By weakness (CWE)

CWE-183: related vulnerabilities

CVEs classified under CWE-183. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

4 published vulnerabilities

• CVE-2026-59802HIGH 8.2

  PasswordPusher versions before 2.8.1 contain a validation flaw that allows attackers to embed malicious JavaScript code disguised as data URIs within password-sharing links. When a victim clicks one of these malicious links, the JavaScript executes in their browser under PasswordPusher's trusted domain, enabling credential theft and phishing attacks. The vulnerability is straightforward to exploit and requires only that a user click a specially crafted link—no complex setup or special conditions are needed.

• CVE-2026-46608HIGH 7.4

  Glances, a popular open-source system monitoring tool, contains a critical flaw in how it manages browser access control when deployed as an XML-RPC server. When an administrator configures the tool to restrict access to specific internal dashboards by listing two or more approved origins, the security control silently breaks and instead allows any website on the internet to pull sensitive system monitoring data. This happens because of a logic error in the CORS (cross-origin resource sharing) fallback mechanism introduced in version 4.5.3. An attacker does not need to compromise credentials or trick a user into clicking anything unusual—merely visiting a malicious webpage while connected to the same network or having the Glances server exposed to the internet is enough to expose real-time CPU, memory, disk, process, and other system metrics.

• CVE-2026-50189HIGH 7.2

  Appsmith, a low-code platform for building admin dashboards and internal tools, contains a critical configuration issue in versions before 2.1. The platform exposes supervisord—a process management tool—through a public-facing web route, allowing authenticated administrators to execute arbitrary commands on the underlying Docker container. An attacker with admin credentials can manipulate the supervisord XML-RPC interface to add malicious programs and execute OS-level commands, completely compromising the container's integrity and confidentiality.

• CVE-2026-11525LOW 3.7

  Undici, a Node.js HTTP client library, incorrectly parses the SameSite attribute in Set-Cookie headers. Instead of validating that the attribute is exactly 'Strict', 'Lax', or 'None' as the HTTP specification requires, undici accepts any value containing one of those words as a substring and silently converts it to the closest match. This means a server sending a malformed cookie like 'SameSite=NoneOfYourBusiness' will be treated as 'None'—the least restrictive setting—potentially weakening the security properties applications expect from SameSite enforcement.