179 matches found
storybook: Storybook: Arbitrary code execution via insufficient message-origin restrictions
A flaw was found in Storybook. Due to insufficient iframe embedding and message-origin restrictions, a remote attacker can achieve arbitrary code execution if a developer running a local development server visits a malicious website. By tricking the developer into interacting with an injected...
storybook: Storybook: Arbitrary code execution via insufficient message-origin restrictions
A flaw was found in Storybook. Due to insufficient iframe embedding and message-origin restrictions, a remote attacker can achieve arbitrary code execution if a developer running a local development server visits a malicious website. By tricking the developer into interacting with an injected...
storybook: Storybook: Arbitrary code execution via insufficient message-origin restrictions
A flaw was found in Storybook. Due to insufficient iframe embedding and message-origin restrictions, a remote attacker can achieve arbitrary code execution if a developer running a local development server visits a malicious website. By tricking the developer into interacting with an injected...
SUSE CVE-2026-114125
Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origi...
CVE-2026-114125
A flaw was found in Storybook. Due to insufficient iframe embedding and message-origin restrictions, a remote attacker can achieve arbitrary code execution if a developer running a local development server visits a malicious website. By tricking the developer into interacting with an injected...
CVE-2026-114125
Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origi...
CVE-2026-114125
Storybook versions prior to 8.6.19 , 9.1.21 , 10.6.2 , and 11.0.0-alpha.6 are vulnerable to code injection due to missing origin validation in the Storybook preview. Insufficient iframe embedding and message-origin restrictions allow a malicious website to interact with a running Storybook develo...
CVE-2026-114125 Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites
Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origi...
CVE-2026-114125 Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites
Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origi...
Rocky Linux 9 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource / firefox-x11 Multiple Vulnerabilities (crlsa-2023_4462)
The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20234462 advisory. Mozilla: Offscreen Canvas could have bypassed cross-origin restrictions CVE-2023-4045 Mozilla: Incorrect value used during WASM compilation CVE-2023-4046...
Rocky Linux 8 [CIQ] Security Update: thunderbird / thunderbird-debuginfo / thunderbird-debugsource Multiple Vulnerabilities (crlsa-2023_4497)
The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20234497 advisory. Mozilla: Offscreen Canvas could have bypassed cross-origin restrictions CVE-2023-4045 Mozilla: Incorrect value used during WASM compilation CVE-2023-4046...
PYSEC-2026-2004 vantage6's CORS settings overly permissive
Impact The vantage6 server has no restrictions on CORS settings. It should be possible for people to set the allowed origins of the server. The impact is limited because v6 does not use session cookies Patches No Workarounds No...
Open WebUI: Cross-origin postMessage confirmation bypass via action:submit
Summary The chat message listener allows non-same-origin input:prompt and action:submit messages, so an external site can set prompt text and trigger submitPrompt in an authenticated victim session. I validated this with a cross-origin attacker page that auto-posted messages and caused unauthoriz...
CVE-2026-34373
Parse Server’s GraphQL API endpoint prior to versions 8.6.66 and 9.7.0-alpha.10 does not respect the allowOrigin setting, unconditionally allowing cross-origin requests from any website and bypassing configured origin restrictions. The REST API enforces allowOrigin correctly. A fix is available i...
PT-2026-29167
Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.66 Parse Server versions prior to 9.7.0-alpha.10 Description Parse Server, an open source backend deployable on Node.js infrastructures, has an issue where the GraphQL API endpoint does not enforce the...
Improper Access Control
agentapi is vulnerable to an Improper Access Control. The vulnerability is due to client-side DNS rebinding when the API is served over plain HTTP on localhost, where an attacker can bypass origin restrictions and access the /messages endpoint, and attackers can exploit this to exfiltrate sensiti...
EUVD-2013-2774
Malware in sbrugna...
EUVD-2013-2773
Malware in sbrugna...