CVE-2026-19177

Insufficient validation of untrusted input in UI in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

CVE-2026-19142

Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

KLA91193 Multiple vulnerabilities in Microsoft Office

Multiple vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to execute arbitrary code, gain privileges, spoof user interface. Below is a complete list of vulnerabilities: 1. A remote code execution vulnerability in Azure Service Bus can be exploited...

GHSA-X8RC-WPG4-GRPF Electron: Cross-origin iframe can position native autofill popup

Impact The native autofill popup could be positioned by a cross-origin iframe outside that iframe's bounds, over the embedding page's UI, enabling clickjacking or spoofing of trusted UI. Apps are only affected if they embed untrusted content in iframes within windows that also display trusted UI...

Electron: Cross-origin iframe can position native autofill popup

Impact The native autofill popup could be positioned by a cross-origin iframe outside that iframe's bounds, over the embedding page's UI, enabling clickjacking or spoofing of trusted UI. Apps are only affected if they embed untrusted content in iframes within windows that also display trusted UI...

CVE-2026-70600

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the native autofill popup could be positioned by a cross-origin iframe outside that iframe's bounds, over the embedding page's UI, enabling...

CVE-2026-70600

CVE-2026-70600 affects Electron: prior to versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3 the native autofill popup could be positioned by a cross-origin iframe outside that iframe’s bounds, over the embedding page’s UI. This could enable clickjacking or spoofing of trusted UI when apps embed ...

CVE-2026-70600 Electron: Cross-origin iframe can position native autofill popup

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the native autofill popup could be positioned by a cross-origin iframe outside that iframe's bounds, over the embedding page's UI, enabling...

MAL-2026-12822 Malicious code in beaver-ui-search-dropdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 117b4f6c7e9e402d92085e427c4b40874e9b6838e16c15562408a0bda241f9ae The package presents itself as a UI dropdown library but on require executes init.js, which selects a platform-specific asset linux/darwin/win32,...

Malicious code in beaver-ui-search-dropdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 117b4f6c7e9e402d92085e427c4b40874e9b6838e16c15562408a0bda241f9ae The package presents itself as a UI dropdown library but on require executes init.js, which selects a platform-specific asset linux/darwin/win32,...

MAL-2026-12823 Malicious code in beaver-ui-side-navigation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 868e87654c2af06a8362918fbcd52680c253a85063f1a0c7fc71494b0cfd304d On require/import of the package, index.js unconditionally loads helpers.js which fetches a platform-specific binary from attacker-controlled...

MAL-2026-12828 Malicious code in beaver-ui-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5eaa4db154b26013412a01287354ef2f0ffb074b9bfd27c6e214fd60ddf4c9be The package's main index.js unconditionally requires./setup.js at load time. setup.js selects a platform-specific path, downloads an opaque native...

Malicious code in beaver-ui-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c303fcf069e3feb6dfa3d2b8ba7b7b2251c89d796bcf9fcd5d05e44849c64a0d Package advertises itself as a React UI toolkit but on require, helpers.js runs init at module load which selects a platform-specific URL, fetches a...

Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs

Summary Open WebUI fetches user-supplied URLs on the server for RAG URL ingestion, URL-to-markdown conversion and web-search content retrieval, and decides whether a destination is allowed by asking whether its IP address is globally routable. That test operates on the literal IPv6 address and do...

Malicious code in @servicetitan/standalone-ui (npm)

npm/@servicetitan/standalone-ui is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

CLSA-2026-1773188127 TuxCare security update for jquery-ui (5 CVEs)

TuxCare rebuilt jquery-ui to address 5 CVEs. Fixed in 1.10.4-tuxcare.1...

CVE-2026-14337 Pega Platform versions 23.1.0 through 25.1.3 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.

Pega Platform versions 23.1.0 through 25.1.3 are affected by an Stored Cross-site scripting XSS vulnerability in a user interface component. Requires a high privileged user with a developer role...

MAL-2026-11910 Malicious code in @servicetitan/onboarding-ui (npm)

npm/@servicetitan/onboarding-ui is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

cam-hunter

📡 CAM HUNTER — Advanced DVR / NVR / XVR Security Testing Frame...

SUSE CVE-2026-17715

Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. Chromium security severity: High...