Advisories · Weakness
CWE-1021.
Every Advisory and CVE whose sources give the weakness CWE-1021, newest first.
- CVSS 5.3 Medium
Clickjacking in OpenText Directory Services (OTDS)
- OpenText Directory Services (OTDS)
- CWE-1021
- CVSS 4.6 Medium
Multiple vulnerabilities that affects IBM Db2 Genius Hub
- IBM Db2 Genius Hub
- CWE-1021
- CVSS 5.1 Medium
Clickjacking vulnerability in the Alosuite web application.
- AM System ALO Suite
- CWE-1021
- CVSS 5.3 Medium
NocoDB before 2026.08.0 Clickjacking via Missing Frame-Control Headers
- nocodb
- CWE-1021
- CVSS 4.3 Medium
Microsoft Edge (Chromium-based) Spoofing Vulnerability
- Microsoft Edge (Chromium-based)
- CWE-1021
- CVSS 6.4 Medium
HCL BigFix AEX is affected by multiple security vulnerabilities.
- HCL Software BigFix AEX
- CWE-1021
- CVSS 6.9 Medium
Clickjacking in boneIO
- boneIO
- CWE-1021
- CVSS 8.6 High
Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites
- Path traversal
- Code injection
>=8.0.0, <8.6.19 || >=9.0.0, <9.1.21 || >=10.0.0, <10.6.2 || >=11.0.0-alpha.0, <11.0.0-alpha.6 · fixed in 8.6.19, 9.1.21, 10.6.2, 11.0.0-alpha.6
GHSA-f2ph-cmg5-wxc8 · CVE-2026-114125 - CVSS 8.8 High
Clickjacking in Google Chrome
- Google Chrome
- CWE-1021
- CVSS 3.5 Low
Gitea Jupyter notebook UI redress through CSS class injection
- Gitea
- Cross-site scripting (XSS)
- CWE-1021
- CVSS 8.4 High
Open WebUI 0.11.1 before 0.11.4 Stored XSS via DOCX Preview
- open-webui
- Cross-site scripting (XSS)
- CWE-1021
- CVSS 5.1 Medium
Shenzhen HCC Technology MPOS M6 PLUS Display QR Code Rendering ui layer
- Shenzhen HCC Technology MPOS M6 PLUS
- CWE-1021
- CVSS 5.4 Medium
Clickjacking in Google Chrome
- Google Chrome
- CWE-1021
- CVSS 5.4 Medium
Clickjacking in Google Chrome
- Google Chrome
- CWE-1021
- CVSS 5.4 Medium
Clickjacking in Google Chrome
- Google Chrome
- CWE-1021
- CVSS 5.4 Medium
Clickjacking in Dell Secure Connect Gateway (SCG) Policy Manager
- Dell Secure Connect Gateway (SCG) Policy Manager
- CWE-1021
- CVSS 9.1 CriticalCritical · CVSS 9+
Clickjacking in Fortinet FortiPAM Chrome Extension
- Fortinet FortiPAM Chrome Extension
- CWE-1021
- CVSS 7.8 High
Clickjacking in Apple iOS and iPadOS and others
- Apple iOS and iPadOS
- Apple macOS
- CWE-1021
- CVSS 5.5 Medium
Clickjacking in Apple macOS
- Apple macOS
- CWE-1021
- CVSS 8.7 High
Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin
- Cross-site scripting (XSS)
- CWE-1021
>=0.8.11, <0.11.1 · fixed in 0.11.1
GHSA-jmc6-2wr8-h3wj · CVE-2026-87995 - CVSS 4.2 Medium
Clickjacking in Google Chrome
- Google Chrome
- CWE-1021
- CVSS 5.4 Medium
Clickjacking in Google Chrome
- Google Chrome
- CWE-1021
- CVSS 4.0 Medium
Clickjacking in Google Chrome
- Google Chrome
- CWE-1021
- CVSS 7.3 High
Clickjacking in Google Android
- Google Android
- CWE-1021
- CVSS 9.8 CriticalCritical · CVSS 9+
Clickjacking issue in the DOM: Events component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-1021
- CVSS 5.3 Medium
Ebyte NA111-M Improper Restriction of Rendered UI Layers or Frames
- Ebyte NA111-M Firmware
- CWE-1021
-
GeoLens's authorization and cache-scope flaws disclose private dataset data and metadata to unauthorized users (fixed in 1.2.4)
- Other injection
- Information disclosure
<1.2.4 · fixed in 1.2.4
GHSA-p77j-g7h5-r2vw - CVSS 7.4 High
Address bar spoofing risk in affected iOS versions of Arc Search
- The Browser Company of New York ArcSearch
- CWE-1021
- CVSS 6.5 Medium
Clickjacking issue in the Downloads component in Firefox for Android
- Mozilla Firefox
- CWE-1021
- CVSS 8.1 High
Clickjacking issue in the Widget component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-1021
- CVSS 7.5 High
Information disclosure in the WebRTC component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-1021
- CVSS 6.5 Medium
Clickjacking issue in Firefox for Android
- Mozilla Firefox
- CWE-1021
- CVSS 3.7 Low
Security Misconfiguration in SAP Data Services Management Console
- SAP_SE SAP Data Services Management Console
- CWE-1021
- CVSS 7.2 High
Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path
- CWE-693
- CWE-1021
<39.8.10 || >=40.0.0-alpha.1, <41.10.3 || >=42.0.0-alpha.1, <42.0.1 · fixed in 39.8.10, 41.10.3, 42.0.1
GHSA-9f4c-93c8-jc8g · CVE-2026-70608 - CVSS 3.1 Low
Electron: Cross-origin iframe can position native autofill popup
- CWE-1021
<39.8.8 || >=40.0.0-alpha.1, <40.9.1 || >=41.0.0-alpha.1, <41.2.1 || >=42.0.0-alpha.1, <42.0.0-beta.3 · fixed in 39.8.8, 40.9.1, 41.2.1, 42.0.0-beta.3
GHSA-x8rc-wpg4-grpf · CVE-2026-70600 - CVSS 8.2 High
Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin
- Cross-site scripting (XSS)
- CWE-1021
>=0.9.0, <0.11.0 · fixed in 0.11.0
GHSA-3xpf-xq7r-v8c5 · CVE-2026-70486 - CVSS 7.5 High
Clickjacking in Oracle Corporation Oracle Platform Security for Java
- Oracle Corporation Oracle Platform Security for Java
- CWE-1021
- CVSS 6.5 Medium
Clickjacking issue in the WebExtensions component in Firefox for Android
- Mozilla Firefox
- CWE-1021
- CVSS 6.1 Medium
Frameable content vulnerability in the Secure Access server login page
- Absolute Security Secure Access
- CWE-1021
- CVSS 8.1 High
Microsoft Bing App for IOS Spoofing Vulnerability
- Microsoft Bing Search for iOS
- CWE-1021
- CVSS 3.5 Low
Clickjacking in JetBrains YouTrack
- JetBrains YouTrack
- CWE-1021
- CVSS 5.4 Medium
ajenti through v2.2.13 has a clickjacking weakness in the browser-facing login and administrative UI.
- CWE-1021
- CVSS 9.3 CriticalCritical · CVSS 9+
Jupyter Server: Stored XSS in `NbconvertFileHandler` / `NbconvertPostHandler` via missing `sandbox` CSP
- Cross-site scripting (XSS)
- CWE-1021
<2.20.0 · fixed in 2.20.0
GHSA-fcw5-x6j4-ccmp · CVE-2026-44727 - CVSS 7.4 High
Address Bar Spoofing in Arc Search for Android (window.open race condition)
- The Browser Company of New York` Arc Search
- CWE-1021
- CVSS 5.4 Medium
Spoofing issue in the DOM: Core & HTML component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-1021
- CVSS 5.4 Medium
Clickjacking issue in the Widget: Gtk component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-1021
- CVSS 4.3 Medium
Improper Restriction of Rendered UI Layers or Frames in GitLab
- GitLab
- CWE-1021
- CVSS 7.1 High
nebula-mesh: Web UI and API responses lack security headers (CSP, X-Frame-Options, HSTS, etc.)
- CWE-1021
<0.3.1 · fixed in 0.3.1
GHSA-w7w5-5gcp-38rw · CVE-2026-47723 - CVSS 7.8 High
Clickjacking in Google Android
- Google Android
- CWE-1021
- CVSS 5.9 Medium
Clickjacking in Google Android
- Google Android
- CWE-1021
- CVSS 7.8 High
Clickjacking in Google Android
- Google Android
- CWE-1021
- CVSS 4.0 Medium
HCL BigFix Remote Control Server WebUI is affected by a misconfigured Content Security Policy
- HCLSoftware BigFix Remote Control Server
- CWE-1021
- CVSS 6.3 Medium
Besen BS20 EV Charging Station Firmware Version Check ui layer
- Besen BS20 EV Charging Station
- CWE-1021
- CVSS 7.3 High
An issue in ClipBucket v5 v.5.5.2 allows an attacker to execute arbitrary code via the Authentication interface, login page endpoint and HTTP response security headers components
- CWE-1021
- CVSS 2.3 Low
HCL AION is affected by a vulnerability where certain security-related HTTP response headers are not properly configured
- HCL AION
- CWE-1021
- CVSS 4.3 Medium
Clickjacking in Apple Safari and others
- Apple Safari
- Apple iOS and iPadOS
- CWE-1021
- CVSS 3.1 Low
Clickjacking in Google Chrome
- Google Chrome
- CWE-1021
- CVSS 3.5 Low
Improper Restriction of Rendered UI Layers or Frames in GitLab
- GitLab
- CWE-1021
- CVSS 7.4 High
Address bar spoofing risk in ArcSearch on Android
- The BrowserCompany of New York ArcSearch
- CWE-1021
- CVSS 3.7 Low
HCL Nomad server on Domino is affected by a missing default frame-ancestors directive
- HCLSoftware Nomad server on Domino
- CWE-1021