EUVD-2026-107374

Electron: Pointer lock permission requests can be attributed to the wrong frame...

CVE-2026-56011-Lab

CVE-2026-56011 - MapPress Maps for WordPress Unauthenticated XSS in iframe map rendering Executive Summary This repository contains a local Docker lab for reproducing and validating CVE-2026-56011, an unauthenticated Cross-Site Scripting vulnerability affecting MapPress Maps for WordPress. MapPre...

CVE-2026-114125

A flaw was found in Storybook. Due to insufficient iframe embedding and message-origin restrictions, a remote attacker can achieve arbitrary code execution if a developer running a local development server visits a malicious website. By tricking the developer into interacting with an injected...

CVE-2026-114125

Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origi...

GHSA-FW47-9C62-H3VW Electron: HID and USB permission checks can be attributed to the wrong origin

Impact For hid and usb permission checks made from an iframe, session.setPermissionCheckHandler was given the top-level frame's origin and details instead of the requesting frame's. Apps that allow these permissions based on origin could grant an embedded frame access intended for the top-level...

Electron: HID and USB permission checks can be attributed to the wrong origin

Impact For hid and usb permission checks made from an iframe, session.setPermissionCheckHandler was given the top-level frame's origin and details instead of the requesting frame's. Apps that allow these permissions based on origin could grant an embedded frame access intended for the top-level...

CVE-2026-113800

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, hid and usb permission checks made from an iframe caused setPermissionCheckHandler to receive the top-level frame's origin and...

CVE-2026-114125

Storybook versions prior to 8.6.19 , 9.1.21 , 10.6.2 , and 11.0.0-alpha.6 are vulnerable to code injection due to missing origin validation in the Storybook preview. Insufficient iframe embedding and message-origin restrictions allow a malicious website to interact with a running Storybook develo...

CVE-2026-114125 Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites

Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origi...

CVE-2026-114125 Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites

Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origi...

GHSA-C9RX-X947-FP3H ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)

Summary Since 2.18.0, when an is not allowed and disallowedTagsMode is 'discard' the defaults, its raw-text content is re-sanitized by a recursive call to sanitizeHtmltext, options the change from 5564, fixing 5550. The recursion has no bound and starts each nested call with a fresh state. Two...

EUVD-2026-105176

ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe stack overflow, nestingLimit not enforced...

ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)

Summary Since 2.18.0, when an is not allowed and disallowedTagsMode is 'discard' the defaults, its raw-text content is re-sanitized by a recursive call to sanitizeHtmltext, options the change from 5564, fixing 5550. The recursion has no bound and starts each nested call with a fresh state. Two...

CVE-2026-113800 Electron: HID and USB permission checks can be attributed to the wrong origin

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, hid and usb permission checks made from an iframe caused setPermissionCheckHandler to receive the top-level frame's origin and...

EUVD-2026-107347

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, hid and usb permission checks made from an iframe caused setPermissionCheckHandler to receive the top-level frame's origin and...

CVE-2026-113800

The Electron framework is vulnerable to an origin validation error in versions prior to 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5 . The root cause is that hid and usb permission checks initiated from an iframe incorrectly passed the top-level frame's origin and details to the setPermissionCheck...

CVE-2026-113800 Electron: HID and USB permission checks can be attributed to the wrong origin

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, hid and usb permission checks made from an iframe caused setPermissionCheckHandler to receive the top-level frame's origin and...

CVE-2026-113650

A flaw was found in sanitize-html. A remote attacker can cause a Denial of Service DoS by submitting specially crafted HTML input containing disallowed iframe elements. Under default configurations, the library re-sanitizes iframe content through unbounded recursive calls, exhausting system...

CVE-2026-113650

ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an is not allowed and disallowedTagsMode is 'discard' the defaults, its raw-text content is re-sanitized by a recursive call to sanitizeHtmltext, options. The recursion has no bound and starts each...

CVE-2026-113650 ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)

ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an is not allowed and disallowedTagsMode is 'discard' the defaults, its raw-text content is re-sanitized by a recursive call to sanitizeHtmltext, options. The recursion has no bound and starts each...