CVE Watch5 jul 2026

CVE-2026-37470

An issue in ClipBucket v5 v.5.5.2 allows an attacker to execute arbitrary code via the Authentication interface, login page endpoint and HTT

CVSS

7.3

Alto

EPSS

0.3%

p24

KEV

—

Exploit Today

0-100

Publicado: 22 may 2026 · Última mod.: 5 jul 2026 · CWE-1021

EPSS · 30d

0.3%EPSS · 30 días0.3%

2026-06-302026-07-17

Descripción técnica

An issue in ClipBucket v5 v.5.5.2 allows an attacker to execute arbitrary code via the Authentication interface, login page endpoint and HTTP response security headers components

Referencias oficiales

medium.comhttps://medium.com/@arpit03sharma2003/cve-2026-37470-clickjacking-vulnerability-in-clipbucket-v5-leads-to-credential-theft-and-8415def7804a

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2021-416576.1 MED

51.4%

——15SmartBear CodeCollaborator v6.1.6102 was discovered to contain a vulnerability in the web UI which would allow an attacker to conduct a clickjacking attack.9d CVE-2026-585958.1 ALT

37.6%

——11Improper restriction of rendered ui layers or frames in Microsoft Bing App for IOS allows an unauthorized attacker to perform spoofing over a network.1d CVE-2026-409577.5 ALT

23.3%

——7o CVE-2026-40957 is a frameable content vulnerability in the Secure Access server login page prior to 14.55. Attackers with control of a malicious web site could use it to potentially steal credentials from an unwary administrator.1d CVE-2026-447275.4 MED

13.4%

——4Jupyter Server is the backend for Jupyter web applications. Prior to 2.20, the nbconvert HTTP handlers in jupyter_server render user-authored notebook HTML under the Jupyter origin without a sandbox directive in their Content-Security-Policy. Combined with nbconvert.HTMLExporter's default non-sanitizing behavior, a notebook carrying an HTML payload in a display_data output triggers stored XSS with cookie access, full /api/* authority, and kernel RCE. This vulnerability is fixed in 2.20.3d CVE-2026-141104.3 MED

9.4%

——3Inappropriate implementation in DarkMode in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)15d CVE-2026-141425.4 MED

7.0%

——2Inappropriate implementation in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)16d