CVE-2026-46370 Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint

Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the labels host-listing endpoint GET /api/v1/fleet/labels/id/hosts allowed an authenticated user with the lowest-privilege Observer role to extract host enrollment secrets through a...

CVE-2026-41262

Fleet (open-source device management platform) versions prior to 4.85.0 contain an authorization bypass in the global policy read endpoint. The GetPolicyByIDQueries handler authorizes against an empty policy object with a nil TeamID, which the OPA policy rule permits for any user holding a role o...

CVE-2026-48786 Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint

Fleet is an open-source device management platform built on osquery. In versions prior to 4.87.0, the target search endpoint POST /api/latest/fleet/targets returned unmasked team enroll secrets and full team configuration, including credential-bearing agent options, to low-privilege observer-clas...

CVE-2026-48786 Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint

Fleet is an open-source device management platform built on osquery. In versions prior to 4.87.0, the target search endpoint POST /api/latest/fleet/targets returned unmasked team enroll secrets and full team configuration, including credential-bearing agent options, to low-privilege observer-clas...

CVE-2026-80196

creationtimestamp| type| source ---|---|--- 2026-08-26 18:04:02+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117163127023272638 2026-08-26 18:04:02+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mtyw7nsnmz2g...

DRUPAL-CONTRIB-2026-113

The Entity API module extends the Drupal core entity API to provide a unified way to deal with entities and their properties. The module doesn't correctly apply access controls for JSON:API entity collection endpoints. This exposes an information disclosure vulnerability. This vulnerability is...

CVE-2026-79258

A flaw was found in WebXR within Google Chrome. This incorrect authorization vulnerability allows a remote attacker, by leveraging social engineering tactics and a specially crafted HTML page, to obtain sensitive cross-origin data. This could lead to unauthorized information disclosure...

CVE-2026-79265

A flaw was found in Google Chrome. A remote attacker, who has compromised the renderer process and leveraged social engineering, could exploit an incomplete cleanup vulnerability in the GetUserMedia component. This could allow them to obtain sensitive information via a crafted HTML page...

CVE-2026-79288

A flaw was found in Google Chrome's Autofill feature on Android. Improper input validation allows a remote attacker to obtain sensitive information by tricking a user into visiting a specially crafted HTML page. This vulnerability could lead to the exposure of sensitive user data...

CVE-2026-79246

A flaw was found in chromium-browser. An information leak vulnerability exists in the DataTransfer component of Google Chrome. A remote attacker could exploit this by enticing a user to visit a specially crafted HTML page, leading to the disclosure of sensitive information...

CVE-2026-79055

A flaw was found in Google Chrome on Android. An information leak vulnerability exists in the Sharing feature. A local attacker, by leveraging social engineering tactics, could exploit this flaw through a co-installed application, potentially leading to the disclosure of sensitive information...

CVE-2026-78977

A flaw was found in Google Chrome. An uninitialized resource in the GPU component of Google Chrome on Android could allow a remote attacker to exploit this vulnerability. By crafting a malicious HTML page, the attacker could potentially read memory contents from within the sandbox environment,...

CVE-2026-79126

A flaw was found in Proxy in Google Chrome. An adjacent attacker could exploit this vulnerability by sending crafted network traffic, potentially leading to the disclosure of sensitive information. This issue stems from an incorrect provision of specified functionality within the Proxy component...

CVE-2026-79146

A flaw was found in CustomTabs in Google Chrome. A local attacker could exploit this vulnerability through a co-installed application. This could result in an information leak, allowing the attacker to access cross-origin data...

CVE-2026-79004

A flaw was found in Media in Google Chrome. A remote attacker, after compromising the renderer process, could exploit an out-of-bounds read vulnerability by using a specially crafted HTML page. This could allow the attacker to read sensitive memory outside of the browser's security sandbox, leadi...

CVE-2026-78896

A flaw was found in Google Chrome. This vulnerability, located in the StorageAccessAPI, allows a remote attacker to exploit it by crafting a malicious HTML page. Successful exploitation could lead to an information leak, enabling the attacker to obtain sensitive cross-origin data...

CVE-2026-79287

A flaw was found in chromium-browser. A remote attacker could exploit an observable discrepancy in Forms by crafting a malicious HTML page. This could allow the attacker to obtain sensitive information from the user...

CVE-2026-79293

A flaw was found in chromium-browser. A remote attacker could exploit an information leak in the Animation component by crafting a malicious HTML page. This could allow the attacker to obtain sensitive information from the user's browser...

CVE-2026-79291

A flaw was found in Google Chrome. A remote attacker could exploit this vulnerability by enticing a user to visit a specially crafted HTML page. This could lead to an information leak, allowing the attacker to obtain sensitive information...

CVE-2026-79271

A flaw was found in Google Chrome. An information leak vulnerability exists in the Document Object Model DOM. A remote attacker could exploit this by leveraging social engineering tactics to trick a user into visiting a specially crafted HTML page. This could allow the attacker to obtain sensitiv...