EUVD-2026-79986

Missing authorization in AppManifest in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-91732

Missing authorization in AppManifest in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-91732

CVE-2026-91732 is a missing authorization vulnerability in the AppManifest component of Google Chrome prior to 153.0.8010.47 . A remote attacker who had already compromised the renderer process and leveraged social engineering could use a crafted HTML page to bypass the web origin policy. Chromiu...

CVE-2026-91732

Missing authorization in AppManifest in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-91717

Missing authorization in Android in Google Chrome on on Android prior to 153.0.8010.47 allowed a local attacker to obtain sensitive information via a co-installed app. Chromium security severity: High...

CVE-2026-91717

Missing authorization in Android in Google Chrome on on Android prior to 153.0.8010.47 allowed a local attacker to obtain sensitive information via a co-installed app. Chromium security severity: High...

EUVD-2026-79971

Missing authorization in Android in Google Chrome on on Android prior to 153.0.8010.47 allowed a local attacker to obtain sensitive information via a co-installed app. Chromium security severity: High...

CVE-2026-91717

Google Chrome on Android prior to version 153.0.8010.47 is vulnerable to a missing authorization flaw in the Android component. A local attacker can exploit this to obtain sensitive information via a co-installed application. This vulnerability is addressed in version 153.0.8010.52 for various di...

CVE-2026-91717

Missing authorization in Android in Google Chrome on on Android prior to 153.0.8010.47 allowed a local attacker to obtain sensitive information via a co-installed app. Chromium security severity: High...

EUVD-2026-79952

The affected products are missing authorization on state-changing CGIs and session checks are not performed...

CVE-2026-66887

Digital Watchdog VMAX DVR and NVR devices are vulnerable due to missing authorization on state-changing CGI endpoints and the absence of session checks , allowing an attacker on the adjacent network to modify device state without authentication. CISA ICS-CERT rated this CRITICAL (CVSS 3.1: 9.6 / ...

CVE-2026-66887 Missing Authorization in Digital Watchdog VMAX DVR and NVR Product Lineups

The affected products are missing authorization on state-changing CGIs and session checks are not performed...

CVE-2026-66887 Missing Authorization in Digital Watchdog VMAX DVR and NVR Product Lineups

The affected products are missing authorization on state-changing CGIs and session checks are not performed...

CVE-2026-18426

Concrete CMS versions 9.0.0 through 9.5.2 are affected by a missing authorization flaw in the Express Form block . Control-management actions (add, modify, delete) relied solely on CSRF token validation, but the token is bound only to the user and action—not to a specific block, page, or form. Th...

CVE-2026-18426 Concrete CMS 9.0.0 to 9.5.2 Express Form block missing authorization allows an authenticated editor to modify Express Forms they cannot edit

Concrete CMS 9.0.0 through 9.5.2 did not enforce a block-level edit-permission check on the Express Form block's control-management actions, which relied solely on CSRF token validation. Because the token is bound to the user and action rather than to a specific block, page, or form, an...

CVE-2026-18426 Concrete CMS 9.0.0 to 9.5.2 Express Form block missing authorization allows an authenticated editor to modify Express Forms they cannot edit

Concrete CMS 9.0.0 through 9.5.2 did not enforce a block-level edit-permission check on the Express Form block's control-management actions, which relied solely on CSRF token validation. Because the token is bound to the user and action rather than to a specific block, page, or form, an...

CVE-2026-18426 Concrete CMS 9.0.0 to 9.5.2 Express Form block missing authorization allows an authenticated editor to modify Express Forms they cannot edit

Concrete CMS 9.0.0 through 9.5.2 did not enforce a block-level edit-permission check on the Express Form block's control-management actions, which relied solely on CSRF token validation. Because the token is bound to the user and action rather than to a specific block, page, or form, an...

CVE-2026-18422

Concrete CMS before 9.5.3 is vulnerable in the multilingual page assignment backend action (Backend\Page\Multilingual::assign), where a destination-side authorization check and a CSRF token validation were both missing. An authenticated user holding only the Edit Page Multilingual Settings permis...

CVE-2026-68530

Concrete CMS 9 through 9.5.2 did not perform an authorization check on several board-instance actions in the Boards area of the Dashboard. The instance details single-page controller resolved a board instance directly from an attacker-supplied instance ID and then viewed, refreshed, regenerated, ...

CVE-2026-18421

Concrete CMS 9 through 9.5.2 does not perform an authorization check in three actions of the Boards data source dashboard controller update, updatedatasource, and deletedatasource, which resolve a ConfiguredDataSource directly from an attacker-supplied identifier without confirming the requester'...