CVE-2026-106389: Incorrect Authorization

Incorrect authorization in USB in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. Chromium security severity: Medium...

CVE-2026-106404: Incorrect Authorization

Incorrect authorization in FontAccess in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106199: Incorrect Authorization

Incorrect authorization in Actor in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially bypass site isolation via a crafted HTML page. Chromium security severity: Low...

PT-2026-107037

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description Missing authorization in the Animation component allows a remote attacker to bypass the web origin policy, which is a security mechanism that restricts how a document or script loaded...

PT-2026-107061

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description Incorrect authorization in the USB component allows a remote attacker to bypass system access restrictions. This is achieved by leveraging social engineering to induce the installation ...

PT-2026-106870

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description Incorrect authorization in Chromoting on Mac allows a remote attacker to bypass system access restrictions by sending crafted network traffic. Recommendations Update Google Chrome to...

PT-2026-106979

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description Incorrect authorization in DevTools allows a local attacker to bypass system access restrictions by using a crafted HTML page. Recommendations Update Google Chrome to version...

PT-2026-107016

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description Missing authorization in Permissions allows a remote attacker who has compromised the renderer process and used social engineering to bypass system access restrictions through a crafted...

PT-2026-107090

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description Missing authorization in the Network component allows a remote attacker to bypass the web origin policy—a security mechanism that restricts how a document or script loaded from one orig...

PT-2026-106953

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description Incorrect authorization in the PermissionElement allows a remote attacker to potentially bypass the web origin policy, which is a security mechanism that restricts how a document or...

PT-2026-106961

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description Missing authorization in the Browser component allows a remote attacker to bypass system access restrictions. This is achieved by leveraging social engineering to entice a user to visit...

PT-2026-106917

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description Incorrect authorization in Permissions allows a remote attacker to bypass system access restrictions by sending crafted network traffic. Recommendations Update Google Chrome to version...

PT-2026-106980

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description Incorrect authorization in the Network component allows a remote attacker who has compromised the renderer process to bypass system access restrictions by using a crafted HTML page...

PT-2026-106999

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description Incorrect authorization in Core allows a remote attacker who has compromised the renderer process to bypass system access restrictions by using a crafted HTML page. Recommendations Upda...

PT-2026-107079

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description Incorrect authorization in the GetUserMedia function allows a remote attacker who has compromised the renderer process to bypass system access restrictions by using a crafted HTML page...

PT-2026-107252

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs json file, bson file, jfile make, bfile make, and jbin file are affected because each does not enforce FILE privilege ...

CVE-2026-105572: Authorization Bypass Through User-Controlled Key

A vulnerability has been found in PickMall Lilishop up to 4.2.4. This affects an unknown function of the file /buyer/trade/receipt of the component Buyer Invoice List. Such manipulation of the argument memberId leads to authorization bypass. It is possible to launch the attack remotely. The explo...

PT-2026-107156

Name of the Vulnerable Software and Affected Versions Kibana versions 8.14.0 through 8.19.21 Kibana versions 9.0.0 through 9.4.6 Kibana versions 9.5.0 through 9.5.3 Description An authorization bypass exists in the Fleet package installation process where a user with delegated package-management...

AlmaLinux 9 : sudo (ALSA-2026:75571)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:75571 advisory. sudo: sudo: TZ environment variable allows bypass of NOTBEFORE/NOTAFTER time-based authorization CVE-2026-96512 Tenable has extracted the preceding description...

Elasticsearch 9.0.x < 9.4.8 / 9.5.x < 9.5.5 Incorrect Authorization (ESA-2026-199)

The version of Elasticsearch installed on the remote host is 9.0.x prior to 9.4.8, or 9.5.x prior to 9.5.5. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-199 advisory. - Authorization Bypass Through User-Controlled Key CWE-639 in Elasticsearch can lead to Information...