CVE-2026-3303CWE-942

CVE-2026-3303

Low · published October 19, 2026

CVSS v3.1
3.7
EPSS
0%
Percentile
16.2
In the wild
Unconfirmed
What it is

IBM Concert 1.0 through 3.0.0 uses cross-origin resource sharing (CORS) which could allow an attacker to carry out privileged actions as the domain name is not being limited to only trusted domains.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00255 · 16.2th percentile
Weakness
CWE-942 · Permissive Cross-domain Security Policy with Untrusted Domains
Published
2026-10-19T22:17Z
References (1)
https://www.ibm.com/support/pages/node/7292374 · [email protected]
EPSS history
Timeline
  • 21 OCT 03:29Z
    EPSS moved — → 0%
    epss
  • 19 OCT 17:17Z
    IBM Concert Software Permissive Cross-domain Security Policy
    cvelistv5
  • 19 OCT 17:17Z
    IBM Concert Software Permissive Cross-domain Security Policy
    cvelistv5