53623 matches found
CVE-2026-70604 Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.3, 41.4.0, and 42.0.0, a custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page loaded from a remot...
GHSA-M55F-7GQJ-FR98 Electron: Extension tab APIs operate across session boundaries
Impact Extension tab and scripting APIs were not scoped to the extension's own session. A malicious or compromised extension loaded into one session could navigate, script, and read from windows belonging to a different session. Apps are only affected if they load Chrome extensions via...
CVE-2026-70603
The provided documents describe CVE-2026-70603 for Electron: shell.openPath() could bypass path validation when a string-based check is used and embedded null bytes are present. Affected versions are prior to 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1. If an application passes untrusted input-deri...
CVE-2026-70603
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1, shell.openPath did not reject paths containing embedded null bytes. Apps that perform string-only validation of file paths, for example...
ROOT-APP-PYPI-CVE-2024-49767 CVE-2024-49767 in Werkzeug - Patched by Root
Root has patched CVE-2024-49767 in the Werkzeug package for Root:PyPI. Multiple fixed versions available...
CVE-2026-70602
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, extension tab and scripting APIs were not scoped to the extension's own session. A malicious or compromised extension loaded into one session...
ROOT-APP-PYPI-CVE-2023-25577 CVE-2023-25577 in Werkzeug - Patched by Root
Root has patched CVE-2023-25577 in the Werkzeug package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2024-22195 CVE-2024-22195 in Jinja2 - Patched by Root
Root has patched CVE-2024-22195 in the Jinja2 package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2024-34064 CVE-2024-34064 in Jinja2 - Patched by Root
Root has patched CVE-2024-34064 in the Jinja2 package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2023-30861 CVE-2023-30861 in Flask - Patched by Root
Root has patched CVE-2023-30861 in the Flask package for Root:PyPI. Multiple fixed versions available...
CVE-2026-70600
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the native autofill popup could be positioned by a cross-origin iframe outside that iframe's bounds, over the embedding page's UI, enabling...
CVE-2026-70599 Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, serial-port and media permission checks made from an iframe passed the top-level frame origin to session.setPermissionCheckHandler instead of...
CVE-2026-70598
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3, offscreen rendering frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could...
CVE-2026-70598
CVE-2026-70598 affects Electron: prior to 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3, offscreen rendering frame data from the GPU process was not fully validated by the main process. A compromised GPU process could cause the main process to read out‑of‑bounds memory while producing paint images, ...
CVE-2026-70598 Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3, offscreen rendering frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could...
EUVD-2026-53403
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the check Electron uses on macOS to confirm it was launched by a same-signed parent process could be bypassed by a local process. Apps that...
ROOT-APP-NPM-NSWG-ECO-434 NSWG-ECO-434 in base64-url - Patched by Root
Root has patched NSWG-ECO-434 in the base64-url package for Root:npm. Multiple fixed versions available...
ROOT-APP-RUBY-CVE-2026-54902 CVE-2026-54902 in oj - Patched by Root
Root has patched CVE-2026-54902 in the oj package for Root:Ruby. Multiple fixed versions available...