47167 matches found
CVE-2026-32717 AnythingLLM access control bypass: suspended users can continue using Browser Extension API keys
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, in multi-user mode, AnythingLLM blocks suspended users on the normal JWT-backed session path, but it does not block them on the browser extension API...
CVE-2026-32717
AnythingLLM prior to 1.11.2 in multi-user mode suffers an access control bypass where suspended users remain authenticated via browser extension API keys. If a user already has a valid brx-... browser extension API key, it continues to work after suspension, allowing access to browser extension e...
CVE-2026-32717
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, in multi-user mode, AnythingLLM blocks suspended users on the normal JWT-backed session path, but it does not block them on the browser extension API...
CVE-2026-32717 AnythingLLM access control bypass: suspended users can continue using Browser Extension API keys
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, in multi-user mode, AnythingLLM blocks suspended users on the normal JWT-backed session path, but it does not block them on the browser extension API...
CVE-2026-32717 AnythingLLM access control bypass: suspended users can continue using Browser Extension API keys
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, in multi-user mode, AnythingLLM blocks suspended users on the normal JWT-backed session path, but it does not block them on the browser extension API...
GHSA-VMHQ-CQM9-6P7Q OpenClaw: `browser.request` let `operator.write` persist admin-only browser profile changes
Summary An authorization mismatch in the gateway let an authenticated caller with only operator.write use browser.request to reach browser profile management routes that persist configuration to disk. In practice, this exposed an admin-only configuration write primitive through /profiles/create...
OpenClaw: `browser.request` let `operator.write` persist admin-only browser profile changes
Summary An authorization mismatch in the gateway let an authenticated caller with only operator.write use browser.request to reach browser profile management routes that persist configuration to disk. In practice, this exposed an admin-only configuration write primitive through /profiles/create...
Incorrect Authorization
Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization via the browser.request. An attacker can modify or create browser profiles and persist unauthorized configuration changes by sending crafted requests to profile...
Minor update(8) for Vivaldi Android Browser 7.8
Head to the Google Play Store and download the browser. Alternatively, you can download Vivaldi from Uptodown, the Android app store. Your rating for our browser matters. ⭐️ ⭐️ ⭐️ ⭐️ ⭐️ Enjoy! Changelog The following is a list of changes since the seventh 7.8 minor update: Upgraded to...
Minor update (8) for Vivaldi Desktop Browser 7.8
Download Vivaldi The following improvements were made since the seventh 7.8 minor update: Chromium Update to 144.0.7559.246 ESR includes security fixes for CVE-2026-3909 & CVE-2026-3910 from 146.0.7680.80 Main photo byDominik Van Opdenbosch...
CVE-2026-3942
An incorrect security ui flaw was found in the PictureInPicture component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=475238879...
CVE-2026-3941
An insufficient policy enforcement flaw was found in the DevTools component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=474670215...
CVE-2026-3939
An insufficient policy enforcement flaw was found in the PDF component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=40058077...
CVE-2026-3938
An insufficient policy enforcement flaw was found in the Clipboard component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=474763968...
CVE-2026-3934
An insufficient policy enforcement flaw was found in the ChromeDriver component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=478783560...
CVE-2026-3931
A heap buffer overflow flaw was found in the Skia component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=417599694...
CVE-2026-3929
A side-channel information leakage flaw was found in the ResourceTiming component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=477180001...
CVE-2026-3930
An unsafe navigation flaw was found in the Navigation component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=476898368...