CVE-2026-37737

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

sanic-cors version 2.2.0 and prior contains an improper regular expression in the try_match() function in sanic_cors/core.py that uses re.match without end-anchoring. This allows an attacker to bypass CORS origin allowlists by registering a domain that begins with a trusted origin string, to gain unauthorized access to cross-origin requests for authenticated resources.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-346 CWE-625

Affected software

No affected versions have been published.

Timeline

Published: Jun 5, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-37747.5The application allows PDF JavaScript and document/print actions (such as WillPrint/DidPrint) to update form fields, annotations, or optiona CVE-2026-377487.2Visitor Management System 1.0 by sanjay1313 is vulnerable to Unrestricted File Upload in vms/php/admin_user_insert.php and vms/php/update_1.CVE-2026-377499.8A SQL injection vulnerability in CodeAstro Simple Attendance Management System v1.0 allows remote unauthenticated attackers to bypass authen CVE-2026-37757.8The application's update service, when checking for updates, loads certain system libraries from a search path that includes directories wri CVE-2026-377506.1A reflected Cross-Site Scripting (XSS) vulnerability in School Management System by mahmoudai1 allows unauthenticated remote attackers to ex CVE-2026-377519.8An OS command injection vulnerability in the killSessionSync function (lib/agent-runtime.ts) of 23blocks-OS ai-maestro v0.24.17 allows attac CVE-2026-37765.5The application does not validate the presence of required appearance (AP) data before accessing stamp annotation resources. When a PDF cont CVE-2026-37777.8The application does not properly validate the lifetime and validity of internal view cache pointers after JavaScript changes the document z CVE-2026-37785.5The application does not detect or guard against cyclic PDF object references while handling JavaScript in PDF. When pages and annotations a CVE-2026-37797.8The application's list box calculate array logic keeps stale references to page or form objects after they are deleted or re-created, which CVE-2026-37807.8The application's installer runs with elevated privileges but resolves system executables and DLLs using untrusted search paths that can inc CVE-2026-37815.4The Attendance Manager plugin for WordPress is vulnerable to SQL Injection via the 'attmgr_off' parameter in all versions up to, and includi