CVE-2026-39040: Improper Neutralization of Input During Web Page Generation

BharatMLStack up to and including 1.3.0 is vulnerable to Cross Site Scripting XSS via the component Trufflebox UI trufflebox-ui in ExpressionViewModal.jsx...

CVE-2026-83042: Improper Authentication

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware component: OIM Legacy UI. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identit...

CVE-2026-83154: Improper Authentication

Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM component: Open UI. Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via SOAP to compromise Siebel CRM End User. Successful attacks of this...

CVE-2026-83203: Improper Access Control

Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM component: Open UI. Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User. Successful attacks of this...

CVE-2026-12749: Improper Neutralization of Input During Web Page Generation

IBM Cloud Pak for Business Automation is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

PT-2026-92167

BharatMLStack up to and including v1.3.0 is vulnerable to Cross Site Scripting XSS in the component Trufflebox UI trufflebox-ui in GenericNumerixTable.jsx...

PT-2026-92159

Name of the Vulnerable Software and Affected Versions IBM Cloud Pak for Business Automation affected versions not specified Description An authenticated user can embed arbitrary JavaScript code into the Web UI. This stored cross-site scripting issue allows for the alteration of intended...

CVE-2026-91942: Improper Neutralization of Input During Web Page Generation

crawl4ai before 0.9.3 contains a DOM-based cross-site scripting vulnerability in the Docker Playground UI that assigns untrusted crawl results to element.innerHTML. Attackers can craft malicious PDFs with event-handler markup to execute JavaScript in the Playground origin and steal API tokens fro...

PT-2026-92669

Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM component: Open UI. Supported versions that are affected are 17.0-26.7. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM End User. Successful attacks requir...

PT-2026-92823

Name of the Vulnerable Software and Affected Versions Oracle Business Intelligence Enterprise Edition version 12.2.1.4.0 Description A flaw in the Service Administration UI component allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation ca...

PT-2026-92490

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware component: OIM Legacy UI. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity...

PT-2026-93225

A security flaw has been discovered in ag-ui-protocol ag-ui 0.3.0. Affected is the function urllib.request.urlopen of the file integrations/aws-strands/python/src/ag ui strands/utils.py of the component Multimodal Content. The manipulation of the argument Value results in server-side request...

PT-2026-92566

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware component: OIM Legacy UI. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identit...

PT-2026-93157

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.47 Description Missing authorization in the Transactions Platform allows a remote attacker who has compromised the renderer process to spoof UI elements by using a crafted HTML page. Recommendations...

PT-2026-93141

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.47 Description A race condition in WebAppInstalls allows a remote attacker to spoof UI elements by using a crafted HTML page. A race condition occurs when the timing or sequence of events is unplanned...

ROS-20260915-73-0188

The vulnerability of the File Input component in Google Chrome and Microsoft Edge is related to the user interface’s false representation of critical information. Exploiting this vulnerability allows a malicious actor to compromise data integrity through a specially created HTML page...

CVE-2026-39038

BharatMLStack version v1.3.0 and below is vulnerable to a Cross Site Scripting (XSS) vulnerability. The flaw exists within the trufflebox-ui component, specifically in the GenericNumerixTable.jsx file. Exploitation of this vulnerability could allow an attacker to execute malicious scripts in the ...

ROS-20260915-73-0065

The vulnerability of the File Input service in Google Chrome and Microsoft Edge is related to information representation errors in the user interface. Exploiting this vulnerability can allow an attacker to replace the user interface through a created HTML page...

PT-2026-92740

Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM component: Open UI. Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM End User. Successful attacks of this...

ROS-20260915-73-0187

The vulnerability of the SplitView component in Google Chrome and Microsoft Edge relates to the improper presentation of critical information to the user interface. Exploiting this vulnerability can allow an attacker to compromise data integrity and also cause service interruptions through the us...