EUVD-2026-121552

Improper restriction of rendered ui layers or frames in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally...

Visual Studio Code Security Feature Bypass Vulnerability

Improper restriction of rendered ui layers or frames in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally...

EUVD-2026-120439

Nuxt UI is an intuitive Vue UI library powered by Reka UI and Tailwind CSS. Prior to 4.8.1, the server-rendered form element produced by UForm in src/runtime/components/Form.vue omits the method and action attributes and relies solely on the hydrated @submit.prevent handler to stop native...

Improper Removal of Sensitive Information Before Storage or Transfer

Overview Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer in the redact method of the secrets masker in secretsmasker.py. A user who can read task logs or rendered template fields can read a registered secret such as a...

CVE-2026-113504

Apache Airflow's secrets masker stopped descending into nested structures after five levels, so a secret registered with the masker — for example a Connection password or a Variable value — that appeared more than five containers deep under non-sensitive keys was shown in cleartext in task logs a...

CVE-2026-113504 Apache Airflow: Secrets masker: pattern-based masking bounded at depth 5 returns deeply-nested registered secrets in cleartext

Apache Airflow's secrets masker stopped descending into nested structures after five levels, so a secret registered with the masker — for example a Connection password or a Variable value — that appeared more than five containers deep under non-sensitive keys was shown in cleartext in task logs a...

CVE-2026-113504 Apache Airflow: Secrets masker: pattern-based masking bounded at depth 5 returns deeply-nested registered secrets in cleartext

Apache Airflow's secrets masker stopped descending into nested structures after five levels, so a secret registered with the masker — for example a Connection password or a Variable value — that appeared more than five containers deep under non-sensitive keys was shown in cleartext in task logs a...

EUVD-2026-119894

Apache Airflow's secrets masker stopped descending into nested structures after five levels, so a secret registered with the masker — for example a Connection password or a Variable value — that appeared more than five containers deep under non-sensitive keys was shown in cleartext in task logs a...

CVE-2026-113504

Apache Airflow's secrets masker stopped descending into nested structures after five levels, so a secret registered with the masker — for example a Connection password or a Variable value — that appeared more than five containers deep under non-sensitive keys was shown in cleartext in task logs a...

CVE-2026-113504

In Apache Airflow , a vulnerability exists in the secrets masker component which fails to descend into nested structures beyond five levels. Consequently, secrets such as Connection passwords or Variable values nested deeper than five containers under non-sensitive keys are exposed in cleartext w...

CVE-2026-113504: Apache Software Foundation Apache Airflow: Apache Airflow's secrets masker stopped descending into nested structures after five levels, so a secret registered…

Apache Airflow's secrets masker stopped descending into nested structures after five levels, so a secret registered with the masker — for example a Connection password or a Variable value — that appeared more than five containers deep under non-sensitive keys was shown in cleartext in task logs a...

PT-2026-140281

Apache Airflow's secrets masker stopped descending into nested structures after five levels, so a secret registered with the masker — for example a Connection password or a Variable value — that appeared more than five containers deep under non-sensitive keys was shown in cleartext in task logs a...

CVE-2026-102564 Dynific Addons for Elementor (formerly Anywhere Elementor) <= 1.3.0 - Unauthenticated Arbitrary Shortcode Execution via Comment Content via do_shortcode() over rendered template buffer

The The Dynific Addons for Elementor formerly Anywhere Elementor plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.3.0 This is due to the software allowing users to execute an action that does not properly validate a value before running...

CVE-2026-124027 ChatWiki before 2.10.0 Unauthenticated Document Disclosure via getLibRawFileOnePage

ChatWiki before 2.10.0 contains a missing authentication vulnerability in the GET /manage/getLibRawFileOnePage route that allows unauthenticated attackers to read other tenants' documents. Attackers can enumerate sequential adminuserid and file id query parameters, bypassing the ownership check, ...

CVE-2026-121880 RStudio Server / Posit Workbench localhost port-proxy does not enforce per-session port ownership

Authorization bypass through user-controlled key in the localhost port-proxy /p// in Posit Software, PBC RStudio Server and Posit Workbench before 2026.08.0 allows remote authenticated users to reach web applications and other services bound to 127.0.0.1 under a different user's session, and to...

EUVD-2026-117111

IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to improper restriction of rendered UI layers or frames...

PT-2026-137130

IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to improper restriction of rendered UI layers or frames...

CVE-2026-20942

Improper restriction of rendered ui layers or frames in Microsoft Edge Chromium-based allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-20942

A spoofing vulnerability exists in Microsoft Edge (Chromium-based) due to improper restriction of rendered UI layers or frames. An unauthorized attacker can exploit this over a network to perform spoofing , which may lead to changes in the user interface to beguile users into inaccurate behavior....

CVE-2026-20942: Microsoft Microsoft Edge (Chromium-based): Improper restriction of rendered ui layers or frames in Microsoft Edge (Chromium-based) allows an unauthorized attacker…

Improper restriction of rendered ui layers or frames in Microsoft Edge Chromium-based allows an unauthorized attacker to perform spoofing over a network...