By weakness (CWE)

CWE-1021: related vulnerabilities

CVEs classified under CWE-1021. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

12 published vulnerabilities

• CVE-2026-0036HIGH 7.8

  CVE-2026-0036 is a tapjacking vulnerability in Android's StageCoordinator animation handler that allows a malicious app to escalate privileges without requiring user interaction or special permissions. An attacker with a local account on the device can overlay transparent windows to intercept touch events or manipulate the animation state, gaining unauthorized access to sensitive device functions and data. The vulnerability affects multiple Android versions and is rated HIGH severity due to its direct path to privilege escalation.

• CVE-2026-28577HIGH 7.8

  A vulnerability in Android's window management system allows a locally authenticated attacker to perform a tapjacking attack—placing hidden overlay windows on top of legitimate applications to intercept user input or actions. This attack doesn't require user interaction to trigger and can result in unauthorized privilege escalation. The attacker needs only local access to the device (such as through an installed app), making it a practical threat in real-world scenarios.

• CVE-2026-12348HIGH 7.4

  Arc Search for Android contains an address bar spoofing vulnerability that allows attackers to display a legitimate domain name in the browser's address bar while simultaneously rendering malicious content underneath. This classic phishing vector tricks users into trusting the displayed domain and interacting with attacker-controlled forms, links, or scripts. The vulnerability requires user interaction (clicking or navigating) but no special privileges, making it a practical threat to any Arc Search user on Android.

• CVE-2026-0061MEDIUM 5.9

  CVE-2026-0061 is a privilege escalation vulnerability in Android's WindowState component that allows an attacker to manipulate the permission-granting UI through overlay attacks (tapjacking). By displaying a malicious overlay on top of the system permission dialog, an attacker can trick users into granting sensitive permissions without explicit awareness. The critical aspect is that this requires no special execution privileges and no user interaction in the traditional sense—the attack succeeds through visual deception rather than social engineering or code execution exploits.

• CVE-2026-12322MEDIUM 5.4

  A clickjacking vulnerability exists in the Gtk widget component used by Firefox and Thunderbird. An attacker could craft a malicious webpage that tricks users into clicking on hidden UI elements, potentially allowing unauthorized actions such as modifying settings or accessing sensitive information. The vulnerability requires user interaction—a click on a deceptive overlay—but no special privileges. It affects both confidentiality and availability of the application.

• CVE-2026-12323MEDIUM 5.4

  A spoofing vulnerability exists in Firefox and Thunderbird's DOM (Document Object Model) and HTML processing component. An attacker could potentially deceive users about the true origin or content of a webpage or email through DOM manipulation. The issue requires user interaction to trigger and affects confidentiality and availability rather than integrity. Mozilla fixed this in Firefox 152 and Thunderbird 152.

• CVE-2026-14142MEDIUM 5.4

  A flaw in how Google Chrome handles extensions could allow an attacker who has already compromised your browser's rendering engine to trick you into clicking malicious UI elements by disguising them as legitimate browser controls. The attacker would need to first gain control of the renderer process—typically through a separate vulnerability or compromise—then exploit this weakness to display fake dialogs or buttons that appear to come from Chrome itself. This is a secondary attack that depends on prior compromise.

• CVE-2026-38979MEDIUM 5.4

  Ajenti, a system administration interface, fails to protect its login and administrative panels from clickjacking attacks. An attacker can craft a webpage that tricks users into unknowingly interacting with hidden Ajenti UI elements, potentially leading to unauthorized actions or credential harvesting. The vulnerability exists because Ajenti does not add browser-level framing protections to its responses.

• CVE-2026-44727MEDIUM 5.4

  Jupyter Server versions before 2.20 contain a stored cross-site scripting (XSS) vulnerability in the notebook conversion feature. When a user opens a malicious notebook through the web interface, specially crafted HTML content in the notebook can execute arbitrary JavaScript in the browser with access to session cookies and the Jupyter API. An attacker who can get a user to open a prepared notebook—either by hosting it or tricking them into uploading it—can steal credentials, modify notebooks, or execute code on the Jupyter kernel itself. The vulnerability requires user interaction (opening the notebook) and authenticated access to Jupyter, which limits the immediate blast radius but poses significant risk in multi-user or shared research environments.

• CVE-2026-10733MEDIUM 4.3

  GitLab CE and EE versions up to 18.10.7, 18.11.4, and 19.0.1 contain a flaw that allows authenticated users to crash the CI/CD Catalog page. An attacker with valid GitLab credentials can trigger improper input handling in the Catalog interface, causing the service to become temporarily unavailable for users accessing that feature. The vulnerability requires authentication, so external attackers cannot exploit it directly, but it poses a localized availability risk within your GitLab instance.

• CVE-2026-14110MEDIUM 4.3

  Google Chrome versions before 150.0.7871.47 contain a vulnerability in the Dark Mode feature that allows an attacker to deceive users through crafted web pages. By manipulating how Dark Mode renders interface elements, an attacker could trick users into believing they are interacting with legitimate browser controls or content when they are not. This is a client-side UI spoofing vulnerability that requires user interaction to exploit.

• CVE-2026-59791LOW 3.5

  JetBrains YouTrack versions before 2026.2.17012 contain a CSS injection vulnerability in the Mermaid diagram rendering feature. An authenticated user can inject malicious CSS through diagram content, potentially allowing them to deface or manipulate how information appears to other users viewing the same diagrams. This is a low-severity issue because it requires authentication, user interaction, and affects only the presentation layer without compromising data confidentiality or system availability.