EUVD-2026-94012

Backstage: Improper preservation of access restrictions during service credential delegation...

CVE-2026-106301

A flaw was found in the Contextual Tasks component of chromium-browser. This flaw allows a remote attacker who has already compromised the renderer process to bypass access restrictions into privileged browser pages. By convincing a user to open a crafted HTML page, the attacker exploits a confus...

CVE-2026-106492

Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaults package is affected by improper preservation of access restrictions during service credential delegation. An external service credential configured with access restrictions...

CVE-2026-106492 Backstage: Improper preservation of access restrictions during service credential delegation

Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaults package is affected by improper preservation of access restrictions during service credential delegation. An external service credential configured with access restrictions...

CVE-2026-106492

The Backstage framework is vulnerable in the @backstage/backend-defaults package prior to versions 0.16.1 and 0.17.8 . The root cause is the improper preservation of access restrictions during service credential delegation. Specifically, an external service credential with restrictions (such as r...

HPESBNW05158 rev.1 - Multiple Vulnerabilities in HPE Networking ClearPass Policy Manager (CPPM)

Potential Security Impact: Local: Access Restriction Bypass SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Aruba ClearPass Enterprise Software - Please refer to Vulnerability Summary for information on impacted software verisions. - Any hardware running the affected software is...

dnsresolver

dnsresolver A Lightning-Fast DNS Resolver Table of Contents Installation Usage Basic Usage Resolving Hosts with Ports Virtual Host Enumeration Using Unresolved Domains Using Localhost Demonstrations Feedback License Installation Make sure you have rust installed, then run the following command to...

HPESBNW05155 rev.2 - HPE Telco Service Orchestrator, Multiple Vulnerabilities

Potential Security Impact: Remote: Access Restriction Bypass, Unauthorized Data Injection, memory corruption SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Telco Service Orchestrator Prior to v5.7.1 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | |...

Linux Distros Unpatched Vulnerability : CVE-2026-102297

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ZoneMinder before 1.38.4 fails to apply per-monitor access restrictions in the FramesController index endpoint. Authenticated users with Events view permission...

DEBIAN-CVE-2026-95370

Inappropriate implementation in NFC in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-95376: Externally Controlled Reference to a Resource in Another Sphere

Externally controlled reference in DevTools in Google Chrome prior to 154.0.8037.57 allowed an adjacent attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. Chromium security severity: Medium...

HPESBNW05150 rev.1 - Multiple Vulnerabilities in HPE Networking Instant On APs

Potential Security Impact: Local: Access Restriction Bypass, Escalation of Privilege; Remote: Access Restriction Bypass, Code Execution, Denial of Service DoS, Server-Side Request Forgery SSRF SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Networking Instant On Access Points...

CVE-2026-100693

A flaw was found in Hugo. Case-sensitive validation in the URL deny rule mechanism allows an attacker to bypass access restrictions. By supplying mixed-case URL schemes when fetching remote resources, an attacker can access restricted network destinations, such as localhost or internal IP...

CVE-2026-79108

A flaw was found in Google Chrome's Web Authentication Passkeys & Security Keys feature. A remote attacker could leverage social engineering techniques by presenting a crafted HTML page to a user. This misrepresentation in the user interface could allow the attacker to bypass system access...

Astra Linux – Vulnerability in Chromium

Incorrect reference resolution in passwords in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions through a crafted file. Chromium security severity: Medium...

DRUPAL-CONTRIB-2026-183

This module enables sites to block access for the administrative user account user 1 or users with the administrator role. The module does not sufficiently enforce these access restrictions across all supported authentication mechanisms. As a result, a blocked administrative user may still be abl...

HPESBNW05137 rev.1 - Multiple Vulnerabilities in HPE Networking Analytics and Location Engine (ALE)

Potential Security Impact: Local: Access Restriction Bypass SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. ArubaOS Wi-Fi Controllers and Gateways ALE 5.0.0.0 and below CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2026-76708 |...

EUVD-2026-79987

Confused deputy in PriceTracking in Google Chrome on on iOS prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions into a privileged page via crafted network traffic. Chromium security severity: Medium...

HPESBNW05135 rev.1 - Multiple Vulnerabilities in HPE Networking EdgeConnect SD-WAN Gateways & Orchestrator

Potential Security Impact: Local: Access Restriction Bypass SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Aruba EdgeConnect Enterprise Orchestration Software - Please refer to the "Vulnerability Summary" section for details about affected software versions Aruba EdgeConnect...

CVE-2026-87548

A flaw was found in the Installer component of Google Chrome. A remote attacker could exploit this vulnerability by enticing a user to visit a specially crafted HTML page. This improper state validation could allow the attacker to bypass system access restrictions, potentially leading to...