CVE-2026-96238
Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network.
CVSS
6.5
Medio
EPSS
0.2%
p13
KEV
—
Exploit Today
4
0-100
Publicado: 13 oct 2026 · Última mod.: 13 oct 2026 · CWE-346
Sin historial EPSS suficiente todavía.
Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-101897——
——0Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 1.20.0 until 1.21.1, the Angular DevTools background service worker accepts chrome.runtime.sendMessage runtime messages from untrusted web pages or third-party content scripts without adequately verifying the message source. An untrusted sender that obtains a valid randomized victim tabId can direct the extension to use chrome.debugger to attach to another browser tab and trigger Chrome DevTools Protocol breakpoints. This can display the debugging banner, pause JavaScript execution, and prevent interaction with the target tab, but it does not provide remote code execution, privilege escalation, or cross-origin access to memory or credentials. This issue is fixed in version 1.21.1.16hCVE-2026-973819.9 CRÍ10.8%
——3Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 contains an origin validation error in the IsPermitted method of its ActiveX control. After successfully reading the hosting document's hostname, a hostname that is not on the permitted list falls through without setting E_ACCESSDENIED, causing IsPermitted to return S_OK. An attacker who induces a user to visit a malicious webpage in Internet Explorer can invoke the control to enumerate update and system information, install updates without consent, display dialogs, or restart the computer when a reboot is pending. This issue was fixed in Legacy Update 1.13.2.1dCVE-2026-962345.3 MED19.3%
——6Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.2dCVE-2026-881325.9 MED23.2%
——7Origin validation error in Azure Key Vault allows an unauthorized attacker to disclose information over a network.1dCVE-2026-702138.0 ALT23.0%
——7Origin validation error in Microsoft Power Apps allows an authorized attacker to execute code over a network.1dCVE-2026-698776.5 MED32.8%
——10Origin validation error in Azure DevOps allows an unauthorized attacker to disclose information over a network.1d