CVE-2026-106324

Google Chrome on Android versions prior to 155.0.8059.39 is vulnerable to incorrect authorization within the WebAppInstalls component. A remote attacker can exploit this flaw by serving a crafted HTML page to bypass system access restrictions. The vulnerability has a Medium security severity. Whi...

CVE-2026-106327

Google Chrome versions prior to 155.0.8059.39 are vulnerable to an incorrect authorization flaw in Core . This vulnerability allows a remote attacker who has already compromised the renderer process to bypass system access restrictions by utilizing a crafted HTML page . The Chromium security seve...

EUVD-2026-93799

Incorrect authorization in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. Chromium security severity: High...

Kibana 8.19.22, 9.4.7, 9.5.4 Security Update (ESA-2026-187)

Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data Interception Authorization Bypass Through User-Controlled Key CWE-639 in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana...

CVE-2025-2995

CVE-2025-29927 授权绕过复现 此仓库是对 next 包中 CVE-2025-29927 漏洞的复现 如何复现 1. 按照以下步骤克隆并运行 Next.js 应用程序 2. 测试授权是否拒绝访问 /api/hello 端点 $ curl http://localhost:3000/api/hello "error":"Unauthorized"% 3. 测试当提供了 token 时授权正常工作 $ curl -H "Authorization: my-jwt-token-here" http://localhost:3000/api/hello "message":"Hell...

POC_CVE-2026-46716

CVE-2026-46716 — Nezha 监控通过 Cron API 授权绕过实现跨租户 RCE 一个用于复现和检测 CVE-2026-46716 的实验室环境。该漏洞是 Nezha 监控中的一个严重漏洞：POST /api/v1/cron 端点缺少管理员权限检查，使 RoleMember 用户能够实现跨租户远程代码执行。 漏洞概述 字段| 详情 ---|--- CVE ID| CVE-2026-46716 GHSA| GHSA-99gv-2m7h-3hh9 CVSS| 9.9（严重）— AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H 受影响版本|...

CVE-2025-29927

CVE-2025-29927 - Next.js 中间件授权绕过 PoC 这是一个基于 夺旗（CTF） 风格的漏洞概念验证，适用于 Next.js 中间件授权绕过 漏洞（CVE-2025-29927 ）。目标是通过绕过认证中间件，从 /protected 路由获取旗标。 漏洞概要 CVE : CVE-2025-29927 类型 : 授权绕过 组件 : Next.js 中间件 影响 : 未授权访问受保护的路由 PoC 目标路由 : /protected 预期行为 : 未授权用户被重定向到 / 漏洞行为 : 使用精心构造的请求可以绕过重定向，直接访问受保护内容 PoC 环境搭建 1. 克隆仓...

CVE-2026-105860 Payload: Tenant authorization bypass in Multi-Tenant Plugin

Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, the default tenant array field access allows an authenticated user to assign the user's own account to other tenants...

CVE-2026-105860

The Payload headless content management system is vulnerable to a tenant authorization bypass in the @payloadcms/plugin-multi-tenant plugin. In versions before 3.90.0 and canary versions before 4.0.0-canary.34 , the default tenant array field access allows an authenticated user to assign their ow...

CVE-2026-105860 Payload: Tenant authorization bypass in Multi-Tenant Plugin

Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, the default tenant array field access allows an authenticated user to assign the user's own account to other tenants...

CVE-2026-105860 Payload: Tenant authorization bypass in Multi-Tenant Plugin

Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, the default tenant array field access allows an authenticated user to assign the user's own account to other tenants...

GHSA-7C34-32V3-J575 Payload relationship-query authorization bypass

Impact A readable collection could expose information about protected documents in a related collection. You are affected if: - You expose a readable collection with a relationship to a collection protected by access.read where constraints. Patches Users should upgrade Payload packages to = 3.90....

NPM: Payload relationship-query authorization bypass

NPM: Payload relationship-query authorization bypass vulnerability discovered by ? in WordPress Npm payload versions 3.90.0...

Payload relationship-query authorization bypass

Impact A readable collection could expose information about protected documents in a related collection. You are affected if: - You expose a readable collection with a relationship to a collection protected by access.read where constraints. Patches Users should upgrade Payload packages to = 3.90....

CVE-2026-104070

The Crayons plugin for SPIP versions before 3.5.0 is vulnerable to a missing authorization flaw in crayons_store.php. By omitting the secu_ anti-forgery parameter, unauthenticated attackers can bypass modification checks and modify arbitrary editable object fields. This allows attackers to chain ...

CVE-2026-104070 SPIP Crayons Plugin < 3.5.0 Authorization Bypass RCE

The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary editable object fields by omitting the secu anti-forgery parameter in crayonsstore.php, causing the authorization dispatcher to resolve an...

CVE-2026-105852 Payload relationship-query authorization bypass

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, querying a readable collection with a relationship to another collection can expose information about related documents protected by access.read where...

CVE-2026-105852 Payload relationship-query authorization bypass

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, querying a readable collection with a relationship to another collection can expose information about related documents protected by access.read where...

CVE-2026-105852 Payload relationship-query authorization bypass

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, querying a readable collection with a relationship to another collection can expose information about related documents protected by access.read where...

CVE-2026-105852

The Payload headless content management system is vulnerable to an authorization bypass in versions before 3.90.0 and canary versions before 4.0.0-canary.34 . The root cause is that querying a readable collection with a relationship to another collection can expose information about documents in ...