 2.2% | 2019-04-17 |
| CVE-2019-9498The implementations of EAP-PWD in hostapd EAP Server do not validate the scalar and element values in EAP-pwd-CommitWi-Fi Alliance · hostapd with EAP-pwd support · 2019-04-17 | – | 2.2% | 2019-04-17 |
| CVE-2019-1442A security feature bypass vulnerability exists when Microsoft Office does not validate URLs.An attacker could send a victim a specially crafted file, which could trick the victim…Microsoft · Microsoft SharePoint Server · 2019-11-12 | – | 2.2% | 2019-11-12 |
| CVE-2020-11868ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet with a spoofed source IP address…Ntp · Ntp · CVSS 7.5 · 2020-04-17 | 7.5 | 2.1% | 2020-04-17 |
| CVE-2023-23578Improper access control vulnerability in SkyBridge MB-A200 firmware Ver. 01.00.05 and earlier allows a remote unauthenticated attacker to connect to the product's ADB port.Seiko Solutions Inc. · SkyBridge MB-A200 · CVSS 7.5 · 2023-05-10 | 7.5 | 2.0% | 2023-05-10 |
| CVE-2005-0877Dnsmasq before 2.21 allows remote attackers to poison the DNS cache via answers to queries that were not made by Dnsmasq.Thekelleys · Dnsmasq · 2005-03-26 | – | 2.0% | 2005-03-26 |
| CVE-2022-41924Tailscale Windows daemon is vulnerable to RCE via CSRFtailscale · tailscale · CVSS 9.6 · 2022-11-23 | 9.6 | 1.9% | 2022-11-23 |
| CVE-2019-5773Insufficient origin validation in IndexedDB in Google Chrome prior to 72.0.3626.81 allowed a remote attacker who had compromised the renderer process to bypass same origin policy…Google · Chrome · 2019-02-19 | – | 1.8% | 2019-02-19 |
| CVE-2023-32223D-Link DSL-224 firmware version 3.0.10 post authentication command executionD-Link · DSL-224 firmware version 3.0.10 · CVSS 8.8 · 2023-06-28 | 8.8 | 1.8% | 2023-06-28 |
| CVE-2016-5168Skia, as used in Google Chrome before 50.0.2661.94, allows remote attackers to bypass the Same Origin Policy and obtain sensitive information.Google · Chrome · 2017-04-21 | – | 1.7% | 2017-04-21 |
| CVE-2021-30596Incorrect security UI in Navigation in Google Chrome on Android prior to 92.0.4515.131 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML…Google · Chrome · 2021-08-26 | – | 1.7% | 2021-08-26 |
| CVE-2017-5591An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable applica…Poezio · Poezio · 2017-02-09 | – | 1.7% | 2017-02-09 |
| CVE-2017-8530Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an attacker to trick a user into loading a page with malicious content when Micro…Microsoft Corporation · Microsoft Edge · 2017-06-15 | – | 1.7% | 2017-06-15 |
| CVE-2024-50654lilishop <=4.2.4 is vulnerable to Incorrect Access Control, which can allow attackers to obtain coupons beyond the quantity limit by capturing and sending the data packets for cou…Pickmall · Lilishop · CVSS 7.5 · 2024-11-15 | 7.5 | 1.6% | 2024-11-15 |
| CVE-2019-19019An issue was discovered in TitanHQ WebTitan before 5.18. It contains a Remote Code Execution issue through which an attacker can execute arbitrary code as root. The issue stems fr…Titanhq · Webtitan · 2019-12-02 | – | 1.6% | 2019-12-02 |
| CVE-2025-69260A message out-of-bounds read vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service condition on affected installations. Please note…Trend Micro, Inc. · Trend Micro Apex Central · CVSS 7.5 · 2026-01-08 | 7.5 | 1.6% | 2026-01-08 |
| CVE-2025-69259A message unchecked NULL return value vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service condition on affected installations. Pl…Trend Micro, Inc. · Trend Micro Apex Central · CVSS 7.5 · 2026-01-08 | 7.5 | 1.6% | 2026-01-08 |
| CVE-2017-5603An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable applica…Jitsi · Jitsi · 2017-02-09 | – | 1.6% | 2017-02-09 |
| CVE-2018-18494A same-origin policy violation allowing the theft of cross-origin URL entries when using the Javascript location property to cause a redirection to another site using performance.…Mozilla · Thunderbird · 2019-02-28 | – | 1.5% | 2019-02-28 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.