CVE-2026-86737: Missing Authorization

snipe-it versions before 8.7.0 fail to enforce asset view authorization in the GET /hardware/asset/barcode endpoint. Authenticated attackers can iterate asset IDs to retrieve barcodes and enumerate asset tags across tenants, including soft-deleted and cross-company assets...

PT-2026-88531

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in Extensions allows a remote attacker to obtain sensitive information through the use of a crafted Chrome extension. Recommendations Update Google Chrome to versi...

PT-2026-88543

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in Actor allows a remote attacker to obtain sensitive information by inducing a user to visit a crafted HTML page. Recommendations Update Google Chrome to version...

PT-2026-88593

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in the FileSystem component allows a remote attacker to bypass system access restrictions. This is achieved by leveraging social engineering to entice a user to...

PT-2026-88637

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in Extensions allows a remote attacker who has compromised the renderer process to potentially execute arbitrary code outside the sandbox via crafted network...

PT-2026-88656

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in the Browser component allows a remote attacker to bypass system access restrictions by using a crafted HTML page. Recommendations Update Google Chrome to versio...

PT-2026-88660

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in the Browser component allows a remote attacker to bypass system access restrictions by using a crafted HTML page. Recommendations Update Google Chrome to versio...

PT-2026-88711

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in the FileSystem component allows a remote attacker who has compromised the renderer process to obtain cross-origin data through a crafted HTML page...

CVE-2026-81823: Missing Authorization

The vulnerability, if exploited, could allow an unauthenticated miscreant to perform read operations intended only for PIMBoards users, resulting in information disclosure. Write operations are not impacted...

PT-2026-87637

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server affected versions not specified Description Missing authorization allows an authorized attacker to elevate privileges over a network, which enables them to affect the system. Recommendations At the moment, there is no...

PT-2026-87923

Name of the Vulnerable Software and Affected Versions Data Sharing Service Client affected versions not specified Description Missing authorization in the Data Sharing Service Client allows an authorized attacker to elevate privileges locally, which can lead to unauthorized system impact...

PT-2026-88575

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in the Omnibox allows a remote attacker to bypass system access restrictions and access a privileged page. This is achieved by leveraging social engineering and a...

PT-2026-87062

XenForo before 2.3.13 contains a missing authorization vulnerability in the ACP cache-rebuild dispatcher that allows limited administrators with only the rebuildCache permission to perform unauthorized approval queue actions by supplying an arbitrary job class and actor user ID in the POST body...

Security Bulletin: Triton Inference Server - September 2026

NVIDIA has released a software update for NVIDIA® Triton Inference Server. To protect your system, clone or update this software to Triton Inference Server r26.07 or later from the NVIDIA Triton Inference Server GitHub repo. Go to NVIDIA Product Security. Details NVIDIA has released a software...

PT-2026-87050

Cvlaunchd contained a missing authorization issue affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X...

PT-2026-87491

Missing authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...

PT-2026-87418

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server affected versions not specified Description Missing authorization allows an authorized attacker to elevate privileges over a network, which enables them to affect the system. Recommendations At the moment, there is no...

PT-2026-87415

Name of the Vulnerable Software and Affected Versions Windows Modern Device Management MDM affected versions not specified Description Missing authorization in Windows Modern Device Management MDM allows an authorized attacker to elevate privileges locally. Recommendations At the moment, there is...

PT-2026-88643

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in Core allows a remote attacker who has compromised the renderer process to bypass site isolation by using a crafted HTML page. Site isolation is a security featu...

CVE-2026-18851: Missing Authorization

Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacker to escalate their privileges to admin...