CVE-2026-8919

The record

Permissive Cross-domain Security Policy with Untrusted Domains in ASUS GameSDK allows a remote user to obtain a local user’s NTLM hash by convincing the user to visit a crafted web page that sends a request containing a UNC path to the application’s local service endpoint. This can result in information disclosure or data tampering, may cause GameSDK to become unavailable, and may also enable access to the victim’s information on other services. Refer to the ' Security Update for ASUS GameSDK  ' section on the ASUS Security Advisory for more information.

Affected packages

Related vulnerabilities

• CVE-2026-62863 MoLing is a computer-use and browser-use based MCP server. CWE-942
• CVE-2026-119285 Fiber is an Express inspired web framework written in Go. CWE-942
• CVE-2026-110737 The push endpoint of a Vaadin application that uses server push reflects the request… CWE-942
• CVE-2026-116748 Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in… CWE-942
• CVE-2026-115917 vLLM is an inference and serving engine for large language models. CWE-942
• CVE-2026-107858 Missing Origin Validation in WebSockets (CWE-1385) and Permissive Cross-domain Policy… CWE-942
• CVE-2026-89058 A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins… CWE-942
• CVE-2026-53649 Joro is a web exploitation framework. CWE-942