CVE Watch29 sept 2026

CVE-2026-102674

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, an

CVSS

8.2

Alto

EPSS

—

KEV

—

Exploit Today

0-100

Publicado: 29 sept 2026 · Última mod.: 29 sept 2026 · CWE-266 · CWE-693

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, windows opened from a sandboxed top-level document did not inherit that document's active HTML sandbox restrictions. Untrusted content in a sandboxed top-level document that was permitted to open popups could therefore create a window with the Electron application's full origin instead of the restricted origin intended by the sandbox. Applications that deny such popups with setWindowOpenHandler are not affected. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-972457.2 ALT

—

———Shop Worker Privilege Escalation in SureCart <= 4.7.2 versions.3h CVE-2026-968216.3 MED

—

———Subscriber Privilege Escalation in FluentBoards <= 2.0.12 versions.3h CVE-2026-968157.2 ALT

—

———Custom role Privilege Escalation in Vitepos <= 3.5.0 versions.3h CVE-2026-963509.8 CRÍ

—

———Subscriber Privilege Escalation in Estatik <= 4.3.5 versions.3h CVE-2026-941787.5 ALT

—

———Subscriber Privilege Escalation in Import and export users and customers <= 2.5.2 versions.3h CVE-2026-1028464.7 MED

—

———A vulnerability was detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Impacted is the function sistem.php::simpan of the file application/modules/admin/controllers/sistem.php of the component Configuration Handler. The manipulation of the argument tipe/title/content_setting results in improper authorization. The attack may be launched remotely. The exploit is now public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.3h