CVE-2026-109346 better-auth 1.3.8-beta.3 before 1.7.0-rc.3 Device Authorization Phishing via /device

better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET /device omits the requesting clientid and scope. Attackers can start a device request via /device/code, trick signed-in users into approving the code, then...

CVE-2026-108901 Shenzhen HCC Technology MPOS M6 PLUS Display QR Code Rendering ui layer

A vulnerability was found in Shenzhen HCC Technology MPOS M6 PLUS 1.31-N. Affected by this vulnerability is an unknown functionality of the component Display QR Code Rendering. Performing a manipulation of the argument alignment results in improper restriction of rendered ui layers. The attack ca...

Malicious code in ap3-foundations-ui (npm)

Source: amazon-inspector 7469eefaab624821647b4e412c4ceac1f422d4857b8484767041fdc355398477 The package's preinstall hook runs index.js, which collects installer host identifiers os.hostname, os.userInfo.username, os.homedir, process.cwd, os.platform, os.arch, and process.env.CI and POSTs them as...

Malicious code in ap3-foundations-ui (npm)

ap3-foundations-ui describes itself as a security research PoC for dependency confusion and does not identify an upstream package it copies. Its preinstall hook runs node index.js during npm install; the script sends the package name and version, hostname, username, home directory, working...

MAL-2026-17806 Malicious code in ap3-foundations-ui (npm)

ap3-foundations-ui describes itself as a security research PoC for dependency confusion and does not identify an upstream package it copies. Its preinstall hook runs node index.js during npm install; the script sends the package name and version, hostname, username, home directory, working...

PT-2026-110889

Name of the Vulnerable Software and Affected Versions IBM DB2 Recovery Expert for Linux, UNIX and Windows version 5.5 IF 2 Description An unauthenticated attacker can embed arbitrary JavaScript code in the Web UI. This cross-site scripting issue allows the attacker to alter intended functionality...

PT-2026-110890

Name of the Vulnerable Software and Affected Versions IBM Db2 Recovery Expert for Linux, UNIX and Windows version 5.5 IF 2 Description An unauthenticated attacker can embed arbitrary JavaScript code into the Web UI. This cross-site scripting issue allows the attacker to alter the intended...

CVE-2026-108908: Improper Neutralization of Input During Web Page Generation

A vulnerability was identified in Netcore NR268 1.7.121109. Affected by this vulnerability is the function eval of the file /router/l7callboarduserset.cgi of the component Web UI. Such manipulation of the argument title/note/URL/content leads to cross site scripting. The attack can be launched...

CVE-2026-109346: User Interface (UI) Misrepresentation of Critical Information

better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET /device omits the requesting clientid and scope. Attackers can start a device request via /device/code, trick signed-in users into approving the code, then...

CVE-2025-27897: Improper Neutralization of Input During Web Page Generation

IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within ...

CVE-2026-18541: Improper Neutralization of Input During Web Page Generation

IBM Planning Analytics 2.0, and 2.1 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

PT-2026-111090

Name of the Vulnerable Software and Affected Versions IBM Planning Analytics versions 2.0 through 2.1 Description An authenticated user can embed arbitrary JavaScript code into the Web UI. This stored cross-site scripting issue allows for the alteration of intended functionality, which could...

CVE-2026-84321: Insufficient Session Expiration

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GenerateShortToken creates standalone short-token records without a long Token value, but DeleteUserTokens invalidates cached entries only when the long Token field is nonempty. A revoked short token can therefore remain i...

CVE-2026-84320: Improper Limitation of a Pathname to a Restricted Directory

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.3, Nginx UI validates an automatic backup's storagepath, but AutoBackup.GetName returns a user-controlled name without rejecting path separators or parent-directory components, and downstream filename formatting embeds that...

CVE-2026-84318: Protection Mechanism Failure

Nginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool nginxconfigadd writes nginx configuration files to disk and triggers an nginx reload without calling config.ValidateConfigFile. The identical flow in the REST API POST /api/configs does call that...

CVE-2026-84314: Improper Authorization

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the POST /api/users/:id user-management endpoint permits an authenticated user to change another user's password without passing RequireSecureSession, even though the self-service password-change path requires that step-up...

CVE-2026-84313: Improper Authentication

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST /api/otpenroll and POST /api/finishpasskeyregister are registered outside RequireSecureSession and accept a normal authenticated session without verifying the current password. An attacker with a stolen JWT can bind a...

CVE-2026-84360: Authentication Bypass Using an Alternate Path or Channel

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and /mcpmessage require only ordinary authentication before exposing nginxconfigadd and nginxconfigmodify. An OTP-enabled user with a normal JWT...

CVE-2026-84319: Protection Mechanism Failure

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx directives such as loadmodule, jsimport, and jscontent. However, the MCP configuration interface allows a secondary authenticated user to write and apply equivale...

CVE-2026-84317: Improper Input Validation

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, internal/config/validation.go ValidateConfigFile is a security control that blocks dangerous nginx directives — js, perl, loadmodule of the njs/perl modules, and user root. It is enforced on three of the four config-write...