Cyber Resilience

CVE-2026-37470

High

Published: 22 May 2026

Published
22 May 2026
Modified
22 May 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
EPSS Score 0.0045 35.6th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-37470 is a high-severity Improper Restriction of Rendered UI Layers or Frames (CWE-1021) vulnerability in Clipbucket (inferred from references). Its CVSS base score is 7.3 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

An issue in ClipBucket v5 v.5.5.2 allows an attacker to execute arbitrary code via the Authentication interface, login page endpoint and HTTP response security headers components

CWE(s)
CWE-1021

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

CWE-1021 clickjacking weakness on public login/auth endpoint directly enables web application exploitation for initial access.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

Affected Assets

Clipbucket
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References