CVE-2026-106295

Incorrect authorization in Unbounded Element in Google Chrome prior to...

CVE-2026-106205

Missing authorization in Passwords in Google Chrome on on Android prio...

CVE-2026-104050: Authorization Bypass Through User-Controlled Key

The Academy LMS WordPress plugin before 4.0.0 does not verify that a quiz question belongs to the course the requesting user is authorized to access before returning that question's answer options, allowing any authenticated user with access to a single course, such as an enrolled student, to rea...

CVE-2026-104651: Authorization Bypass Through User-Controlled Key

The Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 does not verify authorization or that the requesting user owns the target order in several of its order payment-processing actions, allowing any authenticated user, including subscribers, to act on and alter orders belonging to...

PT-2026-107700

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.3 Splunk Enterprise versions prior to 10.2.7 Splunk Enterprise versions prior to 10.0.10 Description An authorization bypass exists in the Representational State Transfer REST API. A user with the edit...

Linux Distros Unpatched Vulnerability : CVE-2026-106329

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute...

PT-2026-107539

Name of the Vulnerable Software and Affected Versions praisonai-platform versions prior to 0.1.9 Description Issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member can delete a dependency from an owner-created issue by accessing it through a...

PT-2026-107687

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.3 Splunk Enterprise versions prior to 10.2.7 Splunk Enterprise versions prior to 10.0.10 Splunk Enterprise versions prior to 9.4.15 Splunk Secure Gateway versions prior to 3.10.11 Splunk Secure Gateway...

CVE-2026-106208

Missing authorization in API in Google Chrome prior to 155.0.8059.39 a...

CVE-2026-106365

Missing authorization in Animation in Google Chrome prior to 155.0.805...

CVE-2026-106289

Missing authorization in FedCM in Google Chrome prior to 155.0.8059.39...

CVE-2026-106267

Missing authorization in Network in Google Chrome prior to 155.0.8059...

CVE-2026-106196

Missing authorization in Navigation in Google Chrome on on iOS prior t...

CVE-2026-106199

Incorrect authorization in Actor in Google Chrome on on Android prior...

CVE-2026-106362

Missing authorization in DevTools in Google Chrome prior to 155.0.8059...

CVE-2026-106280

Incorrect authorization in PermissionElement in Google Chrome prior to...

CVE-2026-106195

Incorrect authorization in Chromoting in Google Chrome on on Mac prior...

CVE-2026-106297

Incorrect authorization in Scheduling in Google Chrome prior to 155.0...

CVE-2026-106363

Missing authorization in FullScreen in Google Chrome prior to 155.0.80...

CVE-2026-76278: Authorization Bypass Through User-Controlled Key

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the editspl2modulepermissions capability could use the affected Representational State Transfer REST API to access permission grants for SPL2 modules that the user does not have permission to view. The...