Cross-origin resource sharing 2 PortSwiggerlabs: CORS vulnerability with trusted null origin Aug 18, 2026 PortSwiggerlabs: CORS vulnerability with basic origin reflection Aug 18, 2026