CVE-2025-25257

Fortinet FortiWeb CVE-2025-25257 Vulnerability Tester Description This PowerShell script is designed for authorized penetration testing purposes only. It tests Fortinet FortiWeb appliances for CVE-2025-25257, an unauthenticated SQL injection vulnerability in the /api/fabric/device/status endpoint...

CVE-2026-104651

The Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 does not verify authorization or that the requesting user owns the target order in several of its order payment-processing actions, allowing any authenticated user, including subscribers, to act on and alter orders belonging to...

CVE-2026-104678

The CP Media Player WordPress plugin (versions before 1.3.4 ) is vulnerable to an improper access control flaw in its settings-page handler . Due to a lack of capability checks, users with only Contributor-level access can perform actions reserved for administrators, such as creating, modifying, ...

CVE-2026-106355

A missing authorization flaw was found in the Media component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/559777100...

CVE-2026-106350

An incorrect authorization flaw was found in the Browser component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/553270559...

CVE-2026-106195

An incorrect authorization flaw was found in the Chromoting component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/553930843...

CVE-2026-106371

An incorrect authorization flaw was found in the Transactions Platform component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/553326010...

CVE-2026-106270

An incorrect authorization flaw was found in the WebAppInstalls component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/553269860...

CVE-2026-106288

A missing authorization flaw was found in the Browser component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/553274076...

CVE-2026-106249

An incorrect authorization flaw was found in the Autofill component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/552440317...

CVE-2026-106259

An incorrect authorization flaw was found in the PermissionElement component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/540076586...

CVE-2026-106422

An incorrect authorization flaw was found in the API component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/519458746...

CVE-2026-106309

An incorrect authorization flaw was found in the Selection component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/503708636...

CVE-2026-81535

In wolfSSH versions prior to 1.5.1, a vulnerability exists when built with the --enable-fwd flag. The DoChannelOpen() function in src/internal.c only applies forwarding policy callbacks to direct-tcpip channel opens, allowing forwarded-tcpip opens to bypass authorization checks and remain uncappe...

CVE-2026-106471

A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. A low-privilege authenticated attacker who can access the first referenced object ca...

CVE-2026-106244

An incorrect authorization flaw was found in the Permissions component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/502475175...

EUVD-2026-94155

A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. A low-privilege authenticated attacker who can access the first referenced object ca...

CVE-2026-106471 Candlepin: candlepin: broken object-level authorization via verifyauthorizationfilter multi-@verify hasaccess latching

A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. A low-privilege authenticated attacker who can access the first referenced object ca...

CVE-2026-106471

A flaw in Candlepin involves broken object-level authorization within the central authorization filter. The system incorrectly grants access if any one of multiple @Verify-annotated parameters is accessible, rather than requiring access to every verified entity. A low-privilege authenticated atta...

CVE-2026-106471 Candlepin: candlepin: broken object-level authorization via verifyauthorizationfilter multi-@verify hasaccess latching

A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. A low-privilege authenticated attacker who can access the first referenced object ca...