CVE-2026-92087: Improper Authorization

@fastify/auth is a Fastify plugin that composes multiple authentication and authorization strategies into a single route guard. In versions 5.0.0 through 5.1.0, when strategies are composed with the relation "or" option together with the run "all" option and one entry is a nested array acting as ...

PT-2026-93816

Name of the Vulnerable Software and Affected Versions FileRise versions prior to 3.28.0 Description Improper session isolation between the WebDAV interface and the web application session context allows authenticated low-privilege attackers to gain unauthorized read and write access. By combining...

PT-2026-94041

Name of the Vulnerable Software and Affected Versions SecObserve versions prior to 1.59.1 Description An information disclosure issue exists in the ApiConfigurationSerializer which fails to remove the basic auth password field from API configuration responses. This allows users with view-only...

CVE-2026-91716

Use after free in Auth in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

DEBIAN-CVE-2026-91716

Use after free in Auth in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-61554

emp3r0r is a C2 designed by Linux users for Linux environments. Prior to version 4.2.5, the httppoll C2 transport accepts attacker-controlled HTTP polling sessions before CBOR MsgAuth authentication is completed. A remote unauthenticated attacker can create arbitrary polling sessions and send...

CVE-2026-91716

Use after free in Auth in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

EUVD-2026-79996

emp3r0r is a C2 designed by Linux users for Linux environments. Prior to version 4.2.5, the httppoll C2 transport accepts attacker-controlled HTTP polling sessions before CBOR MsgAuth authentication is completed. A remote unauthenticated attacker can create arbitrary polling sessions and send...

CVE-2026-61554 emp3r0r has an unauthenticated HTTP Polling DoS

emp3r0r is a C2 designed by Linux users for Linux environments. Prior to version 4.2.5, the httppoll C2 transport accepts attacker-controlled HTTP polling sessions before CBOR MsgAuth authentication is completed. A remote unauthenticated attacker can create arbitrary polling sessions and send...

CVE-2026-61554 emp3r0r has an unauthenticated HTTP Polling DoS

emp3r0r is a C2 designed by Linux users for Linux environments. Prior to version 4.2.5, the httppoll C2 transport accepts attacker-controlled HTTP polling sessions before CBOR MsgAuth authentication is completed. A remote unauthenticated attacker can create arbitrary polling sessions and send...

emp3r0r has an unauthenticated HTTP Polling DoS

Summary The httppoll C2 transport accepts attacker-controlled HTTP polling sessions before CBOR MsgAuth authentication is completed. A remote unauthenticated attacker can create arbitrary polling sessions and send request bodies that are forwarded into the C2 dispatch path. This can consume serve...

GHSA-4595-RVPX-4Q34 emp3r0r has an unauthenticated HTTP Polling DoS

Summary The httppoll C2 transport accepts attacker-controlled HTTP polling sessions before CBOR MsgAuth authentication is completed. A remote unauthenticated attacker can create arbitrary polling sessions and send request bodies that are forwarded into the C2 dispatch path. This can consume serve...

CVE-2026-91716

Use after free in Auth in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-91716

A use after free vulnerability exists in the Auth component of Google Chrome prior to version 153.0.8010.47 . A remote attacker can exploit this flaw by providing a crafted HTML page to execute arbitrary code outside the sandbox . This issue also affects Microsoft Edge (Chromium-based), which add...

CVE-2026-91716

Use after free in Auth in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

EUVD-2026-79978

Use after free in Auth in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-91716

Use after free in Auth in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-91716

Use after free in Auth in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-89027

miniOrange JWT Authentication for WP REST APIs plugin for WordPress before 4.8.0 contains an authentication method downgrade vulnerability that allows unauthenticated attackers to bypass administrator-configured authentication by supplying a specific GET parameter without any capability check or...

CVE-2026-76680

Vulnerabilities in the API of EdgeConnect SD-WAN Orchestrator could allow a remote attacker authenticated with low privileges to conduct server-side request forgery SSRF attacks. A successful exploit allows an attacker to enumerate information about the internal structure of the EdgeConnect SD-WA...