CVE-2026-109332Low· 3.1▾ SunlitNetwork-AI (npm network-ai) before 5.15.2 contains an origin validation error in McpSseServer._handleRequest in lib/mcp-transport-sse.ts that reflects localhost Origins into Access-Control-Allow-Origin regardless of bind interface. When …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 17.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Network-AI (npm network-ai) before 5.15.2 contains an origin validation error in McpSseServer._handleRequest in lib/mcp-transport-sse.ts that reflects localhost Origins into Access-Control-Allow-Origin regardless of bind interface. When the server binds a non-loopback address, an attacker page with a localhost Origin visited by a victim can read unauthenticated endpoints like /health cross-origin.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-77363High· 8.8obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults
CVE-2026-109286High· 8.1Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user's session token by posting unvalidated verify:chat messages
CVE-2026-9191Critical· 9.6Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently isolate user-supplied code executed through certain REST and XDBC evaluation paths from HTTP request, response, and session state
CVE-2026-108268NoneEnclave OS Virtual runs container workloads inside confidential virtual machines with end-to-end attestation
CVE-2026-108269NoneRemote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections
CVE-2026-108267NonePrivasys Go is a maintained fork of the Go programming language that adds RA-TLS support to crypto/tls