PT-2026-88703

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in the FileSystem component allows a remote attacker to bypass system access restrictions by using a crafted HTML page. Recommendations Update Google Chrome to...

PT-2026-88706

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in SiteIsolation allows a remote attacker who has compromised the renderer process to bypass site isolation by using a crafted HTML page. Site isolation is a...

PT-2026-88587

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in the FileSystem component allows a remote attacker to potentially execute arbitrary code outside the sandbox. This requires the attacker to have already...

PT-2026-88613

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in the ControlledFrame component allows a remote attacker to bypass system access restrictions. This is achieved by leveraging social engineering to entice a user ...

PT-2026-87562

Name of the Vulnerable Software and Affected Versions Windows Hyper-V affected versions not specified Description Missing authorization in Windows Hyper-V allows an authorized attacker to elevate privileges over a network, which can lead to an elevation-of-privilege that affects the system...

PT-2026-87438

Name of the Vulnerable Software and Affected Versions Windows SMB Server affected versions not specified Description Missing authorization in the Windows SMB Server allows an authorized attacker to disclose sensitive information locally, which can subsequently affect the system. Recommendations A...

PT-2026-86958

Due to a missing authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform, an authenticated attacker could gain unauthorized access to sensitive system configuration information. Successful exploitation could result in exposure of security relevant settings and internal...

PT-2026-88541

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in the Downloads component allows a remote attacker to bypass system access restrictions by using a crafted Chrome extension. Recommendations Update Google Chrome ...

PT-2026-87063

Name of the Vulnerable Software and Affected Versions XenForo versions prior to 2.3.13 Description A missing authorization issue exists in the force-agreement controller. This allows any ACP administrator to access and submit force-agreement forms, bypassing the assigned permissions and the optio...

PT-2026-88108

Missing authorization in Windows Kernel allows an authorized attacker to elevate privileges locally...

Security Updates for Microsoft SharePoint Server Subscription Edition (September 2026)

The Microsoft SharePoint Server Subscription Edition installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Improper access control in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...

CVE-2026-86996: Missing Authorization

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the workflow setting named This workflow can be called by was enforced by the Execute Workflow node but not when a workflow was attached to an Agent as a tool. A user able to build an Agent could invoke a restricted...

CVE-2026-86438 Lara Dashboard before 1.3.2 Missing Authorization in Marketplace Module Install Action

Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire action, allowing non-Superadmin administrators to install modules. Attackers can download and auto-activate arbitrary PHP modules from the marketplace over unsigned HTTP requests, achieving remote...

CVE-2026-86438 Lara Dashboard before 1.3.2 Missing Authorization in Marketplace Module Install Action

Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire action, allowing non-Superadmin administrators to install modules. Attackers can download and auto-activate arbitrary PHP modules from the marketplace over unsigned HTTP requests, achieving remote...

CVE-2026-86438

Lara Dashboard versions prior to 1.3.2 contain an authorization bypass in the MarketplaceModuleBrowser Livewire component. The installModule action fails to restrict access to Superadmin-level roles, allowing any authenticated non-Superadmin administrator to trigger module installation. Because m...

CVE-2026-86438 Lara Dashboard before 1.3.2 Missing Authorization in Marketplace Module Install Action

Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire action, allowing non-Superadmin administrators to install modules. Attackers can download and auto-activate arbitrary PHP modules from the marketplace over unsigned HTTP requests, achieving remote...

CVE-2026-86436 Lara Dashboard before 1.3.2 Missing Authorization in Post-Builder Media Upload Endpoints

Lara Dashboard before 1.3.2 fails to authorize access to the post-builder image and video upload endpoints, allowing authenticated accounts without content permissions to upload files. Attackers can upload polyglot files with attacker-chosen extensions to the public web root and execute code if t...

CVE-2026-86436

Lara Dashboard before version 1.3.2 fails to enforce authorization on the post-builder image and video upload endpoints , permitting authenticated accounts without content permissions to upload files. Attackers can exploit this by uploading polyglot files with attacker-chosen extensions into the ...

CVE-2026-86436 Lara Dashboard before 1.3.2 Missing Authorization in Post-Builder Media Upload Endpoints

Lara Dashboard before 1.3.2 fails to authorize access to the post-builder image and video upload endpoints, allowing authenticated accounts without content permissions to upload files. Attackers can upload polyglot files with attacker-chosen extensions to the public web root and execute code if t...

CVE-2026-86436 Lara Dashboard before 1.3.2 Missing Authorization in Post-Builder Media Upload Endpoints

Lara Dashboard before 1.3.2 fails to authorize access to the post-builder image and video upload endpoints, allowing authenticated accounts without content permissions to upload files. Attackers can upload polyglot files with attacker-chosen extensions to the public web root and execute code if t...