CVE-2026-79041: Missing Authorization

Missing authorization in Browser in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy into a privileged page via a crafted HTML page. Chromium security severity: Low...

CVE-2026-78953: Missing Authorization

Missing authorization in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. Chromium security severity: Medium...

CVE-2026-79672: Missing Authorization

Ech0 before 4.4.3 fails to enforce scope-based authorization on nine comment panel admin endpoints, allowing access tokens with minimal scopes to perform full comment moderation operations. Attackers with a limited-scope access token can list, approve, reject, delete comments, and modify comment...

CVE-2026-56092: Missing Authorization

The extension forces empty frontend-group and subpage-inheritance restrictions onto page records during indexer sub-requests, and this forged state was persisted into the shared rootline cache, allowing anonymous visitors to bypass extendToSubpages-inherited access restrictions on cached pages...

CVE-2026-17548: Missing Authorization

Missing authorization in Checkmk 2.5.0p12, 2.4.0p36, 2.3.0p50 and all 2.2.0 versions allows an authenticated user who knows the ID of a background job to view that job's status and results...

PT-2026-81182

A missing authorization vulnerability exists in SKYSEA Client View and SKYMEC IT Manager. If this vulnerability is exploited, an attacker who can log in to the Windows system on which the affected product is installed may execute arbitrary code with SYSTEM privilege...

PT-2026-81216

Missing authorization in Checkmk 2.5.0p12, 2.4.0p36, 2.3.0p50 and all 2.2.0 versions allows an authenticated user who knows the ID of a background job to view that job's status and results...

CVE-2026-77140: Missing Authorization

The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, not in the action that persists the change. An unauthenticated visitor who knows the UID of a visible employee record can send a direct POST request to the update action and overwrite...

CVE-2026-77142: Missing Authorization

The frontend company self-service editing feature relies on a template-level visibility flag to hide the edit form for company records a visitor does not own, but the corresponding write operation does not repeat this ownership check on the server side. As a result, a visitor who knows the...

CVE-2026-77141: Missing Authorization

The extension resolves the targeted club record from a user-supplied request argument in its frontend edit, update, and activate actions, but performs no ownership check in any of them. An unauthenticated visitor who knows the UID of a club record can send a direct request to the update or activa...

CVE-2026-78968: Missing Authorization

Missing authorization in Core in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially spoof address bar via a crafted HTML page. Chromium security severity: Low...

PT-2026-81483

In Dradis Community Edition, the ProvidersController and AgentsController gate their admin required before action on defined?Dradis::Pro, a constant that is never defined in CE, so the authorization check is never applied. As a result, any authenticated non-admin user can create an AI provider...

PT-2026-81635

Name of the Vulnerable Software and Affected Versions Google Chrome on Mac versions prior to 152.0.7977.65 Description Missing authorization allows a remote attacker to bypass the web origin policy—a security mechanism that restricts how a document or script loaded from one origin can interact wi...

PT-2026-81638

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 152.0.7977.65 Description Missing authorization in WebAppInstalls allows a remote attacker who has compromised the renderer process to obtain sensitive information by using a crafted HTML page...

CVE-2026-79116: Missing Authorization

Missing authorization in Viz in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-79208: Missing Authorization

Missing authorization in HTTP2 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to leak sensitive information via crafted network traffic. Chromium security severity: Medium...

CVE-2026-78897: Missing Authorization

Missing authorization in BrowserTag in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted Chrome extension. Chromium security severity: Low...

CVE-2026-77143: Missing Authorization

The frontend topic editing flow does not verify on the server side that the requesting visitor owns the topic being modified. As a result, a visitor who knows the identifier of a topic from the public forum can submit a modified update request for that topic directly and overwrite its content,...

PT-2026-82029

Mattermost doesn't require role-management authorization when setting the scheme admin flag on group syncable link and patch endpoints in github.com/mattermost/mattermost-server...

CVE-2026-16645: Missing Authorization

Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 3.2.0...