20657 matches found
CVE-2026-23904 Apache Kyuubi: Unrestricted access via Kyuubi engine-ui proxy
Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination. A remote requester with network access to the proxy can cause the Kyuubi server to send HTTP requests to arbitrary reachable hosts, resulting in SSRF or open-proxy behavior. This...
openSUSE 16 Security Update : agama-web-ui (openSUSE-SU-2026:21448-1)
The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21448-1 advisory. - CVE-2025-7783: form-data: unsafe Math.random function is used to select a boundary value for multipart form-encoded data bsc1246822. -...
CVE-2026-47725
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.3, every /ui/ POST / PUT / PATCH / DELETE route processes the request as soon as the session cookie validates. SameSite=Lax on the session cookie prevents most cross-site form submits bu...
CVE-2026-49258 Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete)
Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN. In versions 0.3.5 and below, the web UI /ui/ does not apply the per-operator CA scoping employed by the JSON API. This was partially addressed by GHSA-598g-h2vc-h5vg, but the changes were not implemented in the web...
CVE-2026-49258
Nebula Mesh Web UI contains ownership checks gaps in versions ≤ 0.3.5, allowing authenticated non-admin operators to access, block, or delete resources across operators via endpoints such as /ui/hosts/{id}/block, /ui/hosts/{id}, /ui/hosts, /ui/networks, and /ui/events. The root cause is improper ...
CVE-2026-47725 nebula-mesh: Web UI lacks CSRF tokens on /ui/* mutating endpoints
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.3, every /ui/ POST / PUT / PATCH / DELETE route processes the request as soon as the session cookie validates. SameSite=Lax on the session cookie prevents most cross-site form submits bu...
CVE-2026-47725 nebula-mesh: Web UI lacks CSRF tokens on /ui/* mutating endpoints
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.3, every /ui/ POST / PUT / PATCH / DELETE route processes the request as soon as the session cookie validates. SameSite=Lax on the session cookie prevents most cross-site form submits bu...
EUVD-2026-49887
IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.6, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.6, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 is vulnerable to stored cross-site scripting. This vulnerability allows a...
CVE-2026-67174
Pivotick contains a DOM-based cross-site scripting vulnerability in its generic UI element resolution and icon-rendering utilities. The tryResolveHTMLElement function treated any resolved string as HTML markup by assigning it to a element through innerHTML. Strings derived from untrusted graph...
MAL-2026-11132 Malicious code in bianira-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a775549df738e414db9982a4695da893427c09ccc63cd520917c1b73476f4336 plugin.js the package main contains an appended top-level IIFE that runs on any require/import of the package. Every network-related identifier...
MAL-2026-11136 Malicious code in fluid-type-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de176a872add830e311ef01f6432b609d41e31cbf2ec6bf2dbc473dcff5c2216 src/index.js in [email protected] contains a hidden code block, pushed off-screen by a long run of tab characters, that runs when the module is...
CVE-2026-13860
An incorrect security ui flaw was found in the Autofill component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=417052041...
CVE-2026-13904
An incorrect security ui flaw was found in the Safe Browsing component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=504185807...
CVE-2026-13927
An insufficient validation of untrusted input flaw was found in the UI component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=511826446...
CVE-2026-13956
An incorrect security ui flaw was found in the PageInfo component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=513515168...
CVE-2026-13905
An incorrect security ui flaw was found in the Chrome for iOS component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=504192688...
CVE-2026-13986
An inappropriate implementation flaw was found in the Media UI component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=514020959...
CVE-2026-13983
An incorrect security ui flaw was found in the Chrome for iOS component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=514009910...