CWE-346

890 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 2 of them as exploited in the wild.

Critical 92High 305Medium 454Low 38Not scored 1

CVEs per yearBy the year they were published

CVE-2025-34291
Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCE
Langflow · Langflow
ExploitedCritical9.4
CVE-2015-4495
The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin…
Product not named
ExploitedHigh8.8

CVE-2026-123499
Vikunja veans before 2.7.1 Credential Leak via Repo-Controlled .veans.yml Server
go-vikunja · vikunja
Medium6.0
CVE-2026-102344
Lavish: DNS rebinding allows any website to read arbitrary local files and inject prompts into the AI agent via the unauthenticated local server
kunchenguid · lavish-axi
High8.1
CVE-2026-116630
undici vulnerable to cross-user information disclosure via cross-origin redirect revalidation
undici · undici
Medium5.9
CVE-2026-116592
undici vulnerable to cache poisoning and cross-user disclosure via intermediate redirect hops
undici · undici
High7.4
CVE-2026-123272
mcp-go before v1.2.1 Origin Validation Error via Unvalidated Well-Known Protected Resource Metadata
mark3labs · mcp-go
Medium5.1
CVE-2026-123271
ChatCLI before v1.215.2 Origin Validation Error via Unvalidated MCP OAuth Resource Indicator
diillson · ChatCLI
Medium5.1
CVE-2026-119344
Cocos Intra-handshake attested TLS implementation is vulnerable to Diversion Attacks
ultravioletrs · cocos
Critical9.1
CVE-2026-102895
GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin
gpustack · gpustack
Critical9.8
CVE-2026-63183
OmniAuth: Host Header Injection Vulnerability
omniauth · omniauth
Medium6.9
CVE-2026-92704
SharpEmu: Cross-site request forgery in the debugger frontend leads to arbitrary process execution
sharpemu · sharpemu
High8.3