CVE-2026-121560: logchimp: LogChimp 0.9.0-alpha.1 before 0.9.3 contains an authorization bypass vulnerability that allows authenticated post…

LogChimp 0.9.0-alpha.1 before 0.9.3 contains an authorization bypass vulnerability that allows authenticated post authors to modify any other post by supplying mismatched postId and id body parameters. Attackers can set postId to their own post and id to an enumerated victim post UUID to overwrit...

PT-2026-136177

SurrealDB from 3.2.0 before 3.3.0 contains a server-side request forgery vulnerability in the FilteringResolver is private ip check that fails to unwrap NAT64, 6to4, and Teredo IPv6 addresses. Authenticated users triggering outbound HTTP requests via SurrealQL http functions can use transition...

PT-2026-136316

Lightdash 0.2609.0 before 3.137.0 contains an authorization bypass vulnerability in the RenameService that allows authenticated users with update Project permission on one project to access and modify dashboards belonging to a different project, caused by the failure to verify that the projectUui...

PT-2026-136374

ag-psd is a JavaScript library for reading and writing Photoshop Document files. Prior to 31.0.3, readPsd accepts a totalMemoryLimit for parsing untrusted PSD files, but decodeLayerImageData expects a differently named memoryLimit property and therefore passes an undefined limit to...

PT-2026-136473

Incomplete cleanup in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. Chromium security severity: Low...

PT-2026-136478

Incorrect authorization in API in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

PT-2026-136491

Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-121040: Google Chrome: Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised…

Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-121087: Google Chrome: Improper input validation in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web…

Improper input validation in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: High...

CVE-2026-121222: Google Chrome: Incorrect authorization in Forms in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin…

Incorrect authorization in Forms in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

CVE-2026-44266: enspirit elo: Elo is a purely functional expression language for no-code tools

Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, the Ruby backend in src/compilers/ruby.ts embeds attacker-controlled text in Ruby double-quoted strings without escaping , so Ruby interpolation forms in the string-literal emitter or the labelled subtype-constraint...

CVE-2026-121085: Google Chrome: Incorrect authorization in WebUI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system…

Incorrect authorization in WebUI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. Chromium security severity: Low...

CVE-2026-121135: Google Chrome: Security issue in Platform in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin…

Security issue in Platform in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-121141: Google Chrome: Improper input validation in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging…

Improper input validation in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

CVE-2026-121174: Google Chrome: Missing authorization in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass…

Missing authorization in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: High...

CVE-2026-121196: Google Chrome: Privilege elevation in Mobile in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to bypass…

Privilege elevation in Mobile in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-63197: traPtitech traQ: traQ is a messenger application built for Digital Creators Club traP

traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, instances configured with TRAQSTORAGETYPE=local can return user-uploaded SVG or HTML content from the /files/fileId retrieval endpoint for direct browser rendering. An attacker with file-upload capability can...

PT-2026-136170

Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 contains an authorization bypass in the session upgrade endpoint, which creates a new session for any valid session token without enforcing the Session class create class-level permission. Attackers holding a user's session token can sen...

PT-2026-136188

AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows station users with WebHooks permission to bypass the UserUrlFilter guard via the Mastodon, Telegram, GroupMe, and RadioReg connectors. Attackers can set instance url, api, or webhookurl to internal addresses...

PT-2026-136192

Froxlor before 2.3.15 contains an authorization bypass vulnerability that allows authenticated customers to create MySQL databases by calling the Mysqls.add API endpoint, which lacks the customer hide options check. Customers can invoke Mysqls.add even when the admin has disabled the MySQL featur...