PT-2026-95120

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.52 Description Missing authorization in Storage allows a remote attacker who has compromised the renderer process to bypass site isolation by using a crafted PDF file. Site isolation is a security...

Missing Authorization

Overview djust is a Phoenix LiveView-style reactive components for Django with Rust-powered performance. Real-time UI updates over WebSocket, no JavaScript build step required. Affected versions of this package are vulnerable to Missing Authorization inadequate enforcement of object-level...

Missing Authorization

Overview djust is a Phoenix LiveView-style reactive components for Django with Rust-powered performance. Real-time UI updates over WebSocket, no JavaScript build step required. Affected versions of this package are vulnerable to Missing Authorization via the WebSocket/SSE mount path, where...

Missing Authorization

Overview djust is a Phoenix LiveView-style reactive components for Django with Rust-powered performance. Real-time UI updates over WebSocket, no JavaScript build step required. Affected versions of this package are vulnerable to Missing Authorization via the sessionid parameter. An attacker can...

CVE-2026-92586 AVideo through 29.0 Missing Authorization via comment API endpoint

AVideo through 29.0 commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to verify video access permissions in the setapicomment function, allowing authenticated users to post comments on password-protected and group-restricted videos. Attackers can submit POST requests to the comment API endpoi...

CVE-2026-92586 AVideo through 29.0 Missing Authorization via comment API endpoint

AVideo through 29.0 commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to verify video access permissions in the setapicomment function, allowing authenticated users to post comments on password-protected and group-restricted videos. Attackers can submit POST requests to the comment API endpoi...

CVE-2026-92585 AVideo through 29.0 Missing Authorization Check via API Like Endpoint

AVideo through 29.0 commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the API like endpoint, allowing logged-in users to vote on password-protected and group-restricted videos. Attackers can submit like and dislike requests to increment vote counters on...

CVE-2026-92585 AVideo through 29.0 Missing Authorization Check via API Like Endpoint

AVideo through 29.0 commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the API like endpoint, allowing logged-in users to vote on password-protected and group-restricted videos. Attackers can submit like and dislike requests to increment vote counters on...

CVE-2026-92586

AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) contains an authorization bypass in the set_api_comment function. The function fails to verify video access permissions, allowing authenticated users to post comments on password-protected and group-restricted videos by submitt...

CVE-2026-92585 AVideo through 29.0 Missing Authorization Check via API Like Endpoint

AVideo through 29.0 commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the API like endpoint, allowing logged-in users to vote on password-protected and group-restricted videos. Attackers can submit like and dislike requests to increment vote counters on...

CVE-2026-92585

AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to validate video access permissions in its API like endpoint. The root cause is a missing authorization check in the set.json.php endpoint when called with APIName parameters, allowing any logged-in user to submit like o...

CVE-2026-92586 AVideo through 29.0 Missing Authorization via comment API endpoint

AVideo through 29.0 commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to verify video access permissions in the setapicomment function, allowing authenticated users to post comments on password-protected and group-restricted videos. Attackers can submit POST requests to the comment API endpoi...

CVE-2026-76438

A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software could allow an authenticated, remote attacker with low privileges to alter configurations on an affected device. This vulnerability is due to missing authorization checks. An attacker could...

CVE-2026-92783

Yeti (through version 2.11.0 ) fails to validate caller permissions in the DELETE /api/v2/rbac/{id} endpoint, allowing users with only read access to delete access control (RBAC) relationships. An attacker can revoke the owner's grant and permanently lock legitimate owners out of objects . The vu...

CVE-2026-92783 Yeti through 2.11.0 Missing Authorization on RBAC Relationship Deletion

Yeti through 2.11.0 fails to validate caller permissions in the DELETE /api/v2/rbac/id endpoint, allowing users with read access to delete access control relationships. Attackers can revoke the owner's grant and permanently lock legitimate owners out of objects...

CVE-2026-92783 Yeti through 2.11.0 Missing Authorization on RBAC Relationship Deletion

Yeti through 2.11.0 fails to validate caller permissions in the DELETE /api/v2/rbac/id endpoint, allowing users with read access to delete access control relationships. Attackers can revoke the owner's grant and permanently lock legitimate owners out of objects...

CVE-2026-92783 Yeti through 2.11.0 Missing Authorization on RBAC Relationship Deletion

Yeti through 2.11.0 fails to validate caller permissions in the DELETE /api/v2/rbac/id endpoint, allowing users with read access to delete access control relationships. Attackers can revoke the owner's grant and permanently lock legitimate owners out of objects...

CVE-2026-92780

KnowStreaming through version 3.4.1 fails to enforce role-based access control on its REST API endpoints , specifically in the PermissionInterceptor component. Any authenticated user can call identity-management endpoints to create administrator accounts or grant themselves administrative privile...

CVE-2026-92780 KnowStreaming through 3.4.1 Missing Authorization on the REST API

KnowStreaming through 3.4.1 fails to enforce role-based access control on REST API endpoints, allowing any authenticated user to access protected functionality. Attackers can call identity-management endpoints to create administrator accounts or grant themselves administrative privileges without...

CVE-2026-92780 KnowStreaming through 3.4.1 Missing Authorization on the REST API

KnowStreaming through 3.4.1 fails to enforce role-based access control on REST API endpoints, allowing any authenticated user to access protected functionality. Attackers can call identity-management endpoints to create administrator accounts or grant themselves administrative privileges without...