Malicious code in dolyame-ui-contenteditable (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9eaf7524b69f412cf3ba4a466c4b9ade04fcaafd989fd3ff0d437e0a3ec941d0 On require of the package, index.js unconditionally loads./compat.js, which reassembles three attacker-controlled Cloudflare Workers hostnames...

Malicious code in dolyame-ui-inputcard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f197253949137705611984d7012281b6056c4dbfb7bf4931445e06ab68ee304 On require of the package, shim.js and lib/telemetry.js disguised as a Sentry-style APM SDK select a platform-specific asset, fetch an opaque binary...

MAL-2026-13558 Malicious code in dolyame-ui-clickoutsidehoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f51c89bb293b46f81970bb75e1d39616abb2244683d83bbc03dcd60f7f5e4e57 On require of this package, index.js loads shim.js which assembles hostnames from split string fragments to hide them e.g...

MAL-2026-13510 Malicious code in dolyame-ui-progresscircle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 248909eca58bc4f747cced81acc6919e90204bf5f5e1b65417a9fe230dfa3f4d The package's main entry unconditionally loads ext.js, which on require/import downloads a platform-specific executable over HTTPS from hardcoded...

Malicious code in dolyame-ui-stateutils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cdcb488491701865d9106e75e576785ff3b4f1d9687e456eb69f1ff69d8a393f On require/import, index.js loads loader.js which fetches an opaque platform-specific binary from one of three obfuscated Cloudflare Workers endpoint...

EUVD-2026-54127

Use after free in Views in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

EUVD-2026-54114

Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

PT-2026-69056

Name of the Vulnerable Software and Affected Versions Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x Description An incorrect authorization issue exists in the repository-creation user interface. A user account with delegated repository-admin privileges for a specific repository format c...

DEBIAN-CVE-2026-19177

Insufficient validation of untrusted input in UI in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

CVE-2026-19158

Use after free in Views in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2026-19177

Google Chrome (and Chromium-based browsers such as Microsoft Edge ) are affected by CVE-2026-19177 , which involves insufficient validation of untrusted input in the UI . A remote attacker who has already compromised the renderer process can exploit this to potentially perform a sandbox escape us...

CVE-2026-19177

Insufficient validation of untrusted input in UI in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

CVE-2026-19142

Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

MAL-2026-13416 Malicious code in @bananacool467/ui-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8497bfe55fd379ac7c87c73e99e8c532193a17516996d9ae6cfb856b84a052a The package advertises itself as a UI-components library README compares it to MUI, but its main export surface includes useTerminal, a server-side...

KLA91193 Multiple vulnerabilities in Microsoft Office

Multiple vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to execute arbitrary code, gain privileges, spoof user interface. Below is a complete list of vulnerabilities: 1. A remote code execution vulnerability in Azure Service Bus can be exploited...

Views Component Spear Phishing

The vulnerability of the Views component in Google Chrome and Microsoft Edge is related to information representation errors in the user interface. Exploiting this vulnerability can allow an attacker to perform spear-phishing attacks remotely...

CVE-2026-20311 Cisco IOS XE Software Web UI Denial of Service Vulnerability

A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, remote attacker with low privileges to cause a denial of service DoS condition on an affected device. This vulnerability is due to insufficient error handling in the web-based management...

GHSA-X8RC-WPG4-GRPF Electron: Cross-origin iframe can position native autofill popup

Impact The native autofill popup could be positioned by a cross-origin iframe outside that iframe's bounds, over the embedding page's UI, enabling clickjacking or spoofing of trusted UI. Apps are only affected if they embed untrusted content in iframes within windows that also display trusted UI...

Electron: Cross-origin iframe can position native autofill popup

Impact The native autofill popup could be positioned by a cross-origin iframe outside that iframe's bounds, over the embedding page's UI, enabling clickjacking or spoofing of trusted UI. Apps are only affected if they embed untrusted content in iframes within windows that also display trusted UI...

CVE-2026-70600 Electron: Cross-origin iframe can position native autofill popup

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the native autofill popup could be positioned by a cross-origin iframe outside that iframe's bounds, over the embedding page's UI, enabling...