Linux Distros Unpatched Vulnerability : CVE-2026-66077

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, The management UI uses EJS 1.0 in which does NOT HTML-escap...

CVE-2026-66077

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, The management UI uses EJS 1.0 in which does NOT HTML-escape. connection.ejs:135 renders and peercertissuer directly into the page. The same pattern appears in streamConnection.ejs:102,106,110. The...

DEBIAN-CVE-2026-66077

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, The management UI uses EJS 1.0 in which does NOT HTML-escape. connection.ejs:135 renders and peercertissuer directly into the page. The same pattern appears in streamConnection.ejs:102,106,110. The...

CVE-2026-94183

Arc Search for Android before version 1.12.10 does not display a fullscreen notification when a page enters fullscreen mode while the app is running in the background. A remote attacker can exploit this via a specially crafted website to render fake UI elements, such as a spoofed address bar,...

CVE-2026-66077 RabbitMQ: Stored XSS via TLS peer-certificate DN in management UI

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, The management UI uses EJS 1.0 in which does NOT HTML-escape. connection.ejs:135 renders and peercertissuer directly into the page. The same pattern appears in streamConnection.ejs:102,106,110. The...

CVE-2026-66077

RabbitMQ versions prior to 3.13.15 , 4.0.20 , 4.1.11 , and 4.2.6 are vulnerable to Stored XSS via the management UI. The issue stems from the use of EJS 1.0 , where specific templates (connection.ejs and streamConnection.ejs) render the TLS peer-certificate Subject DN without HTML escaping. If a ...

CVE-2026-66077

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, The management UI uses EJS 1.0 in which does NOT HTML-escape. connection.ejs:135 renders and peercertissuer directly into the page. The same pattern appears in streamConnection.ejs:102,106,110. The...

CVE-2026-94183

Arc Search for Android versions prior to 1.12.10 are vulnerable to a UI spoofing risk. The application fails to display a fullscreen notification when a webpage enters fullscreen mode while the app is running in the background. A remote attacker can exploit this by using a specially crafted websi...

EUVD-2026-85570

Arc Search for Android before version 1.12.10 does not display a fullscreen notification when a page enters fullscreen mode while the app is running in the background. A remote attacker can exploit this via a specially crafted website to render fake UI elements, such as a spoofed address bar,...

CVE-2026-71177

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Improper Restriction of Rendered UI Layers or Frames vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges and Session...

CVE-2026-71177

Dell Secure Connect Gateway (SCG) Policy Manager , versions prior to 5.34.00.16 , is vulnerable to an Improper Restriction of Rendered UI Layers or Frames vulnerability. A low privileged attacker with remote access could exploit this flaw to achieve Elevation of privileges and Session theft . Rem...

EUVD-2026-85328

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Improper Restriction of Rendered UI Layers or Frames vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges and Session...

CVE-2026-92378

A session management vulnerability exists in the Legacy UI Reduced Function Login feature of NT-ware uniFLOW Online. Under specific timing conditions during Service Offline Emergency Mode, a previously authenticated session may be retained after logout, which could allow a subsequent user to be...

swagger-ui

소개: Swagger UI의 역할 Swagger UI 는 OpenAPI이전 명칭 Swagger 명세를 대화형 웹 인터페이스로 렌더링하는 널리 사용되는 라이브러리입니다. 이를 통해 개발자와 통합자는 백엔드 구현 없이도 API를 탐색하고 테스트할 수 있습니다. CVE‑2018‑25031 상세 정보 근본 원인: 원격 명세 로딩 이 취약점은 Swagger UI 클라이언트가 원격 설정 또는 명세 파일을 로드하는 데 사용하는 URL 쿼리 매개변수의 유효성 검사가 불충분하여 발생합니다. 관련된 일반적인 매개변수는 다음과 같습니다...

EUVD-2026-85153

A session management vulnerability exists in the Legacy UI Reduced Function Login feature of NT-ware uniFLOW Online. Under specific timing conditions during Service Offline Emergency Mode, a previously authenticated session may be retained after logout, which could allow a subsequent user to be...

CVE-2026-92378

A session management vulnerability exists in the Legacy UI Reduced Function Login feature of NT-ware uniFLOW Online . Under specific timing conditions during Service Offline Emergency Mode , a previously authenticated session may be retained after a user logs out. This flaw could allow a subseque...

Oracle E-Business Suite - Server-Side Request Forgery

Vulnerability in the Oracle Configurator product of Oracle E-Business Suite component: Runtime UI. Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. id:...

Linux Distros Unpatched Vulnerability : CVE-2026-91713

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in Browser in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements...

Linux Distros Unpatched Vulnerability : CVE-2026-95305

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - UI misrepresentation in Chromoting. CVE-2026-95305 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C...

Linux Distros Unpatched Vulnerability : CVE-2026-95363

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - UI misrepresentation in FileSystem. CVE-2026-95363 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C...