2856 matches found
CVE-2026-63431 Horilla: Missing Authorization on Payroll Component Views Exposes Employee Salary Structures and Personal Loan Records (IDOR)
Horilla is an HR and CRM software. In 1.5.0-85 and earlier, payroll/views/componentviews.py does not consistently authorize access in allowancesdeductionstab, viewsingleallowance, and viewsinglededuction before loading records selected by empid, allowanceid, or deductionid. An authenticated...
EUVD-2026-87362
Horilla is an HR and CRM software. In 1.5.0-85 and earlier, payroll/views/componentviews.py does not consistently authorize access in allowancesdeductionstab, viewsingleallowance, and viewsinglededuction before loading records selected by empid, allowanceid, or deductionid. An authenticated...
EUVD-2026-87258
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's HTML sanitizer, which blocks remote images in ticket articles and email views, can be bypassed using a shortened URL format that omits the double slash after the scheme for example a shortened HTTP URL...
Chromium CVE-2026-95351: Use after free in Views
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium CVE-2026-95277: Use after free in Views
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium CVE-2026-95371: Missing authorization in Views
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
CVE-2026-78909
A flaw was found in Google Chrome. This use-after-free vulnerability in the Views component allows a remote attacker to execute arbitrary code outside of the browser's security sandbox. This can be achieved by leveraging social engineering tactics to entice a user to visit a specially crafted HTM...
PT-2026-99136
Name of the Vulnerable Software and Affected Versions Horilla versions 1.0.0 through 1.5.9 Horilla version 2.0.0 affected versions not specified Description The get mail preview handlers in recruitment/views/actions.py and employee/not in out dashboard.py render a user-controlled body at the...
CVE-2026-63432: Improper Control of Generation of Code
Horilla is an HR and CRM software. From 1.0.0 until 1.6.0 and 2.0.0, the getmailpreview handlers in recruitment/views/actions.py and employee/notinoutdashboard.py render a user-controlled body at /recruitment/get-mail-preview/ and /employee/get-employee-mail-preview with the full request object i...
PT-2026-99081
Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.1.2 Description The HTML sanitizer used in ticket articles and email views fails to correctly identify and block remote images when a shortened URL format is used that omits the double slash after the scheme. Because...
CVE-2026-63431: Missing Authorization
Horilla is an HR and CRM software. In 1.5.0-85 and earlier, payroll/views/componentviews.py does not consistently authorize access in allowancesdeductionstab, viewsingleallowance, and viewsinglededuction before loading records selected by empid, allowanceid, or deductionid. An authenticated...
PT-2026-99135
Name of the Vulnerable Software and Affected Versions Horilla versions 1.5.0-85 and earlier Description An authentication bypass exists in the payroll module where the system fails to consistently authorize access before loading records. An authenticated employee can manipulate identifiers to...
Astra Linux – Vulnerability in Chromium
The use of after-free in Views in Google Chrome before version 152.0.7977.65 allowed a remote attacker to leverage social engineering to execute arbitrary code outside the sandbox through a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in Views in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...
Astra Linux – Vulnerability in Chromium
The use of after-free in Views in Google Chrome before version 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
The use of “after free” in Views in Google Chrome before version 151.0.7922.109 allowed a remote attacker who convinced a user to perform certain UI gestures to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
The use of after-free in Views in Google Chrome before version 151.0.7922.72 allowed a local attacker to potentially perform a sandbox escape through a malicious file. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
Missing authorization in Views in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leverage social engineering to bypass system access restrictions through a crafted HTML page. Chromium security severity: High...
SUSE CVE-2026-95277
Use after free in Views in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...
SUSE CVE-2026-95351
Use after free in Views in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...