CVE-2026-81272: Missing Authorization

Editor Broken Access Control in FluentPlayer Pro = 1.3.2 versions...

PT-2026-82789

Certain configuration endpoints may lack proper server-side authorization checks, allowing unauthorized users to access or modify sensitive device settings. This could result in full compromise of device functionality...

PT-2026-82787

go-wind-cms GoWind before 1.0.0 has a missing authorization vulnerability. The NewAuthorizer function in app/admin/service/internal/data/data.go and app/app/service/internal/data/data.go returns a no-op authorization engine noop.State, so the authz middleware always allows requests. Any...

CVE-2026-75419

go-wind-cms GoWind before 1.0.0 has a missing authorization vulnerability. The NewAuthorizer function in app/admin/service/internal/data/data.go and app/app/service/internal/data/data.go returns a no-op authorization engine noop.State, so the authz middleware always allows requests. Any...

CVE-2026-81335: Missing Authorization

Baserow dispatches an Application Builder data source without acting on the result of its permission check. The dispatch and record-name views in backend/src/baserow/contrib/builder/api/datasources/views.py are declared with a permission class that admits any caller, so a request carrying no...

PT-2026-82427

The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2, allowing unauthenticated attackers to disclose the payment status of arbitrary orders by enumerating order identifiers...

CVE-2026-80433: Missing Authorization

Subscriber Sensitive Data Exposure in SureFeedback Client Site = 1.2.12 versions...

CVE-2026-75419

go-wind-cms GoWind before 1.0.0 has a missing authorization vulnerability. The NewAuthorizer function in app/admin/service/internal/data/data.go and app/app/service/internal/data/data.go returns a no-op authorization engine noop.State, so the authz middleware always allows requests. Any...

CVE-2026-75419

go-wind-cms GoWind before 1.0.0 has a missing authorization vulnerability. The NewAuthorizer function in app/admin/service/internal/data/data.go and app/app/service/internal/data/data.go returns a no-op authorization engine noop.State, so the authz middleware always allows requests. Any...

EUVD-2026-66810

KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 1.6.15, the SSO configuration API endpoints are exposed on the same public routing boundary as the SSO login and callback endpoints, so SSO, OIDC, and SAML management operations can be reached without...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Tivoli System Automation Application Manager (CVE-2026-16184)

Summary IBM WebSphere Application Server is used by IBM Tivoli System Automation Application Manager and is affected by an authentication bypass. Vulnerability Details CVEID:CVE-2026-16184 DESCRIPTION: IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass...

SUSE CVE-2026-79286

Missing authorization in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a co-installed app. Chromium security severity: Medium...

CVE-2026-79058

A flaw was found in the Passwords feature of Google Chrome. A remote attacker, after compromising the browser's renderer process, could exploit this missing authorization vulnerability. By using a specially crafted HTML page, the attacker could spoof user interface UI elements, potentially...

CVE-2026-79021

A flaw was found in chromium-browser. This vulnerability, related to missing authorization in the InterestGroups component, allows a remote attacker to bypass system access restrictions. The attacker must first compromise the browser's rendering engine and then use a specially crafted PDF file to...

CVE-2026-79184

A flaw was found in Google Chrome. Missing authorization in the Preload feature allows a remote attacker, who has compromised the renderer process, to bypass the web origin policy. This can be achieved by crafting a malicious HTML page, leading to unauthorized access or actions across different w...

CVE-2026-78968

A missing authorization flaw was found in the Core component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=518125889...

CVE-2026-79044

A flaw was found in WebAppInstalls in Google Chrome on Android. A remote attacker, after compromising the renderer process, could exploit missing authorization by using a specially crafted HTML page. This could allow the attacker to obtain sensitive information...

CVE-2026-79041

A flaw was found in Google Chrome. A remote attacker, through social engineering, could exploit a missing authorization vulnerability to bypass the web origin policy. By convincing a user to open a specially crafted HTML page, the attacker could gain access to privileged browser pages, potentiall...

CVE-2026-78967

A flaw was found in chromium-browser. Missing authorization in the Back-Forward Cache BFCache component of Google Chrome allows a remote attacker to bypass system access restrictions. This vulnerability can be exploited by an attacker who has already compromised the renderer process, through the...

CVE-2026-78953

A flaw was found in Google Chrome. This missing authorization vulnerability in SiteIsolation allows a remote attacker, who has already compromised the renderer process, to bypass site isolation. This can be achieved by providing a specially crafted PDF file...