CWE-346 Origin Validation Error

Microsoft Security Advisory CVE-2026-96234 - .NET and Visual Studio Information Disclosure Vulnerability

Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout

TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment

PraisonAI: Call API localhost-only authentication bypass via spoofed Host header

Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header

Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint

AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins

Next.js has information disclosure in development server's Model Context Protocol endpoint

Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass

Payload external upload trust validation issue

Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path

MLflow: Improper Origin Validation in MLflow Assistant /ajax-api Endpoints Enables Browser-Mediated Local Command Execution

SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint (`/ws/network/proxy`) via explicit `CheckOrigin: true` bypass

Duplicate Advisory: SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint (`/ws/network/proxy`) via explicit `CheckOrigin: true` bypass

undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors

Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab

Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled

Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)

DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution

Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools

Netty has Insufficient Bailiwick Validation for NS Records

Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records

Grav: Origin validation bypass in Uri::referrer() and Pages::referrerRoute() via unanchored prefix match

Duplicate Advisory: Grav: Origin validation bypass in Uri::referrer() and Pages::referrerRoute() via unanchored prefix match

Apache NiFi fails to validate proxy host headers when constructing qualified URLs