CVE-2026-103278 Ghost 5.8.0 before 6.34.0 Staff Account Takeover via Admin iframe

Ghost versions 5.8.0 before 6.34.0 contain an input validation vulnerability in the admin iframe that allows attackers to take over staff user accounts. Attackers with content publishing privileges can craft malicious pages that, when visited by active staff users, enable account takeover through...

CVE-2026-103278 Ghost 5.8.0 before 6.34.0 Staff Account Takeover via Admin iframe

Ghost versions 5.8.0 before 6.34.0 contain an input validation vulnerability in the admin iframe that allows attackers to take over staff user accounts. Attackers with content publishing privileges can craft malicious pages that, when visited by active staff users, enable account takeover through...

CVE-2026-103278 Ghost 5.8.0 before 6.34.0 Staff Account Takeover via Admin iframe

Ghost versions 5.8.0 before 6.34.0 contain an input validation vulnerability in the admin iframe that allows attackers to take over staff user accounts. Attackers with content publishing privileges can craft malicious pages that, when visited by active staff users, enable account takeover through...

BIT-DISCOURSE-2026-91132 Discourse: Wildcard iframe origin allowlist bypass via authority separators

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, sites using wildcard patterns in the allowediframes setting could accept a crafted iframe URL whose allowlisted suffix appeared after a URL authority separator. The wildcard origin check matched...

Rocky Linux 8 [CIQ] Security Update: thunderbird / thunderbird-debuginfo / thunderbird-debugsource Multiple Vulnerabilities (crlsa-2022_1730)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20221730 advisory. Mozilla: Bypassing permission prompt in nested browsing contexts CVE-2022-29909 Mozilla: iframe Sandbox bypass CVE-2022-29911 Mozilla: Fullscreen...

Rocky Linux 8 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource Multiple Vulnerabilities (crlsa-2022_1705)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20221705 advisory. Mozilla: Bypassing permission prompt in nested browsing contexts CVE-2022-29909 Mozilla: iframe Sandbox bypass CVE-2022-29911 Mozilla: Fullscreen...

CVE-2026-103278: Relative Path Traversal

Ghost versions 5.8.0 before 6.34.0 contain an input validation vulnerability in the admin iframe that allows attackers to take over staff user accounts. Attackers with content publishing privileges can craft malicious pages that, when visited by active staff users, enable account takeover through...

Linux Distros Unpatched Vulnerability : CVE-2026-102673

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from...

webkitgtk: Maliciously crafted web content may violate iframe sandboxing policy

A flaw was found in WebKitGTK. Processing malicious web content can violate the iframe sandboxing policy due to improper validation...

GHSA-HQ2X-R82H-9WJ4 Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab

Impact Popups opened from a sandboxed iframe through a link for example target="blank" or a middle-click did not inherit the iframe's HTML sandbox restrictions. Content that was meant to run sandboxed could open a popup with the embedding app's full origin, gaining access to that origin's cookies...

Origin Validation Error

Overview electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Origin Validation Error via the OpenURLFromTab navigation path, when a sandboxed iframe with allow-popups but without...

CVE-2026-102673

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandboxed iframe through Electron's OpenURLFromTab navigation path, including links using target="blank" or a middle-click, did not...

CVE-2026-102673 Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandboxed iframe through Electron's OpenURLFromTab navigation path, including links using target="blank" or a middle-click, did not...

EUVD-2026-89078

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandboxed iframe through Electron's OpenURLFromTab navigation path, including links using target="blank" or a middle-click, did not...

CVE-2026-102673 Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandboxed iframe through Electron's OpenURLFromTab navigation path, including links using target="blank" or a middle-click, did not...

CVE-2026-56011-Lab

CVE-2026-56011 - MapPress Maps for WordPress 무인증 XSS iframe 지도 렌더링 요약 이 저장소는 MapPress Maps for WordPress에 영향을 미치는 무인증 크로스사이트 스크립팅Cross-Site Scripting 취약점인 CVE-2026-56011을 재현하고 검증하기 위한 로컬 Docker 랩입니다. MapPress Maps for WordPress는 WordPress 페이지와 게시물 내부에 지도를 렌더링하는 데 사용되는 WordPress 플러그인입니다. 취약한 동작은...

PT-2026-102684

Name of the Vulnerable Software and Affected Versions Electron versions prior to 41.10.4 Electron versions prior to 42.5.2 Electron versions prior to 43.0.0 Description Popups opened from a sandboxed iframe via the OpenURLFromTab navigation path, such as links using target=" blank" or...

CVE-2026-102673: Origin Validation Error

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandboxed iframe through Electron's OpenURLFromTab navigation path, including links using target="blank" or a middle-click, did not...

CVE-2026-84463 Zammad: Stored HTML injection in Knowledge Base video widget enables forced session switching via unescaped iframe attribute

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, a user with Knowledge Base editing rights for a category can embed a video widget in a published answer with a specially crafted value. When the answer is rendered, that value is inserted into the page's HTML...

CVE-2026-84463 Zammad: Stored HTML injection in Knowledge Base video widget enables forced session switching via unescaped iframe attribute

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, a user with Knowledge Base editing rights for a category can embed a video widget in a published answer with a specially crafted value. When the answer is rendered, that value is inserted into the page's HTML...