CVE-2026-3303
Low · 3.7CVSS
3.7
EPSS
0.2%
Published
Oct 19, 2026
CISA due date
—
The record
IBM Concert 1.0 through 3.0.0 uses cross-origin resource sharing (CORS) which could allow an attacker to carry out privileged actions as the domain name is not being limited to only trusted domains.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-62863 MoLing is a computer-use and browser-use based MCP server. CWE-942
- CVE-2026-119285 Fiber is an Express inspired web framework written in Go. CWE-942
- CVE-2026-110737 The push endpoint of a Vaadin application that uses server push reflects the request… CWE-942
- CVE-2026-116748 Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in… CWE-942
- CVE-2026-115917 vLLM is an inference and serving engine for large language models. CWE-942
- CVE-2026-107858 Missing Origin Validation in WebSockets (CWE-1385) and Permissive Cross-domain Policy… CWE-942
- CVE-2026-85313 Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Jetty… CWE-942
- CVE-2026-84176 Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel… CWE-942