Medium
CVE-2026-114121
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 109
Reset filters
Low
CVE-2026-114122
Electron: Frame subscription trusts GPU-supplied frame geometry
Low
CVE-2026-114124
Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry
Medium
CVE-2026-113798
Electron: Pointer lock permission requests can be attributed to the wrong frame
Low
CVE-2026-113797
Electron: Extension tabs.query returns tab URLs and titles without the tabs permission
Medium
CVE-2026-113796
Electron: SameSite cookie restrictions are not applied to windows opened from links
Medium
CVE-2026-113800
Electron: HID and USB permission checks can be attributed to the wrong origin
An issue in Electron causes HID and USB permission checks from an iframe to receive the top-level frame's origin and details. Applications relying on origin-based logic may grant embedded frames access intended only for the top-level page.
High
CVE-2026-106104
Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server
High
CVE-2026-102826
simple-git allows command execution through unblocked Git configuration includes
Medium
CVE-2026-102672
Electron: Local race condition in Squirrel.Mac update installation on macOS
High
CVE-2026-102673
Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab
High
CVE-2026-102674
Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions
High
CVE-2026-102675
Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled
High
CVE-2026-102676
Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions
High
CVE-2026-102677
Electron: Sandboxed preload code cache can be poisoned by a compromised renderer
Medium
CVE-2026-70612
Electron: Sandboxed iframes can launch external protocol handlers
Medium
CVE-2026-70611
Electron: DevTools embedder handler executes arbitrary files via shell open
Medium
CVE-2026-70610
Electron: contextBridge object copy honors prototype setters
Medium
CVE-2026-70609
Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter
High
CVE-2026-70608
Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path
Medium
CVE-2026-70607
Electron: window.open features string controls some window options considered privileged
Medium
CVE-2026-70606
Electron: ProtocolResponse.url reuses the default session cache instead of the registering session
Medium
CVE-2026-70605
Electron: HTTP redirect followed into local file loader
High
CVE-2026-70604
Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.