CVE-2025-64063

Primakon Pi Portal 1.0.18 API endpoints fail to enforce sufficient authorization checks when processing requests. Specifically, a standard user can exploit this flaw by sending direct HTTP requests to administrative endpoints, bypassing the UI restrictions. This allows the attacker to manipulate...

CVE-2025-33203

NVIDIA NeMo Agent Toolkit UI for Web contains a vulnerability in the chat API endpoint where an attacker may cause a Server-Side Request Forgery. A successful exploit of this vulnerability may lead to information disclosure and denial of service...

CVE-2025-13132

A flaw was found in dia. This vulnerability allows users to be misled about the current site via a malicious site rendering a fake user interface UI without a full-screen notification...

CVE-2025-13502

A flaw was found in WebKitGTK and WPE WebKit. This vulnerability allows an out-of-bounds read and integer underflow, leading to a UIProcess crash DoS via a crafted payload to the GLib remote inspector server...

EUVD-2025-199496

Malicious code in @huntersofbook/ui npm...

pcs security update

0.11.10-1.el97.1 - Fixed CVE-2025-59830, CVE-2025-61770, CVE-2025-61771, CVE-2025-61772, CVE-2025-61919 by updating bundled rubygem rack Resolves: RHEL-120945, RHEL-121035, RHEL-123630, RHEL-123642, RHEL-124938 0.11.10-1 - Rebased pcs to the latest sources see CHANGELOG.md Resolves: RHEL-77194,...

Mozilla Firefox Information Disclosure

The vulnerability of Mozilla Firefox and Firefox ESR browsers is related to errors in information representation by the user interface. Exploiting this vulnerability can allow a remote attacker to perform spear-phishing attacks...

Mozilla Firefox Focus UI Compromise

The vulnerability of Mozilla Firefox and Firefox Focus user interfaces is related to errors in information representation by the user interface. Exploiting this vulnerability can allow an attacker to compromise the confidentiality and integrity of the protected information...

EUVD-2025-198553

Malicious code in snapchat-ui npm...

EUVD-2025-198554

Malicious code in linkedin-ui npm...

CVE-2025-13132

This vulnerability allowed a site to enter fullscreen, after a user click, without a full-screen notification toast appearing. Without this notification, users could potentially be misled about what site they were on if a malicious site renders a fake UI like a fake address bar...

CVE-2025-13132 Dia: Increased Spoof Risk; Missing full screen toast

This vulnerability allowed a site to enter fullscreen, after a user click, without a full-screen notification toast appearing. Without this notification, users could potentially be misled about what site they were on if a malicious site renders a fake UI like a fake address bar...

CVE-2025-13132 Dia: Increased Spoof Risk; Missing full screen toast

This vulnerability allowed a site to enter fullscreen, after a user click, without a full-screen notification toast appearing. Without this notification, users could potentially be misled about what site they were on if a malicious site renders a fake UI like a fake address bar...

CVE-2025-13132

CVE-2025-13132 affects the "dia" browser (Red Hat/Dia references) where a flaw allows entering fullscreen after a user click without showing the fullscreen notification toast. This could let a malicious site spoof the UI (e.g., fake address bar). Root cause: lack of fullscreen notification. Impac...

PT-2025-47790

Name of the Vulnerable Software and Affected Versions Web Browser affected versions not specified Description A flaw exists that permits a website to initiate fullscreen mode following a user click without displaying a fullscreen notification. This absence of notification could mislead users...

CVE-2025-36153

IBM Concert 1.0.0 through 2.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2025-0421

Improper Restriction of Rendered UI Layers or Frames vulnerability in Shopside Software Technologies Inc. Shopside allows iFrame Overlay.This issue affects Shopside: through 05022025...

CVE-2025-36153 IBM Concert Cross-Site Scripting

IBM Concert 1.0.0 through 2.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2025-36153

CVE-2025-36153 affects IBM Concert Software versions 1.0.0–2.0.0. The vulnerability is a cross-site scripting flaw caused by insufficient input filtering/escaping of user-supplied data, allowing an unauthenticated attacker to inject arbitrary JavaScript into the Web UI and potentially disclose cr...

CVE-2025-55127

HackerOne community member Dao Hoang Anh yoyomiski has reported an improper neutralization of whitespace in the username when adding new users. A username with leading or trailing whitespace could be virtually indistinguishable from its legitimate counterpart when the username is displayed in the...