Skip to content
OpenAdvisories

Weakness (CWE)

CWE-346: Origin Validation Error

Class Draft

The product does not properly verify that the source of data or communication is valid.

Source: MITRE CWE-346

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Critical 9.3
    CVE-2026-103922 Public exploit

    Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path

    Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its path, allowing a victim who activates …

    swift com.capacitorjs ionic-team @capacitor Android iOS npm Maven SwiftURL
  • Critical 9.8
    CVE-2026-6508 Public exploit

    RCE in TUBITAK BILGEM's Liderahenk

    Origin Validation Error vulnerability in TUBITAK BILGEM Software Technologies Research Institute Liderahenk allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Liderahenk: from 2.0.1 before 2.0.2.

    TUBITAK BILGEM Software Technologies Research Institute Liderahenk
  • Critical 9.1
    CVE-2026-23552 Public exploit

    Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy

    Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component.  The Camel-Keycloak KeycloakSecurityPolicy does not validate the iss (issuer) claim of JWT tokens against the configured realm. A token issued by one Keycloak realm…

    Apache Software Foundation Apache Camel org.apache.camel:camel-keycloak Maven
  • Critical 9.7
    CVE-2026-22794 Public exploit

    Account Takeover Vulnerability in Appsmith

    Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.93, the server uses the Origin value from the request headers as the email link baseUrl without validation. If an attacker controls the Origin, password reset / email ver…

    appsmithorg appsmith
  • Critical 9.4
    CVE-2025-34291 Exploited Public exploit EPSS 93%

    Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCE

    Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie c…

    Langflow Langflow langflow PyPI
    KEV May 21, 2026
  • Critical 9.6
    CVE-2022-41924 Public exploit

    Tailscale Windows daemon is vulnerable to RCE via CSRF

    A vulnerability identified in the Tailscale Windows client allows a malicious website to reconfigure the Tailscale daemon `tailscaled`, which can then be used to remotely execute code. In the Tailscale Windows client, the local API was bound to a local TCP so…

    tailscale tailscale tailscale.com tailscale Alpine Go
  • Critical 9.1
    CVE-2021-26291 Public exploit

    block repositories using http by default

    Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a posit…

    Apache Software Foundation Apache Maven org.apache.maven:maven-core maven Debian Ubuntu Maven