CVE-2026-44762 | Low | 3.7 | 2026-08-11 | SAP Data Services Management Console allows an overly permissive Content Security Policy (CSP) configuration and lacks certain restrictive directives, which co… |
CVE-2026-70608 | High | 7.2 | 2026-08-05 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.3, and 42.0.1, a sandboxed ifra… |
CVE-2026-70600 | Low | 3.1 | 2026-08-05 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the… |
CVE-2026-70486 | High | 8.2 | 2026-08-04 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, the terminal file-preview serveUrl iframe branch… |
CVE-2026-47723 | | | 2026-07-23 | nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.1, none of the response paths in `internal/web/`… |
CVE-2026-60370 | High | 7.5 | 2026-07-22 | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that a… |
CVE-2026-16397 | Medium | 6.5 | 2026-07-21 | Clickjacking issue in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 153. |
CVE-2026-40957 | High | 7.5 | 2026-07-15 | o
CVE-2026-40957 is a frameable content
vulnerability in the Secure Access server login page prior to 14.55. Attackers
with control of a malicious web site c… |
CVE-2026-58595 | High | 8.1 | 2026-07-14 | Improper restriction of rendered ui layers or frames in Microsoft Bing App for IOS allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-59791 | Low | 3.5 | 2026-07-10 | In JetBrains YouTrack before 2026.2.17012 cSS injection via Mermaid diagram rendering was possible |
CVE-2026-38979 | Medium | 5.4 | 2026-07-06 | ajenti through v2.2.13 has a clickjacking weakness in the browser-facing login and administrative UI. In ajenti-core/aj/http.py, the core HTTP response path in… |
CVE-2026-14142 | Medium | 5.4 | 2026-06-30 | Inappropriate implementation in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perfor… |
CVE-2026-14110 | Medium | 4.3 | 2026-06-30 | Inappropriate implementation in DarkMode in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chr… |
CVE-2026-44727 | Medium | 5.4 | 2026-06-22 | Jupyter Server is the backend for Jupyter web applications. Prior to 2.20, the nbconvert HTTP handlers in jupyter_server render user-authored notebook HTML und… |
CVE-2026-12348 | High | 7.4 | 2026-06-17 | Address bar spoofing in Arc Search for Android allows a remote attacker to display a trusted domain in the address bar while rendering attacker-controlled cont… |
CVE-2026-12323 | Medium | 5.4 | 2026-06-16 | Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 152 and Thunderbird 152. |
CVE-2026-12322 | Medium | 5.4 | 2026-06-16 | Clickjacking issue in the Widget: Gtk component. This vulnerability was fixed in Firefox 152 and Thunderbird 152. |
CVE-2026-10733 | Medium | 4.3 | 2026-06-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.0 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that could have al… |
CVE-2026-28577 | High | 7.8 | 2026-06-01 | In addWindow of WindowManagerService.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. This could lead to local escalation of priv… |
CVE-2026-0061 | Medium | 5.9 | 2026-06-01 | In multiple functions of WindowState.java, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack. This could l… |
CVE-2026-0036 | High | 7.8 | 2026-06-01 | In startAnimation of StageCoordinator.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. This could lead to local escalation of pri… |
CVE-2026-21785 | Medium | 4.0 | 2026-05-27 | A misconfigured Content Security Policy (CSP) in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0442 and earlier) fails to define directives without f… |
CVE-2026-9396 | Low | 3.7 | 2026-05-24 | A security flaw has been discovered in Besen BS20 EV Charging Station up to 20260426. Affected by this vulnerability is an unknown functionality of the compone… |
CVE-2026-37470 | High | 7.3 | 2026-05-22 | An issue in ClipBucket v5 v.5.5.2 allows an attacker to execute arbitrary code via the Authentication interface, login page endpoint and HTTP response security… |
CVE-2026-42502 | Medium | 6.1 | 2026-05-22 | Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications… |
CVE-2026-27136 | Medium | 6.1 | 2026-05-22 | Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications… |
CVE-2026-25681 | Medium | 6.1 | 2026-05-22 | Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications… |
CVE-2025-62316 | Low | 2.3 | 2026-05-14 | HCL AION is affected by a vulnerability where certain security-related HTTP response headers are not properly configured. Absence of these headers may reduce t… |
CVE-2026-28971 | Medium | 4.3 | 2026-05-11 | The issue was addressed with improved UI handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, visionOS 26.5. A malicious i… |
CVE-2026-8022 | Low | 3.1 | 2026-05-06 | Inappropriate implementation in MHTML in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who convinced a user to engage in specific UI gestures… |
CVE-2026-3254 | Low | 3.5 | 2026-04-22 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 18.11.1 that under certain conditions could have allowed an authenticat… |
CVE-2026-2378 | High | 7.4 | 2026-03-20 | ArcSearch for Android versions prior to 1.12.7 could display a different domain in the address bar than the content being shown, enabling address bar spoofing… |
CVE-2025-62328 | Low | 3.7 | 2026-03-11 | HCL Nomad server on Domino did not configure the frame-ancestors directive in the Content-Security-Policy header by default which could allow an attacker to ob… |
CVE-2026-0007 | High | 8.6 | 2026-03-02 | In writeToParcel of WindowInfo.cpp, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack. This could lead to… |
CVE-2025-58405 | Medium | 6.1 | 2026-03-02 | The CGM CLININET application does not implement any mechanisms that prevent clickjacking attacks, neither HTTP security headers nor HTML-based frame‑busting pr… |
CVE-2026-27511 | Medium | 4.3 | 2026-02-23 | Shenzhen Tenda F3 Wireless Router firmware V12.01.01.55_multi contains a clickjacking vulnerability in the web-based administrative interface. The interface do… |
CVE-2026-26000 | Medium | 6.1 | 2026-02-12 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Prior to 17.9.0, 17.4.6, and 16.10.13, it's possible u… |
CVE-2026-20645 | Medium | 4.6 | 2026-02-11 | An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26… |
CVE-2026-24839 | Medium | 4.7 | 2026-01-28 | Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, the Dokploy web interface is vulnerable to Clickjacking attacks due… |
CVE-2026-23731 | Medium | 4.3 | 2026-01-16 | WeGIA is a web manager for charitable institutions. Prior to 3.6.2, The web application is vulnerable to clickjacking attacks. The WeGIA application does not s… |
CVE-2025-15032 | High | 7.4 | 2026-01-16 | Missing about:blank indicator in custom-sized new windows in Dia before 1.9.0 on macOS could allow an attacker to spoof a trusted domain in the window title an… |
CVE-2025-52987 | Medium | 6.1 | 2026-01-15 | A clickjacking vulnerability exists in the web portal of Juniper Networks Paragon Automation (Pathfinder, Planner, Insights) due to the application's failure t… |
CVE-2026-22918 | Medium | 4.3 | 2026-01-15 | An attacker may exploit missing protection against clickjacking by tricking users into performing unintended actions through maliciously crafted web pages, lea… |
CVE-2025-65922 | Medium | 4.3 | 2026-01-05 | PLANKA 2.0.0 lacks X-Frame-Options and CSP frame-ancestors headers, allowing the application to be embedded within malicious iframes. While this does not lead… |
CVE-2025-14812 | High | 7.5 | 2025-12-19 | ArcSearch for iOS versions prior to 1.45.2 could display a different domain in the address bar than the content being shown after an iframe-triggered URI-schem… |
CVE-2025-14809 | High | 7.4 | 2025-12-19 | ArcSearch for Android versions prior to 1.12.6 could display a different domain in the address bar than the content being shown, enabling address bar spoofing… |
CVE-2025-59849 | Medium | 4.7 | 2025-12-17 | Improper management of Content Security Policy in HCL BigFix Remote Control Lite Web Portal (versions 10.1.0.0326 and lower) may allow the execution of malicio… |
CVE-2025-59479 | Medium | 6.1 | 2025-12-16 | CHOCO TEI WATCHER mini (IB-MCT001) contains an issue with improper restriction of rendered UI layers or frames. If a user clicks on content on a malicious web… |
CVE-2025-14373 | Medium | 4.3 | 2025-12-12 | Inappropriate implementation in Toolbar in Google Chrome on Android prior to 143.0.7499.110 allowed a remote attacker to perform domain spoofing via a crafted… |
CVE-2025-48639 | High | 7.3 | 2025-12-08 | In DefaultTransitionHandler.java, there is a possible way to unknowingly grant permissions to an app due to a tapjacking/overlay attack. This could lead to loc… |
CVE-2025-48597 | High | 7.8 | 2025-12-08 | In multiple locations, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack. This could lead to local escalat… |
CVE-2025-63522 | Medium | 4.6 | 2025-12-01 | Reverse Tabnabbing vulnerability in FeehiCMS 2.1.1 in the Comments Management function |
CVE-2025-36149 | Medium | 6.3 | 2025-11-21 | IBM Concert Software 1.0.0 through 2.0.0 could allow a remote attacker to hijack the clicking action of the victim. |
CVE-2025-13132 | High | 7.4 | 2025-11-21 | This vulnerability allowed a site to enter fullscreen, after a user click, without a full-screen notification (toast) appearing. Without this notification, use… |
CVE-2025-0421 | Medium | 4.7 | 2025-11-19 | Improper Restriction of Rendered UI Layers or Frames vulnerability in Shopside Software Technologies Inc. Shopside allows iFrame Overlay.
This issue affects S… |
CVE-2025-64387 | | | 2025-10-31 | The web application is vulnerable to a so-called ‘clickjacking’ attack. In this type of attack, the vulnerable page is inserted into a page controlled by the a… |
CVE-2025-30191 | Medium | 5.4 | 2025-10-31 | Malicious content from E-Mail can be used to perform a redressing attack. Users can be tricked to perform unintended actions or provide sensitive information t… |
CVE-2025-28129 | Medium | 5.4 | 2025-10-06 | Phpgurukul Hostel Management System 2.1 is vulnerable to clickjacking. |
CVE-2025-52658 | Low | 3.5 | 2025-10-03 | HCL MyXalytics is affected by the use of vulnerable/outdated versions which can expose the application to known security risks that could be exploited. |
CVE-2025-59950 | Medium | 6.7 | 2025-09-30 | FreshRSS is a free, self-hostable RSS aggregator. In versions 1.26.3 and below, due to a bypass of double clickjacking protection (confirmation dialog), it is… |
CVE-2025-57769 | Medium | 6.1 | 2025-09-29 | FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below contain a vulnerability where a specially crafted page can trick a user into execut… |
CVE-2025-0546 | Medium | 4.7 | 2025-09-17 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Restriction of Rendered UI Layers or Frames vulnerability… |
CVE-2025-32350 | High | 7.8 | 2025-09-04 | In maybeShowDialog of ControlsSettingsDialogManager.kt, there is a possible overlay of the ControlsSettingsDialog due to a tapjacking/overlay attack. This coul… |
CVE-2025-32349 | High | 7.8 | 2025-09-04 | In multiple locations, there is a possible privilege escalation due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no ad… |
CVE-2024-13066 | Medium | 4.3 | 2025-09-03 | Improper Restriction of Rendered UI Layers or Frames vulnerability in Akinsoft LimonDesk allows iFrame Overlay, CAPEC - 103 - Clickjacking.
This issue affects… |
CVE-2025-41000 | | | 2025-09-03 | Cross-Frame Scripting (XFS) vulnerability in BoomCMS v9.1.4 from UXB London. XFS is a web attack technique that exploits specific browser bugs to spy on users… |
CVE-2025-22419 | High | 7.3 | 2025-09-02 | In multiple locations, there is a possible way to mislead the user into enabling malicious phone calls forwarding due to a tapjacking/overlay attack. This coul… |
CVE-2025-22417 | High | 7.3 | 2025-09-02 | In finishTransition of Transition.java, there is a possible way to bypass touch filtering restrictions due to a tapjacking/overlay attack. This could lead to l… |
CVE-2025-1494 | Medium | 6.1 | 2025-08-26 | IBM Cognos Command Center 10.2.4.1 and 10.2.5 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a mali… |
CVE-2025-9108 | Medium | 4.3 | 2025-08-18 | Affected is an unknown function of the component Login Page. The manipulation leads to improper restriction of rendered ui layers. It is possible to launch the… |
CVE-2025-54527 | Medium | 6.1 | 2025-07-28 | In JetBrains YouTrack before 2025.2.86935,
2025.2.87167,
2025.3.87341,
2025.3.87344 improper iframe configuration in widget sandbox allows popups to bypass… |
CVE-2025-54139 | Medium | 4.3 | 2025-07-23 | HAX CMS allows users to manage their microsite universe with a NodeJS or PHP backend. In haxcms-nodejs versions 11.0.12 and below and in haxcms-php versions 11… |
CVE-2025-7903 | Medium | 4.3 | 2025-07-20 | A vulnerability classified as problematic was found in yangzongzhuan RuoYi up to 4.8.1. Affected by this vulnerability is an unknown functionality of the compo… |
CVE-2025-6983 | | | 2025-07-16 | A
Clickjacking vulnerability in TP-Link Archer C1200 web management page allows an attacker to trick users into performing unintended actions via rendered UI… |
CVE-2025-27455 | Medium | 4.3 | 2025-07-03 | The web application is vulnerable to clickjacking attacks. The site can be embedded into another frame, allowing an attacker to trick a user into clicking on s… |
CVE-2025-53096 | Medium | 5.4 | 2025-07-01 | Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.628.4510, the web UI of Sunshine lacks protection against Clickjacking attacks… |
CVE-2025-36027 | Medium | 5.4 | 2025-06-28 | IBM Datacap 9.1.7, 9.1.8, and 9.1.9
could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious… |
CVE-2025-6557 | Medium | 5.4 | 2025-06-24 | Insufficient data validation in DevTools in Google Chrome on Windows prior to 138.0.7204.49 allowed a remote attacker who convinced a user to engage in specifi… |
CVE-2025-6434 | Medium | 4.3 | 2025-06-24 | The exception page for the HTTPS-Only feature, displayed when a website is opened via HTTP, lacked an anti-clickjacking delay, potentially allowing an attacker… |
CVE-2025-49192 | Medium | 4.3 | 2025-06-12 | The web application is vulnerable to clickjacking attacks. The site can be embedded into another frame, allowing an attacker to trick a user into clicking on s… |
CVE-2025-49191 | Medium | 4.8 | 2025-06-12 | Linked URLs during the creation of iFrame widgets and dashboards are vulnerable to code execution. The URLs get embedded as iFrame widgets, making it possible… |
CVE-2025-49139 | Medium | 5.3 | 2025-06-09 | HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.0, in the HAX site editor, users can create a website blo… |
CVE-2025-5267 | Medium | 5.4 | 2025-05-27 | A clickjacking vulnerability could have been used to trick a user into leaking saved payment card details to a malicious page. This vulnerability was fixed in… |
CVE-2025-43854 | Medium | 6.1 | 2025-04-28 | DIFY is an open-source LLM app development platform. Prior to version 1.3.0, a clickjacking vulnerability was found in the default setup of the DIFY applicatio… |
CVE-2025-32385 | Medium | 5.3 | 2025-04-16 | EspoCRM is an Open Source Customer Relationship Management software. Prior to 9.0.5, Iframe dashlet allows user to display iframes with arbitrary URLs. As the… |
CVE-2025-0362 | Medium | 6.4 | 2025-04-10 | An issue has been discovered in GitLab CE/EE affecting all versions from 7.7 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4. Under certain conditi… |
CVE-2025-25213 | Medium | 6.5 | 2025-04-09 | Improper restriction of rendered UI layers or frames issue exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If a user views and clicks on the content on the malic… |
CVE-2025-31138 | Medium | 5.5 | 2025-04-07 | tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js prior to 1.20.1, where user-controlled inputs… |
CVE-2025-24310 | Medium | 4.3 | 2025-04-04 | Improper restriction of rendered UI layers or frames issue exists in HMI ViewJet C-more series, which may allow a remote unauthenticated attacker to trick the… |
CVE-2025-1923 | Medium | 4.3 | 2025-03-05 | Inappropriate implementation in Permission Prompts in Google Chrome prior to 134.0.6998.35 allowed an attacker who convinced a user to install a malicious exte… |
CVE-2025-1917 | Medium | 4.3 | 2025-03-05 | Inappropriate implementation in Browser UI in Google Chrome on Android prior to 134.0.6998.35 allowed a remote attacker to perform UI spoofing via a crafted HT… |
CVE-2025-1940 | High | 7.1 | 2025-03-04 | A select option could partially obscure the confirmation prompt shown before launching external apps. This could be used to trick a user in to launching an ext… |
CVE-2025-24874 | Medium | 6.8 | 2025-02-11 | SAP Commerce (Backoffice) uses the deprecated X-FRAME-OPTIONS header to protect against clickjacking. While this protection remains effective now, it may not b… |
CVE-2024-49796 | Medium | 5.4 | 2025-02-06 | IBM ApplinX 11.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote atta… |
CVE-2025-1019 | Medium | 4.3 | 2025-02-04 | The z-order of the browser windows could be manipulated to hide the fullscreen notification. This could potentially be leveraged to perform a spoofing attack… |
CVE-2025-1018 | Medium | 5.3 | 2025-02-04 | The fullscreen notification is prematurely hidden when fullscreen is re-requested quickly by the user. This could have been leveraged to perform a potential sp… |
CVE-2024-6466 | Medium | 5.3 | 2025-01-21 | NEC Corporation's WebSAM DeploymentManager v6.0 to v6.80 allows an attacker to reset configurations or restart products via network with X-FRAME-OPTIONS is not… |
CVE-2024-57369 | Medium | 6.4 | 2025-01-17 | Clickjacking vulnerability in typecho v1.2.1. |
CVE-2024-56436 | Medium | 5.5 | 2025-01-08 | Cross-process screen stack vulnerability in the UIExtension module
Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-56435 | Medium | 6.2 | 2025-01-08 | Cross-process screen stack vulnerability in the UIExtension module
Impact: Successful exploitation of this vulnerability may affect service confidentiality. |