The bug has been fixed:
Thanks for reporting. We're working on porting our websites to ASP.NET Core, and those errors you've seen were a result of this.
We caught the first error ourselves on a canary build and fixed it since it surfaced in the logs before deploying a full build. That full build contained the 2nd bug (no CORS headers), which we didn't see in our logs, but fixed quickly after seeing a bug report on MSE.
This bug was introduced to the ASP.NET MVC (old framework) code when we were porting (cross-targeting) the common API code to ASP.NET Core. As a twist of fate, the new (ASP.NET Core) code actually is unit-tested and checks verifies the presence of the CORS headers. But, unfortunately, it doesn't power api.stackexchange.com yet (which still runs on ASP.NET Core), only our mobile app's API backend.