Google Chrome Microsoft Edge Information Disclosure

The vulnerability in the Browser component of Google Chrome and Microsoft Edge is related to improper authorization. Exploitation of this vulnerability may allow a remote attacker to gain access to protected information via a specially crafted HTML page...

CVE-2026-108064: Missing Authorization

The WP Encryption WordPress plugin before 7.8.8.2 does not perform a capability or nonce check on one of the handlers that drives its SSL certificate-provisioning routine, allowing unauthenticated users to make the WP Encryption WordPress plugin before 7.8.8.2 overwrite the site's certificate...

Google Chrome Microsoft Edge Web Authentication Passkeys Security Keys Access

The vulnerability in the Web Authentication component Passkeys and Security Keys of Google Chrome and Microsoft Edge is related to improper authorization. Exploitation of this vulnerability may allow a remote attacker to gain access to protected information via a specially crafted HTML page...

Google Chrome Microsoft Edge Data Compromise

The vulnerability in the Omnibox address strings of Google Chrome and Microsoft Edge is related to improper authorization. Exploitation of this vulnerability enables a remote attacker to compromise the integrity of protected information by using a specially crafted HTML page...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: tomcat (UTSA-2026-130103)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130103 advisory. Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This issue affects Apache Tomcat...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: rsync (UTSA-2026-130118)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130118 advisory. rsync 3.1.0 before 3.5.0contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user...

CVE-2026-92817 Inductive Automation Ignition Software Incorrect Authorization

The Ignition Perspective module does not properly validate session privileges when determining Designer-level access. An authenticated user with access to a Vision project could provide their valid Vision session identifier and gain Designer-level privileges. An attacker could exploit these...

CVE-2026-92817

The Ignition Perspective module in Inductive Automation Ignition software contains an incorrect authorization vulnerability (CWE-863). The software fails to properly validate session privileges when determining Designer-level access . Specifically, an authenticated user with access to a Vision pr...

CVE-2026-92817 Inductive Automation Ignition Software Incorrect Authorization

The Ignition Perspective module does not properly validate session privileges when determining Designer-level access. An authenticated user with access to a Vision project could provide their valid Vision session identifier and gain Designer-level privileges. An attacker could exploit these...

CVE-2026-15468

Authorization bypass through User-Controlled key vulnerability in HYPR Passwordless on Windows allows Privilege Escalation. This issue affects HYPR Passwordless: before 11.3.3...

Exploit for CVE-2026-108924

CVE-2026-108924 — Kirby dynamic field-option authorization byp...

CVE-2026-15468

Authorization bypass through User-Controlled key vulnerability in HYPR Passwordless on Windows allows Privilege Escalation. This issue affects HYPR Passwordless: before 11.3.3...

CVE-2026-15468

Authorization bypass through User-Controlled key vulnerability in HYPR Passwordless on Windows allows Privilege Escalation. This issue affects HYPR Passwordless: before 11.3.3...

CVE-2026-15468

HYPR Passwordless on Windows versions prior to 11.3.3 is vulnerable to an authorization bypass caused by a User-Controlled key vulnerability (CWE-639). This security flaw allows for Privilege Escalation . No specific exploit details or remediation steps are provided in the documents beyond the ve...

CVE-2026-110160

Missing authorization in ReadingMode in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially bypass site isolation via a crafted HTML page. Chromium security severity: High...

CVE-2026-110144

Incorrect authorization in Mojo in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. Chromium security severity: High...

CVE-2026-95695

IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization...

CVE-2026-95639

Photoshop Desktop is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim...

CVE-2026-75994

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by...

CVE-2026-71385

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an...