CVE-2026-49258

Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN. In versions 0.3.5 and below, the web UI /ui/ does not apply the per-operator CA scoping employed by the JSON API. This was partially addressed by GHSA-598g-h2vc-h5vg, but the changes were not implemented in the web...

CVE-2026-49258 Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete)

Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN. In versions 0.3.5 and below, the web UI /ui/ does not apply the per-operator CA scoping employed by the JSON API. This was partially addressed by GHSA-598g-h2vc-h5vg, but the changes were not implemented in the web...

CVE-2026-47725 nebula-mesh: Web UI lacks CSRF tokens on /ui/* mutating endpoints

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.3, every /ui/ POST / PUT / PATCH / DELETE route processes the request as soon as the session cookie validates. SameSite=Lax on the session cookie prevents most cross-site form submits bu...

CVE-2026-47725

Summary (CVE-2026-47725) Nebula-mesh web UI lacked CSRF protection on all /ui/* mutating endpoints (POST/PUT/PATCH/DELETE) prior to v0.3.3. A session-cookie/Lax-SameSite boundary and third-party page triggers (including a forced GET /ui/logout via an image tag) enable potential privilege escalati...

CVE-2026-7775

IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.6, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.6, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 is vulnerable to stored cross-site scripting. This vulnerability allows a...

CVE-2026-7775 Cross-site Scripting Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway

IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.6, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.6, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 is vulnerable to stored cross-site scripting. This vulnerability allows a...

CVE-2026-13842

An incorrect security ui flaw was found in the Chrome for iOS component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=516836297...

CVE-2026-13912

An incorrect security ui flaw was found in the Safe Browsing component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=508259433...

CVE-2026-13982

An incorrect security ui flaw was found in the Passwords component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=514006829...

CVE-2026-13969

An uninitialized use flaw was found in the UI component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=513762962...

CVE-2026-13980

An incorrect security ui flaw was found in the Chrome for iOS component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=513989973...

CVE-2026-14026

An incorrect security ui flaw was found in the SplitView component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=507263861...

CVE-2026-13998

An incorrect security ui flaw was found in the File Input component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=514070501...

CVE-2026-14028

An incorrect security ui flaw was found in the Chrome for iOS component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=401816601...

CVE-2026-14030

An incorrect security ui flaw was found in the SplitView component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=488762971...

CVE-2026-14123

An incorrect security ui flaw was found in the Chrome for iOS component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=513856644...

CVE-2026-14141

An incorrect security ui flaw was found in the Document Picture-in-Picture component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=514072867...

CVE-2026-14144

An incorrect security ui flaw was found in the Views component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=514079793...

CVE-2026-63301

In Quick.CMS, the administrative user interface restricts deletion of the primary language by omitting the corresponding option from the interface; however, the underlying language-deletion API endpoint does not enforce an equivalent server-side authorization check. As a result, an authenticated...

EUVD-2026-49731

An unauthenticated remote attacker can abuse the improper validation of the post-login redirect of the web-UI to trick users to a malicious website. This can result in a loss of confidentiality and availability...