CVE-2026-38056 ST Engineering iDirect iQ-Series Terminals Missing Authorization

A local privilege escalation vulnerability exists in the iDirect iQ200 VSAT terminal running firmware 23.0.1.0. The iQ200 is a rackmount satellite modem deployed across oil and gas, maritime, defense, and remote infrastructure as the primary, and often sole communications link for offshore rigs,...

CVE-2026-89248

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is missing an authentication/authorization check in plugin/WebRTC/status.json.php. When the WebRTC plugin is present, any unauthenticated remote user can request /plugin/WebRTC/status.json.php and receive JSON containing the absolute...

gstreamer1-plugins-base security update

An update is available for gstreamer1-plugins-base. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list GStreamer is a streaming media framework based on graphs of...

CVE-2026-82213

The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested belongs to the current user, allowing unauthenticated attackers to retrieve other customers' stored card token references together with a valid authorisation signature...

CVE-2026-89252 AVideo Missing Authorization in addLiveLink.php LiveLink Update

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to verify ownership in addLiveLink.php when updating LiveLinks, allowing authenticated users to modify other users' links. A canStream user can overwrite another user's LiveLink HLS source and metadata by supplying an existing...

CVE-2026-89252 AVideo Missing Authorization in addLiveLink.php LiveLink Update

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to verify ownership in addLiveLink.php when updating LiveLinks, allowing authenticated users to modify other users' links. A canStream user can overwrite another user's LiveLink HLS source and metadata by supplying an existing...

CVE-2026-89252

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in addLiveLink.php when updating LiveLinks. The component fails to verify ownership, allowing any authenticated canStream user to overwrite another user's LiveLink HLS source and metadata...

CVE-2026-89251 AVideo Missing Authorization via AD_Server log.php Wallet Credit

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ad impressions in plugin/ADServer/log.php, allowing logged-in users to submit arbitrary label values that trigger unverified wallet credits to campaign video owners. Attackers can repeatedly POST label=start requests...

CVE-2026-89251

AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) contains a missing authorization flaw in plugin/AD_Server/log.php. The plugin fails to validate ad impressions, allowing any logged-in user to submit arbitrary label values that trigger unverified YPTWallet credits to campaign video...

EUVD-2026-76062

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an unauthenticated file read vulnerability in the getRecordedFile.php endpoint that streams recorded FLV files from the temporary directory. Attackers can request the endpoint with a known or guessed stream key to downlo...

CVE-2026-89248

AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) is affected by an information disclosure in the WebRTC plugin file plugin/WebRTC/status.json.php. The endpoint performs no authentication or authorization check (no User::isLogged(), User::isAdmin(), or forbiddenPage()), allowing an...

CVE-2026-89248 AVideo WebRTC Plugin Information Disclosure via status.json.php

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is missing an authentication/authorization check in plugin/WebRTC/status.json.php. When the WebRTC plugin is present, any unauthenticated remote user can request /plugin/WebRTC/status.json.php and receive JSON containing the absolute...

Exploit for CVE-2026-88861

SecDim Challenge Builder Repro — Assurance Drift Working rep...

CVE-2026-87569

A flaw was found in Google Chrome. Missing authorization in the Views component allows a remote attacker, leveraging social engineering, to bypass system access restrictions. This can be achieved by enticing a user to open a specially crafted HTML page...

CVE-2026-87492

A flaw was found in DevTools in Google Chrome. This incorrect authorization vulnerability allows a remote attacker to potentially execute arbitrary code outside the browser's security sandbox. The exploitation occurs when a user interacts with a specially crafted HTML page, leading to a severe...

CVE-2026-87447

A flaw was found in the Network component of Google Chrome. This vulnerability, stemming from incorrect authorization, could allow a remote attacker to bypass the web origin policy. By leveraging social engineering and a specially crafted Chrome extension, an attacker could potentially gain...

CVE-2026-87441

A flaw was found in Google Chrome. Missing authorization in the Downloads component allowed a remote attacker to bypass system access restrictions. This could be achieved by convincing a user to install a specially crafted Chrome extension...

CVE-2026-47839 Federated OIDC Users Can Bypass externalGroupsWhitelist to Gain uaa.admin

A vulnerability allows users authenticating through a federated OIDC provider to obtain the uaa.admin scope despite operators restricting that provider through externalGroupsWhitelist configuration. The issue occurs specifically when an OIDC identity provider uses groupMappingMode: ASSCOPES with ...

WordPress CM HIPAA Forms plugin < 3.2.0 - Unauthenticated Authorization Bypass vulnerability

Unauthenticated Authorization Bypass vulnerability discovered by David Ballard in WordPress Plugin HIPAA FORMS versions 3.2.0...

Improper Authorization

Apache CXF is vulnerable to Improper Authorization. The vulnerability is due to the OAuth2 Dynamic Client Registration endpoint accepting and storing client-supplied scope values without validating them against an allowed scope list, which allows an attacker to self-assign privileged scopes durin...