Monthly
Cross-origin credential exposure in HeyForm before 3.0.0-rc.8 allows any attacker-controlled web page visited by a logged-in user to make fully authenticated GraphQL API requests against the HeyForm server. The server's default CORS configuration (`origin: true, credentials: true`) unconditionally echoed the request Origin header back as `Access-Control-Allow-Origin` while also asserting `Access-Control-Allow-Credentials: true`, defeating the browser's same-origin policy for all origins. This exposes workspaces, projects, forms, submissions, and respondent data to exfiltration and permits account settings modification; no public exploit has been identified at time of analysis.
CORS misconfiguration in Rybbit before 2.7.0 allows any attacker-controlled website to issue credentialed cross-origin requests to the Rybbit analytics server, because the server unconditionally reflects the request's Origin header in Access-Control-Allow-Origin while simultaneously enabling Access-Control-Allow-Credentials. Authenticated victims who visit a malicious page expose their analytics data, account information, and permit the attacker's script to perform state-changing API operations on their behalf. No public exploit has been identified at time of analysis, but the underlying attack class requires only standard browser Fetch API usage and is trivial to implement.
Sensitive-data exposure in Cohere North AI v1.1.5 stems from the server accepting cross-origin requests without validating the Origin header, letting any untrusted website read authenticated API responses in a victim's browser. Affects the North enterprise AI platform; tagged as CORS misconfiguration / information disclosure. No public exploit or active exploitation is identified, and EPSS is low (0.14%, 4th percentile), though the NVD-published CVSS of 9.8 likely overstates real-world impact.
Permissive CORS misconfiguration in the Grav API Plugin (all versions prior to 1.0.0-rc.16) allows cross-origin JavaScript on any attacker-controlled website to submit a stolen JWT via Authorization or X-API-Token headers and read full authenticated API responses, enabling data exfiltration and account modification with the token owner's privileges. The wildcard Access-Control-Allow-Origin: * header was returned by default for all /api/v1 endpoints - including authenticated ones - bypassing browser Same-Origin Policy protections entirely. A secondary vector existed via URL query-string token acceptance (?token=) on general API routes, leaking JWTs into server logs and Referer headers where they could be harvested and then weaponized via the CORS bypass. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present.
Glances REST API prior to 4.5.6 exposes authenticated system monitoring data to untrusted cross-origin websites due to a logic error in the CORS credentials guard: the exact-equality check (`cors_origins == ["*"]`) fails to catch multi-entry origin lists that contain the wildcard alongside other origins, while Starlette's CORSMiddleware still treats any such list as 'allow all origins' and reflects credentials. Any website visited by an authenticated Glances user can read sensitive REST API data - including full process lists with command-line arguments - by triggering the browser's automatic replay of cached HTTP Basic Auth credentials in a cross-origin request. A proof-of-concept is publicly embedded in the GHSA advisory; no confirmed active exploitation (not in CISA KEV) has been observed at time of analysis.
CORS misconfiguration in the openssl_encrypt pip package (versions before 1.4.0) enables any website to issue fully credentialed cross-origin API requests on behalf of authenticated users, exposing sensitive API responses to attacker-controlled origins. Both standalone server components - key-server and telemetry-server - ship with the maximally permissive combination of allow_origins=["*"] and allow_credentials=True as their default configuration, propagated through docker-compose.yml and .env.example. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code is known at time of analysis, though the attack pattern is a well-understood, low-complexity web exploit.
Cross-origin read bypass in Electron's custom protocol handler exposes sensitive application data to remote pages via fetch() and XMLHttpRequest. Electron apps on any branch prior to 39.8.10, 40.9.3, 41.4.0, or 42.0.0 that register a custom scheme with supportFetchAPI: true but omit corsEnabled: true fail to enforce CORS, allowing a malicious remote page loaded in the renderer to read the full response body of privileged custom-scheme requests. No public exploit code is identified at time of analysis and the vulnerability is not in CISA KEV, but the confidentiality impact is rated high by the vendor given the potential to exfiltrate internal application data.
Information disclosure in Progress MOVEit Transfer (all versions before 2025.1.5, and 2026.0.0 before 2026.0.3) stems from an overly permissive cross-domain (CORS) security policy that trusts untrusted origins, allowing a malicious website to read sensitive responses from an authenticated victim's MOVEit session. The vendor rates it CVSS 9.8, though the underlying weakness (CWE-942) and vendor tags point squarely at cross-origin data leakage rather than direct server compromise. No public exploit identified at time of analysis, and EPSS is low at 0.18% (8th percentile).
CORS misconfiguration in HCL DevOps Loop enables authenticated network-adjacent attackers to perform unauthorized cross-origin requests against the application. The improper CORS policy potentially allows untrusted domains to read application responses, exposing session-bound resources to attacker-controlled origins. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the tag 'Authentication Bypass' suggests resource exposure can undermine access control assumptions.
Cross-origin data exposure in the Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 stems from a hardcoded 'Access-Control-Allow-Origin: *' header returned on every response, including authenticated endpoints and preflight (OPTIONS) responses. Because the plugin authenticates via the Authorization and X-API-Token request headers rather than cookies, any malicious website scripting a leaked access token can read the response bodies of authenticated endpoints and perform write actions as that token's user. Reported by VulnCheck with no public exploit identified at time of analysis; not listed in CISA KEV.
Cross-origin credential exposure in HeyForm before 3.0.0-rc.8 allows any attacker-controlled web page visited by a logged-in user to make fully authenticated GraphQL API requests against the HeyForm server. The server's default CORS configuration (`origin: true, credentials: true`) unconditionally echoed the request Origin header back as `Access-Control-Allow-Origin` while also asserting `Access-Control-Allow-Credentials: true`, defeating the browser's same-origin policy for all origins. This exposes workspaces, projects, forms, submissions, and respondent data to exfiltration and permits account settings modification; no public exploit has been identified at time of analysis.
CORS misconfiguration in Rybbit before 2.7.0 allows any attacker-controlled website to issue credentialed cross-origin requests to the Rybbit analytics server, because the server unconditionally reflects the request's Origin header in Access-Control-Allow-Origin while simultaneously enabling Access-Control-Allow-Credentials. Authenticated victims who visit a malicious page expose their analytics data, account information, and permit the attacker's script to perform state-changing API operations on their behalf. No public exploit has been identified at time of analysis, but the underlying attack class requires only standard browser Fetch API usage and is trivial to implement.
Sensitive-data exposure in Cohere North AI v1.1.5 stems from the server accepting cross-origin requests without validating the Origin header, letting any untrusted website read authenticated API responses in a victim's browser. Affects the North enterprise AI platform; tagged as CORS misconfiguration / information disclosure. No public exploit or active exploitation is identified, and EPSS is low (0.14%, 4th percentile), though the NVD-published CVSS of 9.8 likely overstates real-world impact.
Permissive CORS misconfiguration in the Grav API Plugin (all versions prior to 1.0.0-rc.16) allows cross-origin JavaScript on any attacker-controlled website to submit a stolen JWT via Authorization or X-API-Token headers and read full authenticated API responses, enabling data exfiltration and account modification with the token owner's privileges. The wildcard Access-Control-Allow-Origin: * header was returned by default for all /api/v1 endpoints - including authenticated ones - bypassing browser Same-Origin Policy protections entirely. A secondary vector existed via URL query-string token acceptance (?token=) on general API routes, leaking JWTs into server logs and Referer headers where they could be harvested and then weaponized via the CORS bypass. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present.
Glances REST API prior to 4.5.6 exposes authenticated system monitoring data to untrusted cross-origin websites due to a logic error in the CORS credentials guard: the exact-equality check (`cors_origins == ["*"]`) fails to catch multi-entry origin lists that contain the wildcard alongside other origins, while Starlette's CORSMiddleware still treats any such list as 'allow all origins' and reflects credentials. Any website visited by an authenticated Glances user can read sensitive REST API data - including full process lists with command-line arguments - by triggering the browser's automatic replay of cached HTTP Basic Auth credentials in a cross-origin request. A proof-of-concept is publicly embedded in the GHSA advisory; no confirmed active exploitation (not in CISA KEV) has been observed at time of analysis.
CORS misconfiguration in the openssl_encrypt pip package (versions before 1.4.0) enables any website to issue fully credentialed cross-origin API requests on behalf of authenticated users, exposing sensitive API responses to attacker-controlled origins. Both standalone server components - key-server and telemetry-server - ship with the maximally permissive combination of allow_origins=["*"] and allow_credentials=True as their default configuration, propagated through docker-compose.yml and .env.example. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code is known at time of analysis, though the attack pattern is a well-understood, low-complexity web exploit.
Cross-origin read bypass in Electron's custom protocol handler exposes sensitive application data to remote pages via fetch() and XMLHttpRequest. Electron apps on any branch prior to 39.8.10, 40.9.3, 41.4.0, or 42.0.0 that register a custom scheme with supportFetchAPI: true but omit corsEnabled: true fail to enforce CORS, allowing a malicious remote page loaded in the renderer to read the full response body of privileged custom-scheme requests. No public exploit code is identified at time of analysis and the vulnerability is not in CISA KEV, but the confidentiality impact is rated high by the vendor given the potential to exfiltrate internal application data.
Information disclosure in Progress MOVEit Transfer (all versions before 2025.1.5, and 2026.0.0 before 2026.0.3) stems from an overly permissive cross-domain (CORS) security policy that trusts untrusted origins, allowing a malicious website to read sensitive responses from an authenticated victim's MOVEit session. The vendor rates it CVSS 9.8, though the underlying weakness (CWE-942) and vendor tags point squarely at cross-origin data leakage rather than direct server compromise. No public exploit identified at time of analysis, and EPSS is low at 0.18% (8th percentile).
CORS misconfiguration in HCL DevOps Loop enables authenticated network-adjacent attackers to perform unauthorized cross-origin requests against the application. The improper CORS policy potentially allows untrusted domains to read application responses, exposing session-bound resources to attacker-controlled origins. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the tag 'Authentication Bypass' suggests resource exposure can undermine access control assumptions.
Cross-origin data exposure in the Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 stems from a hardcoded 'Access-Control-Allow-Origin: *' header returned on every response, including authenticated endpoints and preflight (OPTIONS) responses. Because the plugin authenticates via the Authorization and X-API-Token request headers rather than cookies, any malicious website scripting a leaked access token can read the response bodies of authenticated endpoints and perform write actions as that token's user. Reported by VulnCheck with no public exploit identified at time of analysis; not listed in CISA KEV.