CVE-2026-39039

In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token, full user object, and session ID in the browser's localStorage, which is fully accessible to any JavaScript running on the page...

CVE-2026-73942: Improper Access Control

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware component: OIM Legacy UI. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity...

EUVD-2026-78941

In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token, full user object, and session ID in the browser's localStorage, which is fully accessible to any JavaScript running on the page...

CVE-2026-39039: Improper Neutralization of Input During Web Page Generation

In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token, full user object, and session ID in the browser's localStorage, which is fully accessible to any JavaScript running on the page...

PT-2026-92063

crawl4ai versions before 0.9.3 contain a DOM-based cross-site scripting vulnerability in the Playground UI where the forceHighlightElement function assigns textContent back to innerHTML, re-parsing JSON responses as HTML. Attackers can inject malicious scripts through crawled page content like th...

CVE-2026-39038

BharatMLStack version v1.3.0 and below is vulnerable to a Cross Site Scripting (XSS) vulnerability. The flaw exists within the trufflebox-ui component, specifically in the GenericNumerixTable.jsx file. Exploitation of this vulnerability could allow an attacker to execute malicious scripts in the ...

ROS-20260915-73-0188

The vulnerability of the File Input component in Google Chrome and Microsoft Edge is related to the user interface’s false representation of critical information. Exploiting this vulnerability allows a malicious actor to compromise data integrity through a specially created HTML page...

CVE-2026-83042: Improper Authentication

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware component: OIM Legacy UI. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identit...

ROS-20260915-73-0185

The vulnerability of the SplitView component in Google Chrome and Microsoft Edge relates to the improper presentation of critical information to the user interface. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

CVE-2026-12749: Improper Neutralization of Input During Web Page Generation

IBM Cloud Pak for Business Automation is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2026-39038

BharatMLStack up to and including v1.3.0 is vulnerable to Cross Site Scripting XSS in the component Trufflebox UI trufflebox-ui in GenericNumerixTable.jsx...

CVE-2026-39039

In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token, full user object, and session ID in the browser's localStorage, which is fully accessible to any JavaScript running on the page...

CVE-2026-39038: Improper Neutralization of Input During Web Page Generation

BharatMLStack up to and including v1.3.0 is vulnerable to Cross Site Scripting XSS in the component Trufflebox UI trufflebox-ui in GenericNumerixTable.jsx...

CVE-2026-73943: Improper Access Control

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware component: OIM Legacy UI. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Identit...

ROS-20260915-73-0197

The vulnerability of the Isolated Web Apps component in Google Chrome and Microsoft Edge relates to the user interface’s false representation of critical information. Exploiting this vulnerability allows a malicious actor to compromise data integrity through a specially created HTML page...

PT-2026-93141

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.47 Description A race condition in WebAppInstalls allows a remote attacker to spoof UI elements by using a crafted HTML page. A race condition occurs when the timing or sequence of events is unplanned...

CVE-2026-39040

BharatMLStack versions up to and including 1.3.0 are vulnerable to Cross Site Scripting (XSS) . The flaw exists within the Trufflebox UI (trufflebox-ui) component, specifically in the ExpressionViewModal.jsx file. This vulnerability is characterized as an improper neutralization of input during w...

CVE-2026-91944: Improper Neutralization of Input During Web Page Generation

crawl4ai versions before 0.9.3 contain a DOM-based cross-site scripting vulnerability in the Playground UI where the forceHighlightElement function assigns textContent back to innerHTML, re-parsing JSON responses as HTML. Attackers can inject malicious scripts through crawled page content like th...

CVE-2026-92069: User Interface (UI) Misrepresentation of Critical Information

Spoofing issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3...

CVE-2026-91942: Improper Neutralization of Input During Web Page Generation

crawl4ai before 0.9.3 contains a DOM-based cross-site scripting vulnerability in the Docker Playground UI that assigns untrusted crawl results to element.innerHTML. Attackers can craft malicious PDFs with event-handler markup to execute JavaScript in the Playground origin and steal API tokens fro...