CVE-2026-10032

The openUrl function in @a2ui/webcore passes an agent-controlled URL directly to window.open without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary...

CVE-2026-10032

The openUrl function in @a2ui/webcore passes an agent-controlled URL directly to window.open without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary...

CVE-2026-10032

The CVE-2026-10032 issue involves the openUrl function in @a2ui/web_core, which passes an agent-controlled URL directly to window.open() without URI scheme validation. A malicious actor can supply a javascript: URI as the url argument for a Button component’s functionCall action, allowing arbitra...

The vulnerability of the xorg-x11-server package, related to the use of memory after it is freed during the processing of Button Action objects, allows for increasing privileges and executing arbitrary code in the root context.

The vulnerability of the xorg-x11-server package is related to the use of memory after it is freed during the processing of Button Action objects. Exploiting this vulnerability can allow an attacker to enhance their privileges and execute arbitrary code in the root context...

X.Org Server RecalculateMasterButtons Out-Of-Bounds Access Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of X.Org Server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of Button...

Cross site scripting

Cross-site scripting XSS vulnerability in the Max Foundry MaxButtons plugin before 1.26.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter in a button action on the maxbuttons-controller page to wp-admin/admin.php, related to the button creation pa...

CVE-2014-7181

Cross-site scripting XSS vulnerability in the Max Foundry MaxButtons plugin before 1.26.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter in a button action on the maxbuttons-controller page to wp-admin/admin.php, related to the button creation pa...

WordPress MaxButtons Plugin <= 1.26.0 - XSS

Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "id" parameter in a button action on the maxbuttons-controller page to wp-admin/admin.php, related to the button creation page. Solution Update the plugin...