PT-2026-88752

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Incorrect authorization in the PushAPI allows a remote attacker who has compromised the renderer process to bypass the web origin policy using a crafted HTML page. The web origin policy...

PT-2026-88722

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in FedCM Federated Credential Management, an API that allows users to sign into websites using their existing accounts from other providers allows a remote attacke...

PT-2026-88534

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in Cross-Origin Resource Sharing CORS, a mechanism that allows restricted resources on a web page to be requested from another domain, enables a remote attacker wh...

PT-2026-88536

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Incomplete cleanup in the Browser component allows a remote attacker to bypass the web origin policy, which is a security mechanism that restricts how a document or script loaded from o...

PT-2026-88598

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in the WebUI allows a remote attacker who has compromised the renderer process to bypass the web origin policy using a crafted HTML page. The web origin policy is ...

PT-2026-88608

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Incorrect authorization in the Loader component allows a remote attacker to bypass the web origin policy, which is a security mechanism that restricts how a document or script loaded fr...

PT-2026-88650

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Improper encoding or escaping of output in CSS allows a remote attacker to potentially bypass the web origin policy, which is a security mechanism that restricts how a document or scrip...

PT-2026-88651

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Improper certificate validation in Cross-Origin Resource Sharing CORS, a mechanism that allows restricted resources on a web page to be requested from another domain, enables a remote...

PT-2026-88542

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description A confused deputy issue in the Prerender component allows a remote attacker who has compromised the renderer process to potentially bypass the web origin policy using a crafted HTML pag...

PT-2026-88547

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Incorrect authorization in the Network component allows a remote attacker to bypass the web origin policy, which is a security mechanism that restricts how a document or script loaded...

PT-2026-86968

Name of the Vulnerable Software and Affected Versions Armoury Crate affected versions not specified Description A permissive Cross-domain Security Policy with untrusted domains allows a remote user to obtain a local user's NTLM hash. This occurs when a user is convinced to visit a crafted web pag...

PT-2026-87677

Untrusted pointer dereference in Windows Group Policy allows an authorized attacker to elevate privileges over a network...

PT-2026-87063

Name of the Vulnerable Software and Affected Versions XenForo versions prior to 2.3.13 Description A missing authorization issue exists in the force-agreement controller. This allows any ACP administrator to access and submit force-agreement forms, bypassing the assigned permissions and the optio...

CVE-2026-69717: Untrusted Pointer Dereference

Untrusted pointer dereference in Windows Group Policy allows an authorized attacker to elevate privileges over a network...

PT-2026-86952

SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-privileged attacker could exploit this weakness by manipulating a connected backend system to trigger affected functionality. This could allow arbitrary command...

CVE-2026-12962: Permissive Cross-domain Policy with Untrusted Domains

A Permissive Cross-domain Security Policy with Untrusted Domains in Armoury Crate allows a remote user to obtain a local user's NTLM hash by convincing the user to visit a crafted web page that sends a request containing a UNC path to the application's local service endpoint.Refer to the ' Securi...

CVE-2026-62895: Permissive Cross-domain Policy with Untrusted Domains

Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate privileges over a network...

PT-2026-87213

Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate privileges over a network...

PT-2026-87174

AshLua exposes Ash read actions to Lua scripts run through an eval action. A read call accepts an operation list, min, max, first, sum, avg that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value. Ash field policies redact forbidden fields on returned records...

PT-2026-87175

AshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type min, max, sum, avg that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value. Ash field policies redact forbidden fields on returned records replacing them with...