CVE-2026-84353

Use after free in Shared Tab Groups in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-84353

CVE-2026-84353 is a critical use-after-free vulnerability in Shared Tab Groups of Google Chrome prior to version 152.0.7977.75 (Android/Linux) and 152.0.7977.76 (Windows/Mac). A remote attacker leveraging social engineering (e.g., luring a user to a malicious website or HTML email) can execute ar...

CVE-2026-84470

A flaw was found in Ansible Automation Platform's automation-controller AWX. The Bulk Job Launch API POST /api/v2/bulk/joblaunch/ authorizes the requested instancegroups with only a read-level permission check, whereas the standard single-job launch path requires use-level permission on the same...

CVE-2026-84470

A permission-check inconsistency in Ansible Automation Platform 's automation-controller (AWX) allows an execution-placement authorization bypass . The Bulk Job Launch API (POST /api/v2/bulk/job_launch/) validates requested instance_groups at only a read-level permission, whereas the standard sin...

CVE-2026-46603

A flaw was found in golang.org/x/image/vp8l. A remote attacker can cause a denial of service by providing a specially crafted VP8L image. This image, containing many unused Huffman tree groups, leads to excessive memory allocation during VP8L decoding, resulting in memory exhaustion. Mitigation...

PT-2026-84563

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 152.0.7977.75 Description A use after free issue exists in Shared Tab Groups. A remote attacker can leverage social engineering to execute arbitrary code outside the sandbox by inducing a user to visi...

Google Chrome < 152.0.7977.75 Multiple Vulnerabilities

The version of Google Chrome installed on the remote macOS host is prior to 152.0.7977.75. It is, therefore, affected by multiple vulnerabilities as referenced in the 202609stable-channel-update-for-desktop advisory. - Use after free in Shared Tab Groups in Google Chrome on on Android prior to...

BIT-KEYCLOAK-2026-16108 Keycloak-services: keycloak-services: realm default-group reads disclose hidden groups under fgap v2

A flaw was found in the default-groups REST endpoint and realm representation of Keycloak. This component is responsible for managing groups that are automatically assigned to new users within a realm. The issue allows a delegated administrator with realm-viewing permissions to see the names and...

CVE-2026-82633 Dolibarr 10.0.0 before 24.0.0 Missing Authorization on REST Users Groups Endpoint

Dolibarr versions 10.0.0 before 24.0.0 fail to perform per-object authorization checks in the Users::getGroups REST API endpoint, allowing authenticated users to retrieve group memberships of other users. Attackers can call GET /users/id/groups with arbitrary user identifiers to access group name...

CVE-2026-82633

Dolibarr versions 10.0.0 through 23.x fail to perform per-object authorization checks in the Users::getGroups REST API endpoint (GET /users/{id}/groups). Any authenticated user can call this endpoint with arbitrary user identifiers to retrieve group memberships, entity associations, and private n...

CVE-2026-82562

CVE-2026-82562 affects the qs Node.js querystring parser (v6.14.2 through v6.15.3). When qs.parse is called with both comma: true and throwOnLimitExceeded: true, a comma-separated value under a bracket-push key (a[]=1,2,3,4) is wrapped as a single nested element before the arrayLimit check runs, ...

CVE-2026-54552

A flaw was found in sh, a Python library for process launching. When sh runs from an elevated process and launches a command with the uid option set to an unprivileged user, the child process may retain the parent process's supplementary groups. This incomplete privilege drop can allow the child...

BIT-KEYCLOAK-2026-14613 Keycloak-services: keycloak-services: keycloak: fgap v2 role groups endpoint discloses hidden group metadata without group view permission

A vulnerability was discovered in Keycloak's administrative interface that allows certain administrators to see information about groups they shouldn't have access to. When the new Fine-Grained Admin Permissions FGAP v2 are turned on, an administrator who is allowed to see a specific "role" can...

CVE-2026-78372

RansomLook does not consistently enforce authorization checks when accessing groups, markets, and ransom notes marked as private. An unauthenticated or otherwise unauthorized remote attacker can access information associated with private entities through several web views and API endpoints. The...

EUVD-2026-64845

RansomLook does not consistently enforce authorization checks when accessing groups, markets, and ransom notes marked as private. An unauthenticated or otherwise unauthorized remote attacker can access information associated with private entities through several web views and API endpoints. The...

CVE-2026-78372 RansomLook Missing Authorization Allows Disclosure of Private Group and Ransom Note Data

RansomLook does not consistently enforce authorization checks when accessing groups, markets, and ransom notes marked as private. An unauthenticated or otherwise unauthorized remote attacker can access information associated with private entities through several web views and API endpoints. The...

CVE-2026-78372

RansomLook is a ransomware group monitoring platform that fails to consistently enforce authorization checks when accessing groups, markets, and ransom notes marked as private. An unauthenticated remote attacker can access information associated with private entities through several web views and...

CVE-2026-78372 RansomLook Missing Authorization Allows Disclosure of Private Group and Ransom Note Data

RansomLook does not consistently enforce authorization checks when accessing groups, markets, and ransom notes marked as private. An unauthenticated or otherwise unauthorized remote attacker can access information associated with private entities through several web views and API endpoints. The...

CVE-2026-78369 Missing Authentication Allows Unauthorized Creation of Crypto Groups in RansomLook

RansomLook contains a missing authentication vulnerability in the /admin/crypto/group/new endpoint. While the endpoint provides an administrative function for creating new crypto group entries, it was not protected by the application's authentication mechanism. An unauthenticated remote attacker...

CVE-2026-78369 Missing Authentication Allows Unauthorized Creation of Crypto Groups in RansomLook

RansomLook contains a missing authentication vulnerability in the /admin/crypto/group/new endpoint. While the endpoint provides an administrative function for creating new crypto group entries, it was not protected by the application's authentication mechanism. An unauthenticated remote attacker...