CVE-2025-61163

Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with untrusted domains. This occurs via the server failing to validate the Origin header of incoming connection requests...

CVE-2026-41262 Fleet: Cross-Team Policy Data Exposure via Global Policy Read Endpoint

Fleet is an open-source device management platform built on osquery. In versions prior to 4.85.0, the global policy read endpoint GET /api/latest/fleet/policies/policyid fails to verify team ownership of the requested policy, allowing an authenticated user with observer-level access on any single...

CVE-2026-41262 Fleet: Cross-Team Policy Data Exposure via Global Policy Read Endpoint

Fleet is an open-source device management platform built on osquery. In versions prior to 4.85.0, the global policy read endpoint GET /api/latest/fleet/policies/policyid fails to verify team ownership of the requested policy, allowing an authenticated user with observer-level access on any single...

CVE-2026-41262

Fleet is an open-source device management platform built on osquery. In versions prior to 4.85.0, the global policy read endpoint GET /api/latest/fleet/policies/policyid fails to verify team ownership of the requested policy, allowing an authenticated user with observer-level access on any single...

CVE-2026-41262

Fleet (open-source device management platform) versions prior to 4.85.0 contain an authorization bypass in the global policy read endpoint. The GetPolicyByIDQueries handler authorizes against an empty policy object with a nil TeamID, which the OPA policy rule permits for any user holding a role o...

EUVD-2026-66659

Fleet is an open-source device management platform built on osquery. In versions prior to 4.85.0, the global policy read endpoint GET /api/latest/fleet/policies/policyid fails to verify team ownership of the requested policy, allowing an authenticated user with observer-level access on any single...

CVE-2026-41262 Fleet: Cross-Team Policy Data Exposure via Global Policy Read Endpoint

Fleet is an open-source device management platform built on osquery. In versions prior to 4.85.0, the global policy read endpoint GET /api/latest/fleet/policies/policyid fails to verify team ownership of the requested policy, allowing an authenticated user with observer-level access on any single...

SUSE CVE-2026-79267

Race condition in Workers in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-79269

Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-79273

Incorrect reference resolution in WebView in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

CVE-2026-79269

A flaw was found in ANGLE, a component of Chromium. A remote attacker could exploit an uninitialized resource vulnerability by enticing a user to visit a specially crafted HTML page. This could potentially allow the attacker to bypass the web origin policy, leading to unauthorized access to...

CVE-2026-79190

A flaw was found in Extensions in Google Chrome. A remote attacker, after compromising the renderer process, could exploit incorrect authorization to bypass the web origin policy via a crafted HTML page. This could allow the attacker to circumvent security restrictions, potentially leading to...

CVE-2026-79123

A flaw was found in Google Chrome. Improper input validation in the New Tab Page NTP Footer allows a remote attacker, who has already compromised the renderer process, to bypass the web origin policy. This can be achieved by enticing a user to visit a crafted HTML page...

CVE-2026-79260

A flaw was found in Google Chrome. Improper input validation in the Cookies component allowed a remote attacker, who had already compromised the renderer process, to bypass the web origin policy. This could be achieved by enticing a user to visit a crafted HTML page, potentially leading to...

CVE-2026-79060

An incorrect authorization flaw was found in the StorageAccessAPI component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=519254827...

CVE-2026-79106

A flaw was found in Google Chrome. Improper input validation in the Input component allows a remote attacker, who has already compromised the renderer process and leveraged social engineering, to bypass the web origin policy. This could lead to unauthorized access to sensitive information or...

CVE-2026-79237

An incorrect authorization flaw was found in the Navigation component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=499068536...

CVE-2026-79238

A flaw was found in ServiceWorker in Google Chrome. This incorrect authorization vulnerability allows a remote attacker, by leveraging social engineering tactics and a specially crafted Chrome extension, to bypass the web origin policy. Bypassing the web origin policy could lead to unauthorized...

CVE-2026-79264

A flaw was found in Google Chrome. This vulnerability, caused by incorrect reference resolution in the Preload component, allows a remote attacker to bypass the web origin policy. By crafting a malicious HTML page, an attacker could potentially access sensitive information or perform unauthorized...

CVE-2026-79262

A flaw was found in Google Chrome. Incorrect authorization in the Network component allowed a remote attacker to bypass the web origin policy by crafting a malicious HTML page. This bypass could enable an attacker to access restricted resources or data from other origins, potentially leading to...