CVE-2026-113063
Clickjacking in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI eleme
CVSS
8.8
Alta
EPSS
0.3%
p25
KEV
—
Exploit Today
7
0-100
Publicado: 20 de out. de 2026 · Última mod.: 3 de nov. de 2026 · CWE-1021
0.3%EPSS · 30 dias0.4%
2026-10-212026-11-07
Clickjacking in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements via crafted network traffic. (Chromium security severity: Low)
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1235294.6 MÉD—
———Vikunja before 2.7.1 contains a stored CSS injection vulnerability that allows authenticated users with project write access to inject arbitrary CSS via unsanitized table-cell data-background-color attributes. Attackers can store crafted task descriptions or comments to render full-viewport phishing overlays or force zero-click outbound background-image requests that deanonymize viewers.9hCVE-2026-1238503.5 BAI11.0%
——3In JetBrains YouTrack before 2026.2.19422 cSS injection was possible in Mermaid diagrams via configuration directives2dCVE-2026-218343.1 BAI4.4%
——1HCL AION is affected by a vulnerability where the Content-Security-Policy (CSP) security response header was missing from application responses. Without this header, the browser does not restrict the sources of scripts and other content, increasing exposure to cross-site scripting and content-injection attacks, potentially resulting in unintended behavior or security impact under certain conditions.2dCVE-2026-1233115.3 MÉD3.4%
——1In JetBrains IntelliJ IDEA before 2026.3,
2026.2.4 command execution via a hidden run control in the Markdown preview was possible1dCVE-2026-181594.3 MÉD10.3%
——3A vulnerability in OpenText OpenText Directory Services (OTDS) on Windows and Linux allows Clickjacking.
This issue affects OpenText Directory Services (OTDS): from 10.5 through 26.2.2dCVE-2026-1085364.6 MÉD5.0%
——1IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to improper restriction of rendered UI layers or frames.4d