CVE-2023-38873-G1

🚨 G1 = A05:2021 – Security Misconfiguration ClickJacking ⚠️ Puntuación base: 6.5 MEDIO Escala: CVSS ⚠️ 📌 Descripción Este repositorio demuestra una falla de seguridad del tipo Clickjacking presente en el sitio del G1. La vulnerabilidad permite que un atacante cargue el sitio dentro de un iframe ,...

Johnny-You-Are-Fired

Johnny-You-Are-Fired Artefactos para la publicación USENIX | Artículo completo aquí Resumen OpenPGP y S/MIME son los dos estándares principales para cifrar y firmar digitalmente correos electrónicos. Se supone que las firmas digitales garantizan la autenticidad e integridad de los mensajes. En es...

CVE-2026-74951

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Clickjacking issue in Firefox for Android...

CVE-2026-18534 Address bar spoofing risk in affected iOS versions of Arc Search

ArcSearch for iOS versions prior to 1.48.0 could keep the address bar hidden after a page-initiated scroll, allowing attacker-controlled content to imitate browser interface elements and increasing spoofing risk...

UBUNTU-CVE-2026-74951

Clickjacking issue in Firefox for Android. This vulnerability was fixed in Firefox 154...

UBUNTU-CVE-2026-74975

Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154...

CVE-2026-74951

Clickjacking issue in Firefox for Android. This vulnerability was fixed in Firefox 154...

CVE-2026-74980

A clickjacking vulnerability exists in the Downloads component of Firefox for Android . This flaw was addressed in Firefox 154 . No specific exploit details or exploit links are provided in the documents, and no direct mitigation steps are listed beyond the available update. Impact is noted as pa...

CVE-2026-74980

Clickjacking issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154...

CVE-2026-74978

Clickjacking issue in the Widget component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

PT-2026-77008

Name of the Vulnerable Software and Affected Versions Firefox for Android versions prior to 154 Description A spoofing issue exists within the Downloads component, which could allow an attacker to deceive users by misrepresenting the source or nature of a downloaded file. Recommendations Update t...

PT-2026-77013

Name of the Vulnerable Software and Affected Versions Firefox for Android versions prior to 154 Description A clickjacking issue exists in the Downloads component. Clickjacking is a technique where an attacker uses multiple transparent or semi-transparent layers to trick a user into clicking on a...

PT-2026-69267

Name of the Vulnerable Software and Affected Versions Nexter Blocks versions prior to 5.0.2 Description Insufficient access control in a REST endpoint allows users with the Contributor role or higher to save arbitrary global CSS. This stored CSS is rendered site-wide on the front end, which can...

CVE-2026-44767 Allowlist Bypass in setThemeRoot() Enables Cross-Origin CSS Injection

setThemeRoot failed to enforce the sap-allowed-theme-origins allowlist. An attacker-controlled absolute cross-origin URL could be stored and used directly to construct a element, even when no tag was present in the document. The same bypass was reachable via the ?sap-themeRoot URL...

CVE-2026-33406

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, configuration values from the /api/config endpoint are placed directly into HTML value="" attributes without escaping in settings-advanced.js,...

CVE-2026-33406

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, configuration values from the /api/config endpoint are placed directly into HTML value="" attributes without escaping in settings-advanced.js,...

CVE-2026-33406 Pi-hole has a Stored HTML attribute injection

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, configuration values from the /api/config endpoint are placed directly into HTML value="" attributes without escaping in settings-advanced.js,...

CVE-2026-31873

Unhead is a document head and template manager. Prior to 2.1.11, The link.href check in makeTagSafe safe.ts uses String.includes, which is case-sensitive. Browsers treat URI schemes case-insensitively. DATA:text/css,... is the same as data:text/css,... to the browser, but 'DATA:...'.includes'data...

CVE-2026-31873

Unhead is a document head and template manager. Prior to 2.1.11, The link.href check in makeTagSafe safe.ts uses String.includes, which is case-sensitive. Browsers treat URI schemes case-insensitively. DATA:text/css,... is the same as data:text/css,... to the browser, but 'DATA:...'.includes'data...

CVE-2025-70296

A stored HTML injection vulnerability in the Recipe Notes rendering component in Mealie 3.3.1 allows remote authenticated users to inject arbitrary HTML, resulting in user interface redressing within the recipe view...