Search: “cors”

18 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 25 Exploit / PoC 15 Malware 9 Data breach 5 Ransomware 4 Phishing & fraud 2 Policy & legal 1 Advisory 1 Threat actor 1 AI safety & security 1

SeverityAll critical 25 high 20 medium 18 low 1 info 0

[20260802] - Core - Improper CORS origin validation

Joomla patches CVE-2026-71573, improper CORS origin validation in CMS requests, in versions 5.4.8 and 6.1.3.

Joomla disclosed improper CORS origin validation (CVE-2026-71573), where configured CORS origins were not properly validated on CORS requests, rated moderate impact/severity and moderate probability. It affects Joomla CMS 4.0.0-5.4.7 and 6.0.0-6.1.2. Fixed in Joomla 5.4.8 and 6.1.3; reported on 2026-07-09 by Agamemnon Fakas and caveeroo.

Joomla Security CentreAug 17, 14:00 UTC · Aug 17, 2026Advisory CVE-2026-71573

Wavethrough CVE-2018-8235 flaw in Microsoft Edge leaks sensitive data

Security AffairsJun 23, 08:07 UTC · Jun 23, 2018Vulnerability CVE-2018-8235

Hacking printers exploiting Cross

Security AffairsFeb 1, 06:47 UTC · Feb 1, 2017Exploit / PoC

148 npm Packages Disguised as Student Proxies Turned Browsers Into a DDoS Botnet

The Hacker NewsJul 15, 00:00 UTC · Jul 15, 2026Malware1

CVE-2026-82438: Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins

Three CORS misconfigurations in Apache Storm 3.0.0 let malicious web pages from arbitrary origins read authenticated API responses.

CVE-2026-82438 (severity: important) affects Apache Storm Webapp (storm-webapp) versions 3.0.0 before 3.1.0. Three separate mechanisms allowed a web page on an unrelated origin to read responses served to authenticated users, including the Logviewer reflecting the request's Origin header in Access-Control-Allow-Origin while also sending Access-Control-Allow-Credentials. This enables a malicious site to silently exfiltrate authenticated Storm API and log data from a victim's browser session.

oss-securitySep 13, 14:39 UTC · 3d agoVulnerability CVE-2026-824381

A Malicious Webpage Could Poison Your Local AI Model Behind NVIDIA NemoClaw

Oasis Security found NVIDIA NemoClaw's Ollama binding to 0.0.0.0 enables DNS rebinding attacks that let attacker pages poison model chat templates with persistent hidden instructions.

Oasis Security disclosed that NVIDIA NemoClaw on Windows/WSL paths binds Ollama to 0.0.0.0:11434 without authentication, exposing the API to browser-based DNS rebinding attacks from malicious webpages. An attacker can then modify the model's chat template via /api/create, planting hidden instructions that run on every subsequent inference and persist across conversations, invisible to API consumers. NemoClaw v0.0.35 fixed the issue on macOS and Linux; no fix exists for Windows and WSL paths beyond a warning in v0.0.34. Ollama's own 2024 fix (CVE-2024-28224) added Host header validation, but it is skipped when bound to non-loopback addresses. No exploitation has been reported as of August 25, 2026.

The Hacker NewsAug 25, 15:58 UTC · 22d agoAI safety & security CVE-2024-282241