CVE-2020-36907: Allocation of Resources Without Limits or Throttling

Aerohive HiveOS contains a denial of service vulnerability in the NetConfig UI that allows unauthenticated attackers to render the web interface unusable. Attackers can send a crafted HTTP request to the action.php5 script with specific parameters to trigger a 5-minute service disruption...

PT-2026-1442

Aerohive HiveOS contains a denial of service vulnerability in the NetConfig UI that allows unauthenticated attackers to render the web interface unusable. Attackers can send a crafted HTTP request to the action.php5 script with specific parameters to trigger a 5-minute service disruption...

CVE-2025-66376

Zimbra Collaboration ZCS 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets CSS @import directives in an HTML e-mail message...

Malicious code in faceplate-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06d59e051a3b111ec2ba70071d0c2273f89c30a8eb1c6de75cb69d2eefc08b17 The package faceplate-ui was found to contain malicious code. Source: ghsa-malware 760b2fdc48604bbd4ed6a6251e192cec01c7f27dc59320b0a6e7f5fec3d1c13f A...

EUVD-2026-0932

Malicious code in faceplate-ui npm...

CVE-2025-65922: Improper Restriction of Rendered UI Layers or Frames

PLANKA 2.0.0 lacks X-Frame-Options and CSP frame-ancestors headers, allowing the application to be embedded within malicious iframes. While this does not lead to unintended modification of projects or tasks, it exposes users to Phishing attacks. Attackers can frame the legitimate Planka applicati...

CVE-2025-66376: Improper Neutralization of Input During Web Page Generation

Zimbra Collaboration ZCS 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets CSS @import directives in an HTML e-mail message...

CVE-2025-66376

CVE-2025-66376 affects Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13. The issue is a stored cross-site scripting (XSS) in the Classic UI caused by CSS @import directives in HTML emails. Impact is described as stored XSS in the Classic UI; no exploit details are provided bey...

PT-2026-1317

Name of the Vulnerable Software and Affected Versions PLANKA version 2.0.0 Description The application does not implement X-Frame-Options and CSP frame-ancestors headers, which allows it to be embedded within malicious iframes. This can expose users to phishing attacks through UI Redressing,...

PT-2026-1290

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration Suite versions prior to 10.0.18 Zimbra Collaboration Suite versions prior to 10.1.13 Description A stored cross-site scripting XSS flaw exists in the Classic UI of the software. The issue occurs when the HTML sanitizer fai...

CVE-2025-15426

A vulnerability was identified in jackying H-ui.admin up to 3.1. This affects an unknown function in the library /lib/webuploader/0.1.5/server/preview.php. The manipulation leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit is publicly available and might...

PT-2026-24884

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 146.0.7680.71 Description An incorrect security user interface in the Downloads feature of Google Chrome on Android allowed a remote attacker to perform UI spoofing through a crafted HTML page. This issue has a...

PT-2026-6485

The SignalK access request system has two related features that when combined by themselves and with the infromation disclosure vulnerability enable convincing social engineering attacks against administrators. When a device creates an access request, it specifies three fields: clientId,...

📄 Zimbra Collaboration 10.0 / 10.1 Local File Inclusion

This is a proof of concept exploiting a local file inclusion vulnerability existing in the Webmail Classic UI of Zimbra Collaboration ZCS versions 10.0 and 10.1. The issue is due to improper handling of user-supplied request parameters in the RestFilter servlet. zimbramail-CVE-2025-68645-poc A...

Exploit for CVE-2025-68645

zimbramail-CVE-2025-68645-poc A proof-of-concept exp...

PT-2026-7644

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 145.0.7632.45 Description A flaw exists in the PictureInPicture functionality of Google Chrome. This issue could allow a remote attacker to perform UI spoofing by convincing a user to interact with a specially...

PT-2026-7642

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 145.0.7632.45 Description A flaw exists in Google Chrome due to insufficient policy enforcement in Frames. This allows a remote attacker to perform UI spoofing using a specially crafted HTML page. The Chromium...

PT-2026-8145

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contained a memory leak in the NFC LLCP Logical Link Control Protocol implementation, specifically within the nfc llcp send ui frame function. The issue stemmed from a...

EUVD-2025-205825

Malicious code in @ptest2535/ui-coremal npm...

MAL-2025-192982 Malicious code in @ptest2535/ui-core_mal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7628a65ea5a9b366c3df0045c4c0a1c8b44ec278dc10792f971ed266fe08ce5a The package @ptest2535/ui-coremal was found to contain malicious code. Source: ghsa-malware...