CVE-2026-105784

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, selecting a note containing a jsoncanvas fence causes the whiteboard text and file-node components in...

CVE-2026-105784 Joplin whiteboard card rendering allows CSS injection into application chrome

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, selecting a note containing a jsoncanvas fence causes the whiteboard text and file-node components in...

CVE-2026-105784

The open-source note-taking application Joplin is vulnerable to CSS injection in versions prior to 3.7.13 . The root cause is the improper handling of jsoncanvas fences, where the TextNode.tsx and FileNode.tsx components render card content using the full Markdown renderer and insert the resultin...

CVE-2023-38873-G1

🚨 G1 = A05:2021 – セキュリティの設定ミス ClickJacking ⚠️ 基本スコア: 6.5 中程度 スケール: CVSS ⚠️ 📌 説明 このリポジトリは、G1 サイトに存在する Clickjacking タイプのセキュリティ脆弱性を示しています。この脆弱性により、攻撃者はサイトを iframe 内に読み込み、悪意のある要素を重ねてユーザーを欺くことができます。 ⚠️ Clickjacking とは？ Clickjacking UI Redressing とも呼ばれる...

Johnny-You-Are-Fired

Johnny-You-Are-Fired USENIX 논문의 아티팩트 | 전체 논문 여기 초록 OpenPGP와 S/MIME는 이메일을 암호화하고 디지털 서명하기 위한 두 가지 주요 표준이다. 디지털 서명은 메시지의 진위성과 무결성을 보장하기 위한 것이다. 이 연구에서 우리는 OpenPGP 및 S/MIME 이메일 서명 검증의 다양한 구현에 대한 실질적인 위조 공격을 다섯 가지 공격 클래스로 보여준다: 1 우리는 S/MIME 컨테이너 형식의 엣지 케이스를 분석한다. 2 우리는 가장 널리 사용되는 OpenPGP 구현인 GnuPG API...

CVE-2026-74951

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Clickjacking issue in Firefox for Android...

CVE-2026-18534 Address bar spoofing risk in affected iOS versions of Arc Search

ArcSearch for iOS versions prior to 1.48.0 could keep the address bar hidden after a page-initiated scroll, allowing attacker-controlled content to imitate browser interface elements and increasing spoofing risk...

UBUNTU-CVE-2026-74951

Clickjacking issue in Firefox for Android. This vulnerability was fixed in Firefox 154...

UBUNTU-CVE-2026-74975

Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154...

CVE-2026-74951

Clickjacking issue in Firefox for Android. This vulnerability was fixed in Firefox 154...

CVE-2026-74980

CVE-2026-74980 is a clickjacking vulnerability affecting the Downloads component in Firefox for Android . The vulnerability has been addressed in Firefox 154 . Documentation confirms this issue was part of a broader set of security fixes (MFSA 2026-74) and has been reported in the wild according ...

CVE-2026-74980

Clickjacking issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154...

CVE-2026-74978

Clickjacking issue in the Widget component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

PT-2026-77008

Name of the Vulnerable Software and Affected Versions Firefox for Android versions prior to 154 Description A spoofing issue exists within the Downloads component, which could allow an attacker to deceive users by misrepresenting the source or nature of a downloaded file. Recommendations Update t...

PT-2026-77013

Name of the Vulnerable Software and Affected Versions Firefox for Android versions prior to 154 Description A clickjacking issue exists in the Downloads component. Clickjacking is a technique where an attacker uses multiple transparent or semi-transparent layers to trick a user into clicking on a...

PT-2026-69267

Name of the Vulnerable Software and Affected Versions Nexter Blocks versions prior to 5.0.2 Description Insufficient access control in a REST endpoint allows users with the Contributor role or higher to save arbitrary global CSS. This stored CSS is rendered site-wide on the front end, which can...

CVE-2026-44767 Allowlist Bypass in setThemeRoot() Enables Cross-Origin CSS Injection

setThemeRoot failed to enforce the sap-allowed-theme-origins allowlist. An attacker-controlled absolute cross-origin URL could be stored and used directly to construct a element, even when no tag was present in the document. The same bypass was reachable via the ?sap-themeRoot URL...

CVE-2026-33406

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, configuration values from the /api/config endpoint are placed directly into HTML value="" attributes without escaping in settings-advanced.js,...

CVE-2026-33406

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, configuration values from the /api/config endpoint are placed directly into HTML value="" attributes without escaping in settings-advanced.js,...

CVE-2026-33406 Pi-hole has a Stored HTML attribute injection

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, configuration values from the /api/config endpoint are placed directly into HTML value="" attributes without escaping in settings-advanced.js,...