PT-2026-88643

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in Core allows a remote attacker who has compromised the renderer process to bypass site isolation by using a crafted HTML page. Site isolation is a security featu...

PT-2026-88660

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in the Browser component allows a remote attacker to bypass system access restrictions by using a crafted HTML page. Recommendations Update Google Chrome to versio...

PT-2026-87881

Missing authorization in Windows Remote Access Connection Manager allows an authorized attacker to perform tampering locally...

CVE-2026-86737: Missing Authorization

snipe-it versions before 8.7.0 fail to enforce asset view authorization in the GET /hardware/asset/barcode endpoint. Authenticated attackers can iterate asset IDs to retrieve barcodes and enumerate asset tags across tenants, including soft-deleted and cross-company assets...

PT-2026-88637

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in Extensions allows a remote attacker who has compromised the renderer process to potentially execute arbitrary code outside the sandbox via crafted network...

PT-2026-88711

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in the FileSystem component allows a remote attacker who has compromised the renderer process to obtain cross-origin data through a crafted HTML page...

PT-2026-88529

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in the ServiceWorker allows a remote attacker who has compromised the renderer process to bypass system access restrictions by using a crafted HTML page...

PT-2026-88534

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in Cross-Origin Resource Sharing CORS, a mechanism that allows restricted resources on a web page to be requested from another domain, enables a remote attacker wh...

PT-2026-88543

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in Actor allows a remote attacker to obtain sensitive information by inducing a user to visit a crafted HTML page. Recommendations Update Google Chrome to version...

PT-2026-88575

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in the Omnibox allows a remote attacker to bypass system access restrictions and access a privileged page. This is achieved by leveraging social engineering and a...

PT-2026-88593

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in the FileSystem component allows a remote attacker to bypass system access restrictions. This is achieved by leveraging social engineering to entice a user to...

PT-2026-88598

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in the WebUI allows a remote attacker who has compromised the renderer process to bypass the web origin policy using a crafted HTML page. The web origin policy is ...

Security Bulletin: Triton Inference Server - September 2026

NVIDIA has released a software update for NVIDIA® Triton Inference Server. To protect your system, clone or update this software to Triton Inference Server r26.07 or later from the NVIDIA Triton Inference Server GitHub repo. Go to NVIDIA Product Security. Details NVIDIA has released a software...

PT-2026-88501

Impact The endpoints /rest/roles/:slug/assignments and /rest/roles/:slug/assignments/:projectId/members checked only that the caller could manage the role type, not that they could see the project named in the request. A user holding role-management permission could therefore name any project on...

PT-2026-87142

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could abuse missing authorization. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and denial of service...

PT-2026-88107

Name of the Vulnerable Software and Affected Versions Microsoft Azure Entra ID affected versions not specified Description Missing authorization in the Microsoft Azure Entra ID compatibility package allows an authorized attacker to elevate privileges over a network. Recommendations At the moment,...

Security Updates for Microsoft SharePoint Server Subscription Edition (September 2026)

The Microsoft SharePoint Server Subscription Edition installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Improper access control in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...

PT-2026-87063

Name of the Vulnerable Software and Affected Versions XenForo versions prior to 2.3.13 Description A missing authorization issue exists in the force-agreement controller. This allows any ACP administrator to access and submit force-agreement forms, bypassing the assigned permissions and the optio...

PT-2026-86997

Missing Authorization vulnerability in Unbounce Unbounce Landing Pages unbounce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unbounce Landing Pages: from n/a through 1.1.4...

PT-2026-87122

AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in the SocialMediaPublisher plugin's add.json.php endpoint that allows authenticated users to modify other users' OAuth token records. Attackers can supply arbitrary row IDs to overwrite another...