59084 matches found
Shopper: Media sub-form store() still lacks authorization (Incomplete fix for GHSA-h4mp-g9c6-xwph)
Title Missing authorization on Media sub-form store action allows unpermissioned product media update Description A lack of authorization control on the store method was found in packages/admin/src/Livewire/Components/Products/Form/Media.php. The security fix released for GHSA-h4mp-g9c6-xwph adde...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization through the store function. An attacker can modify product thumbnail and gallery images without proper authorization by invoking the store method on the media component during an authenticated admin-panel session...
Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component
Title Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component Description A lack of authorization control was discovered in the stockAction method in packages/admin/src/Livewire/Components/Products/VariantStock.php. The component exposes a public $variant...
GHSA-G3F9-G5VJ-P62F Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component
Title Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component Description A lack of authorization control was discovered in the stockAction method in packages/admin/src/Livewire/Components/Products/VariantStock.php. The component exposes a public $variant...
Shopper: privilege escalation via improper Livewire admin component authorization
Summary Three Livewire admin components in shopper/framework latest master at commit fcd0c59, released as v2.8.0 gate state-mutating actions on the read-only viewusers permission. This is the same class as the issue Shopper fixed in v2.8.0 / PR 511 / GHSA-f946-9qp6-vgch — the PR moved most write...
GHSA-J328-XMGP-J4Q3 Shopper: privilege escalation via improper Livewire admin component authorization
Summary Three Livewire admin components in shopper/framework latest master at commit fcd0c59, released as v2.8.0 gate state-mutating actions on the read-only viewusers permission. This is the same class as the issue Shopper fixed in v2.8.0 / PR 511 / GHSA-f946-9qp6-vgch — the PR moved most write...
Shopping privilege escalation through missing authorization in Settings components
Summary Four Livewire components in the Settings area expose destructive Filament actions delete / edit that perform no server-side authorization. Any authenticated user who can reach the Settings pages — i.e. holding only the coarse accesssetting permission, without being an admin and without an...
CVE-2026-89547
A flaw was found in the Linux kernel's SUNRPC component. A local administrator, under specific conditions of memory pressure or fault injection during RPC server startup, can trigger a failure in per-CPU counter allocation. This failure leads to uninitialized counters, which, when subsequently...
EUVD-2026-76208
Editor SQL Injection in Amelia = 2.4.9 versions...
CVE-2026-89212
creationtimestamp| type| source ---|---|--- 2026-09-11 15:00:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvatghix5j24 2026-09-11 15:01:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/6qajrzwbl6j67 2026-09-11 15:20:05+00:00| seen|...
CVE-2026-87643
A flaw was found in Google Chrome. An integer overflow vulnerability exists in the Graphics Processing Unit GPU. A remote attacker could exploit this by enticing a user to visit a specially crafted HTML page. This could potentially lead to arbitrary code execution outside of the browser's securit...
CVE-2026-87638
A flaw was found in Google Chrome's Media component. A remote attacker could exploit an out-of-bounds write vulnerability by enticing a user to visit a specially crafted HTML page. This could potentially allow the attacker to execute arbitrary code outside of the browser's security sandbox...
CVE-2026-87569
A flaw was found in Google Chrome. Missing authorization in the Views component allows a remote attacker, leveraging social engineering, to bypass system access restrictions. This can be achieved by enticing a user to open a specially crafted HTML page...
CVE-2026-87558
An use after free flaw was found in the Payments component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=553128689...
CVE-2026-87528
A type confusion flaw was found in the Rust component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=539569491...
CVE-2026-87526
A flaw was found in Chromium. A remote attacker leveraging social engineering could exploit a use-after-free vulnerability in the Passwords component. This could potentially allow the attacker to execute arbitrary code outside the sandbox via user interface interaction...
CVE-2026-87474
A flaw was found in Google Chrome. A use-after-free vulnerability in the Payments component could allow a remote attacker to execute arbitrary code outside of the browser's security sandbox. This exploitation is possible by enticing a user to visit a specially crafted HTML page...
CVE-2026-87470
An improper quantity validation flaw was found in the Tint component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=536446354...
CVE-2026-87447
A flaw was found in the Network component of Google Chrome. This vulnerability, stemming from incorrect authorization, could allow a remote attacker to bypass the web origin policy. By leveraging social engineering and a specially crafted Chrome extension, an attacker could potentially gain...