Live › vulnerability › CVE-2026-3303
Go to dashboardIBM Concert versions 1.0 through 3.0.0 accept cross-origin requests from domains that are not on a trusted list. A malicious web page could make a logged-in user's browser perform privileged actions in Concert.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running IBM Concert versions 1.0 through 3.0.0 where a logged-in user could visit an untrusted site in the same browser. The sources do not say which deployment setups are exposed. Teams not running IBM Concert in that version range can skip it.
No product ranges from the sources yet.
3.0.0, as listed in the IBM advisory.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
IBM Concert 1.0 through 3.0.0 uses cross-origin resource sharing (CORS) which could allow an attacker to carry out privileged actions as the domain name is not being limited to only trusted domains.
This page as .md · .json · in your agent: get_signal("CVE-2026-3303")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.