8695 matches found
PT-2026-66214
Inappropriate implementation in DataTransfer in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...
PT-2026-66154
Name of the Vulnerable Software and Affected Versions Google Chrome on iOS versions prior to 151.0.7922.72 Description An inappropriate implementation in Chrome for iOS allows a remote attacker to perform UI spoofing, which is the act of mimicking a legitimate user interface to deceive users, by...
PT-2026-66147
Name of the Vulnerable Software and Affected Versions Google Chrome on iOS versions prior to 151.0.7922.72 Description An inappropriate implementation in Chrome for iOS allows a remote attacker to perform UI spoofing, which is the act of mimicking a legitimate user interface to deceive users, by...
PT-2026-66112
Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 151.0.7922.72 Description An inappropriate implementation in the Messages component allows a remote attacker to perform UI spoofing, which is the act of mimicking a legitimate user interface to deceiv...
Linux Distros Unpatched Vulnerability : CVE-2026-17888
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient validation of untrusted input in WebUI in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape vi...
Send and Pretend: Exploiting Transcript Consistency Issues in End-To-End Encrypted Group Chats
End-to-end encrypted E2EE messaging apps are widely praised for their security and thus also used for sensitive coordination in group chats e.g., by political decision makers. After Threema and WhatsApp, also Signal and iMessage have recently introduced polls to aid agreement processes in groups...
CVE-2026-49258
Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN. In versions 0.3.5 and below, the web UI /ui/ does not apply the per-operator CA scoping employed by the JSON API. This was partially addressed by GHSA-598g-h2vc-h5vg, but the changes were not implemented in the web...
CVE-2026-49258 Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete)
Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN. In versions 0.3.5 and below, the web UI /ui/ does not apply the per-operator CA scoping employed by the JSON API. This was partially addressed by GHSA-598g-h2vc-h5vg, but the changes were not implemented in the web...
EUVD-2026-49992
Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN. In versions 0.3.5 and below, the web UI /ui/ does not apply the per-operator CA scoping employed by the JSON API. This was partially addressed by GHSA-598g-h2vc-h5vg, but the changes were not implemented in the web...
CVE-2026-47725 nebula-mesh: Web UI lacks CSRF tokens on /ui/* mutating endpoints
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.3, every /ui/ POST / PUT / PATCH / DELETE route processes the request as soon as the session cookie validates. SameSite=Lax on the session cookie prevents most cross-site form submits bu...
CVE-2026-47725
Summary (CVE-2026-47725) Nebula-mesh web UI lacked CSRF protection on all /ui/* mutating endpoints (POST/PUT/PATCH/DELETE) prior to v0.3.3. A session-cookie/Lax-SameSite boundary and third-party page triggers (including a forced GET /ui/logout via an image tag) enable potential privilege escalati...
CVE-2026-7775
IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.6, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.6, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 is vulnerable to stored cross-site scripting. This vulnerability allows a...
CVE-2026-7775 Cross-site Scripting Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway
IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.6, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.6, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 is vulnerable to stored cross-site scripting. This vulnerability allows a...
CVE-2026-13842
An incorrect security ui flaw was found in the Chrome for iOS component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=516836297...
CVE-2026-13912
An incorrect security ui flaw was found in the Safe Browsing component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=508259433...
CVE-2026-13982
An incorrect security ui flaw was found in the Passwords component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=514006829...
CVE-2026-13969
An uninitialized use flaw was found in the UI component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=513762962...
CVE-2026-13980
An incorrect security ui flaw was found in the Chrome for iOS component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=513989973...