CVE-2026-79042

CVE-2026-79042 is a missing authorization flaw in the Payments component of Google Chrome on Android , affecting versions prior to 152.0.7977.65 . A remote attacker, leveraging social engineering, could exploit the issue through a crafted HTML page to potentially bypass system access restrictions...

CVE-2026-79226

Google Chrome prior to 152.0.7977.65 is affected by an improper privilege management flaw in the Regional Capabilities component. A remote attacker leveraging social engineering can exploit this through a crafted Chrome extension to bypass system access restrictions . Chromium rates the severity ...

CVE-2026-79067

Missing authorization in the Network component of Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had already compromised the renderer process to bypass system access restrictions via a crafted HTML page. The vulnerability is classified as Medium severity by Chromium. The attac...

CVE-2026-79088

An incorrect authorization flaw in the FileSystem component of Google Chrome prior to 152.0.7977.65 allowed a remote attacker, leveraging social engineering , to bypass system access restrictions by delivering a crafted HTML page. The Chromium project rated the issue as Medium severity. The fix i...

CVE-2018-12596

CVE-2018-12596 Ektron CMS 9.20 SP2 permite que atacantes remotos chamem páginas aspx através da página "activateuser.aspx", mesmo que uma página esteja localizada sob o caminho /WorkArea/, o que é proibido normalmente disponível exclusivamente para administradores locais. Publicação no Exploit-DB...

PT-2026-81688

Improper input validation in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. Chromium security severity: Low...

dnsresolver

dnsresolver Un risolutore DNS veloce come un lampo Indice dei contenuti Installazione Utilizzo Utilizzo di base Risoluzione di host con porte Enumerazione degli host virtuali Utilizzo di domini non risolti Utilizzo di localhost Dimostrazioni Feedback Licenza Installazione Assicurati di avere Rust...

CVE-2026-76235

A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service. Mitigation Restrict network access...

CVE-2026-17595

Nexus Repository 3 did not fully sandbox JEXL expressions used in Content Selectors. An account holding the nexus:selectors:create permission could construct an expression that read Java object properties not intended to be exposed to the expression engine, disclosing internal JVM class metadata...

EUVD-2026-54519

Nexus Repository 3 did not fully sandbox JEXL expressions used in Content Selectors. An account holding the nexus:selectors:create permission could construct an expression that read Java object properties not intended to be exposed to the expression engine, disclosing internal JVM class metadata...

EUVD-2025-210627

When secondary user stores are configured, the implicit-association resolver incorrectly initializes from a secondary user store and bypasses the primary user store during search and uniqueness checks. This allows a subject to be associated with an unintended local account if the same lookup clai...

CVE-2021-32084

An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. If a customer restricts access to the web console by IP address or subnets, the API endpoints are not restricted. If credentials/API keys are known to an attacker, the appliance can still be accessed via the API,...

CVE-2026-43760

An access issue was addressed with improved access restrictions. This issue is fixed in macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to access user-sensitive data...

CVE-2026-16242

A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert and without token-based agent authentication, so client certificates were not validated. A remote attacker who can reach the Konnectivity...

EUVD-2026-45012

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to users with admin access. An authenticated user could call IMAP LISTRIGHTS against any mailbox they could name and learn what principals had what access to it. This action should have been restricted ...

CVE-2026-56352

n8n before 2.19.3 contains a file path restriction bypass in the legacy ExecuteWorkflow node's localFile source option, which reads workflow files from disk without the file-access checks enforced by other file-reading nodes. Although hidden from the UI since v1.2, it remains reachable via the RE...

CVE-2026-57474

The CVE entry CVE-2026-57474 concerns Deloitte AI Assist for Customer. Public-facing API endpoints accepted unauthenticated requests, exposing configuration information that could aid an attacker’s reconnaissance. The root cause is exposure of configuration data via unauthenticated access to API ...

PT-2026-56028

Name of the Vulnerable Software and Affected Versions FOSSBilling versions 0.6.10 through 0.7.2 Description An issue exists in the Config::prettyPrintArrayToPHP method where string values are written into the config.php file without escaping single quotes during configuration updates. Since...

DRUPAL-CONTRIB-2026-060

The optional Paragraphs Library module allows the reuse of paragraphs in multiple places. The module doesn't sufficiently restrict access to unpublished library items in lists. This vulnerability is mitigated by the fact the paragraphs\library module must be in use, and that an attacker must have...

PT-2026-49149

Name of the Vulnerable Software and Affected Versions Microweber versions prior to 2.0.21 Description A path traversal issue exists in the API Endpoint component. A remote attacker can manipulate the cache path relative argument within the userfiles path function of the '/api nosession/thumbnail...