https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-28T22:19:03.211877+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-116748 CVE-2026-116748 — Transmission 4.0.0 before 4.1.3 Permissive CORS Leaks RPC Anti-CSRF Token 2026-10-28T22:19:03.212835+00:00

Affected: transmission

Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handle_request() in rpc-server.cc that exposes the X-Transmission-Session-Id anti-CSRF token to any web origin. Malicious web pages can read the token from the 409 handshake response and replay it to issue RPC calls, enabling script-torrent-done execution, download-dir changes, or torrent and data deletion.