CVE-2026-114130

Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.0, an incomplete fix for CVE-2026-53722 allows an application with pages disabled to render a script-capable URL through NuxtLink when attacker-controlled input bound to to is prefixed with an ASCII C0 control character. Th...

CVE-2026-114127

The Astro web framework (versions 7.1.0 to 7.3.3 ) is vulnerable to arbitrary CSS injection within its server-side View Transition CSS generator. The root cause is the failure to keep string animation properties (such as duration , delay , easing , direction , fillMode , or animation names ) with...

CVE-2026-114127 Astro: Arbitrary CSS injection in Astro View Transitions

Astro is a web framework for content-driven websites. From 7.1.0 until 7.3.3, Astro's server-side View Transition CSS generator does not keep string animation properties within their generated declarations. An application that passes attacker-controlled data into properties such as duration, dela...

CVE-2026-114127 Astro: Arbitrary CSS injection in Astro View Transitions

Astro is a web framework for content-driven websites. From 7.1.0 until 7.3.3, Astro's server-side View Transition CSS generator does not keep string animation properties within their generated declarations. An application that passes attacker-controlled data into properties such as duration, dela...

CVE-2026-108901

A vulnerability was found in Shenzhen HCC Technology MPOS M6 PLUS 1.31-N. Affected by this vulnerability is an unknown functionality of the component Display QR Code Rendering. Performing a manipulation of the argument alignment results in improper restriction of rendered ui layers. The attack ca...

CVE-2026-108901 Shenzhen HCC Technology MPOS M6 PLUS Display QR Code Rendering ui layer

A vulnerability was found in Shenzhen HCC Technology MPOS M6 PLUS 1.31-N. Affected by this vulnerability is an unknown functionality of the component Display QR Code Rendering. Performing a manipulation of the argument alignment results in improper restriction of rendered ui layers. The attack ca...

CVE-2026-108901: Improper Restriction of Rendered UI Layers or Frames

A vulnerability was found in Shenzhen HCC Technology MPOS M6 PLUS 1.31-N. Affected by this vulnerability is an unknown functionality of the component Display QR Code Rendering. Performing a manipulation of the argument alignment results in improper restriction of rendered ui layers. The attack ca...

CLEANSTART-2026-UV14417 Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered Templates UI

Security vulnerability affects the airflow-3 package. Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered Templates UI...

DRUPAL-CONTRIB-2026-166

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module does not sufficiently restrict access to raw webform source editing when the Webform UI module is not enabled. This could allow a user with webform creation ...

CVE-2026-71177

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Improper Restriction of Rendered UI Layers or Frames vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges and Session...

CVE-2026-71177

Dell Secure Connect Gateway (SCG) Policy Manager , versions prior to 5.34.00.16 , is vulnerable to an Improper Restriction of Rendered UI Layers or Frames vulnerability. A low privileged attacker with remote access could exploit this flaw to achieve Elevation of privileges and Session theft . Rem...

CVE-2026-71177

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Improper Restriction of Rendered UI Layers or Frames vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges and Session...

EUVD-2026-85328

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Improper Restriction of Rendered UI Layers or Frames vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges and Session...

CVE-2026-71177

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Improper Restriction of Rendered UI Layers or Frames vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges and Session...

CVE-2026-71177: Improper Restriction of Rendered UI Layers or Frames

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Improper Restriction of Rendered UI Layers or Frames vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges and Session...

PT-2026-97331

Name of the Vulnerable Software and Affected Versions Dell Secure Connect Gateway SCG Policy Manager versions prior to 5.34.00.16 Description An Improper Restriction of Rendered UI Layers or Frames issue exists where a low privileged attacker with remote access could potentially exploit the flaw ...

PT-2026-97663

Name of the Vulnerable Software and Affected Versions Drupal Webform versions 0.0.0 through 6.2.12 Drupal Webform versions 6.3.0 through 6.3.1 Description Stored Cross-Site Scripting XSS occurs when the module does not sufficiently restrict access to raw webform source editing while the Webform U...

CVE-2026-84388

A improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome Extension 8.0 all versions, FortiPAM Chrome Extension 7.4 all versions may allow attacker to information disclosure via remote unauthenticated attack...

EUVD-2026-84423

A improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome Extension 8.0 all versions, FortiPAM Chrome Extension 7.4 all versions may allow attacker to information disclosure via remote unauthenticated attack...

CVE-2026-84388

An improper restriction of rendered UI layers or frames vulnerability in Fortinet FortiPAM Chrome Extension (versions 8.0 and 7.4 , all versions) allows a remote, unauthenticated attacker to achieve information disclosure and compromise the confidentiality and integrity of protected data. Accordi...