CVE-2026-106224

A missing authorization flaw was found in the Google Lens component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/502278429...

CVE-2026-106217

A missing authorization flaw was found in the Google Lens component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/501770489...

CVE-2026-106198

A missing authorization flaw was found in the FileSystem component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/510773353...

CVE-2026-106194

A missing authorization flaw was found in the WebAppInstalls component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/498739277...

CVE-2026-106196

A missing authorization flaw was found in the Navigation component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/504215649...

CVE-2026-108096

Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category before 3.1.2 might allow an authenticated remote user to read records owned by other users of the same application via crafted queries. This issue has been addressed in...

CVE-2026-108096 Improper authorization in query resolvers for SQL-backed models in AWS Amplify API Category

Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category before 3.1.2 might allow an authenticated remote user to read records owned by other users of the same application via crafted queries. This issue has been addressed in...

CVE-2026-108096

The AWS Amplify API Category contains an improper authorization vulnerability in the query resolvers generated by the @aws-amplify/graphql-index-transformer component. This flaw exists in versions prior to 3.1.2 and allows an authenticated remote user to read records owned by other users within t...

CVE-2026-108096 Improper authorization in query resolvers for SQL-backed models in AWS Amplify API Category

Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category before 3.1.2 might allow an authenticated remote user to read records owned by other users of the same application via crafted queries. This issue has been addressed in...

WordPress Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin <= 6.2.5 - Missing Authorization to Authenticated (Custom+) Sensitive Data Exposure and Modification vulnerability

Missing Authorization to Authenticated Custom+ Sensitive Data Exposure and Modification vulnerability discovered by Nadir Şensoy in WordPress Plugin FluentForm versions = 6.2.5...

WordPress AI Puffer – AI Chatbot, AI Writer & Automation plugin <= 2.4.89 - Missing Authorization to Authenticated (Subscriber+) Semantic Search Settings Modification vulnerability

Missing Authorization to Authenticated Subscriber+ Semantic Search Settings Modification vulnerability discovered by Wordfence PRISM in WordPress Plugin GPT3 AI Content Writer versions = 2.4.89...

WordPress AI Puffer – AI Chatbot, AI Writer & Automation plugin <= 2.4.89 - Missing Authorization to Authenticated (Subscriber+) Global Plugin Settings Modification vulnerability

Missing Authorization to Authenticated Subscriber+ Global Plugin Settings Modification vulnerability discovered by Wordfence PRISM in WordPress Plugin GPT3 AI Content Writer versions = 2.4.89...

CVE-2026-106324

An incorrect authorization flaw was found in the WebAppInstalls component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/501171258...

CVE-2026-106222

An incorrect authorization flaw was found in the Sync component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/496623893...

CVE-2026-106208

A missing authorization flaw was found in the API component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/497062057...

CVE-2026-107282

A flaw was found in AsyncHttpClient. When an application performs request retries or failovers to a different host, the client fails to properly reset the original host's security and proxy context. Consequently, an unintended destination host can receive sensitive information, including...

CVE-2026-106329

An incorrect authorization flaw was found in the FileSystem component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/562043997...

CVE-2026-108111

ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability in the GET /workflow/search endpoint that exposes other users' private workflows. Authenticated non-admin users can query this endpoint, which lacks owner or ispublic filtering, to list enabled private workflows in the sa...

CVE-2026-108112

ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' workflows via POST /workflow/del/uuid. Attackers can obtain workflow UUIDs from GET /workflow/search and supply them because softDelete skips the...

CVE-2026-108110

MOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-api document endpoints that allows authenticated users to access other users' stored objects by supplying arbitrary object paths. Attackers who know a target's object path can send it to /api/documents/fetch or...