CVE-2026-66768 Improper Access Control in SAP NetWeaver (SAP GUI for Java)

SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-privileged attacker could exploit this weakness by manipulating a connected backend system to trigger affected functionality. This could allow arbitrary command...

EUVD-2026-72577

SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-privileged attacker could exploit this weakness by manipulating a connected backend system to trigger affected functionality. This could allow arbitrary command...

PT-2026-88698

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Incorrect authorization in the ServiceWorker allows a remote attacker to bypass the web origin policy, which is a security mechanism that restricts how a document or script loaded from...

PT-2026-88536

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Incomplete cleanup in the Browser component allows a remote attacker to bypass the web origin policy, which is a security mechanism that restricts how a document or script loaded from o...

PT-2026-88650

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Improper encoding or escaping of output in CSS allows a remote attacker to potentially bypass the web origin policy, which is a security mechanism that restricts how a document or scrip...

PT-2026-88677

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Incorrect authorization in the Isolated component allows a remote attacker to bypass the web origin policy—a security mechanism that restricts how a document or script loaded from one...

PT-2026-86968

Name of the Vulnerable Software and Affected Versions Armoury Crate affected versions not specified Description A permissive Cross-domain Security Policy with untrusted domains allows a remote user to obtain a local user's NTLM hash. This occurs when a user is convinced to visit a crafted web pag...

PT-2026-87677

Untrusted pointer dereference in Windows Group Policy allows an authorized attacker to elevate privileges over a network...

PT-2026-87063

Name of the Vulnerable Software and Affected Versions XenForo versions prior to 2.3.13 Description A missing authorization issue exists in the force-agreement controller. This allows any ACP administrator to access and submit force-agreement forms, bypassing the assigned permissions and the optio...

PT-2026-88542

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description A confused deputy issue in the Prerender component allows a remote attacker who has compromised the renderer process to potentially bypass the web origin policy using a crafted HTML pag...

PT-2026-87213

Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-69717: Untrusted Pointer Dereference

Untrusted pointer dereference in Windows Group Policy allows an authorized attacker to elevate privileges over a network...

CVE-2026-62895: Permissive Cross-domain Policy with Untrusted Domains

Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate privileges over a network...

PT-2026-86952

SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-privileged attacker could exploit this weakness by manipulating a connected backend system to trigger affected functionality. This could allow arbitrary command...

CVE-2026-12962: Permissive Cross-domain Policy with Untrusted Domains

A Permissive Cross-domain Security Policy with Untrusted Domains in Armoury Crate allows a remote user to obtain a local user's NTLM hash by convincing the user to visit a crafted web page that sends a request containing a UNC path to the application's local service endpoint.Refer to the ' Securi...

PT-2026-87174

AshLua exposes Ash read actions to Lua scripts run through an eval action. A read call accepts an operation list, min, max, first, sum, avg that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value. Ash field policies redact forbidden fields on returned records...

PT-2026-87175

AshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type min, max, sum, avg that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value. Ash field policies redact forbidden fields on returned records replacing them with...

PT-2026-88661

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Incorrect authorization in Web Authentication allows a remote attacker to bypass the web origin policy, which is a security mechanism that restricts how a document or script loaded from...

PT-2026-88722

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in FedCM Federated Credential Management, an API that allows users to sign into websites using their existing accounts from other providers allows a remote attacke...

PT-2026-88726

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Incorrect authorization in DeviceBoundSessionCredentials allows a remote attacker to bypass the web origin policy through the use of crafted network traffic. Recommendations Update Goog...