EUVD-2026-116938

In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, when URL client window mode is enabled jakarta.faces.CLIENTWINDOWMODE=url, the client window id from the jfwid or jakarta.faces.ClientWindow request parameter is appended to generated URLs...

CVE-2026-120421

In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, a reflected cross-site scripting (XSS) vulnerability exists when jakarta.faces.CLIENT_WINDOW_MODE=url is enabled. The root cause is that the client window id from the jfwid or jakarta.faces.Cli...

JSONBee

JSONBee A ready to use JSONP endpoints to help bypass content security policy of different websites. The tool was presented during HackIT 2018 in Kiev. The presentation can be found here not sure why format of the slides is screwed :D:...

zappzarapp-php-security

⚡ zappzarapp/security Comprehensive PHP security library providing CSP, Security Headers, CSRF protection, Secure Cookies, Password Validation, Input Sanitization, Rate Limiting, SRI, Secrets Loading, Encryption, Session Security, TOTP two-factor authentication, Signed URLs, and Security Event...

browsertunnel

browsertunnel Browsertunnel is a tool for exfiltrating data from the browser using the DNS protocol. It achieves this by abusing dns-prefetch, a feature intended to reduce the perceived latency of websites by doing DNS lookups in the background for specified domains. DNS traffic does not appear i...

PT-2026-136995

In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, when URL client window mode is enabled jakarta.faces.CLIENT WINDOW MODE=url, the client window id from the jfwid or jakarta.faces.ClientWindow request parameter is appended to generated URLs...

CVE-2026-120421: Eclipse Foundation Eclipse Mojarra: In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, when URL client…

In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, when URL client window mode is enabled jakarta.faces.CLIENTWINDOWMODE=url, the client window id from the jfwid or jakarta.faces.ClientWindow request parameter is appended to generated URLs...

CVE-2026-108049

Clickjacking vulnerability in the Alosuite web application. The affected login interface can be embedded in a web page controlled by an attacker because it does not implement adequate user interface protection mechanisms, such as the X-Frame-Options header or an appropriate Content-Security-Polic...

CVE-2026-108049

The Alosuite web application contains a clickjacking vulnerability (CWE-1021) within its login interface. The root cause is the absence of adequate user interface protection mechanisms, specifically the X-Frame-Options header or an appropriate Content-Security-Policy (frame-ancestors) directive. ...

EUVD-2026-115798

Clickjacking vulnerability in the Alosuite web application. The affected login interface can be embedded in a web page controlled by an attacker because it does not implement adequate user interface protection mechanisms, such as the X-Frame-Options header or an appropriate Content-Security-Polic...

CVE-2026-108049 Clickjacking vulnerability in the Alosuite web application.

Clickjacking vulnerability in the Alosuite web application. The affected login interface can be embedded in a web page controlled by an attacker because it does not implement adequate user interface protection mechanisms, such as the X-Frame-Options header or an appropriate Content-Security-Polic...

EUVD-2026-114902

Apache Wicket 10.10.0, 10.11.0 and 9.24.0 do not set the Content-Security-Policy headers on a page whose render request handler is wrapped in more than one IRequestHandlerDelegate. The framework unwraps only a single delegate level when deciding whether a request renders a page, so with a deeper...

CVE-2026-87718

Apache Wicket 10.10.0, 10.11.0 and 9.24.0 do not set the Content-Security-Policy headers on a page whose render request handler is wrapped in more than one IRequestHandlerDelegate. The framework unwraps only a single delegate level when deciding whether a request renders a page, so with a deeper...

CVE-2026-87718

Apache Wicket versions 10.10.0, 10.11.0, and 9.24.0 are vulnerable to a flaw where Content-Security-Policy (CSP) headers are silently omitted. This occurs when a page's render request handler is wrapped in more than one IRequestHandlerDelegate , as the framework only unwraps a single delegate lev...

CVE-2026-87718 Apache Wicket: CSP headers silently omitted for pages served through nested request handler delegates

Apache Wicket 10.10.0, 10.11.0 and 9.24.0 do not set the Content-Security-Policy headers on a page whose render request handler is wrapped in more than one IRequestHandlerDelegate. The framework unwraps only a single delegate level when deciding whether a request renders a page, so with a deeper...

CVE-2026-113429

Legacy v1 to v3 Actions artifact uploads stored the request's Content-Encoding header unchecked in the column that is served as the artifact's Content-Type on download, and a value starting with video/ or audio/ also removed the sandboxing Content-Security-Policy. A user who can run an Actions jo...

EUVD-2026-114792

Legacy v1 to v3 Actions artifact uploads stored the request's Content-Encoding header unchecked in the column that is served as the artifact's Content-Type on download, and a value starting with video/ or audio/ also removed the sandboxing Content-Security-Policy. A user who can run an Actions jo...

CVE-2026-113429

The Gitea platform is vulnerable to a stored Cross-Site Scripting (XSS) flaw in legacy (v1 to v3) Actions artifact uploads. The root cause is the failure to validate the Content-Encoding header, which is stored and served as the artifact's Content-Type. If an attacker uploads an artifact with a v...

CVE-2026-113429 Gitea stored XSS through legacy Actions artifact Content-Encoding

Legacy v1 to v3 Actions artifact uploads stored the request's Content-Encoding header unchecked in the column that is served as the artifact's Content-Type on download, and a value starting with video/ or audio/ also removed the sandboxing Content-Security-Policy. A user who can run an Actions jo...

CVE-2026-113429 Gitea stored XSS through legacy Actions artifact Content-Encoding

Legacy v1 to v3 Actions artifact uploads stored the request's Content-Encoding header unchecked in the column that is served as the artifact's Content-Type on download, and a value starting with video/ or audio/ also removed the sandboxing Content-Security-Policy. A user who can run an Actions jo...