CVE-2026-102236
Improper restriction of rendered ui layers or frames in Visual Studio Code allows an unauthorized attacker to bypass a security feature loca
CVSS
8.6
High
EPSS
—
KEV
—
Exploit Today
0
0-100
Published: Nov 10, 2026 · Last modified: Nov 10, 2026 · CWE-1021
Not enough EPSS history yet.
Improper restriction of rendered ui layers or frames in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-181942.5 LOW1.2%
——0IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to perform unauthorized actions due to missing anti-clickjacking controls.6hCVE-2026-1235294.6 MED4.6%
——1Vikunja before 2.7.1 contains a stored CSS injection vulnerability that allows authenticated users with project write access to inject arbitrary CSS via unsanitized table-cell data-background-color attributes. Attackers can store crafted task descriptions or comments to render full-viewport phishing overlays or force zero-click outbound background-image requests that deanonymize viewers.4hCVE-2026-1238503.5 LOW11.0%
——3In JetBrains YouTrack before 2026.2.19422 cSS injection was possible in Mermaid diagrams via configuration directives4dCVE-2026-218343.1 LOW4.4%
——1HCL AION is affected by a vulnerability where the Content-Security-Policy (CSP) security response header was missing from application responses. Without this header, the browser does not restrict the sources of scripts and other content, increasing exposure to cross-site scripting and content-injection attacks, potentially resulting in unintended behavior or security impact under certain conditions.7hCVE-2026-1233115.3 MED3.5%
——1In JetBrains IntelliJ IDEA before 2026.3,
2026.2.4 command execution via a hidden run control in the Markdown preview was possible3hCVE-2026-181594.3 MED10.3%
——3A vulnerability in OpenText OpenText Directory Services (OTDS) on Windows and Linux allows Clickjacking.
This issue affects OpenText Directory Services (OTDS): from 10.5 through 26.2.4d