# CWE-1021. Every Advisory and CVE whose sources give the weakness CWE-1021, newest first. ## Records, newest first (an older page) - [OpenClaw has Canvas route hardening for mixed-trust deployments](https://agentprime.io/advisories/GHSA-cjv3-m589-v3rx.md) `GHSA-cjv3-m589-v3rx` · npm `openclaw`: affected `<2026.2.21`, fixed in `2026.2.21` · CVSS 4.0, no score published · Not analysed yet · Published 3 Mar 2026 · Tags: Cross-site scripting (XSS), CWE-1021 - [Clickjacking in Google Android](https://agentprime.io/advisories/CVE-2026-0007.md) `CVE-2026-0007` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 2 Mar 2026 · Tags: CWE-1021 - [Lack of protection mechanisms against Clickjacking attacks](https://agentprime.io/advisories/CVE-2025-58405.md) `CVE-2025-58405` · CVE record: CGM CGM CLININET · CVSS 5.3 Medium · Not analysed yet · Published 2 Mar 2026 · Tags: CWE-1021 - [Tenda F3 Clickjacking in Web Management Interface](https://agentprime.io/advisories/CVE-2026-27511.md) `CVE-2026-27511` · CVE record: Shenzhen Tenda Technology Co., Ltd. Tenda F3 · CVSS 5.1 Medium · Not analysed yet · Published 23 Feb 2026 · Tags: CWE-1021 - [XWiki vulnerable to click-jacking through CSS injection in comments](https://agentprime.io/advisories/GHSA-74rh-c5rh-88vg.md) `GHSA-74rh-c5rh-88vg`, `CVE-2026-26000` · Maven `org.xwiki.platform:xwiki-platform-web`: affected `>=17.5.0, <17.9.0 || >=17.0.0-rc-1, <17.4.6 || <16.10.13`, fixed in `17.9.0`, `17.4.6`, `16.10.13` · CVSS 5.3 Medium · Not analysed yet · Published 12 Feb 2026 · Tags: CWE-1021 - [Clickjacking in Apple iOS and iPadOS](https://agentprime.io/advisories/CVE-2026-20645.md) `CVE-2026-20645` · CVE record: Apple iOS and iPadOS · CVSS 4.6 Medium · Not analysed yet · Published 11 Feb 2026 · Tags: CWE-1021 - [Dokploy has a clickjacking vulnerability - Missing X-Frame-Options and CSP frame-ancestors headers](https://agentprime.io/advisories/CVE-2026-24839.md) `CVE-2026-24839` · CVE record: Dokploy dokploy · CVSS 4.7 Medium · Not analysed yet · Published 28 Jan 2026 · Tags: CWE-1021 - [WeGIA Clickjacking Vulnerability](https://agentprime.io/advisories/CVE-2026-23731.md) `CVE-2026-23731` · CVE record: LabRedesCefetRJ WeGIA · CVSS 4.3 Medium · Not analysed yet · Published 16 Jan 2026 · Tags: CWE-1021 - [CVE-2025-15032: Increased Spoofing risk; custom new window missing about:blank](https://agentprime.io/advisories/CVE-2025-15032.md) `CVE-2025-15032` · CVE record: The Browser Company of New York Dia · CVSS 7.4 High · Not analysed yet · Published 16 Jan 2026 · Tags: CWE-1021 - [Paragon Automation: A clickjacking vulnerability in the web server configuration has been addressed](https://agentprime.io/advisories/CVE-2025-52987.md) `CVE-2025-52987` · CVE record: Juniper Networks Paragon Automation (Pathfinder, Planner, Insights) · CVSS 5.1 Medium · Not analysed yet · Published 15 Jan 2026 · Tags: CWE-1021 - [Clickjacking in SICK AG TDC-X401GL](https://agentprime.io/advisories/CVE-2026-22918.md) `CVE-2026-22918` · CVE record: SICK AG TDC-X401GL · CVSS 4.3 Medium · Not analysed yet · Published 15 Jan 2026 · Tags: CWE-1021 - [PLANKA 2.0.0 lacks X-Frame-Options and CSP frame-ancestors headers, allowing the application to be embedded within malicious iframes.](https://agentprime.io/advisories/CVE-2025-65922.md) `CVE-2025-65922` · CVE record · CVSS 4.3 Medium · Not analysed yet · Published 5 Jan 2026 · Tags: CWE-1021 - [Tuta Mail has DOM attribute and CSS injection in its Contact Viewer feature](https://agentprime.io/advisories/GHSA-24v3-254g-jv85.md) `GHSA-24v3-254g-jv85` · npm `@tutao/tutanota-utils`: affected `<314.251111.0`, fixed in `314.251111.0` · CVSS 4.0, no score published · Not analysed yet · Published 19 Dec 2025 · Tags: Cross-site scripting (XSS), CWE-1021 - [Address bar spoofing risk in ArcSearch on Android](https://agentprime.io/advisories/CVE-2025-14809.md) `CVE-2025-14809` · CVE record: The Browser Company of New York ArcSearch · CVSS 7.4 High · Not analysed yet · Published 19 Dec 2025 · Tags: CWE-1021 - [Address bar spoofing risk in Arc Search on iOS](https://agentprime.io/advisories/CVE-2025-14812.md) `CVE-2025-14812` · CVE record: The Browser Company of New York ArcSearch · CVSS 7.5 High · Not analysed yet · Published 19 Dec 2025 · Tags: CWE-1021 - [HCL BigFix Remote Control is vulnerable to an insecure CSP configuration](https://agentprime.io/advisories/CVE-2025-59849.md) `CVE-2025-59849` · CVE record: HCL Software BigFix Remote Control · CVSS 4.7 Medium · Not analysed yet · Published 17 Dec 2025 · Tags: CWE-693, CWE-1021 - [Clickjacking in Inaba Denki Sangyo Co., Ltd. CHOCO TEI WATCHER mini (IB-MCT001)](https://agentprime.io/advisories/CVE-2025-59479.md) `CVE-2025-59479` · CVE record: Inaba Denki Sangyo Co., Ltd. CHOCO TEI WATCHER mini (IB-MCT001) · CVSS 5.1 Medium · Not analysed yet · Published 16 Dec 2025 · Tags: CWE-1021 - [Clickjacking in Google Chrome](https://agentprime.io/advisories/CVE-2025-14373.md) `CVE-2025-14373` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 12 Dec 2025 · Tags: CWE-1021 - [Clickjacking in Google Android](https://agentprime.io/advisories/CVE-2025-48639.md) `CVE-2025-48639` · CVE record: Google Android · CVSS 7.3 High · Not analysed yet · Published 8 Dec 2025 · Tags: CWE-1021 - [Clickjacking in Google Android](https://agentprime.io/advisories/CVE-2025-48597.md) `CVE-2025-48597` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 8 Dec 2025 · Tags: CWE-1021 - [FeehiCMS is vulnerable to reverse tabnabbing](https://agentprime.io/advisories/GHSA-w756-rf26-7rmr.md) `GHSA-w756-rf26-7rmr`, `CVE-2025-63522`, `PKSA-2tvw-ry46-vvzy` · Packagist `feehi/feehicms`: affected `<=2.1.1`, no fixed version yet · CVSS 4.6 Medium · Not analysed yet · Published 1 Dec 2025 · Tags: CWE-1021 - [IBM Concert Software clickjacking](https://agentprime.io/advisories/CVE-2025-36149.md) `CVE-2025-36149` · CVE record: IBM IBM Concert Software · CVSS 6.3 Medium · Not analysed yet · Published 21 Nov 2025 · Tags: CWE-1021 - [Dia: Increased Spoof Risk; Missing full screen toast](https://agentprime.io/advisories/CVE-2025-13132.md) `CVE-2025-13132` · CVE record: The Browser Company of New York Dia · CVSS 7.4 High · Not analysed yet · Published 21 Nov 2025 · Tags: CWE-1021 - [iFrame Injection in Mikrogrup's Shopside](https://agentprime.io/advisories/CVE-2025-0421.md) `CVE-2025-0421` · CVE record: Shopside Software Technologies Inc. Shopside · CVSS 4.7 Medium · Not analysed yet · Published 19 Nov 2025 · Tags: CWE-1021 - [CLICKJACKING](https://agentprime.io/advisories/CVE-2025-64387.md) `CVE-2025-64387` · CVE record: Circutor TCPRS1plus · CVSS 5.1 Medium · Not analysed yet · Published 31 Oct 2025 · Tags: CWE-1021 - [Clickjacking in Open-Xchange GmbH OX App Suite](https://agentprime.io/advisories/CVE-2025-30191.md) `CVE-2025-30191` · CVE record: Open-Xchange GmbH OX App Suite · CVSS 5.4 Medium · Not analysed yet · Published 31 Oct 2025 · Tags: CWE-1021 - [Phpgurukul Hostel Management System 2.1 is vulnerable to clickjacking.](https://agentprime.io/advisories/CVE-2025-28129.md) `CVE-2025-28129` · CVE record · CVSS 5.4 Medium · Not analysed yet · Published 6 Oct 2025 · Tags: CWE-1021 - [HCL MyXalytics is affected by the use of vulnerable/outdated versions](https://agentprime.io/advisories/CVE-2025-52658.md) `CVE-2025-52658` · CVE record: HCL Software MyXalytics · CVSS 3.5 Low · Not analysed yet · Published 3 Oct 2025 · Tags: CWE-1021, CWE-1104 - [FreshRSS: Double clickjacking can lead to privilege escalation](https://agentprime.io/advisories/CVE-2025-59950.md) `CVE-2025-59950` · CVE record: FreshRSS FreshRSS · CVSS 6.7 Medium · Not analysed yet · Published 29 Sept 2025 · Tags: CWE-1021 - [FressRSS: Clickjacking can lead to XSS and/or privilege escalation](https://agentprime.io/advisories/CVE-2025-57769.md) `CVE-2025-57769` · CVE record: FreshRSS FreshRSS · CVSS 5.3 Medium · Not analysed yet · Published 29 Sept 2025 · Tags: Cross-site scripting (XSS), CWE-1021 - [XSS in Mevzuattr Software's MevzuatTR](https://agentprime.io/advisories/CVE-2025-0546.md) `CVE-2025-0546` · CVE record: Mevzuattr Software MevzuatTR · CVSS 4.7 Medium · Not analysed yet · Published 17 Sept 2025 · Tags: Cross-site scripting (XSS), CWE-1021 - [Clickjacking in Google Android](https://agentprime.io/advisories/CVE-2025-32350.md) `CVE-2025-32350` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 4 Sept 2025 · Tags: CWE-1021 - [Clickjacking in Google Android](https://agentprime.io/advisories/CVE-2025-32349.md) `CVE-2025-32349` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 4 Sept 2025 · Tags: CWE-1021 - [iFrame Injection in Akinsoft's LimonDesk](https://agentprime.io/advisories/CVE-2024-13066.md) `CVE-2024-13066` · CVE record: Akinsoft LimonDesk · CVSS 4.3 Medium · Not analysed yet · Published 3 Sept 2025 · Tags: CWE-1021 - [Cross-Frame Scripting (XFS) in BoomCMS](https://agentprime.io/advisories/CVE-2025-41000.md) `CVE-2025-41000` · CVE record: BoomCMS BoomCMS · CVSS 2.1 Low · Not analysed yet · Published 3 Sept 2025 · Tags: CWE-1021 - [Clickjacking in Google Android](https://agentprime.io/advisories/CVE-2025-22419.md) `CVE-2025-22419` · CVE record: Google Android · CVSS 7.3 High · Not analysed yet · Published 2 Sept 2025 · Tags: CWE-1021 - [Clickjacking in Google Android](https://agentprime.io/advisories/CVE-2025-22417.md) `CVE-2025-22417` · CVE record: Google Android · CVSS 7.3 High · Not analysed yet · Published 2 Sept 2025 · Tags: CWE-1021 - [IBM Cognos Command Center clickjacking](https://agentprime.io/advisories/CVE-2025-1494.md) `CVE-2025-1494` · CVE record: IBM Cognos Command Center · CVSS 6.1 Medium · Not analysed yet · Published 26 Aug 2025 · Tags: CWE-1021 - [Portabilis i-Diario Login Page ui layer](https://agentprime.io/advisories/CVE-2025-9108.md) `CVE-2025-9108` · CVE record: Portabilis i-Diario · CVSS 5.3 Medium · Not analysed yet · Published 18 Aug 2025 · Tags: CWE-1021 - [Clickjacking in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2025-54527.md) `CVE-2025-54527` · CVE record: JetBrains YouTrack · CVSS 6.1 Medium · Not analysed yet · Published 28 Jul 2025 · Tags: CWE-1021 - [HAX CMS application pages vulnerable to clickjacking](https://agentprime.io/advisories/GHSA-54vw-f4xf-f92j.md) `GHSA-54vw-f4xf-f92j`, `CVE-2025-54139`, `PKSA-c643-15gb-71h6` · npm `@haxtheweb/haxcms-nodejs` and 1 more: affected `<11.0.13`, fixed in `11.0.13` · CVSS 4.3 Medium · Not analysed yet · Published 21 Jul 2025 · Tags: CWE-1021 - [yangzongzhuan RuoYi Image Source ui layer](https://agentprime.io/advisories/CVE-2025-7903.md) `CVE-2025-7903` · CVE record: yangzongzhuan RuoYi · CVSS 5.3 Medium · Not analysed yet · Published 20 Jul 2025 · Tags: CWE-1021 - [Clickjacking vulnerability on the management web application of TP-LINK Archer C1200](https://agentprime.io/advisories/CVE-2025-6983.md) `CVE-2025-6983` · CVE record: TP-Link System Inc. Archer C1200 · CVSS 5.1 Medium · Not analysed yet · Published 16 Jul 2025 · Tags: CWE-1021 - [CVE-2025-27455](https://agentprime.io/advisories/CVE-2025-27455.md) `CVE-2025-27455` · CVE record: Endress+Hauser Endress+Hauser MEAC300-FNADE4 · CVSS 4.3 Medium · Not analysed yet · Published 3 Jul 2025 · Tags: CWE-1021 - [Sunshine clickjacking in the UI leads to unauthorized actions being performed](https://agentprime.io/advisories/CVE-2025-53096.md) `CVE-2025-53096` · CVE record: LizardByte Sunshine · CVSS 5.4 Medium · Not analysed yet · Published 1 Jul 2025 · Tags: CWE-1021 - [IBM Datacap clickjacking](https://agentprime.io/advisories/CVE-2025-36027.md) `CVE-2025-36027` · CVE record: IBM Datacap · CVSS 5.4 Medium · Not analysed yet · Published 28 Jun 2025 · Tags: CWE-1021 - [Clickjacking in Google Chrome](https://agentprime.io/advisories/CVE-2025-6557.md) `CVE-2025-6557` · CVE record: Google Chrome · CVSS 5.4 Medium · Not analysed yet · Published 24 Jun 2025 · Tags: CWE-1021 - [HTTPS-Only exception screen lacked anti-clickjacking delay](https://agentprime.io/advisories/CVE-2025-6434.md) `CVE-2025-6434` · CVE record: Mozilla Firefox and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 24 Jun 2025 · Tags: CWE-1021 - [Clickjacking](https://agentprime.io/advisories/CVE-2025-49192.md) `CVE-2025-49192` · CVE record: SICK AG SICK Field Analytics and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 12 Jun 2025 · Tags: CWE-1021 - [Dashboards and iFrames can link malicious web content](https://agentprime.io/advisories/CVE-2025-49191.md) `CVE-2025-49191` · CVE record: SICK AG SICK Field Analytics · CVSS 4.8 Medium · Not analysed yet · Published 12 Jun 2025 · Tags: CWE-1021 - [@haxtheweb/haxcms-nodejs Iframe Phishing vulnerability](https://agentprime.io/advisories/GHSA-v3ph-2q5q-cg88.md) `GHSA-v3ph-2q5q-cg88`, `CVE-2025-49139` · npm `@haxtheweb/haxcms-nodejs`: affected `<11.0.0`, fixed in `11.0.0` · CVSS 5.3 Medium · Not analysed yet · Published 9 Jun 2025 · Tags: CWE-1021 - [Clickjacking vulnerability could have led to leaking saved payment card details](https://agentprime.io/advisories/CVE-2025-5267.md) `CVE-2025-5267` · CVE record: Mozilla Firefox and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 27 May 2025 · Tags: CWE-1021 - [DIFY vulnerable to Clickjacking Attack](https://agentprime.io/advisories/CVE-2025-43854.md) `CVE-2025-43854` · CVE record: langgenius dify · CVSS 2.3 Low · Not analysed yet · Published 28 Apr 2025 · Tags: CWE-1021 - [EspoCRM allows unrestricted Embedding in Iframe dashlet](https://agentprime.io/advisories/CVE-2025-32385.md) `CVE-2025-32385` · CVE record: espocrm espocrm · CVSS 5.3 Medium · Not analysed yet · Published 15 Apr 2025 · Tags: CWE-1021 - [Improper Restriction of Rendered UI Layers or Frames in GitLab](https://agentprime.io/advisories/CVE-2025-0362.md) `CVE-2025-0362` · CVE record: GitLab GitLab · CVSS 6.4 Medium · Not analysed yet · Published 10 Apr 2025 · Tags: CWE-1021 - [Clickjacking in Inaba Denki Sangyo Co., Ltd. AC-WPS-11ac and others](https://agentprime.io/advisories/CVE-2025-25213.md) `CVE-2025-25213` · CVE record: Inaba Denki Sangyo Co., Ltd. AC-WPS-11ac and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 9 Apr 2025 · Tags: CWE-1021 - [tarteaucitron.js allows UI manipulation via unrestricted CSS injection](https://agentprime.io/advisories/GHSA-7524-3396-fqv3.md) `GHSA-7524-3396-fqv3`, `CVE-2025-31138` · npm `tarteaucitronjs`: affected `<1.20.1`, fixed in `1.20.1` · CVSS 5.5 Medium · Not analysed yet · Published 7 Apr 2025 · Tags: CWE-1021 - [Clickjacking in JTEKT ELECTRONICS CORPORATION HMI ViewJet C-more series](https://agentprime.io/advisories/CVE-2025-24310.md) `CVE-2025-24310` · CVE record: JTEKT ELECTRONICS CORPORATION HMI ViewJet C-more series · CVSS 4.3 Medium · Not analysed yet · Published 4 Apr 2025 · Tags: CWE-1021 - [Clickjacking in Google Chrome](https://agentprime.io/advisories/CVE-2025-1923.md) `CVE-2025-1923` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 5 Mar 2025 · Tags: CWE-1021 - [Clickjacking in Google Chrome](https://agentprime.io/advisories/CVE-2025-1917.md) `CVE-2025-1917` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 5 Mar 2025 · Tags: CWE-1021 Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .