52353 matches found
CVE-2026-70607
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, some window options supplied by web content in the window.open features string were applied to the new BrowserWindow without an allowlist...
CVE-2026-70607 Electron: window.open features string controls some window options considered privileged
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, some window options supplied by web content in the window.open features string were applied to the new BrowserWindow without an allowlist...
EUVD-2026-53462
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, some window options supplied by web content in the window.open features string were applied to the new BrowserWindow without an allowlist...
CVE-2026-70602
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, extension tab and scripting APIs were not scoped to the extension's own session. A malicious or compromised extension loaded into one session...
CVE-2026-70595
Ghost is a Node.js content management system. From 6.26.0 until 6.54.1, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network. A successful attack would not result i...
ROOT-APP-PYPI-CVE-2026-28684 CVE-2026-28684 in python-dotenv - Patched by Root
Root has patched CVE-2026-28684 in the python-dotenv package for Root:PyPI. Multiple fixed versions available...
CVE-2026-70605 Electron: HTTP redirect followed into local file loader
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, when following HTTP redirects, net.fetch and net.request did not restrict which schemes a redirect could target. A remote server could redire...
EUVD-2026-53442
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, when following HTTP redirects, net.fetch and net.request did not restrict which schemes a redirect could target. A remote server could redire...
ROOT-APP-NPM-NSWG-ECO-106 NSWG-ECO-106 in negotiator - Patched by Root
Root has patched NSWG-ECO-106 in the negotiator package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2016-10539 CVE-2016-10539 in negotiator - Patched by Root
Root has patched CVE-2016-10539 in the negotiator package for Root:npm. Multiple fixed versions available...
CVE-2026-70604 Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.3, 41.4.0, and 42.0.0, a custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page loaded from a remot...
GHSA-M55F-7GQJ-FR98 Electron: Extension tab APIs operate across session boundaries
Impact Extension tab and scripting APIs were not scoped to the extension's own session. A malicious or compromised extension loaded into one session could navigate, script, and read from windows belonging to a different session. Apps are only affected if they load Chrome extensions via...
CVE-2026-70603
The provided documents describe CVE-2026-70603 for Electron: shell.openPath() could bypass path validation when a string-based check is used and embedded null bytes are present. Affected versions are prior to 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1. If an application passes untrusted input-deri...
CVE-2026-70603
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1, shell.openPath did not reject paths containing embedded null bytes. Apps that perform string-only validation of file paths, for example...
ROOT-APP-PYPI-CVE-2024-49767 CVE-2024-49767 in Werkzeug - Patched by Root
Root has patched CVE-2024-49767 in the Werkzeug package for Root:PyPI. Multiple fixed versions available...
CVE-2026-70602
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, extension tab and scripting APIs were not scoped to the extension's own session. A malicious or compromised extension loaded into one session...
ROOT-APP-PYPI-CVE-2023-25577 CVE-2023-25577 in Werkzeug - Patched by Root
Root has patched CVE-2023-25577 in the Werkzeug package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2024-34064 CVE-2024-34064 in Jinja2 - Patched by Root
Root has patched CVE-2024-34064 in the Jinja2 package for Root:PyPI. Multiple fixed versions available...