CWE-942 · Misconfiguration and Insecure Design
Permissive Cross-domain Security Policy with Untrusted Domains
122CVEs
0exploited
2with a public check
0likely (EPSS 10%+)
SortMost likely exploited
122 CVEs with CWE-942 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2026-61736CheckLightRAG <= 1.5.3 - Credentialed CORS WildcardHKUDS · LightRAG · CVSS 9.3 · 2026-07-15 | 9.3 | 1.4% | 2026-07-15 |
| CVE-2026-116748CheckTransmission 4.0.0-4.1.2 - Permissive CORS Exposes RPC Session IDtransmission · transmission · CVSS 8.8 · 2026-10-26 | 8.8 | 1.2% | 2026-10-26 |
| CVE-2023-38122Inductive Automation Ignition OPC UA Quick Client Permissive Cross-domain Policy Remote Code Execution VulnerabilityInductive Automation · Ignition · CVSS 7.2 · 2024-05-03 | 7.2 | 1.9% | 2024-05-03 |
| CVE-2026-84452Windows ML CLI: CORS misconfig enables localhost RCEmicrosoft · winml-cli · CVSS 8.6 · 2026-09-02 | 8.6 | 1.6% | 2026-09-02 |
| CVE-2023-38125Softing edgeAggregator Permissive Cross-domain Policy with Untrusted Domains Remote Code Execution VulnerabilitySofting · edgeAggregator · CVSS 7.5 · 2024-05-03 | 7.5 | 1.3% | 2024-05-03 |
| CVE-2019-14860It was found that the Syndesis configuration for Cross-Origin Resource Sharing was set to allow all origins. An attacker could use this lack of protection to conduct phishing atta…Redhat · syndesis · CVSS 7.4 · 2019-11-08 | 7.4 | 1.2% | 2019-11-08 |
| CVE-2022-31736A malicious website could have learned the size of a cross-origin resource that supported Range requests. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefo…Mozilla · Thunderbird · CVSS 9.8 · 2022-12-22 | 9.8 | 1.1% | 2022-12-22 |
| CVE-2022-26969In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true.Monospace · Directus · CVSS 9.8 · 2022-12-26 | 9.8 | 1.0% | 2022-12-26 |
| CVE-2023-46281A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All versions < V4.1), SINEC…Siemens · Opcenter Execution Foundation · CVSS 7.1 · 2023-12-12 | 7.1 | 0.9% | 2023-12-12 |
| CVE-2024-21382Microsoft Edge for Android Information Disclosure VulnerabilityMicrosoft · Microsoft Edge (Chromium-based) · CVSS 4.3 · 2024-01-26 | 4.3 | 0.9% | 2024-01-26 |
| CVE-2020-36851Rob--W cors-anywhere Misconfigured CORS Proxy Allows SSRFRob--W / cors-anywhere · Rob--W / cors-anywhere · CVSS 9.5 · 2025-09-25 | 9.5 | 0.8% | 2025-09-25 |
| CVE-2024-41657GHSL-2024-035: Casdoor CORS misconfigurationcasdoor · casdoor · CVSS 8.1 · 2024-08-20 | 8.1 | 0.8% | 2024-08-20 |
| CVE-2026-62895Azure Arc SQL Server Extension Elevation of Privilege VulnerabilityMicrosoft · Azure Arc SQL Server Extension · CVSS 8.8 · 2026-09-08 | 8.8 | 0.8% | 2026-09-08 |
| CVE-2026-107155A permissive cross-domain policy vulnerability has been identified in the SonicOS management interface, which in specific conditions could potentially enable a remote unauthentica…SonicWall · SonicOS · CVSS 8.8 · 2026-11-06 | 8.8 | 0.8% | 2026-11-06 |
| CVE-2022-47717Last Yard 22.09.8-1 is vulnerable to Cross-origin resource sharing (CORS).Lastyard · Last Yard · CVSS 7.5 · 2023-02-01 | 7.5 | 0.7% | 2023-02-01 |
| CVE-2023-36829Sentry CORS misconfiguration vulnerabilitygetsentry · sentry · CVSS 6.8 · 2023-07-06 | 6.8 | 0.7% | 2023-07-06 |
| CVE-2024-41659GHSL-2024-034: memos CORS Misconfiguration in server.gousememos · memos · CVSS 8.1 · 2024-08-20 | 8.1 | 0.6% | 2024-08-20 |
| CVE-2026-56076PraisonAI - Cross-Origin Agent Execution via Hardcoded Wildcard CORS and Missing Authentication on AGUI EndpointPraisonAI · PraisonAI · CVSS 8.1 · 2026-06-18 | 8.1 | 0.6% | 2026-06-18 |
| CVE-2023-46098A vulnerability has been identified in SIMATIC PCS neo (All versions < V4.1). When accessing the Information Server from affected products, the products use an overly permissive C…Siemens · SIMATIC PCS neo · CVSS 8 · 2023-11-14 | 8.0 | 0.6% | 2023-11-14 |
| CVE-2021-34435In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside the IDE. But with the way it is made it is possible for a pre…The Eclipse Foundation · Eclipse Theia · 2021-09-01 | – | 0.6% | 2021-09-01 |
| CVE-2021-27786HCL OneTest Server is vulnerable to Cross Origin Resource Sharing: Arbitrary Origin TrustedHCL Software · HCL OneTest Server · CVSS 4.6 · 2022-06-07 | 4.6 | 0.6% | 2022-06-07 |
| CVE-2026-84176Apache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Origin ReflectionApache Software Foundation · Apache Camel · CVSS 6.5 · 2026-10-19 | 6.5 | 0.6% | 2026-10-19 |
| CVE-2024-53276GHSL-2024-092: Open CORS policy in home-galleryxemle · home-gallery · CVSS 6.3 · 2024-12-23 | 6.3 | 0.6% | 2024-12-23 |
| CVE-2026-82291HeyForm Reflects Any Origin in CORS Responses While Allowing Credentialsheyform · heyform · CVSS 8.1 · 2026-08-28 | 8.1 | 0.6% | 2026-08-28 |
| CVE-2024-49763PlexRipper allows API leak due to open CORS policyPlexRipper · PlexRipper · CVSS 8.7 · 2024-12-02 | 8.7 | 0.5% | 2024-12-02 |
| CVE-2022-34366Dell SupportAssist for Home PCs (version 3.11.2 and prior) contain Overly Permissive Cross-domain Whitelist vulnerability. An authenticated non-admin user could potentially exploi…Dell · SupportAssist Client Consumer · CVSS 6.5 · 2023-02-10 | 6.5 | 0.5% | 2023-02-10 |
| CVE-2026-82287Rybbit Reflects Any Origin in CORS Responses While Allowing Credentialsrybbit-io · rybbit · CVSS 8.1 · 2026-08-28 | 8.1 | 0.5% | 2026-08-28 |
| CVE-2026-34449SiYuan: Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injectionsiyuan-note · siyuan · CVSS 9.7 · 2026-03-31 | 9.7 | 0.5% | 2026-03-31 |
| CVE-2025-43392The issue was addressed with improved handling of caches. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1,…Apple · Safari · CVSS 4.3 · 2025-11-04 | 4.3 | 0.5% | 2025-11-04 |
| CVE-2025-43480The issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicious w…Apple · Safari · CVSS 8.1 · 2025-11-04 | 8.1 | 0.5% | 2025-11-04 |
| CVE-2024-37131SCG Policy Manager, all versions, contains an overly permissive Cross-Origin Resource Policy (CORP) vulnerability. A remote unauthenticated attacker could potentially exploit this…Dell · Secure Connect Gateway (SCG) Policy Manager · CVSS 7.5 · 2024-06-13 | 7.5 | 0.5% | 2024-06-13 |
| CVE-2024-45642IBM Security ReaQta information disclosureIBM · Security ReaQta · CVSS 5.3 · 2024-11-14 | 5.3 | 0.5% | 2024-11-14 |
| CVE-2023-23464Media CP Media Control Panel – Information DisclosureMedia CP · Media Control Panel · CVSS 8.1 · 2023-02-15 | 8.1 | 0.5% | 2023-02-15 |
| CVE-2026-32617AnythingLLM Permissable CORS policyMintplex-Labs · anything-llm · CVSS 7.1 · 2026-03-13 | 7.1 | 0.5% | 2026-03-13 |
| CVE-2026-68517Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcardnicolargo · glances · CVSS 6.5 · 2026-08-17 | 6.5 | 0.5% | 2026-08-17 |
| CVE-2023-50940IBM PowerSC cross-resource origin sharingIBM · PowerSC · CVSS 5.3 · 2024-02-02 | 5.3 | 0.5% | 2024-02-02 |
| CVE-2026-8919Permissive Cross-domain Security Policy with Untrusted Domains in ASUS GameSDK allows a remote user to obtain a local user’s NTLM hash by convincing the user to visit a crafted we…ASUS · GameSDK · CVSS 7.2 · 2026-07-15 | 7.2 | 0.4% | 2026-07-15 |
| CVE-2026-12962A Permissive Cross-domain Security Policy with Untrusted Domains in Armoury Crate allows a remote user to obtain a local user's NTLM hash by convincing the user to visit a crafted…ASUS · Armoury Crate · CVSS 5.3 · 2026-09-08 | 5.3 | 0.4% | 2026-09-08 |
| CVE-2026-90882Reflected arbitrary origins with credentials, allowing cross-origin reads of authenticated user dataEclipse Foundation · open-vsx.org · CVSS 8.7 · 2026-09-22 | 8.7 | 0.4% | 2026-09-22 |
| CVE-2025-25264Overly Permissive CORS Policy in WAGO Device ManagerWAGO · CC100 0751-9x01 · CVSS 6.5 · 2025-06-16 | 6.5 | 0.4% | 2025-06-16 |
| CVE-2026-25478Litestar has a CORS origin allowlist bypass due to unescaped regex metacharacters in allowed originslitestar-org · litestar · CVSS 7.4 · 2026-02-09 | 7.4 | 0.4% | 2026-02-09 |
| CVE-2026-57957Papermark 0.22.0 - CORS Misconfiguration in Viewer Upload Endpointpapermark · papermark · CVSS 4.7 · 2026-06-29 | 4.7 | 0.4% | 2026-06-29 |
| CVE-2023-37526HCL DRYiCE Lucy v9 (now AEX) is affected by a Cross Origin Resource Sharing (CORS) VulnerabilityHCL Software · DRYiCE Lucy · CVSS 6.5 · 2024-05-10 | 6.5 | 0.4% | 2024-05-10 |
| CVE-2024-32862exacqVision CORSJohnson Controls · exacqVision · CVSS 6.8 · 2024-08-01 | 6.8 | 0.4% | 2024-08-01 |
| CVE-2026-8948Same-origin policy bypass in the DOM: Networking componentMozilla · Firefox · CVSS 9.1 · 2026-05-19 | 9.1 | 0.4% | 2026-05-19 |
| CVE-2025-55462A CORS misconfiguration in Eramba Community and Enterprise Editions v3.26.0 allows an attacker-controlled Origin header to be reflected in the Access-Control-Allow-Origin response…Eramba · Eramba · CVSS 6.5 · 2026-01-13 | 6.5 | 0.4% | 2026-01-13 |
| CVE-2026-85313Apache Camel: Camel-Jetty Cross-Origin Credential Exposure via Allow-All CrossOriginFilter Defaults When enableCORS Is SetApache Software Foundation · Apache Camel · CVSS 4.3 · 2026-10-19 | 4.3 | 0.4% | 2026-10-19 |
| CVE-2026-33010mcp-memory-service's Wildcard CORS with Credentials Enables Cross-Origin Memory Theftdoobidoo · mcp-memory-service · CVSS 8.1 · 2026-03-20 | 8.1 | 0.4% | 2026-03-20 |
| CVE-2026-46608Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)nicolargo · glances · CVSS 7.4 · 2026-06-25 | 7.4 | 0.4% | 2026-06-25 |
| CVE-2026-32610Glances's Default CORS Configuration Allows Cross-Origin Credential Theftnicolargo · glances · CVSS 8.1 · 2026-03-18 | 8.1 | 0.4% | 2026-03-18 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.