CVE-2026-89326
Origin Validation Error vulnerability in Apache XML Graphics Batik: the external resource same-origin check does not compare the URL protoco
CVSS
—
Sem CVSS
EPSS
—
KEV
—
Exploit Today
—
0-100
Publicado: 11 de nov. de 2026 · Última mod.: 11 de nov. de 2026 · CWE-346
Ainda não há histórico EPSS suficiente.
Origin Validation Error vulnerability in Apache XML Graphics Batik: the external resource same-origin check does not compare the URL protocol This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue.
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-65957——
———Helio is an MCP proxy that sits between AI agents and the tools they use. Prior to version 0.8.0, the dashboard sideband (default 127.0.0.1:3100) validated CORS request origins by matching the hostname against a private-network string prefix (10., 172.16.–172.31., 192.168.) rather than validating an IP address. A public DNS name such as 192.168.attacker.com, 10.evil.io, or 172.16.pwn.example also satisfies that prefix, so the proxy echoed the attacker origin in Access-Control-Allow-Origin. This issue has been patched in version 0.8.0.3hCVE-2026-1025897.1 ALT—
———When independent Grafana instances share the same [rendering] renderer_token, an image renderer key issued by one instance is accepted by the others, so a user on one instance could act as the user with the same ID on another (origin validation error). This affects instances with the renderAuthJWT feature toggle enabled, the default from Grafana 13.0.0.9hCVE-2026-1215299.6 CRÍ12.4%
——4A origin validation error vulnerability in Fortinet FortiClientMac 7.4.0 through 7.4.7, FortiClientWindows 7.4.0 through 7.4.7, FortiClientWindows 7.2.0 through 7.2.14, FortiClientWindowsPAM 7.4.7, FortiClientWindowsPAM 7.2.14 may allow an unauthorized remote attacker to execute unauthorized code or commands. Successful exploitation requires interaction with the victim.1dCVE-2026-699017.5 ALT33.8%
——10Origin validation error in Microsoft Teams for Android allows an unauthorized attacker to perform spoofing over a network.22hCVE-2026-1181118.0 ALT37.3%
——11Origin validation error in SQL Server allows an authorized attacker to elevate privileges over a network.1dCVE-2026-1253205.3 MÉD3.8%
——1pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the HTTP transport did not validate the Origin header on incoming requests. A user who visited an attacker-controlled page could be targeted through DNS rebinding, allowing the page to reach a locally running server and read schemas and query results from configured databases. The issue affected deployments with the HTTP transport enabled on a machine that also ran a browser, while the default stdio transport was not reachable through this path. This issue is fixed in version 1.1.0.1d