PT-2026-35402

Calling a function that triggers a UI refresh after removing comments via a script may access an invalidated object, leading to program crashes...

PT-2026-36922

Name of the Vulnerable Software and Affected Versions Nginx UI version 2.3.5 Description Nginx UI, a web user interface for the Nginx web server, contains a flaw allowing an unauthenticated bootstrap takeover. This occurs during the initial installation window via the 'POST /api/install' endpoint...

Foxit PDF Reader和Foxit PDF Editor 资源管理错误漏洞

Foxit PDF Reader and Foxit PDF Editor are products of Foxit Corporation, a Chinese company. Foxit PDF Reader is a PDF reader. Foxit PDF Editor is a PDF editor. Both Foxit PDF Reader and Foxit PDF Editor have a resource management vulnerability. This vulnerability arises from calling a function th...

CVE-2026-30351

CVE-2026-30351 describes a path traversal vulnerability in the UI/static component of the LeonVanzyl Autocoder project, specifically at commit 79d02a. An attacker can read arbitrary files by sending crafted URL paths that include traversal sequences. The NVD entry lists a CVSS v3.1 base score of ...

EUVD-2026-25862

A path traversal vulnerability in the UI/static component of leonvanzyl autocoder commit 79d02a allows attackers to read arbitrary files via sending crafted URL path containing traversal sequences...

GHSA-GJ49-89WH-H4GJ vulnerabilities

Vulnerabilities for packages: kubescape, kubescape-operator, hubble-ui...

pcs security update

0.11.10-1.el97.3 - Fixed CVE-2026-4800 by updating pcs-web-ui to 0.1.23.2 Resolves: RHEL-164191...

MAL-2026-3036 Malicious code in uipath-ui-widgets (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa9d3ca9b9ac28cb9fe47c84a695d8905ac59aacc352dfe23dfe6bf85464c481 The package uipath-ui-widgets was found to contain malicious code. Source: ghsa-malware...

Malicious code in uipath-ui-widgets (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa9d3ca9b9ac28cb9fe47c84a695d8905ac59aacc352dfe23dfe6bf85464c481 The package uipath-ui-widgets was found to contain malicious code. Source: ghsa-malware...

Malicious code in kl-b2c-ui-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e32dd1450d1b5670388a4fbf71a7189cff326aa1c7734ee6ea1c89614438c516 The package kl-b2c-ui-kit was found to contain malicious code. Source: ghsa-malware c42673f7cabe65ad288149a7f75426fea7054327c8f73ac59d07e6b60a64b3db...

MAL-2026-3082 Malicious code in kl-b2c-ui-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e32dd1450d1b5670388a4fbf71a7189cff326aa1c7734ee6ea1c89614438c516 The package kl-b2c-ui-kit was found to contain malicious code. Source: ghsa-malware c42673f7cabe65ad288149a7f75426fea7054327c8f73ac59d07e6b60a64b3db...

MAL-2026-3079 Malicious code in axis-ui-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 898e7e6953d0a1f5efd906c36d9a6c798f0dce58017ac54df6e1b09bd26dd6d1 The package axis-ui-generator was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in axis-ui-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 898e7e6953d0a1f5efd906c36d9a6c798f0dce58017ac54df6e1b09bd26dd6d1 The package axis-ui-generator was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in @tochka-ui/foundation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9575f5fa03036022a473218e67ec437c95aa1e3c0768e1006762695c772705c8 The package @tochka-ui/foundation was found to contain malicious code. Source: ghsa-malware...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the Team API endpoints due to improper authorization checks in the TeamController process. An attacker can gain unauthorized access to modify any team's membership, customer assignments, project assignments, and...

Insufficient Granularity of Access Control

Overview Affected versions of this package are vulnerable to Insufficient Granularity of Access Control in the /ui/dags endpoint, which fails to enforce per-DAG access control on embedded Human-in-the-Loop HITL and TaskInstance records. An attacker can access sensitive HITL prompts and TaskInstan...

Malicious Package

Overview auth0-ui-components-docs is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

MAL-2026-3024 Malicious code in auth0-ui-components-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e0d97624d1290690782d9c5e369ea2df5642da13ce61f091ea686ff4af38ce1 The package auth0-ui-components-docs was found to contain malicious code. Source: ghsa-malware...

CVE-2026-41335 OpenClaw < 2026.3.31 - Information Disclosure via Control UI Bootstrap JSON

OpenClaw before 2026.3.31 contains an information disclosure vulnerability in the Control Interface bootstrap JSON that exposes version and assistant agent identifiers. Attackers can extract sensitive fingerprinting information from the Control UI bootstrap payload to identify system versions and...

EUVD-2026-25277

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, The CSVAgent allows providing a custom Pandas CSV read code. Due to lack of sanitization, an attacker can provide a command injection payload that will get interpolated and executed by the...