Chromium CVE-2026-87443: Missing authorization in Actor

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium CVE-2026-87441: Missing authorization in Downloads

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium CVE-2026-87434: Missing authorization in CORS

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium CVE-2026-87431: Missing authorization in Extensions

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium CVE-2026-87429: Missing authorization in ServiceWorker

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

CVE-2026-88619

1024-lab SmartAdmin v3.30.0 contains a missing authorization vulnerability in the scheduled-job management module. The AdminSmartJobController exposes scheduled-job management endpoints without method-level permission checks, allowing a low-privileged authenticated user to access functionality...

PT-2026-92399

Concrete CMS 9 through 9.5.2 does not perform an authorization check in three actions of the Boards data source dashboard controller update, update data source, and delete data source, which resolve a ConfiguredDataSource directly from an attacker-supplied identifier without confirming the...

EUVD-2026-78813

1024-lab SmartAdmin v3.30.0 contains a missing authorization vulnerability in the scheduled-job management module. The AdminSmartJobController exposes scheduled-job management endpoints without method-level permission checks, allowing a low-privileged authenticated user to access functionality...

CVE-2026-81922: Missing Authorization

Concrete CMS before 9.5.3 did not enforce a per-page authorization check when reordering pages from the sitemap. In the sitemap Explore dashboard controller, the sendtotop and sendtobottom reorder tasks ran after only a generic sitemap-access check; the controller loaded the page named by the...

CVE-2026-88619

The 1024-lab SmartAdmin v3.30.0 software contains a missing authorization vulnerability within the scheduled-job management module . Specifically, the AdminSmartJobController fails to implement method-level permission checks on scheduled-job management endpoints. This oversight allows a low-privi...

CVE-2026-91846: Missing Authorization

Affected versions of MISP allow a collection element to be created from a bare UUID without consistently checking whether the acting user is allowed to access the referenced object. The commit explains that collection elements themselves only store UUIDs, while the collection view later resolves...

PT-2026-92400

Concrete CMS 9.0.0 through 9.5.2 was missing an authorization check on the Express entries advanced-search dashboard action. The advanced search method in DashboardSelectableExpressEntryListTrait resolved an Express entity directly from a user-supplied entity ID and rendered that entity's entries...

PT-2026-92413

Concrete CMS before 9.5.3 did not enforce a destination-side authorization check and did not validate a CSRF token in the multilingual page assignment backend action BackendPageMultilingual::assign. As a result, an authenticated user who held the Edit Page Multilingual Settings permission on a...

CVE-2026-18422: Missing Authorization

Concrete CMS before 9.5.3 did not enforce a destination-side authorization check and did not validate a CSRF token in the multilingual page assignment backend action Backend\Page\Multilingual::assign. As a result, an authenticated user who held the Edit Page Multilingual Settings permission on a...

CVE-2026-81923: Missing Authorization

In Concrete CMS before 9.5.3, the SEO Bulk Update Meta Tags editor did not check per-page edit permissions before saving. The saveRecord action validated the per-page CSRF token but never called canEditPageProperties for the target page, so a user who was granted access to the bulk SEO tool and...

CVE-2026-55863: Missing Authorization

motionEye mEye is an online interface for a piece of software called "motion," which is a video surveillance program with motion detection. Prior to 0.44.0, the ActionHandler.post method in motioneye/handlers/action.py lacks the BaseHandler.auth decorator, allowing an unauthenticated remote...

CVE-2026-91732: Missing Authorization

Missing authorization in AppManifest in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

PT-2026-92158

Name of the Vulnerable Software and Affected Versions IBM Business Automation Workflow affected versions not specified Description An authenticated attacker can trigger restricted import actions because of missing authorization controls in both containerized and traditional deployments...

PT-2026-92046

1024-lab SmartAdmin v3.30.0 contains a missing authorization vulnerability in the scheduled-job management module. The AdminSmartJobController exposes scheduled-job management endpoints without method-level permission checks, allowing a low-privileged authenticated user to access functionality...

CVE-2026-12742: Missing Authorization

IBM Business Automation Workflow containers and traditional could allow an authenticated attacker to trigger restricted import actions due to missing authorization controls...