Incorrect authorization in DOM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security seve...

CVE-2026-78975

Incorrect authorization in DOM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive inf

历史摘要 · 未重新核验 · NVD

Incorrect authorization in Core in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to by...

CVE-2026-78961

Incorrect authorization in Core in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised th

历史摘要 · 未重新核验 · NVD

Incorrect authorization in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via ...

CVE-2026-78954

Incorrect authorization in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromi

历史摘要 · 未重新核验 · NVD

Incorrect authorization in Select in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security sever...

CVE-2026-78946

Incorrect authorization in Select in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin

历史摘要 · 未重新核验 · NVD

Incorrect authorization in USB in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to pot...

CVE-2026-78911

Incorrect authorization in USB in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the

历史摘要 · 未重新核验 · NVD

Incorrect authorization in WebProtect in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security...

CVE-2026-78907

Incorrect authorization in WebProtect in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to leak sensitiv

历史摘要 · 未重新核验 · NVD

Incorrect authorization in Downloads in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a c...

CVE-2026-78898

Incorrect authorization in Downloads in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social

历史摘要 · 未重新核验 · NVD

Incorrect authorization in Chromoting in Google Chrome on on Windows prior to 152.0.7977.65 allowed a local attacker to bypass system access restrictions via a local program. (C...

CVE-2026-78892

Incorrect authorization in Chromoting in Google Chrome on on Windows prior to 152.0.7977.65 allowed a local attacker to

历史摘要 · 未重新核验 · NVD

phpMyFAQ public FAQ APIs expose inactive FAQ content

## Affected Product phpMyFAQ ## Affected Versions - Confirmed affected: 4.1.4, API v3.1. - Confirmed affected: curren

历史摘要 · 未重新核验 · GitHub Advisory

A weakness has been identified in liketrek TREK up to 3.0.22. This impacts the function validateShareTokenForAsset of the component Journey Photo Proxy. Executing a manipulation...

CVE-2026-78887

A weakness has been identified in liketrek TREK up to 3.0.22. This impacts the function validateShareTokenForAsset of th

历史摘要 · 未重新核验 · NVD

Ech0 before 4.4.3 protects the PUT /user endpoint with the profile:read scope, a read-only scope, but allows write operations including password changes. An attacker with an adm...

CVE-2026-79673

Ech0 before 4.4.3 protects the PUT /user endpoint with the profile:read scope, a read-only scope, but allows write opera

历史摘要 · 未重新核验 · NVD

General user can mint admin access tokens via /access-tokens This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to version 3.4.2, w...

CVE-2026-49050

General user can mint admin access tokens via /access-tokens This issue affects Apache DolphinScheduler: before 3.4.2

历史摘要 · 未重新核验 · NVD

The extension fails to require the dedicated admin confirmation token when processing an admin-approval request, so a regular user confirmation hash, obtainable by any visitor t...

CVE-2026-77134

The extension fails to require the dedicated admin confirmation token when processing an admin-approval request, so a re

历史摘要 · 未重新核验 · NVD

Grav Login plugin versions before 1.0.16 fail to validate the target account's privilege level in the onApiUserListRowAction unlock handler. An attacker with api.users.write per...

CVE-2026-56710

Grav Login plugin versions before 1.0.16 fail to validate the target account's privilege level in the onApiUserListRowAc

历史摘要 · 未重新核验 · NVD

Cloudreve has Broken Access Control - Revoked Share Access Still Allows Signed File URL Generation via Cached context_hint

## Summary Cloudreve's file-listing responses hand the client a `context_hint` (UUID) that is meant to speed up follow

历史摘要 · 未重新核验 · GitHub Advisory

Dolibarr 21.0.0 before 24.0.0 contains an authorization bypass vulnerability caused by an...

CVE-2026-77923

Dolibarr 21.0.0 before 24.0.0 contains an authorization bypass vulnerability caused by an inverted boolean condition in

历史摘要 · 未重新核验 · GitHub Advisory

Dolibarr before 24.0.0 contains a SQL injection vulnerability in the users REST API that allows...

CVE-2026-71510

Dolibarr before 24.0.0 contains a SQL injection vulnerability in the users REST API that allows authenticated attackers

历史摘要 · 未重新核验 · GitHub Advisory

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the payments REST API...

CVE-2026-71506

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the payments REST API delete endpoint that al

历史摘要 · 未重新核验 · GitHub Advisory

Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization's private pac...

CVE-2026-75542

Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositor

历史摘要 · 未重新核验 · NVD

Dolibarr 21.0.0 before 24.0.0 contains an authorization bypass vulnerability caused by an inverted boolean condition in the private-project membership check within the clonetask...

CVE-2026-77923

Dolibarr 21.0.0 before 24.0.0 contains an authorization bypass vulnerability caused by an inverted boolean condition in

历史摘要 · 未重新核验 · NVD