https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 21:31:18 +0000 https://cve.radiocsirt.org/vuln/cve-2026-44767 <p><strong>Affected:</strong> SAP_SE @ui5/webcomponents-base</p> <p>setThemeRoot() failed to enforce the sap-allowed-theme-origins allowlist. An attacker-controlled absolute cross-origin URL could be stored and used directly to construct a &lt;link rel=stylesheet&gt; element, even when no &lt;meta name=sap-allowed-theme-origins&gt; tag was present in the document. The same bypass was reachable via the ?sap-themeRoot URL parameter.Exploitation requires attacker-influenced input (e.g., a URL query parameter, tenant configuration, or user-supplied setting) to reach setThemeRoot(). A successful exploit allows an attacker to inject arbitrary CSS into the victim page, enabling:- UI redressing and clickjacking- Phishing overlays- Visual defacement- Limited data exfiltration via CSS attribute selectors targeting predictable DOM content</p> <p><strong>Affected:</strong> SAP_SE @ui5/webcomponents-base</p> <p>setThemeRoot() failed to enforce the sap-allowed-theme-origins allowlist. An attacker-controlled absolute cross-origin URL could be stored and used directly to construct a &lt;link rel=stylesheet&gt; element, even when no &lt;meta name=sap-allowed-theme-origins&gt; tag was present in the document. The same bypass was reachable via the ?sap-themeRoot URL parameter.Exploitation requires attacker-influenced input (e.g., a URL query parameter, tenant configuration, or user-supplied setting) to reach setThemeRoot(). A successful exploit allows an attacker to inject arbitrary CSS into the victim page, enabling:- UI redressing and clickjacking- Phishing overlays- Visual defacement- Limited data exfiltration via CSS attribute selectors targeting predictable DOM content</p> https://cve.radiocsirt.org/vuln/cve-2026-44767