CVE-2026-48786 Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint

Fleet is an open-source device management platform built on osquery. In versions prior to 4.87.0, the target search endpoint POST /api/latest/fleet/targets returned unmasked team enroll secrets and full team configuration, including credential-bearing agent options, to low-privilege observer-clas...

CVE-2026-80196

creationtimestamp| type| source ---|---|--- 2026-08-26 18:04:02+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117163127023272638 2026-08-26 18:04:02+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mtyw7nsnmz2g...

DRUPAL-CONTRIB-2026-113

The Entity API module extends the Drupal core entity API to provide a unified way to deal with entities and their properties. The module doesn't correctly apply access controls for JSON:API entity collection endpoints. This exposes an information disclosure vulnerability. This vulnerability is...

CVE-2026-79258

A flaw was found in WebXR within Google Chrome. This incorrect authorization vulnerability allows a remote attacker, by leveraging social engineering tactics and a specially crafted HTML page, to obtain sensitive cross-origin data. This could lead to unauthorized information disclosure...

CVE-2026-79265

A flaw was found in Google Chrome. A remote attacker, who has compromised the renderer process and leveraged social engineering, could exploit an incomplete cleanup vulnerability in the GetUserMedia component. This could allow them to obtain sensitive information via a crafted HTML page...

CVE-2026-79288

A flaw was found in Google Chrome's Autofill feature on Android. Improper input validation allows a remote attacker to obtain sensitive information by tricking a user into visiting a specially crafted HTML page. This vulnerability could lead to the exposure of sensitive user data...

CVE-2026-79246

A flaw was found in chromium-browser. An information leak vulnerability exists in the DataTransfer component of Google Chrome. A remote attacker could exploit this by enticing a user to visit a specially crafted HTML page, leading to the disclosure of sensitive information...

CVE-2026-79055

A flaw was found in Google Chrome on Android. An information leak vulnerability exists in the Sharing feature. A local attacker, by leveraging social engineering tactics, could exploit this flaw through a co-installed application, potentially leading to the disclosure of sensitive information...

CVE-2026-78977

A flaw was found in Google Chrome. An uninitialized resource in the GPU component of Google Chrome on Android could allow a remote attacker to exploit this vulnerability. By crafting a malicious HTML page, the attacker could potentially read memory contents from within the sandbox environment,...

CVE-2026-79126

A flaw was found in Proxy in Google Chrome. An adjacent attacker could exploit this vulnerability by sending crafted network traffic, potentially leading to the disclosure of sensitive information. This issue stems from an incorrect provision of specified functionality within the Proxy component...

CVE-2026-79146

A flaw was found in CustomTabs in Google Chrome. A local attacker could exploit this vulnerability through a co-installed application. This could result in an information leak, allowing the attacker to access cross-origin data...

CVE-2026-79004

A flaw was found in Media in Google Chrome. A remote attacker, after compromising the renderer process, could exploit an out-of-bounds read vulnerability by using a specially crafted HTML page. This could allow the attacker to read sensitive memory outside of the browser's security sandbox, leadi...

CVE-2026-78896

A flaw was found in Google Chrome. This vulnerability, located in the StorageAccessAPI, allows a remote attacker to exploit it by crafting a malicious HTML page. Successful exploitation could lead to an information leak, enabling the attacker to obtain sensitive cross-origin data...

CVE-2026-79287

A flaw was found in chromium-browser. A remote attacker could exploit an observable discrepancy in Forms by crafting a malicious HTML page. This could allow the attacker to obtain sensitive information from the user...

CVE-2026-79293

A flaw was found in chromium-browser. A remote attacker could exploit an information leak in the Animation component by crafting a malicious HTML page. This could allow the attacker to obtain sensitive information from the user's browser...

CVE-2026-79291

A flaw was found in Google Chrome. A remote attacker could exploit this vulnerability by enticing a user to visit a specially crafted HTML page. This could lead to an information leak, allowing the attacker to obtain sensitive information...

CVE-2026-79271

A flaw was found in Google Chrome. An information leak vulnerability exists in the Document Object Model DOM. A remote attacker could exploit this by leveraging social engineering tactics to trick a user into visiting a specially crafted HTML page. This could allow the attacker to obtain sensitiv...

CVE-2026-79274

A flaw was found in chromium-browser. A remote attacker could exploit a vulnerability in the GPU component by crafting a malicious HTML page. This could lead to an information leak, allowing the attacker to obtain sensitive data from other origins...

CVE-2026-79239

A flaw was found in Google Chrome on Android. A remote attacker could exploit an out-of-bounds read vulnerability in the Tint component by tricking a user into visiting a specially crafted HTML page. This could potentially allow the attacker to read sensitive memory within the browser's sandbox,...

CVE-2026-79242

A flaw was found in Google Chrome. This vulnerability, stemming from an observable discrepancy in HTML processing, could be exploited by a remote attacker. By crafting a malicious HTML page, an attacker could gain access to sensitive information...