Base de CVEs

CVE-2026-108901 Baixa · 3.5 CWE-1021 12/10/2026

Shenzhen HCC Technology MPOS M6 PLUS Display QR Code Rendering ui layer

A vulnerability was found in Shenzhen HCC Technology MPOS M6 PLUS 1.31-N. Affected by this vulnerability is an unknown functionality of the component Display QR Code Rendering. Performing a manipulation of the argument alignment results in improper restriction of rendered ui layers. The attack can only be performed from the local network. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-106400 Média · 5.4 CWE-1021 06/10/2026

Clickjacking em Google Chrome

Clickjacking in Messages in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-106356 Média · 5.4 CWE-1021 06/10/2026

Clickjacking in EVP in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging...

Clickjacking in EVP in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-106311 Média · 5.4 CWE-1021 06/10/2026

Clickjacking em Google Chrome

Clickjacking in PermissionElement in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-71177 Média · 5.4 CWE-1021 23/09/2026

Clickjacking em Dell Policy Manager For Secure Connect Gateway

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Restriction of Rendered UI Layers or Frames vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges and Session theft.

CVE-2026-84388 Crítica · 9.6 CWE-1021 22/09/2026

Clickjacking em Fortinet FortiPAM Chrome Extension

A improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome Extension 8.0 all versions, FortiPAM Chrome Extension 7.4 all versions may allow attacker to information disclosure via remote unauthenticated attack

CVE-2026-86911 Média · 5.5 CWE-1021 14/09/2026

Clickjacking em Apple Macos

This issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. A malicious app may be able to bypass clickjacking protections for secure prompts.

CVE-2026-43688 Alta · 7.8 CWE-1021 14/09/2026

Clickjacking em Apple Ipados

A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. Processing a maliciously crafted file may lead to unexpected app termination.

CVE-2026-87655 Média · 5.4 CWE-1021 08/09/2026

Clickjacking em Google Chrome

Clickjacking in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87538 Média · 4.2 CWE-1021 08/09/2026

Clickjacking em Google Chrome

Clickjacking in Input in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-87486 Média · 4.0 CWE-1021 08/09/2026

Clickjacking em Google Chrome

Clickjacking in TrustedWebActivities in Google Chrome on on Android prior to 153.0.8010.36 allowed a local attacker to spoof address bar via a co-installed app. (Chromium security severity: Medium)

CVE-2026-28656 Alta · 7.3 CWE-1021 08/09/2026

Clickjacking em Google Android

In multiple functions of DeviceAdminAdd.java, there is a possible way to an overlay due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

CVE-2026-84139 Média · 6.1 CWE-1021 01/09/2026

Clickjacking issue in the DOM: Events component

Clickjacking issue in the DOM: Events component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

CVE-2026-75548 Média · 5.4 CWE-1021 27/08/2026

Ebyte NA111-M Improper Restriction of Rendered UI Layers or Frames

The affected Ebyte device web management interface does not restrict the interface from being rendered within an external frame. An unauthenticated remote attacker could use a crafted webpage to mislead an authenticated administrator into initiating unintended configuration changes or disruptive actions.

CVE-2026-18534 Alta · 7.4 CWE-1021 18/08/2026

Address bar spoofing risk in affected iOS versions of Arc Search

ArcSearch for iOS versions prior to 1.48.0 could keep the address bar hidden after a page-initiated scroll, allowing attacker-controlled content to imitate browser interface elements and increasing spoofing risk.

CVE-2026-74980 Média · 6.5 CWE-1021 18/08/2026

Clickjacking issue in the Downloads component in Firefox for Android

Clickjacking issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154.

CVE-2026-74978 Alta · 8.1 CWE-1021 18/08/2026

Clickjacking issue in the Widget component

Clickjacking issue in the Widget component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

CVE-2026-74958 Alta · 7.5 CWE-1021 18/08/2026

Information disclosure in the WebRTC component

Information disclosure in the WebRTC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

CVE-2026-74951 Média · 6.5 CWE-1021 18/08/2026

Clickjacking issue in Firefox for Android

Clickjacking issue in Firefox for Android. This vulnerability was fixed in Firefox 154.

CVE-2026-44762 Baixa · 3.7 CWE-1021 10/08/2026

Security Misconfiguration in SAP Data Services Management Console

SAP Data Services Management Console allows an overly permissive Content Security Policy (CSP) configuration and lacks certain restrictive directives, which could enable an authenticated malicious user to leverage this weakness in combination with another vulnerability to inject and execute malicious scripts within the application's context. Successful exploitation may result in a low impact on confidentiality and integrity, with no impact on the availability of the application.

CVE-2026-70600 Média · 4.3 CWE-1021 05/08/2026

Electron: Cross-origin iframe can position native autofill popup

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the native autofill popup could be positioned by a cross-origin iframe outside that iframe's bounds, over the embedding page's UI, enabling clickjacking or spoofing of trusted UI. Apps are only affected if they embed untrusted content in iframes within windows that also display trusted UI. Apps that do not embed untrusted third-party content are not affected. This issue is fixed in versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.

CVE-2026-47723 Alta · 7.1 CWE-1021 23/07/2026

nebula-mesh: Web UI and API responses lack security headers (CSP, X-Frame-Options, HSTS, etc.)

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.1, none of the response paths in `internal/web/` or `internal/api/` set the standard browser-security headers. `grep` for `Content-Security-Policy`, `X-Frame-Options`, `Strict-Transport-Security`, `X-Content-Type-Options`, `Referrer-Policy` returns zero matches across the codebase. Version 0.3.1 fixes the issue.

CVE-2026-60370 Alta · 7.5 CWE-1021 22/07/2026

Clickjacking em Oracle Platform Security For Java

Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVE-2026-16397 Média · 6.5 CWE-1021 21/07/2026

Clickjacking issue in the WebExtensions component in Firefox for Android

Clickjacking issue in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 153.

CVE-2026-40957 Alta · 7.5 CWE-1021 15/07/2026

Frameable content vulnerability in the Secure Access server login page

o CVE-2026-40957 is a frameable content vulnerability in the Secure Access server login page prior to 14.55. Attackers with control of a malicious web site could use it to potentially steal credentials from an unwary administrator.