CVE-2026-106270

Incorrect authorization in WebAppInstalls in Google Chrome prior to 15...

PT-2026-107462

Missing Authorization vulnerability in WP Chill Modula Image Gallery modula-best-grid-gallery allows Retrieve Embedded Sensitive Data.This issue affects Modula Image Gallery: from n/a through 3.0.11...

PT-2026-107700

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.3 Splunk Enterprise versions prior to 10.2.7 Splunk Enterprise versions prior to 10.0.10 Description An authorization bypass exists in the Representational State Transfer REST API. A user with the edit...

CVE-2026-106387

Missing authorization in Mobile in Google Chrome on on iOS prior to 15...

CVE-2026-106388

Missing authorization in DataTransfer in Google Chrome prior to 155.0...

CVE-2026-106264

Missing authorization in Web Authentication Passkeys & Security Keys...

PT-2026-107539

Name of the Vulnerable Software and Affected Versions praisonai-platform versions prior to 0.1.9 Description Issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member can delete a dependency from an owner-created issue by accessing it through a...

PT-2026-107687

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.3 Splunk Enterprise versions prior to 10.2.7 Splunk Enterprise versions prior to 10.0.10 Splunk Enterprise versions prior to 9.4.15 Splunk Secure Gateway versions prior to 3.10.11 Splunk Secure Gateway...

PT-2026-107672

Name of the Vulnerable Software and Affected Versions Amazon Athena engine version 3 Description Missing authorization checks in request handling could have allowed an authenticated user to read limited query metadata from other AWS accounts. The exposed information includes AWS account identifie...

PT-2026-107697

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.3 Splunk Enterprise versions prior to 10.2.7 Splunk Enterprise versions prior to 10.0.10 Splunk Enterprise versions prior to 9.4.15 Description An improper authorization issue exists in the REST API,...

PT-2026-107694

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.3 Splunk Enterprise versions prior to 10.2.7 Splunk Enterprise versions prior to 10.0.10 Splunk Enterprise versions prior to 9.4.15 Splunk Secure Gateway versions prior to 3.10.11 Splunk Secure Gateway...

CVE-2026-104651: Authorization Bypass Through User-Controlled Key

The Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 does not verify authorization or that the requesting user owns the target order in several of its order payment-processing actions, allowing any authenticated user, including subscribers, to act on and alter orders belonging to...

CVE-2026-104050: Authorization Bypass Through User-Controlled Key

The Academy LMS WordPress plugin before 4.0.0 does not verify that a quiz question belongs to the course the requesting user is authorized to access before returning that question's answer options, allowing any authenticated user with access to a single course, such as an enrolled student, to rea...

CVE-2026-103323: Missing Authorization

The Integration for Epos Now and WooCommerce WordPress plugin before 4.11.2 does not perform an authorization check on one of its REST endpoints, allowing unauthenticated users to retrieve the site's scheduled background tasks and their arguments, which include order identifiers and, when...

Linux Distros Unpatched Vulnerability : CVE-2026-106406

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements v...

Microsoft Exchange Server Elevation of Privilege (October 2026)

The Microsoft Exchange Server installed on the remote host is missing a security update. It is, therefore, affected by an elevation of privilege vulnerability. Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a network. CVE-2026-96940 Not...

Linux Distros Unpatched Vulnerability : CVE-2026-106407

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in GetUserMedia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass...

Linux Distros Unpatched Vulnerability : CVE-2026-106198

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass web...

Rocky Linux 9 [CIQ] Security Update: sudo / sudo-debuginfo / sudo-debugsource / sudo-python-plugin / etc (crlsa-2026_75571)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202675571 advisory. sudo: sudo: TZ environment variable allows bypass of NOTBEFORE/NOTAFTER time-based authorization CVE-2026-96512 Tenable has extracted the preceding description blo...

Linux Distros Unpatched Vulnerability : CVE-2026-106344

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged...