112025 matches found
CVE-2026-105876: Missing Authorization
Missing Authorization vulnerability in WP Chill Modula Image Gallery modula-best-grid-gallery allows Retrieve Embedded Sensitive Data.This issue affects Modula Image Gallery: from n/a through 3.0.11...
CVE-2026-104049: Authorization Bypass Through User-Controlled Key
The Academy LMS WordPress plugin before 4.0.0 does not verify course enrollment or object ownership when returning a lesson's content through one of its REST API routes, allowing users with a self-registerable student account to read the full content of arbitrary lessons, including lessons of pai...
CVE-2026-106371
Incorrect authorization in Transactions Platform in Google Chrome on o...
CVE-2026-106309
Incorrect authorization in Selection in Google Chrome on on iOS prior...
CVE-2026-106329
Incorrect authorization in FileSystem in Google Chrome prior to 155.0...
CVE-2026-105139: Incorrect Authorization
Obot 0.26.0 before 0.26.2 contains an authorization bypass vulnerability that allows authenticated users matching any vMCP profile to reach prompts and resources of ungranted components. Because profiles were enforced only on tools, attackers can access prompts, resources, and resource templates...
CVE-2026-107352: Missing Authorization
Missing authorization checks in Amazon Athena engine version 3 request handling could have allowed an authenticated user to read limited query metadata AWS account identifiers and SQL statement text from other AWS accounts. Query results, credentials, and Amazon S3 data were not affected. AWS...
CVE-2026-43976: Incorrect Authorization
wger is a free, open-source workout and fitness manager. Prior to version 2.6, five gym management views in wger apply a flawed gym-scope guard gyma != gymb that silently passes when both operands are None. A trainer with gym.gymtrainer and gym.addadminusernote permissions and no gym assignment...
CVE-2026-82211: Missing Authorization
The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment result supplied to several of its unauthenticated routes, allowing attackers to mark arbitrary orders as paid or failed, to cancel them, and to obtain order keys which expose guest buyers' details...
PT-2026-107489
Obot 0.26.0 before 0.26.2 contains an authorization bypass vulnerability that allows authenticated users matching any vMCP profile to reach prompts and resources of ungranted components. Because profiles were enforced only on tools, attackers can access prompts, resources, and resource templates...
CVE-2026-106367
Missing authorization in Mobile in Google Chrome on on Android prior t...
CVE-2026-106344
Missing authorization in Permissions in Google Chrome prior to 155.0.8...
CVE-2026-106327
Incorrect authorization in Core in Google Chrome prior to 155.0.8059.3...
CVE-2026-106328
Incorrect authorization in PDF in Google Chrome on on Android prior to...
CVE-2026-106363
Missing authorization in FullScreen in Google Chrome prior to 155.0.80...
CVE-2026-106288
Missing authorization in Browser in Google Chrome prior to 155.0.8059...
CVE-2026-106312
Missing authorization in SignIn in Google Chrome prior to 155.0.8059.3...
CVE-2026-106280
Incorrect authorization in PermissionElement in Google Chrome prior to...