SAP NetWeaver AS ABAP Missing Authorization Check (3772838)

The version of SAP NetWeaver AS ABAP detected on the remote host is affected by a missing authorization check vulnerability as referenced in SAP Security Note 3772838: - Due to a missing authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform, an authenticated attacker...

Kibana 7.x / 8.x < 8.19.21 / 9.0.x < 9.4.6 / 9.5.x < 9.5.2 Missing Authorization (ESA-2026-144)

The version of Kibana installed on the remote host is 7.14.0 through 7.17.29, or 8.x prior to 8.19.21, or 9.0.x prior to 9.4.6, or 9.5.x prior to 9.5.2. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-144 advisory. - Missing Authorization CWE-862 in Kibana can lead to...

Kibana 9.4.x < 9.4.5 Missing Authorization (ESA-2026-147)

The version of Kibana installed on the remote host is 9.4.x prior to 9.4.5. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-147 advisory. - Missing Authorization CWE-862 in Kibana can lead to information disclosure via Privilege Abuse CAPEC-122. An authorization contro...

PT-2026-88634

Missing authorization in WebView in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. Chromium security severity: Medium...

CVE-2026-75308

yshopmall

CVE-2026-79324

Missing authorization in the Address Delete controller in Mageplaza GDPR for Magento 2 mageplaza/module-gdpr through 4.2.9 allows remote unauthenticated attackers to delete any customer's saved address, and to erase all stored addresses by iterating the address id, via a GET request to...

PT-2026-88652

Missing authorization in TrustedWebActivities in Google Chrome on on Android prior to 153.0.8010.36 allowed a local attacker to obtain sensitive information via a co-installed app. Chromium security severity: High...

PT-2026-88920

Missing Authorization, Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache Nutch Server Nutch REST API. This issue affects Apache Nutch: from 1.10 through 1.22. Users are recommended to upgrade to version 1.23, which removes the Nutch Server. I...

Linux Distros Unpatched Vulnerability : CVE-2026-87543

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in Core in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass site isolatio...

Linux Distros Unpatched Vulnerability : CVE-2026-87441

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted Chrome...

Linux Distros Unpatched Vulnerability : CVE-2026-87537

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially...

Linux Distros Unpatched Vulnerability : CVE-2026-87522

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in WebView in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to potentially...

RHEL 9 : python-lxml (RHSA-2026:66204)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:66204 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

Linux Distros Unpatched Vulnerability : CVE-2026-87605

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in Contacts in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged socia...

Security Advisory 0150

Security Advisory 0150 PDF Date: September 9, 2026 Revision | Date | Changes ---|---|--- 1.0 | September 9, 2026 | Initial release Description All of the CVEs covered in this advisory apply to affected platforms running Arista EOS with 802.1X authentication and authorization enabled and Access...

CVE-2026-71807

In RuoYi-Cloud-Plus versions up to 2.6.2 , the ruoyi-workflow module contains a broken access control vulnerability. Multiple core task APIs in FlwTaskController lack permission annotations, and the Service layer does not verify whether the current user is the task handler or a related user. As a...

CVE-2026-71807

In RuoYi-Cloud-Plus = 2.6.2 in the ruoyi-workflow module, multiple core task APIs in FlwTaskController lack permission annotations, and the Service layer does not verify whether the current user is the task handler/related user. Authenticated low-privileged remote attackers can read sensitive...

Security Advisory 0179

Security Advisory 0179 PDF Date: September 9, 2026 Revision | Date | Changes ---|---|--- 1.0 | September 9, 2026 | Initial release The CVE-ID tracking this issue: CVE-2026-86106 CVSSv3.1 Base Score: 9.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVSSv4.0 Base Score: 8.7...

CVE-2026-79324

A missing authorization flaw in the Address Delete controller of the Mageplaza GDPR extension for Magento 2 (mageplaza/module-gdpr) through version 4.2.9 allows a remote, unauthenticated attacker to delete any customer's saved address via a simple GET request to /customer/address/delete/id/{id}. ...

PT-2026-89099

🚨 CVE-2026-87875 The cupsUTF32ToUTF8 function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled...