Lucene search
+L

24160 matches found

CVE
CVE
added 2026/09/08 12:13 a.m.30 views

CVE-2026-76977

SAP UI5 is affected by a clickjacking vulnerability in its Frame Options Allowlist mechanism. The framework does not sufficiently validate the parent frame's origin against the configured allowlist, allowing an unauthenticated attacker to host a malicious page that bypasses framing restrictions. ...

4.3CVSS5.8AI score0.00223EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
added 2026/09/08 12:13 a.m.5 views

CVE-2026-76977 Clickjacking vulnerability in SAPUI5(Frame Options Allowlist)

SAP UI5 does not sufficiently validate the parent frame's origin against the configured allowlist. An unauthenticated attacker could host a malicious page to bypass framing restrictions. If an authenticated victim visits the attacker's page and interacts with it, the attacker could trick the vict...

4.3CVSS5.7AI score0.00223EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/09/08 12:13 a.m.12 views

EUVD-2026-72588

SAP UI5 does not sufficiently validate the parent frame's origin against the configured allowlist. An unauthenticated attacker could host a malicious page to bypass framing restrictions. If an authenticated victim visits the attacker's page and interacts with it, the attacker could trick the vict...

4.3CVSS5.8AI score0.00223EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/09/08 12:13 a.m.37 views

CVE-2026-76977 Clickjacking vulnerability in SAPUI5(Frame Options Allowlist)

SAP UI5 does not sufficiently validate the parent frame's origin against the configured allowlist. An unauthenticated attacker could host a malicious page to bypass framing restrictions. If an authenticated victim visits the attacker's page and interacts with it, the attacker could trick the vict...

4.3CVSS0.00223EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/09/08 12:00 a.m.10 views

PT-2026-88534

Missing authorization in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

9.8CVSS5.8AI score0.00474EPSS
SaveExploits12References235
Positive Technologies
Positive Technologies
added 2026/09/08 12:00 a.m.10 views

PT-2026-88674

Information leak in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: Medium...

9.8CVSS5.6AI score0.00474EPSS
SaveExploits12References235
Positive Technologies
Positive Technologies
added 2026/09/08 12:00 a.m.11 views

PT-2026-88708

Improper certificate validation in FedCM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. Chromium security severity: Low...

9.8CVSS5.8AI score0.00474EPSS
SaveExploits12References235
Positive Technologies
Positive Technologies
added 2026/09/08 12:00 a.m.11 views

PT-2026-88611

Missing authorization in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension. Chromium security severity: Low...

9.8CVSS5.8AI score0.00474EPSS
SaveExploits12References235
Positive Technologies
Positive Technologies
added 2026/09/08 12:00 a.m.11 views

PT-2026-88631

Information leak in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. Chromium security severity: Medium...

9.8CVSS5.6AI score0.00474EPSS
SaveExploits12References235
Positive Technologies
Positive Technologies
added 2026/09/08 12:00 a.m.13 views

PT-2026-88566

Incorrect authorization in Workers in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

9.8CVSS5.8AI score0.00474EPSS
SaveExploits12References235
Positive Technologies
Positive Technologies
added 2026/09/08 12:00 a.m.9 views

PT-2026-88598

Missing authorization in WebUI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: High...

9.8CVSS5.8AI score0.00474EPSS
SaveExploits12References235
Cvelist
Cvelist
added 2026/09/08 12:00 a.m.31 views

CVE-2026-78997

UC Browser for Android package com.UCMobile.intl, version 13.7.8.1314 contains a Universal Cross-Site Scripting vulnerability that allows an attacker to execute arbitrary JavaScript in the context of any origin. An attacker hosts a specially crafted URL on a UC-owned domain via a reflected XSS th...

0.00278EPSS
SaveExploits1References2
Positive Technologies
Positive Technologies
added 2026/09/08 12:00 a.m.14 views

PT-2026-86963

SAP UI5 does not sufficiently validate the parent frame's origin against the configured allowlist. An unauthenticated attacker could host a malicious page to bypass framing restrictions. If an authenticated victim visits the attacker's page and interacts with it, the attacker could trick the vict...

4.3CVSS5.7AI score0.00223EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/09/08 12:00 a.m.8 views

EUVD-2026-72957

UC Browser for Android package com.UCMobile.intl, version 13.7.8.1314 contains a Universal Cross-Site Scripting vulnerability that allows an attacker to execute arbitrary JavaScript in the context of any origin. An attacker hosts a specially crafted URL on a UC-owned domain via a reflected XSS th...

6.2AI score0.00278EPSS
SaveExploits1References2
Positive Technologies
Positive Technologies
added 2026/09/08 12:00 a.m.13 views

PT-2026-88732

Cross-site scripting in SanitizerAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

9.8CVSS5.8AI score0.00474EPSS
SaveExploits12References235
Positive Technologies
Positive Technologies
added 2026/09/08 12:00 a.m.14 views

PT-2026-88752

Incorrect authorization in PushAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

9.8CVSS5.8AI score0.00474EPSS
SaveExploits12References235
Positive Technologies
Positive Technologies
added 2026/09/08 12:00 a.m.13 views

PT-2026-88751

Incorrect authorization in Paint in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

9.8CVSS5.9AI score0.00474EPSS
SaveExploits12References235
OSV
OSV
added 2026/09/08 12:00 a.m.5 views

UBUNTU-CVE-2026-58649

Origin validation error in .NET allows an unauthorized attacker to disclose information over a network...

6.5CVSS5.7AI score0.00272EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/09/08 12:00 a.m.13 views

PT-2026-88742

Uninitialized resource in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

9.8CVSS5.6AI score0.00474EPSS
SaveExploits12References235
Positive Technologies
Positive Technologies
added 2026/09/08 12:00 a.m.12 views

PT-2026-88547

Incorrect authorization in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. Chromium security severity: High...

9.8CVSS5.9AI score0.00474EPSS
SaveExploits13References235
Rows per page
Query Builder