Medium
CVE-2026-70602
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 109
Reset filters
Medium
CVE-2026-70603
Electron: shell.openPath path validation bypass via embedded null byte
High
CVE-2026-70601
Electron: Context isolation bypass via Function.prototype.bind hijack
Low
CVE-2026-70600
Electron: Cross-origin iframe can position native autofill popup
Medium
CVE-2026-70599
Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin
Low
CVE-2026-70598
Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size
Medium
CVE-2026-70597
Electron: Parent process code-sign check is spoofable
High
CVE-2026-54673
electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`
High
CVE-2026-54672
electron-updater: Uncontrolled search path elements within `AppImage` built by `app-builder-lib`
Critical
CVE-2026-54257
Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow
Medium
CVE-2026-42890
actual Allows Electron to Run As Node
High
CVE-2026-48017
DbGate: Remote Code Execution via functionName injection in loadReader endpoint
Critical
CVE-2026-47668
DbGate: Unauthenticated Remote Code Execution via JSON Script Runner
Medium
CVE-2026-42045
LobeHub has a Cross-Site Scripting issue that escalates to Remote Code Execution
Low
CVE-2026-34781
Electron: Crash in clipboard.readImage() on malformed clipboard image data
Medium
CVE-2026-34765
Electron: Named window.open targets not scoped to the opener's browsing context
Low
CVE-2026-34764
Electron: Use-after-free in offscreen shared texture release() callback
High
CVE-2026-34780
Electron: Context Isolation bypass via contextBridge VideoFrame transfer
Medium
CVE-2026-34779
Electron: AppleScript injection in app.moveToApplicationsFolder on macOS
Medium
CVE-2026-34778
Electron: Service worker can spoof executeJavaScript IPC replies
Medium
CVE-2026-34777
Electron: Incorrect origin passed to permission request handler for iframe requests
Medium
CVE-2026-34776
Electron: Out-of-bounds read in second-instance IPC on macOS and Linux
Medium
CVE-2026-34775
Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes
High
CVE-2026-34774
Electron: Use-after-free in offscreen child window paint callback
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.