CVE-2026-87047

Tanium Comply is affected by an improper access controls vulnerability, assigned CVSS 3.1 score of 6.3 (Medium) with a network attack vector, low complexity, and low required privileges, resulting in low impacts to confidentiality, integrity, and availability. The vulnerability has been addressed...

CVE-2026-87019

Tanium Comply is affected by an improper access controls vulnerability, as reported by Tanium in advisory TAN-2026-035 . The issue was addressed by the vendor. The CVSS 3.1 score is 4.3 (MEDIUM) , with a network attack vector, low complexity, and low privileges required; the impact is limited to ...

CVE-2026-87475

A missing authorization flaw was found in the Omnibox component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=507225626...

CVE-2026-87595

Server-side request forgery in Mobile in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. Chromium security severity: Low...

DEBIAN-CVE-2026-87556

Missing authorization in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-20909

Gitea versions before 1.25.5 have insufficient permission checks when listing tracked time entries...

SUSE CVE-2026-25712

Gitea versions before 1.25.5 have insufficient visibility checks in organization permission APIs for hidden members and private organizations...

SUSE CVE-2026-55065

Vikunja is an open-source self-hosted task management platform. From 0.24.6 until 2.4.0, DELETE /api/v1/projects/:project/views/:view permits an authenticated user to supply a view identifier from another project while authorizing only against an attacker-controlled project identifier...

Towards Tackling Application Logic Flaws through Autonomous Formal-Logic Modeling and Automated Reasoning

Logic flaws pose significant challenges in the design and implementation of modern, semantically rich systems and applications, impacting security, privacy, and trust. These flaws are inherently tied to business-specific semantics and threat models, making their discovery and reasoning difficult...

VFIO Heap Buffer Overflow DoS

The vulnerability of the vfiopcicorefeaturedmabuf function in the driver/vfio/pci/vfiopcidmabuf.c file of the VFIO device drivers in the Linux operating system is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

SolarWinds Serv-U Privilege Escalation

The vulnerability of the software for secure file sharing and transmission of SolarWinds Serv-U is related to lack of access control. Exploiting this vulnerability can allow a malicious actor, operating remotely, to elevate their privileges to that of a system administrator...

PT-2026-88869

The Masteriyo LMS WordPress plugin before 3.4.0 does not perform any authorization check before returning a course enrolment record over its REST API, allowing unauthenticated users to read any learner's enrolment status, timestamps and course-progress data by walking sequential record identifier...

PT-2026-89174

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.10.0 through 0.11.0 Description An issue exists in the chat-completions handler within backend/open webui/main.py where the system fails to verify if a user has write access to a specified folder when creating a new chat...

SAML SSO - Service Provider - Critical - Improper access control - SA-CONTRIB-2026-141

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The miniorangesaml module does not correctly restrict access to certain functionality intended for administrative use. This could allow...

PT-2026-89242

Name of the Vulnerable Software and Affected Versions Drupal SAML SSO - Service Provider versions 0.0.0 through 3.2.0 Description The miniorange saml module fails to correctly restrict access to specific administrative functionality. This flaw allows unauthorized users to perform forceful browsin...

PT-2026-88785

Tanium addressed an improper access controls vulnerability in Comply...

CVE-2026-21100: Improper Access Control

Improper access control in SystemUI prior to SMR Sep-2026 Release 1 allows local attackers to launch arbitrary activity...

PT-2026-89042

Snipe-IT through version 8.6.3 fails to perform object-level authorization in the updateLicense, updateConsumable, updateAccessory, and updateModel endpoints and in the storeModel endpoint for Predefined Kits. The existing check authorizes only the parent Predefined Kit update on PredefinedKit an...

PT-2026-88769

Tanium addressed an improper access controls vulnerability in Comply...

CVE-2026-50165: Improper Access Control

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. An Improper Access Control issue in versions prior to 2.0-M5-2605 allows an organization owner to read system-level configuration secrets through organization/event scoped "single configuratio...