CVE-2026-106038: Missing Authentication for Critical Function

Mooncake Store master through 0.3.13.post1 contains a missing authentication vulnerability that allows unauthenticated attackers to force-delete any object via Remove, RemoveByRegex, RemoveAll and BatchRemove on the cororpc port. Attackers can send forged requests with the force flag set to bypas...

PT-2026-106852

Name of the Vulnerable Software and Affected Versions Devolutions Server versions prior to 2026.3.7.1 Description Missing authorization in the global vault allows an authenticated user who possesses only the global vault view permission to modify and delete global contact and folder entries...

CVE-2026-106039: Missing Authorization

Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to create, steal, and falsely complete replication tasks via the cororpc port. Attackers can invoke CreateCopyTask, CreateMoveTask, FetchTasks, and MarkTaskToComplete wi...

CVE-2026-106040: Missing Authorization

Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to erase any object's disk replica via EvictDiskReplica and BatchEvictDiskReplica. Attackers reaching the cororpc master port can evict DISK replicas across all tenants,...

CVE-2026-63692: Missing Authentication for Critical Function

Dell Container Storage Modules, versions prior to 1.18.0, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges...

CVE-2026-63688: Missing Authentication for Critical Function

Dell Container Storage Modules CSM, versions prior to v1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-storage gRPC server. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to unauthorized access to...

PT-2026-107117

Name of the Vulnerable Software and Affected Versions multisig-improved repository: mx-multisig-and-modules affected versions not specified Description The reference implementation of the on-chain multisig smart contract system contains a flaw where a missing independent authorization check allow...

Fedora 45 : python3-docs / python3.15 (2026-ab1400e97a)

The remote Fedora 45 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-ab1400e97a advisory. New version of the Python interpreter Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has...

Fedora 43 : python3.12 (2026-f30cb310f9)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-f30cb310f9 advisory. New version of the Python interpreter Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has...

PT-2026-106866

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description Missing authorization in Actor allows a remote attacker who has compromised the renderer process to potentially execute arbitrary code outside the sandbox by using a crafted HTML page...

PT-2026-106880

Missing authorization in Passwords in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Chromium security severity: Medium...

PT-2026-106883

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description A missing authorization in an API allows a remote attacker to leak sensitive information. This issue can be exploited through social engineering by using a crafted Chrome extension...

PT-2026-106892

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description Missing authorization in Google Lens allows a remote attacker who has compromised the renderer process to leak cross-origin data through a crafted HTML page. Cross-origin data leakage...

CVE-2026-106194: Missing Authorization

Missing authorization in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106208: Missing Authorization

Missing authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted Chrome extension. Chromium security severity: Medium...

CVE-2026-106250: Missing Authorization

Missing authorization in Actor in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. Chromium security severity: Low...

CVE-2026-106340: Missing Authorization

Missing authorization in CredentialProvider in Google Chrome on on Windows prior to 155.0.8059.39 allowed a local attacker to obtain sensitive information via physical access. Chromium security severity: Low...

CVE-2026-106384: Missing Authorization

Missing authorization in SiteIsolation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Chromium security severity: Medium...

Oracle Linux 10 : nodejs22 (ELSA-2026-75864)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-75864 advisory. 1:22.23.1-4.0.1 - Add c-ares as dependency orabug 39781219 Tenable has extracted the preceding description block directly from the Oracle Linux...

PT-2026-106985

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description Missing authorization in the SignIn function allows a remote attacker to obtain sensitive information. This issue can be exploited through social engineering using a crafted Chrome...