Linux Distros Unpatched Vulnerability : CVE-2026-102673

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from...

Rocky Linux 8 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource Multiple Vulnerabilities (crlsa-2021_4123)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20214123 advisory. Mozilla: Use-after-free in HTTP2 Session object Mozilla: Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3 Mozilla: iframe sandbox rules did not...

webkitgtk: Maliciously crafted web content may violate iframe sandboxing policy

A flaw was found in WebKitGTK. Processing malicious web content can violate the iframe sandboxing policy due to improper validation...

Malicious Package

Overview epic-web-payment-management-iframe is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

GHSA-HQ2X-R82H-9WJ4 Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab

Impact Popups opened from a sandboxed iframe through a link for example target="blank" or a middle-click did not inherit the iframe's HTML sandbox restrictions. Content that was meant to run sandboxed could open a popup with the embedding app's full origin, gaining access to that origin's cookies...

Origin Validation Error

Overview electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Origin Validation Error via the OpenURLFromTab navigation path, when a sandboxed iframe with allow-popups but without...

CVE-2026-102673

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandboxed iframe through Electron's OpenURLFromTab navigation path, including links using target="blank" or a middle-click, did not...

CVE-2026-102673 Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandboxed iframe through Electron's OpenURLFromTab navigation path, including links using target="blank" or a middle-click, did not...

CVE-2026-102673 Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandboxed iframe through Electron's OpenURLFromTab navigation path, including links using target="blank" or a middle-click, did not...

EUVD-2026-89078

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandboxed iframe through Electron's OpenURLFromTab navigation path, including links using target="blank" or a middle-click, did not...

CVE-2026-102673: Origin Validation Error

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandboxed iframe through Electron's OpenURLFromTab navigation path, including links using target="blank" or a middle-click, did not...

PT-2026-102684

Name of the Vulnerable Software and Affected Versions Electron versions prior to 41.10.4 Electron versions prior to 42.5.2 Electron versions prior to 43.0.0 Description Popups opened from a sandboxed iframe via the OpenURLFromTab navigation path, such as links using target=" blank" or...

CVE-2026-84463 Zammad: Stored HTML injection in Knowledge Base video widget enables forced session switching via unescaped iframe attribute

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, a user with Knowledge Base editing rights for a category can embed a video widget in a published answer with a specially crafted value. When the answer is rendered, that value is inserted into the page's HTML...

CVE-2026-84463 Zammad: Stored HTML injection in Knowledge Base video widget enables forced session switching via unescaped iframe attribute

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, a user with Knowledge Base editing rights for a category can embed a video widget in a published answer with a specially crafted value. When the answer is rendered, that value is inserted into the page's HTML...

CVE-2026-84463 Zammad: Stored HTML injection in Knowledge Base video widget enables forced session switching via unescaped iframe attribute

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, a user with Knowledge Base editing rights for a category can embed a video widget in a published answer with a specially crafted value. When the answer is rendered, that value is inserted into the page's HTML...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the getUrl process. An attacker can execute arbitrary JavaScript in the context of the affected site by injecting specially crafted input into the src attribute of an iframe, which is not properly sanitized...

EUVD-2026-86396

Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled...

Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled

Summary With $wgEmbedVideoRequireConsent disabled not the default, the urls for videos are passed into an iframe src attribute without sanitization. When given a malformed url or id, the src attribute can be escaped via double quotes, allowing for html/javascript injection. Details The iframe...

GHSA-V65J-HFF3-753C Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled

Summary With $wgEmbedVideoRequireConsent disabled not the default, the urls for videos are passed into an iframe src attribute without sanitization. When given a malformed url or id, the src attribute can be escaped via double quotes, allowing for html/javascript injection. Details The iframe...

GHSA-QXG3-46RW-79J8 code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute

Impact A Stored Cross-Site Scripting XSS vulnerability exists in the rich text editor due to improper sanitization of the srcdoc attribute on elements. While the underlying Symfony HtmlSanitizer correctly HTML-encodes special characters inside the attribute value e.g., converting to script, the...