CVE-2026-95297

Missing authorization in Contextual Tasks in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

EUVD-2026-89252

Missing authorization in Contextual Tasks in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-95297

A missing authorization flaw in the Contextual Tasks component of Google Chrome (prior to version 154.0.8037.57 ) allows a remote attacker to bypass the web origin policy via a crafted HTML page. This vulnerability is listed as Medium severity by Chromium security teams. Exploitation details are ...

CVE-2026-92226

Joomla! Core - 20260913 - Core - Improper ACL checks for varous webservice edit tasks in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to perform edit actions on otherwise uneditable items...

CVE-2026-81569 Apache DolphinScheduler: Improper Authorization in Sub-Workflow Tasks Allows Unauthorized Workflow Execution

An improper authorization vulnerability exists in the handling of sub-workflow tasks. An authenticated user who does not have permission to access a target project can reference and invoke a workflow belonging to that project through a sub-workflow task. The system does not properly verify whethe...

CVE-2026-81569

Apache DolphinScheduler versions before 3.4.3 are vulnerable to an improper authorization flaw in the handling of sub-workflow tasks. The system fails to verify if an authenticated user has the necessary permissions to access a target project or execute a referenced workflow within a sub-workflow...

CVE-2026-81569 Apache DolphinScheduler: Improper Authorization in Sub-Workflow Tasks Allows Unauthorized Workflow Execution

An improper authorization vulnerability exists in the handling of sub-workflow tasks. An authenticated user who does not have permission to access a target project can reference and invoke a workflow belonging to that project through a sub-workflow task. The system does not properly verify whethe...

CVE-2026-58138

CVE-2026-58138 — 通过 GraalVM Evaluator 实现 Conductor 未授权远程代码执行 RCE -critical TL;DR： Orkes/OSS Conductor（版本 3.21.21 至 版本说明： 直至 3.29.x 的版本使用简单的 allowHostAccessHostAccess.ALL 配置，本 PoC 直接利用该配置。版本 3.30.0 和 3.30.1 引入了部分黑名单（阻止部分反射），但完整的修复（allowHostClassLoadingfalse 加上引擎加固）仅在 3.30.2 中实施。本 PoC 针对无沙箱配置。 根本原因...

CVE-2026-58138-Conductor-Unauth-RCE

CVE-2026-58138 — Conductor 未认证 RCE via INLINE GraalVM 评估器 Conductor（OSS / Orkes）3.21.21 … 至 3.30.2 在 INLINE（以及 LAMBDA / DOWHILE / SWITCH）任务中评估用户提供的 JavaScript，使用的是具有完全主机访问权限 （HostAccess.ALL）的 GraalVM 上下文。该脚本能够反射访问 java.lang.Runtime 并执行操作系统命令。社区 API 默认无认证 ，因此提交包含此类任务的工作流即为未认证的远程代码执行。 | ---|--- CVE...

CVE-2026-98163

In the Linux kernel, the following vulnerability has been resolved: cgroup: Avoid iteration of dying tasks with zero refcount The commit 260fbcb92bbea "cgroup: Move dyingtasks cleanup from cgrouptaskrelease to cgrouptaskfree" extended the lifetime of tasks on the dyingtasks list. The iterators ha...

CVE-2026-98087

In the Linux kernel, the following vulnerability has been resolved: sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate A migratedisable'd RT task cannot be moved to another CPU, but the scheduler still keeps such a task on that CPU's pushable list rq-rt.pushabletasks and still...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in Contextual Tasks in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to perform privilege escalation via a crafted HTML page. Chromium security severity: High...

Linux Distros Unpatched Vulnerability : CVE-2026-95297

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in Contextual Tasks in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a crafted HTML page...

EUVD-2026-83977

Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check...

GHSA-G26X-M427-F48F Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check

Summary The GET /api/v1/stable/durable-tasks/durable-task endpoint listDurableEventLog is missing tenant authorization validation, allowing any authenticated user to read durable task event logs from any tenant. Impact This CVE requires the attacker to successfully guess the target UUID. Any...

CVE-2026-63104

Kaneo versions 2.3.12 before 2.12.2 are vulnerable to a missing authorization flaw in the bulk task endpoint . While the system verifies workspace membership, it fails to invoke the role-based permission checks required for other task endpoints. Authenticated workspace members with viewer or memb...

CVE-2026-63104 Kaneo 2.3.12 < 2.12.2 Missing Authorization via Bulk Task Endpoint

Kaneo versions 2.3.12 before 2.12.2 contain a missing authorization vulnerability that allows authenticated workspace members with viewer or member roles to delete and modify tasks beyond their assigned permissions by exploiting the bulk task endpoint that omits workspace permission checks...

EUVD-2026-84813

Kaneo versions 2.3.12 before 2.12.2 contain a missing authorization vulnerability that allows authenticated workspace members with viewer or member roles to delete and modify tasks beyond their assigned permissions by exploiting the bulk task endpoint that omits workspace permission checks...

CVE-2026-63342 Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, api-contracts/openapi/paths/v1/workflow-runs/workflowrun.yaml defines the GET /api/v1/stable/durable-tasks/durable-task endpoint implemented by listDurableEventLog without requiri...

PT-2026-96164

Name of the Vulnerable Software and Affected Versions Ajenti versions prior to 2.2.16 Description Authenticated users can access the '/api/core/tasks/start' endpoint to enqueue the InstallPlugin, UnInstallPlugin, or UpgradeAll functions from 'plugins/plugins/tasks.py' without requiring...