EUVD-2026-57703

A security bypass vulnerability in the Account Protection feature of Palo Alto Networks Prisma® Browser enables a user to bypass intended security controls...

CVE-2026-0289 Prisma Browser: Inappropriate Implementation in Account Protection

A security bypass vulnerability in the Account Protection feature of Palo Alto Networks Prisma® Browser enables a user to bypass intended security controls...

CVE-2026-0289

CVE-2026-0289 is a security bypass vulnerability in the Account Protection feature of Palo Alto Networks Prisma Browser , caused by an inappropriate implementation that allows a user to bypass intended security controls. The NVD assigns a CVSS 3.1 score of 6.5 (MEDIUM) with a network attack vecto...

CVE-2026-0289

A security bypass vulnerability in the Account Protection feature of Palo Alto Networks Prisma® Browser enables a user to bypass intended security controls...

CVE-2026-0289 Prisma Browser: Inappropriate Implementation in Account Protection

A security bypass vulnerability in the Account Protection feature of Palo Alto Networks Prisma® Browser enables a user to bypass intended security controls...

PT-2026-71373

An information disclosure vulnerability in the Account Protection feature of Palo Alto Networks Prisma® Browser enables a local attacker to view sensitive data...

PT-2026-71422

Name of the Vulnerable Software and Affected Versions baseline-browser-mapping versions 2.x through 2.10.x Description The software calls process.exit instead of throwing an error when it encounters invalid or conflicting input parameters. This behavior can trigger the immediate termination of th...

CVE-2026-45819: Incorrect Control Flow Scoping

baseline-browser-mapping 2.x before 2.11.0 calls process.exit instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service...

PT-2026-71441

filebrowser versions before 2.63.19 contain an out-of-scope file deletion vulnerability in the TUS upload cache eviction mechanism that allows authenticated users with only Create permission to delete arbitrary files outside their scope. Attackers can swap an ancestor directory with a symlink...

CVE-2026-0290: Insufficiently Protected Credentials

An information disclosure vulnerability in the Account Protection feature of Palo Alto Networks Prisma® Browser enables a local attacker to view sensitive data...

CVE-2026-0289: Insufficiently Protected Credentials

A security bypass vulnerability in the Account Protection feature of Palo Alto Networks Prisma® Browser enables a user to bypass intended security controls...

PT-2026-71439

File Browser versions from 2.50.0 through 2.63.21 fail to validate JWT expiration when proxy authentication is configured with a non-default logout page. Attackers with a previously valid token can access protected routes and administrative endpoints indefinitely, and exchange expired tokens for...

CVE-2026-73611: Insufficient Session Expiration

File Browser versions from 2.50.0 through 2.63.21 fail to validate JWT expiration when proxy authentication is configured with a non-default logout page. Attackers with a previously valid token can access protected routes and administrative endpoints indefinitely, and exchange expired tokens for...

PT-2026-71737

Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces accept browser-supplied file paths without enforcing the allowWri...

CVE-2026-73653: Improper Limitation of a Pathname to a Restricted Directory

Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces accept browser-supplied file paths without enforcing the allowWri...

PT-2026-71372

A security bypass vulnerability in the Account Protection feature of Palo Alto Networks Prisma® Browser enables a user to bypass intended security controls...

PT-2026-71456

Serendipity versions = 2.3.5 and . In include/functions routing.inc.php serveSearch, the sanitisation pipeline runs urldecode after HTML-encoding, so a single URL-encoded HTML payload survives strip tags and htmlspecialchars and is then decoded back into live HTML in the page. A crafted search li...

CVE-2026-73612: Authorization Bypass Through User-Controlled Key

File Browser before v2.63.22 fails to validate access rules for descendants during recursive copy, rename, and delete operations, allowing authenticated users to bypass path-based access controls. Attackers can copy, rename, or delete denied files by operating on their allowed parent directory,...

PT-2026-71440

File Browser before v2.63.22 fails to validate access rules for descendants during recursive copy, rename, and delete operations, allowing authenticated users to bypass path-based access controls. Attackers can copy, rename, or delete denied files by operating on their allowed parent directory,...

CVE-2026-73601: Improper Neutralization of Directives in Dynamically Evaluated Code

Flowise versions before 3.1.3 contain a remote code execution vulnerability in the Custom MCP node when CUSTOMMCPPROTOCOL is set to stdio, allowing authenticated users to execute arbitrary commands by manipulating environment variables and command arguments. Attackers can abuse PYTHONWARNINGS and...