What is the CVSS score of CVE-2026-37470?

CVE-2026-37470 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of N A are affected by CVE-2026-37470?

ClipBucket v5.5.2 is vulnerable to clickjacking attacks that enable attackers to harvest user credentials and manipulate authenticated users through malicious iframe embedding.

How to fix or mitigate CVE-2026-37470?

Within 24 hours: Identify and document all ClipBucket v5.5.2 instances in production; notify affected user communities of credential risk. Within 7 days: Implement interim controls via Web Application Firewall or reverse proxy to enforce X-Frame-Options: DENY and Content-Security-Policy: frame-ancestors 'none'; establish network-level access restrictions if possible. Escalate to ClipBucket vendor to confirm patch release timeline. Within 30 days: Monitor vendor security advisories for official patch release; execute immediate deployment upon availability.

N A CVE-2026-37470

EUVD-2026-31464 HIGH

Improper Restriction of Rendered UI Layers or Frames (CWE-1021)

2026-05-22 mitre

GHSA-4367-8h95-cxcx

XSS RCE N A

7.3

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.3 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 02:27 vuln.today

CVSS changed

Jul 05, 2026 - 02:22 NVD

7.3 (None) 7.3 (HIGH)

CVE Published

May 22, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue in ClipBucket v5 v.5.5.2 allows an attacker to execute arbitrary code via the Authentication interface, login page endpoint and HTTP response security headers components

AnalysisAI

Clickjacking in ClipBucket v5 5.5.2 lets an attacker embed the application's login page in a hidden iframe due to missing HTTP response security headers, enabling UI-redressing attacks that can capture credentials or trick authenticated users into unintended actions. The flaw is classified CWE-1021 (Improper Restriction of Rendered UI Layers), not the 'arbitrary code execution' the raw description claims — the referenced technical writeup and the CVSS profile (UI:R) both point to a framing/credential-theft issue. EPSS is very low (0.05%, 14th percentile) and CISA SSVC scores exploitation as 'none', indicating no observed active exploitation.