CVE-2026-3303

LowCVSS 3.7/10Last modified Nov 3, 2026

Description

IBM Concert 1.0 through 3.0.0 uses cross-origin resource sharing (CORS) which could allow an attacker to carry out privileged actions as the domain name is not being limited to only trusted domains.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-942

Affected software

VendorProductVersions
IBMConcert>= 1.0.0, <= 3.0.0

References

Timeline

Published
Oct 19, 2026
Last modified
Nov 3, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-330309.9Nginx UI is a web user interface for the Nginx web server. In versions 2.3.3 and prior, Nginx-UI contains an Insecure Direct Object ReferencCVE-2026-330318.1Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, a user who was disabled by an administrator can use previCVE-2026-330329.8Nginx UI is a web user interface for the Nginx web server. In versions 2.3.5 and prior, the nginx-ui MCP (Model Context Protocol) integratioCVE-2026-330336.5An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `MultiPartParser` allows remote attackers to degrade CVE-2026-330347.5An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. ASGI requests with a missing or understated `Content-CVE-2026-330356.1WWBN AVideo is an open source video platform. In versions 25.0 and below, there is a reflected XSS vulnerability that allows unauthenticatedCVE-2026-330367.5fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Versions 4.0.0-beta.3 through 5.5.5 cCVE-2026-330378.1WWBN AVideo is an open source video platform. In versions 25.0 and below, the official Docker deployment files (docker-compose.yml, env.examCVE-2026-330388.1WWBN AVideo is an open source video platform. Versions 25.0 and below are vulnerable to unauthenticated application takeover through the insCVE-2026-330398.6WWBN AVideo is an open source video platform. In versions 25.0 and below, the plugin/LiveLinks/proxy.php endpoint validates user-supplied URCVE-2026-33047.5Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability in Multer prior to version 2.1.0 allows an attacker to trCVE-2026-330407.5libp2p-rust is the official rust language Implementation of the libp2p networking stack. In versions prior to 0.49.3, the Gossipsub implemen
CVE-2026-3303: Low severity, CVSS 3.7 | Vulnix