CVE-2026-79046

A race condition in the Permissions component of Google Chrome on Android (prior to 152.0.7977.65 ) allows a remote attacker, leveraging social engineering with a crafted HTML page, to bypass the web origin policy , potentially leading to unauthorized access. The vulnerability carries a CVSS 4.3 ...

CVE-2026-79046

Race condition in Permissions in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-43657

Apple addressed a permissions issue in iOS 26.5 and iPadOS 26.5 that allowed a malicious app to enumerate installed apps on the device. The fix introduces additional restrictions to limit the information a third-party app can discover about other installed applications. The issue carries a CVSS 3...

CVE-2026-79783

rclone before 1.74.4 fails to mask special permission bits when applying source-supplied mode metadata in the local backend, allowing attackers to set setuid/setgid bits on attacker-controlled files. When copying with metadata preservation from an untrusted remote, attackers can plant a setuid...

UBUNTU-CVE-2026-79783

rclone before 1.74.4 fails to mask special permission bits when applying source-supplied mode metadata in the local backend, allowing attackers to set setuid/setgid bits on attacker-controlled files. When copying with metadata preservation from an untrusted remote, attackers can plant a setuid...

EUVD-2026-65521

An authenticated user may initiate repository migration operations without required repository permissions, potentially causing information disclosure, unauthorized state changes, and service disruption. Fixed versions address the issue...

CVE-2026-69104

JFrog Artifactory (self-managed) is affected by an insufficient permission enforcement flaw in repository migration operations . An authenticated user with low privileges can initiate migration operations on repositories for which they lack the required permissions, potentially leading to informa...

EUVD-2026-65472

Joomla Extension - yootheme.com - Authenticated, privileged information disclosure in YOOtheme Pro 1.0.0-5.0.41 - A missing access check allowed users with comtemplate editing permissions to access information about arbitrary modules without the respective commodules permissions...

BIT-KEYCLOAK-2026-9099 Keycloak: group-admin escalation to realm-admin

A flaw was found in Keycloak. A missing authorization check in the GroupResource.addChild endpoint within the Admin REST API allows an authenticated user with limited administrative privileges to reparent any existing group. When Fine-Grained Admin Permissions v2 FGAPv2 is enabled, an attacker wi...

CVE-2026-12878

In affected versions of the Codefresh platform an authenticated user can utilize an API endpoint to elevate to Admin permissions...

EUVD-2026-65354

In affected versions of the Codefresh platform an authenticated user can utilize an API endpoint to elevate to Admin permissions...

CVE-2026-12878

CVE-2026-12878 affects the Codefresh platform , where an authenticated user can leverage an API endpoint to escalate privileges to Admin . The CVSS 4.0 score is 8.6 (HIGH) , with high impact on confidentiality, integrity, and availability of the vulnerable system. Attack requires high privileges ...

webkitgtk: webkitgtk: Visiting a website may leak sensitive data

A flaw was found in WebKitGTK. Visiting a website can leak sensitive data due to a permissions issue that was addressed with additional restrictions...

webkitgtk: webkitgtk: Visiting a website may leak sensitive data

A flaw was found in WebKitGTK. Visiting a website can leak sensitive data due to a permissions issue that was addressed with additional restrictions...

CVE-2026-69665

SKYSEA Client View and SKYMEC IT Manager contain an issue with incorrect default permissions. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is installed may execute arbitrary code with SYSTEM privilege...

CVE-2026-69665

SKYSEA Client View and SKYMEC IT Manager contain an issue with incorrect default permissions. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is installed may execute arbitrary code with SYSTEM privilege...

CVE-2026-69665

SKYSEA Client View and SKYMEC IT Manager are affected by an incorrect default permissions issue on Windows. A local attacker with low-level access can exploit this flaw to execute arbitrary code with SYSTEM privilege , achieving full compromise of the host. The CNA (JPCERT/CC) assigned a CVSS v3....

EUVD-2026-65306

SKYSEA Client View and SKYMEC IT Manager contain an issue with incorrect default permissions. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is installed may execute arbitrary code with SYSTEM privilege...

PT-2026-81640

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 152.0.7977.65 Description A race condition in the permissions system allows a remote attacker to bypass the web origin policy. This is achieved by leveraging social engineering and directing the user ...

CVE-2026-78553

RansomLook created its Flask session-signing key without explicitly restricting the file permissions. The secretkey file was created using the process's default permissions and umask, resulting in permissions such as 0644 under a common 022 umask. Consequently, other local users able to access th...