# CWE-1021.

Every Advisory and CVE whose sources give the weakness CWE-1021, newest first.

## Records, newest first

- [Clickjacking in OpenText Directory Services (OTDS)](https://agentprime.io/advisories/CVE-2026-18159.md)
  `CVE-2026-18159` · CVE record: OpenText OpenText Directory Services (OTDS) · CVSS 5.3 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: CWE-1021
- [Multiple vulnerabilities that affects IBM Db2 Genius Hub](https://agentprime.io/advisories/CVE-2026-108536.md)
  `CVE-2026-108536` · CVE record: IBM Db2 Genius Hub · CVSS 4.6 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: CWE-1021
- [Clickjacking vulnerability in the Alosuite web application.](https://agentprime.io/advisories/CVE-2026-108049.md)
  `CVE-2026-108049` · CVE record: AM System ALO Suite · CVSS 5.1 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-1021
- [NocoDB before 2026.08.0 Clickjacking via Missing Frame-Control Headers](https://agentprime.io/advisories/CVE-2026-119715.md)
  `CVE-2026-119715` · CVE record: nocodb nocodb · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-1021
- [Microsoft Edge (Chromium-based) Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2026-20942.md)
  `CVE-2026-20942` · CVE record: Microsoft Microsoft Edge (Chromium-based) · CVSS 4.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-1021
- [HCL BigFix AEX is affected by multiple security vulnerabilities.](https://agentprime.io/advisories/CVE-2026-67079.md)
  `CVE-2026-67079` · CVE record: HCL Software BigFix AEX · CVSS 6.4 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-1021
- [Clickjacking in boneIO](https://agentprime.io/advisories/CVE-2026-77062.md)
  `CVE-2026-77062` · CVE record: boneIO boneIO · CVSS 6.9 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: CWE-1021
- [Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites](https://agentprime.io/advisories/GHSA-f2ph-cmg5-wxc8.md)
  `GHSA-f2ph-cmg5-wxc8`, `CVE-2026-114125` · npm `storybook` and 5 more: affected `>=8.0.0, <8.6.19 || >=9.0.0, <9.1.21 || >=10.0.0, <10.6.2 || >=11.0.0-alpha.0, <11.0.0-alpha.6`, fixed in `8.6.19`, `9.1.21`, `10.6.2`, `11.0.0-alpha.6` · CVSS 8.6 High · Not analysed yet · Published 21 Oct 2026 · Tags: Path traversal, Code injection, Broken access control, CWE-346
- [Clickjacking in Google Chrome](https://agentprime.io/advisories/CVE-2026-113063.md)
  `CVE-2026-113063` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-1021
- [Gitea Jupyter notebook UI redress through CSS class injection](https://agentprime.io/advisories/CVE-2026-60008.md)
  `CVE-2026-60008` · CVE record: Gitea Gitea · CVSS 3.5 Low · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS), CWE-1021
- [Open WebUI 0.11.1 before 0.11.4 Stored XSS via DOCX Preview](https://agentprime.io/advisories/CVE-2026-109290.md)
  `CVE-2026-109290` · CVE record: open-webui open-webui · CVSS 8.4 High · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS), CWE-1021
- [Shenzhen HCC Technology MPOS M6 PLUS Display QR Code Rendering ui layer](https://agentprime.io/advisories/CVE-2026-108901.md)
  `CVE-2026-108901` · CVE record: Shenzhen HCC Technology MPOS M6 PLUS · CVSS 5.1 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: CWE-1021
- [Clickjacking in Google Chrome](https://agentprime.io/advisories/CVE-2026-106400.md)
  `CVE-2026-106400` · CVE record: Google Chrome · CVSS 5.4 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-1021
- [Clickjacking in Google Chrome](https://agentprime.io/advisories/CVE-2026-106356.md)
  `CVE-2026-106356` · CVE record: Google Chrome · CVSS 5.4 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-1021
- [Clickjacking in Google Chrome](https://agentprime.io/advisories/CVE-2026-106311.md)
  `CVE-2026-106311` · CVE record: Google Chrome · CVSS 5.4 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-1021
- [Clickjacking in Dell Secure Connect Gateway (SCG) Policy Manager](https://agentprime.io/advisories/CVE-2026-71177.md)
  `CVE-2026-71177` · CVE record: Dell Secure Connect Gateway (SCG) Policy Manager · CVSS 5.4 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-1021
- [Clickjacking in Fortinet FortiPAM Chrome Extension](https://agentprime.io/advisories/CVE-2026-84388.md)
  `CVE-2026-84388` · CVE record: Fortinet FortiPAM Chrome Extension · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: CWE-1021
- [Clickjacking in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-43688.md)
  `CVE-2026-43688` · CVE record: Apple iOS and iPadOS and 1 more · CVSS 7.8 High · Not analysed yet · Published 14 Sept 2026 · Tags: CWE-1021
- [Clickjacking in Apple macOS](https://agentprime.io/advisories/CVE-2026-86911.md)
  `CVE-2026-86911` · CVE record: Apple macOS · CVSS 5.5 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: CWE-1021
- [Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin](https://agentprime.io/advisories/GHSA-jmc6-2wr8-h3wj.md)
  `GHSA-jmc6-2wr8-h3wj`, `CVE-2026-87995`, `PYSEC-2026-4123` · PyPI `open-webui`: affected `>=0.8.11, <0.11.1`, fixed in `0.11.1` · CVSS 8.7 High · Not analysed yet · Published 10 Sept 2026 · Tags: Cross-site scripting (XSS), CWE-1021
- [Clickjacking in Google Chrome](https://agentprime.io/advisories/CVE-2026-87538.md)
  `CVE-2026-87538` · CVE record: Google Chrome · CVSS 4.2 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: CWE-1021
- [Clickjacking in Google Chrome](https://agentprime.io/advisories/CVE-2026-87655.md)
  `CVE-2026-87655` · CVE record: Google Chrome · CVSS 5.4 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: CWE-1021
- [Clickjacking in Google Chrome](https://agentprime.io/advisories/CVE-2026-87486.md)
  `CVE-2026-87486` · CVE record: Google Chrome · CVSS 4.0 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: CWE-1021
- [Clickjacking in Google Android](https://agentprime.io/advisories/CVE-2026-28656.md)
  `CVE-2026-28656` · CVE record: Google Android · CVSS 7.3 High · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-1021
- [Clickjacking issue in the DOM: Events component](https://agentprime.io/advisories/CVE-2026-84139.md)
  `CVE-2026-84139` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: CWE-1021
- [Ebyte NA111-M Improper Restriction of Rendered UI Layers or Frames](https://agentprime.io/advisories/CVE-2026-75548.md)
  `CVE-2026-75548` · CVE record: Ebyte Ebyte NA111-M Firmware · CVSS 5.3 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: CWE-1021
- [GeoLens's authorization and cache-scope flaws disclose private dataset data and metadata to unauthorized users (fixed in 1.2.4)](https://agentprime.io/advisories/GHSA-p77j-g7h5-r2vw.md)
  `GHSA-p77j-g7h5-r2vw` · PyPI `geolens`: affected `<1.2.4`, fixed in `1.2.4` · No CVSS score · Not analysed yet · Published 19 Aug 2026 · Tags: Other injection, Information disclosure, Broken access control, Denial of service
- [Address bar spoofing risk in affected iOS versions of Arc Search](https://agentprime.io/advisories/CVE-2026-18534.md)
  `CVE-2026-18534` · CVE record: The Browser Company of New York ArcSearch · CVSS 7.4 High · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-1021
- [Clickjacking issue in the Downloads component in Firefox for Android](https://agentprime.io/advisories/CVE-2026-74980.md)
  `CVE-2026-74980` · CVE record: Mozilla Firefox · CVSS 6.5 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-1021
- [Clickjacking issue in the Widget component](https://agentprime.io/advisories/CVE-2026-74978.md)
  `CVE-2026-74978` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-1021
- [Information disclosure in the WebRTC component](https://agentprime.io/advisories/CVE-2026-74958.md)
  `CVE-2026-74958` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-1021
- [Clickjacking issue in Firefox for Android](https://agentprime.io/advisories/CVE-2026-74951.md)
  `CVE-2026-74951` · CVE record: Mozilla Firefox · CVSS 6.5 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-1021
- [Security Misconfiguration in SAP Data Services Management Console](https://agentprime.io/advisories/CVE-2026-44762.md)
  `CVE-2026-44762` · CVE record: SAP_SE SAP Data Services Management Console · CVSS 3.7 Low · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-1021
- [Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path](https://agentprime.io/advisories/GHSA-9f4c-93c8-jc8g.md)
  `GHSA-9f4c-93c8-jc8g`, `CVE-2026-70608` · npm `electron`: affected `<39.8.10 || >=40.0.0-alpha.1, <41.10.3 || >=42.0.0-alpha.1, <42.0.1`, fixed in `39.8.10`, `41.10.3`, `42.0.1` · CVSS 7.2 High · Not analysed yet · Published 5 Aug 2026 · Tags: CWE-693, CWE-1021
- [Electron: Cross-origin iframe can position native autofill popup](https://agentprime.io/advisories/GHSA-x8rc-wpg4-grpf.md)
  `GHSA-x8rc-wpg4-grpf`, `CVE-2026-70600` · npm `electron`: affected `<39.8.8 || >=40.0.0-alpha.1, <40.9.1 || >=41.0.0-alpha.1, <41.2.1 || >=42.0.0-alpha.1, <42.0.0-beta.3`, fixed in `39.8.8`, `40.9.1`, `41.2.1`, `42.0.0-beta.3` · CVSS 3.1 Low · Not analysed yet · Published 5 Aug 2026 · Tags: CWE-1021
- [Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin](https://agentprime.io/advisories/GHSA-3xpf-xq7r-v8c5.md)
  `GHSA-3xpf-xq7r-v8c5`, `CVE-2026-70486`, `PYSEC-2026-3641` · PyPI `open-webui`: affected `>=0.9.0, <0.11.0`, fixed in `0.11.0` · CVSS 8.2 High · Not analysed yet · Published 4 Aug 2026 · Tags: Cross-site scripting (XSS), CWE-1021
- [Clickjacking in Oracle Corporation Oracle Platform Security for Java](https://agentprime.io/advisories/CVE-2026-60370.md)
  `CVE-2026-60370` · CVE record: Oracle Corporation Oracle Platform Security for Java · CVSS 7.5 High · Not analysed yet · Published 22 Jul 2026 · Tags: CWE-1021
- [Clickjacking issue in the WebExtensions component in Firefox for Android](https://agentprime.io/advisories/CVE-2026-16397.md)
  `CVE-2026-16397` · CVE record: Mozilla Firefox · CVSS 6.5 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: CWE-1021
- [Frameable content vulnerability in the Secure Access server login page](https://agentprime.io/advisories/CVE-2026-40957.md)
  `CVE-2026-40957` · CVE record: Absolute Security Secure Access · CVSS 6.1 Medium · Not analysed yet · Published 15 Jul 2026 · Tags: CWE-1021
- [Microsoft Bing App for IOS Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2026-58595.md)
  `CVE-2026-58595` · CVE record: Microsoft Microsoft Bing Search for iOS · CVSS 8.1 High · Not analysed yet · Published 14 Jul 2026 · Tags: CWE-1021
- [Clickjacking in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-59791.md)
  `CVE-2026-59791` · CVE record: JetBrains YouTrack · CVSS 3.5 Low · Not analysed yet · Published 10 Jul 2026 · Tags: CWE-1021
- [ajenti through v2.2.13 has a clickjacking weakness in the browser-facing login and administrative UI.](https://agentprime.io/advisories/CVE-2026-38979.md)
  `CVE-2026-38979` · CVE record · CVSS 5.4 Medium · Not analysed yet · Published 6 Jul 2026 · Tags: CWE-1021
- [Jupyter Server: Stored XSS in \`NbconvertFileHandler\` / \`NbconvertPostHandler\` via missing \`sandbox\` CSP](https://agentprime.io/advisories/GHSA-fcw5-x6j4-ccmp.md)
  `GHSA-fcw5-x6j4-ccmp`, `CVE-2026-44727`, `PYSEC-2026-366` · PyPI `jupyter-server`: affected `<2.20.0`, fixed in `2.20.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Jun 2026 · Tags: Cross-site scripting (XSS), CWE-1021
- [Address Bar Spoofing in Arc Search for Android (window.open race condition)](https://agentprime.io/advisories/CVE-2026-12348.md)
  `CVE-2026-12348` · CVE record: The Browser Company of New York\` Arc Search · CVSS 7.4 High · Not analysed yet · Published 16 Jun 2026 · Tags: CWE-1021
- [Spoofing issue in the DOM: Core & HTML component](https://agentprime.io/advisories/CVE-2026-12323.md)
  `CVE-2026-12323` · CVE record: Mozilla Firefox and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 16 Jun 2026 · Tags: CWE-1021
- [Clickjacking issue in the Widget: Gtk component](https://agentprime.io/advisories/CVE-2026-12322.md)
  `CVE-2026-12322` · CVE record: Mozilla Firefox and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 16 Jun 2026 · Tags: CWE-1021
- [Improper Restriction of Rendered UI Layers or Frames in GitLab](https://agentprime.io/advisories/CVE-2026-10733.md)
  `CVE-2026-10733` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 11 Jun 2026 · Tags: CWE-1021
- [nebula-mesh: Web UI and API responses lack security headers (CSP, X-Frame-Options, HSTS, etc.)](https://agentprime.io/advisories/GHSA-w7w5-5gcp-38rw.md)
  `GHSA-w7w5-5gcp-38rw`, `CVE-2026-47723`, `GO-2026-5698` · Go `github.com/juev/nebula-mesh`: affected `<0.3.1`, fixed in `0.3.1` · CVSS 7.1 High · Not analysed yet · Published 8 Jun 2026 · Tags: CWE-1021
- [Clickjacking in Google Android](https://agentprime.io/advisories/CVE-2026-28577.md)
  `CVE-2026-28577` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 1 Jun 2026 · Tags: CWE-1021
- [Clickjacking in Google Android](https://agentprime.io/advisories/CVE-2026-0061.md)
  `CVE-2026-0061` · CVE record: Google Android · CVSS 5.9 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: CWE-1021
- [Clickjacking in Google Android](https://agentprime.io/advisories/CVE-2026-0036.md)
  `CVE-2026-0036` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 1 Jun 2026 · Tags: CWE-1021
- [HCL BigFix Remote Control Server WebUI is affected by a misconfigured Content Security Policy](https://agentprime.io/advisories/CVE-2026-21785.md)
  `CVE-2026-21785` · CVE record: HCLSoftware BigFix Remote Control Server · CVSS 4.0 Medium · Not analysed yet · Published 27 May 2026 · Tags: CWE-1021
- [Besen BS20 EV Charging Station Firmware Version Check ui layer](https://agentprime.io/advisories/CVE-2026-9396.md)
  `CVE-2026-9396` · CVE record: Besen BS20 EV Charging Station · CVSS 6.3 Medium · Not analysed yet · Published 24 May 2026 · Tags: CWE-1021
- [An issue in ClipBucket v5 v.5.5.2 allows an attacker to execute arbitrary code via the Authentication interface, login page endpoint and HTTP response security headers components](https://agentprime.io/advisories/CVE-2026-37470.md)
  `CVE-2026-37470` · CVE record · CVSS 7.3 High · Not analysed yet · Published 22 May 2026 · Tags: CWE-1021
- [HCL AION is affected by a vulnerability where certain security-related HTTP response headers are not properly configured](https://agentprime.io/advisories/CVE-2025-62316.md)
  `CVE-2025-62316` · CVE record: HCL AION · CVSS 2.3 Low · Not analysed yet · Published 14 May 2026 · Tags: CWE-1021
- [Clickjacking in Apple Safari and others](https://agentprime.io/advisories/CVE-2026-28971.md)
  `CVE-2026-28971` · CVE record: Apple Safari and 3 more · CVSS 4.3 Medium · Not analysed yet · Published 11 May 2026 · Tags: CWE-1021
- [Clickjacking in Google Chrome](https://agentprime.io/advisories/CVE-2026-8022.md)
  `CVE-2026-8022` · CVE record: Google Chrome · CVSS 3.1 Low · Not analysed yet · Published 6 May 2026 · Tags: CWE-1021
- [Improper Restriction of Rendered UI Layers or Frames in GitLab](https://agentprime.io/advisories/CVE-2026-3254.md)
  `CVE-2026-3254` · CVE record: GitLab GitLab · CVSS 3.5 Low · Not analysed yet · Published 22 Apr 2026 · Tags: CWE-1021
- [Address bar spoofing risk in ArcSearch on Android](https://agentprime.io/advisories/CVE-2026-2378.md)
  `CVE-2026-2378` · CVE record: The BrowserCompany of New York ArcSearch · CVSS 7.4 High · Not analysed yet · Published 20 Mar 2026 · Tags: CWE-1021
- [HCL Nomad server on Domino is affected by a missing default frame-ancestors directive](https://agentprime.io/advisories/CVE-2025-62328.md)
  `CVE-2025-62328` · CVE record: HCLSoftware Nomad server on Domino · CVSS 3.7 Low · Not analysed yet · Published 11 Mar 2026 · Tags: CWE-1021

Older: <https://agentprime.io/advisories/tag/cwe-1021.md?cursor=WyIyMDI2LTAzLTExVDIyOjA0OjExLjE5OTAwMFoiLCJDVkUtMjAyNS02MjMyOCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-1021>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-1021/>. Everything for agents: <https://agentprime.io/llms.txt>.