Export limit exceeded: 416378 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (537 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-91739 | 1 Google | 1 Chrome | 2026-09-18 | 4.2 Medium |
| Missing authorization in Transactions Platform in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-84356 | 1 Google | 1 Chrome | 2026-09-17 | 4.3 Medium |
| UI misrepresentation in FullScreen in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-87995 | 2 Open-webui, Openwebui | 2 Open-webui, Open Webui | 2026-09-16 | 8.7 High |
| Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.11 until 0.11.1, src/lib/components/chat/FileNav/PortPreview.svelte rendered terminal port content in an iframe sandbox containing both allow-scripts and allow-same-origin. Because the terminal proxy serves that content from the Open WebUI origin, an authenticated user with access to a shared terminal server could host script on a previewed port and take over a victim's account when the victim opened the preview. This issue is fixed in version 0.11.1. | ||||
| CVE-2026-28656 | 1 Google | 1 Android | 2026-09-15 | 7.3 High |
| In multiple functions of DeviceAdminAdd.java, there is a possible way to an overlay due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. | ||||
| CVE-2026-87501 | 1 Google | 1 Chrome | 2026-09-10 | 5.4 Medium |
| UI misrepresentation in Passwords in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-87486 | 1 Google | 2 Android, Chrome | 2026-09-10 | 4 Medium |
| Clickjacking in TrustedWebActivities in Google Chrome on on Android prior to 153.0.8010.36 allowed a local attacker to spoof address bar via a co-installed app. (Chromium security severity: Medium) | ||||
| CVE-2026-87538 | 1 Google | 1 Chrome | 2026-09-10 | 4.2 Medium |
| Clickjacking in Input in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-87655 | 1 Google | 1 Chrome | 2026-09-09 | 5.4 Medium |
| Clickjacking in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-87465 | 1 Google | 1 Chrome | 2026-09-09 | 4.2 Medium |
| Incorrect authorization in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-87635 | 1 Google | 1 Chrome | 2026-09-09 | 5.4 Medium |
| UI misrepresentation in Payments in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-84139 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-09-03 | 9.8 Critical |
| Clickjacking issue in the DOM: Events component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. | ||||
| CVE-2026-75548 | 1 Ebyte | 1 Ebyte Ne2-d11 Firmware | 2026-08-31 | 5.4 Medium |
| The affected Ebyte device web management interface does not restrict the interface from being rendered within an external frame. An unauthenticated remote attacker could use a crafted webpage to mislead an authenticated administrator into initiating unintended configuration changes or disruptive actions. | ||||
| CVE-2026-44727 | 1 Jupyter | 1 Jupyter Server | 2026-08-28 | 5.4 Medium |
| Jupyter Server is the backend for Jupyter web applications. Prior to 2.20, the nbconvert HTTP handlers in jupyter_server render user-authored notebook HTML under the Jupyter origin without a sandbox directive in their Content-Security-Policy. Combined with nbconvert.HTMLExporter's default non-sanitizing behavior, a notebook carrying an HTML payload in a display_data output triggers stored XSS with cookie access, full /api/* authority, and kernel RCE. This vulnerability is fixed in 2.20. | ||||
| CVE-2026-74978 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-08-25 | 8.1 High |
| Clickjacking issue in the Widget component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. | ||||
| CVE-2026-74980 | 1 Mozilla | 2 Firefox, Firefox Mobile | 2026-08-25 | 6.5 Medium |
| Clickjacking issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154. | ||||
| CVE-2024-7523 | 1 Mozilla | 1 Firefox Mobile | 2026-08-19 | 6.3 Medium |
| A select option could partially obscure security prompts. This could be used by a malicious site to trick a user into granting permissions. *This issue only affects Android versions of Firefox.* This vulnerability affects Firefox < 129. | ||||
| CVE-2026-74951 | 1 Mozilla | 2 Firefox, Firefox Mobile | 2026-08-19 | 6.5 Medium |
| Clickjacking issue in Firefox for Android. This vulnerability was fixed in Firefox 154. | ||||
| CVE-2026-74958 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-08-19 | 7.5 High |
| Information disclosure in the WebRTC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. | ||||
| CVE-2026-18534 | 1 The Browsercompany Of New York | 1 Arcsearch | 2026-08-18 | 7.4 High |
| ArcSearch for iOS versions prior to 1.48.0 could keep the address bar hidden after a page-initiated scroll, allowing attacker-controlled content to imitate browser interface elements and increasing spoofing risk. | ||||
| CVE-2026-14142 | 1 Google | 1 Chrome | 2026-08-12 | 4.3 Medium |
| Inappropriate implementation in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) | ||||