CVE-2026-108049

The record

Clickjacking vulnerability in the Alosuite web application. The affected login interface can be embedded in a web page controlled by an attacker because it does not implement adequate user interface protection mechanisms, such as the X-Frame-Options header or an appropriate Content-Security-Policy (frame-ancestors) directive. By tricking a victim into interacting with a malicious web page, an attacker can trigger unwanted actions within the Alosuite application embedded in the frame, which could compromise the integrity of user interactions and facilitate further attacks against authenticated users.

Affected packages

Related vulnerabilities

• CVE-2026-119715 NocoDB before 2026.08.0 contains a clickjacking vulnerability that allows any origin to… CWE-1021
• CVE-2026-20942 Improper restriction of rendered ui layers or frames in Microsoft Edge (Chromium-based)… CWE-1021
• CVE-2026-67079 HCL BigFix AEX is affected by a Clickjacking vulnerability, which could allow an attacker… CWE-1021
• CVE-2026-114125 Storybook is a frontend workshop for building user interface components and pages in… CWE-1021
• CVE-2026-113063 Clickjacking in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote… CWE-1021
• CVE-2026-109290 Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability… CWE-1021
• CVE-2026-87655 Clickjacking in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote… CWE-1021
• CVE-2026-87538 Clickjacking in Input in Google Chrome prior to 153.0.8010.36 allowed a remote attacker… CWE-1021