{"id":"CVE-2026-38978","details":"transmission through 4.1.1 was found to have a clickjacking weakness in the browser-facing WebUI and RPC response paths.","modified":"2026-11-06T01:07:21.682019562Z","published":"2026-06-02T00:00:00Z","related":["openSUSE-SU-2026:21189-1"],"database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/38xxx/CVE-2026-38978.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/38xxx/CVE-2026-38978.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-38978"},{"type":"REPORT","url":"https://github.com/transmission/transmission/issues/8726"},{"type":"FIX","url":"https://github.com/transmission/transmission/commit/6b24c1c214ec6a44fa5fdff0ce7da6b16d8ecaa8"},{"type":"FIX","url":"https://github.com/transmission/transmission/pull/8747"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/transmission/transmission","events":[{"introduced":"0"},{"fixed":"6b24c1c214ec6a44fa5fdff0ce7da6b16d8ecaa8"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0"},{"last_affected":"4.1.1"}],"source":"DESCRIPTION"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"6b24c1c214ec6a44fa5fdff0ce7da6b16d8ecaa8"}]}]}}],"versions":["4.1.0-beta.5","4.1.0-beta.4","4.1.0-beta.3","4.1.0-beta.2","4.1.0-beta.1","4.0.3","4.0.2","4.0.1","4.0.0","4.0.0-beta.3","4.0.0-beta.2","4.0.0-beta.1","3.00","2.92","2.91","2.90","2.83","2.82","2.81","2.80","2.74","2.73","2.72","2.71","2.70","2.61","2.60","2.52","2.51","2.50","2.50b1","2.40","2.40b3","2.40b2","2.40b1","2.33","2.32","2.31","2.30","2.30b4","2.30b3","2.30b2","2.30b1","2.21","2.20","2.20b4","2.20b3","2.20b2","2.20b1","2.13","2.12","2.11","2.10","2.00","1.91","1.90","1.83","1.82","1.81","1.80","1.80b5","1.74","1.73","1.72","1.71","1.70","1.61","1.60","1.40","1.32","1.31","1.22","1.21","1.20","1.11","1.10","1.06","0.80","0.7","0.6","0.5"],"database_specific":{"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/transmission/transmission/commit/6b24c1c214ec6a44fa5fdff0ce7da6b16d8ecaa8","target":{"file":"libtransmission/rpc-server.cc","function":"handle_request"},"deprecated":false,"digest":{"function_hash":"96785735937719002800501184382156504375","length":5072},"id":"CVE-2026-38978-64f39328"},{"digest":{"threshold":0.9,"line_hashes":["215936007206132818963529134242901698302","277172573590221647616319288075413366330","128053763517372611836724677293831790717","312342916857223909397311625351801926456","259600417671214015783812729264606596497","108215843786062397252693581652499586611","163648123487238922000555436500097326633"]},"id":"CVE-2026-38978-df79725e","signature_type":"Line","signature_version":"v1","source":"https://github.com/transmission/transmission/commit/6b24c1c214ec6a44fa5fdff0ce7da6b16d8ecaa8","target":{"file":"libtransmission/rpc-server.cc"},"deprecated":false}],"vanir_signatures_modified":"2026-11-06T01:07:21Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-38978.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}]}