CVE-2026-95278: Missing Authorization

Missing authorization in WakeLock in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. Chromium security severity: Low...

CVE-2026-95290: Missing Authorization

Missing authorization in NFC in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-102365

The mall4j framework, through version 4.0 , is vulnerable to a missing authorization flaw in the UserAddrController component. Specifically, the application fails to enforce proper authorization checks on the GET endpoints /user/addr/page and /user/addr/info. This allows authenticated attackers t...

CVE-2026-102365 mall4j through 4.0 Missing Authorization in Admin User Address Endpoints

mall4j through 4.0 fails to enforce authorization checks on GET endpoints in UserAddrController that retrieve customer address data. Authenticated attackers can call /user/addr/page and /user/addr/info endpoints to harvest all customer addresses including names, phone numbers, and postal...

CVE-2026-102365 mall4j through 4.0 Missing Authorization in Admin User Address Endpoints

mall4j through 4.0 fails to enforce authorization checks on GET endpoints in UserAddrController that retrieve customer address data. Authenticated attackers can call /user/addr/page and /user/addr/info endpoints to harvest all customer addresses including names, phone numbers, and postal...

CVE-2026-101139

A vulnerability was detected in Webkul Bagisto up to 2.4.6/2.5.0-beta4. This impacts an unknown function of the file /admin/sales/invoices/mass-update/state of the component Invoice Mass Status Update. Performing a manipulation results in missing authorization. The attack can be initiated remotel...

CVE-2026-101139 Webkul Bagisto Invoice Mass Status Update state authorization

A vulnerability was detected in Webkul Bagisto up to 2.4.6. This impacts an unknown function of the file /admin/sales/invoices/mass-update/state of the component Invoice Mass Status Update. Performing a manipulation results in missing authorization. The attack can be initiated remotely. The explo...

CVE-2026-101139 Webkul Bagisto Invoice Mass Status Update state authorization

A vulnerability was detected in Webkul Bagisto up to 2.4.6/2.5.0-beta4. This impacts an unknown function of the file /admin/sales/invoices/mass-update/state of the component Invoice Mass Status Update. Performing a manipulation results in missing authorization. The attack can be initiated remotel...

EUVD-2026-88444

A vulnerability was detected in Webkul Bagisto up to 2.4.6. This impacts an unknown function of the file /admin/sales/invoices/mass-update/state of the component Invoice Mass Status Update. Performing a manipulation results in missing authorization. The attack can be initiated remotely. The explo...

CVE-2026-101139 Webkul Bagisto Invoice Mass Status Update state authorization

A vulnerability was detected in Webkul Bagisto up to 2.4.6/2.5.0-beta4. This impacts an unknown function of the file /admin/sales/invoices/mass-update/state of the component Invoice Mass Status Update. Performing a manipulation results in missing authorization. The attack can be initiated remotel...

CVE-2026-101139

A vulnerability exists in Webkul Bagisto up to version 2.4.6 within the Invoice Mass Status Update component. The issue impacts an unknown function of the file /admin/sales/invoices/mass-update/state, where performing a manipulation leads to missing authorization . This flaw can be exploited remo...

GO-2026-6514 Perses's missing authorization in datasource proxy allows cross-scope secret disclosure in github.com/perses/perses

Perses's missing authorization in datasource proxy allows cross-scope secret disclosure in github.com/perses/perses...

CVE-2026-97505

A flaw was found in the Linux kernel. Missing authorization checks in the PCI sysfs interface can allow a local user to cause a denial of service DoS. The kernel fails to verify administrative capabilities when resizing a device Base Address Register BAR, relying only on basic file access...

CVE-2026-86335

Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to access private images from other projects via local fingerprint reuse during image or instance import requests...

CVE-2026-86335

Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to access private images from other projects via local fingerprint reuse during image or instance import requests...

UBUNTU-CVE-2026-86335

Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to access private images from other projects via local fingerprint reuse during image or instance import requests...

CVE-2026-86335 LXD Cross-Project Private Image Theft via Unsanitized GetImageFromAnyProject Local Reuse

Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to access private images from other projects via local fingerprint reuse during image or instance import requests...

CVE-2026-86335 LXD Cross-Project Private Image Theft via Unsanitized GetImageFromAnyProject Local Reuse

Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to access private images from other projects via local fingerprint reuse during image or instance import requests...

CVE-2026-86335

Canonical LXD on Linux versions prior to 5.0.10, 5.21.8, and 6.10 is vulnerable to a Missing Authorization flaw in the imageDownload function. A project-restricted client can steal private images from other projects by leveraging local fingerprint reuse during image or instance import requests. T...

EUVD-2026-88256

Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to access private images from other projects via local fingerprint reuse during image or instance import requests...