CWE-942

CVEs per yearBy the year they were published

1. 20191
2. 20211
3. 20223
4. 20239
5. 202417
6. 202525
7. 202692

Newest CVEs

• CVE-2026-62863

  MoLing: unauthenticated SSE and wildcard CORS expose tool sessions

  gojue · moling

  Critical9.6
• CVE-2026-119285

  Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads

  gofiber · fiber

  Medium5.9
• CVE-2026-110737

  Push Endpoint Returns Permissive CORS Headers

  vaadin · vaadin

  Low2.3
• CVE-2026-116748

  Transmission 4.0.0 before 4.1.3 Permissive CORS Leaks RPC Anti-CSRF Token

  transmission · transmission

  High8.7
• CVE-2026-115917

  vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server

  vllm-project · vllm

  Low3.4
• CVE-2026-107858

  Cross-Site WebSocket Hijacking and Permissive CORS in Google Agent Development Kit (ADK) for Java Development Server

  Google · Agent Development Kit (ADK) for Java

  High7.2
• CVE-2026-3303

  IBM Concert Software Permissive Cross-domain Security Policy

  IBM · Concert

  Low3.7
• CVE-2026-85313

  Apache Camel: Camel-Jetty Cross-Origin Credential Exposure via Allow-All CrossOriginFilter Defaults When enableCORS Is Set

  Apache Software Foundation · Apache Camel

  Medium4.3
• CVE-2026-84176

  Apache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Origin Reflection

  Apache Software Foundation · Apache Camel

  Medium6.5
• CVE-2026-111922

  Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost Origins

  go-vikunja · vikunja

  High7.2

Vendors it comes up for most

1. IBM7
2. Mozilla5
3. nicolargo5
4. Google4
5. HCL Software4
6. Apache Software Foundation3
7. HCLSoftware3
8. Microsoft3
9. ASUS2
10. Apple2