EUVD-2026-93694

Incorrect authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106397

Incorrect authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106407

Incorrect authorization in GetUserMedia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106389

Google Chrome versions prior to 155.0.8059.39 are vulnerable to incorrect authorization within the USB component. A remote attacker can leverage social engineering and a crafted Chrome extension to bypass system access restrictions. The vulnerability has a Chromium security severity of Medium . R...

CVE-2026-106196

Google Chrome on iOS versions prior to 155.0.8059.39 is vulnerable to a missing authorization flaw in the Navigation component. A remote attacker can exploit this by using a crafted HTML page to bypass the web origin policy , potentially gaining access to a privileged page . The vulnerability is ...

EUVD-2026-93691

Incorrect authorization in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via crafted network traffic. Chromium security severity: Medium...

EUVD-2026-93684

Missing authorization in FullScreen in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106363

Missing authorization in FullScreen in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106324

Incorrect authorization in WebAppInstalls in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106324

Google Chrome on Android versions prior to 155.0.8059.39 is vulnerable to incorrect authorization within the WebAppInstalls component. A remote attacker can exploit this flaw by serving a crafted HTML page to bypass system access restrictions. The vulnerability has a Medium security severity. Whi...

EUVD-2026-93799

Incorrect authorization in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. Chromium security severity: High...

CVE-2026-106327

Google Chrome versions prior to 155.0.8059.39 are vulnerable to an incorrect authorization flaw in Core . This vulnerability allows a remote attacker who has already compromised the renderer process to bypass system access restrictions by utilizing a crafted HTML page . The Chromium security seve...

Kibana 8.19.22, 9.4.7, 9.5.4 Security Update (ESA-2026-187)

Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data Interception Authorization Bypass Through User-Controlled Key CWE-639 in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana...

CVE-2025-2995

CVE-2025-29927 인증 우회 재현 이 저장소는 next 패키지의 CVE-2025-29927 취약점을 재현한 것입니다. 재현 방법 1. 아래 단계에 따라 Next.js 애플리케이션을 클론하고 실행합니다. 2. /api/hello 엔드포인트에 대한 인증 거부를 테스트합니다. $ curl http://localhost:3000/api/hello "error":"Unauthorized"% 3. 토큰이 제공될 때 인증이 정상 작동하는지 테스트합니다. $ curl -H "Authorization: my-jwt-token-here...

POC_CVE-2026-46716

CVE-2026-46716 — Nezha 모니터링 크로스 테넌트 RCE: Cron API 인증 우회 CVE-2026-46716 을 재현하고 탐지하기 위한 실습 환경입니다. Nezha 모니터링에서 POST /api/v1/cron 엔드포인트에 관리자 권한 검사가 누락되어 RoleMember 사용자가 크로스 테넌트 원격 코드 실행을 할 수 있는 치명적인 취약점입니다. 취약점 개요 항목| 세부 정보 ---|--- CVE ID| CVE-2026-46716 GHSA| GHSA-99gv-2m7h-3hh9 CVSS| 9.9 Critical ...

CVE-2025-29927

CVE-2025-29927 - Next.js 미들웨어 권한 부여 우회 PoC 이는 Next.js 미들웨어 권한 부여 우회 취약점CVE-2025-29927에 대한 CTFCapture The Flag 스타일의 개념 증명PoC입니다. 목표는 인증 미들웨어를 우회하여 /protected 라우트에서 플래그를 획득하는 것입니다. 취약점 요약 CVE : CVE-2025-29927 유형 : 권한 부여 우회 구성 요소 : Next.js 미들웨어 영향 : 보호된 라우트에 대한 무단 접근 PoC 대상 라우트 : /protected 예상 동작 : ...

CVE-2026-105860 Payload: Tenant authorization bypass in Multi-Tenant Plugin

Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, the default tenant array field access allows an authenticated user to assign the user's own account to other tenants...

CVE-2026-105860

The Payload headless content management system is vulnerable to a tenant authorization bypass in the @payloadcms/plugin-multi-tenant plugin. In versions before 3.90.0 and canary versions before 4.0.0-canary.34 , the default tenant array field access allows an authenticated user to assign their ow...

CVE-2026-105860 Payload: Tenant authorization bypass in Multi-Tenant Plugin

Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, the default tenant array field access allows an authenticated user to assign the user's own account to other tenants...

CVE-2026-105860 Payload: Tenant authorization bypass in Multi-Tenant Plugin

Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, the default tenant array field access allows an authenticated user to assign the user's own account to other tenants...