The internet is broken right now.

Incorrect authorization in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)

Auth & access Browser & mail Google Chrome

Missing authorization in IME in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

Auth & access Browser & mail Google Chrome

Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Documents). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle One-to-One Fulfillment. Successful attacks of this vulnerability can result in takeover of Oracle One-to-One Fulfillment. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

Auth & access Web app

Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway. Successful attacks of this vulnerability can result in takeover of Oracle E-Business Suite Integrated SOA Gateway. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

Auth & access Web app

Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger Update Transform, Reports). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iSetup. Successful attacks of this vulnerability can result in takeover of Oracle iSetup. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

Auth & access

Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger Update Transform, Reports). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iSetup. Successful attacks of this vulnerability can result in takeover of Oracle iSetup. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

Auth & access

Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities they aren't authorized to access, including other users, other accounts and, in Unblu Cloud, other customers' accounts, via configuration read and write operations that target those entities. The Collaboration Server doesn't check whether the user reading or changing configuration has access to the entity the configuration belongs to. With certain non-default configuration validation settings, a registered user can additionally write configuration properties they aren't allowed to edit, in any scope. Exploitation requires an authenticated session but no user interaction.

Auth & access Server

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing authorization check vulnerability in engine-rest task sub-resources that allows authenticated attackers with no permission grants to access task comments and attachments by calling singular read and delete endpoints that lack the authorization-filtered checks enforced on their corresponding list endpoints. Using only a known object ID, attackers can exploit TaskAttachmentResourceImpl and TaskCommentResourceImpl methods such as getAttachment, getAttachmentData, deleteAttachment, and getComment to read or download task attachments and comments and to permanently delete task attachments.

Auth & access

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in the device API, device forms, signing key and product forms and JITP settings in nerves-hub nerves_hub_web allows an authenticated user who manages devices in any organization to write into other organizations via submitted org_id, product_id and deployment_id fields. The device API create and update actions and the dashboard device forms pass the request parameters to NervesHub.Devices.Device.changeset/2, which casts the organization, product, deployment group and update state as given. The signing key and product forms merge the session's organization into the submitted parameters so that a submitted org_id wins, and the JITP changeset accepts any product_id. Each request requires the manage role only in the user's own organization, and any account can create one. A device placed on another organization's deployment group, or moved into its product, is sent that organization's firmware with a download URL. The user cannot change or control devices that already belong to the other organization, and cannot upload firmware to it. This issue affects nerves_hub: from 1.0.0 before 2.5.3.

Auth & access Device

A sensitive information disclosure vulnerability in the API of HPE Networking Fabric Composer could allow an authenticated low-privileged user to access sensitive information beyond what is authorized by the user's existing privilege level. Successful exploitation could allow an attacker to obtain sensitive credentials stored on the affected system.

Auth & access

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the /legacy/Api/V8/OAuth2 password-grant endpoint returns distinct error messages for an invalid username and an invalid password. An unauthenticated remote attacker can use those response differences to enumerate valid CRM usernames and target confirmed accounts with password spraying, credential stuffing, brute-force, or social-engineering attacks. This issue is fixed in versions 7.15.2 and 8.10.2.

Auth & access Web app Suitecrm

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.8.14.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to overwrite the site's active ESP integration credentials (AWeber, Constant Contact, Infusionsoft, ConvertKit, or HubSpot API keys) with attacker-controlled values — diverting all subsequent Hustle form lead submissions to the attacker's ESP tenant — and, for HubSpot, irreversibly delete the operator's OAuth token, OAuth referer, and OAuth current-page option rows. This requires the attacker to hold the plugin-granted hustle_create capability (e.g., an Editor delegated hustle_create but not hustle_edit_integrations via Hustle's Permissions tab), which allows them to load a Hustle module wizard page and obtain the hustle_provider_action nonce needed to reach the vulnerable handlers.

Auth & access Web app

Missing Authorization (CWE-862) in the user API of Roskus Prospero Flow CRM from 2.0.0 before 5.26.0 allows a user with a basic role to read the accounts of other users of its own company, including accounts with higher privileges, and, in versions from 3.5.0, to delete them, because the routes GET /api/user/{id} and DELETE /api/user/{id} in routes/api.php carry only the auth:api middleware, which checks that a JSON Web Token is valid and nothing more, and neither UserReadController::read() nor UserDeleteController::delete() checks a permission, a policy or a role before acting. Object access is scoped by company: the read path limits the query to the company of the authenticated user, and the delete path compares the company of the target account with the company of the authenticated user. The delete path skips that comparison when the company of the authenticated user is Company::DEFAULT_COMPANY, so a user with a basic role in that company can delete any account of any company of the installation. Deleting an account removes the data held on it, and the last administrative account of a company can be deleted. This gives the attacker the personal data held on the other accounts, including email address, telephone number, postal address and IBAN, and the ability to delete accounts it has no permission to administer.

Auth & access Web app

Missing authorization in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)

Auth & access Browser & mail Google Chrome

Missing authorization in ShadowDOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

Auth & access Browser & mail Google Chrome

Missing authorization in WebUI in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

Auth & access Browser & mail Google Chrome

Incorrect authorization in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

Auth & access Browser & mail Google Chrome

Incorrect authorization in Workers in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

Auth & access Browser & mail Google Chrome

Missing authorization in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)

Auth & access Browser & mail Google Chrome

Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server). Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Billing and Revenue Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Communications Billing and Revenue Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Communications Billing and Revenue Management accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).

Auth & access Server

An authorization bypass vulnerability in the GlobalProtect gateway of Palo Alto Networks PAN-OS® software enables an authenticated attacker with valid GlobalProtect credentials to bypass IP address restrictions and circumvent network access controls that rely on source IP filtering. Cloud NGFW is not affected by this vulnerability.

Auth & access Network gear

In Apache James server prior version 3.9.1 improper Access Control List processing is exposed by the JMAP protocol which do not account for negative rules positionned by IMAP protocol. This results in users being able to administer folders in JMAP despite having being explicitly denied the right to do so in IMAP. Users are recommended to upgrade to version 3.9.1 which fixes this issue.

Auth & access Server

Authorizer before 2.4.2 contains a password reset poisoning vulnerability that allows unauthenticated attackers to control emailed link hosts by supplying x-authorizer-url gRPC metadata. Attackers can send this metadata to the gRPC port or a Grpc-Metadata-X-Authorizer-Url header through the REST gateway to capture reset or magic-link tokens and take over accounts.

Auth & access Device

Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

Auth & access Web app

Missing authorization in Chromecast in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

Auth & access Browser & mail Google Chrome

Missing authorization in UI in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

Auth & access Browser & mail Google Chrome

Missing authorization in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

Auth & access Browser & mail Google Chrome

Missing authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

Auth & access Browser & mail Google Chrome

Missing authorization in Scheduling in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

Auth & access Browser & mail Google Chrome

Missing authorization in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)

Auth & access Browser & mail Google Chrome

Missing authorization in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

Auth & access Browser & mail Google Chrome

Missing authorization in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

Auth & access Browser & mail Google Chrome

The x402 SIWX server extension in @x402/extensions 2.3.1 through 2.28.0, x402 PyPI 2.11.0 through 2.25.0, and Go module 2.16.0 through 2.28.0 contains an authorization bypass vulnerability that allows paying clients to unlock unpaid routes by supplying a mismatched PaymentPayload.resource URL. Attackers can pay for the cheapest SIWX-protected route while setting resource.url to an expensive route, then repeatedly access it using only a SIGN-IN-WITH-X header without further payment.

Auth & access Library

The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.0.43. The vulnerability exists because the `update_cc_details()` AJAX handler forwards an attacker-supplied `username` parameter to ONTRAPORT via `api_call('update_cc_details', ...)` before performing the local `username_exists()` collision check, and aborts without rolling back the remote rename when a collision is detected — leaving the remote ONTRAPORT contact renamed to an existing WordPress Administrator's login. On a subsequent login attempt, `user_login()` (hooked to `wp_authenticate`) authenticates against ONTRAPORT using the renamed login and the attacker's own password, resolves the local WordPress user row via `get_user_by('login', $username)` — which now selects the real Administrator's row — and calls `wp_set_password()` against that Administrator's user ID; because the `user_level != 10` guard only suppresses PilotPress's own cookie issuance rather than returning a `WP_Error` to core, WordPress proceeds to validate the newly-synchronized password and issues a full Administrator authentication cookie to the attacker. This makes it possible for authenticated attackers with Subscriber-level access and above — specifically any PilotPress member holding a valid ONTRAPORT contact and the Customer Center nonce — to fully take over an Administrator account.

Auth & access Web app

temporal-proxy 0.2.0 through 0.8.0 does not bind encrypted payloads to the namespace they were encrypted for. When payload encryption is enabled, the proxy chooses the decryption key by an identifier stored in the payload rather than by the namespace of the request, and nothing in the ciphertext records that namespace. A caller whom the proxy authorizes only for namespace B, and who has obtained an encrypted payload from namespace A, can therefore have the proxy decrypt it. In 0.8.0, the caller can submit the payload to the codec server's /decode endpoint. In every affected version, a caller who can also write to namespace B on the Temporal server directly can place the payload there and read it back through the proxy. This holds whether namespaces share the default key or each has its own, because a single proxy holds every key it is configured with. The issue does not give the attacker encrypted payloads they could not already obtain, and does not allow encrypted payloads to be modified.

Auth & access Server

Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains an access control bypass vulnerability that allows filemount-restricted backend users to modify folders outside their filemount via the file manager Edit-Multiple operation. Attackers holding the protected or syncExclude field permission can submit outside folder paths in the IDS parameter to publish protected folders or exclude them from DBAFS synchronization, exposing files for public download.

Auth & access Web app

An authorization flaw in the aggregation and view-definition handling of sharded deployments may allow a user holding only basic read-write privileges on a single database to define a view whose underlying processing is not fully subjected to privilege checking. Reading that view may result in unintended access to data belonging to other databases held on the same shard.

Auth & access Server

A flaw was found in the idp-auto-link authenticator of the keycloak-services component, which handles user identity federation. The issue occurs when Keycloak automatically links an incoming identity from an external provider to an existing local account based on an email address without verifying if the provider has validated that email. This can allow an attacker to take over a victim's account by using a matching unverified email address at a brokered provider.

Auth & access Web app

The system fails to properly enforce scope authorization when the `authorize_all_scopes` configuration is enabled. This allows applications using the client credentials grant type to obtain all API scopes, including sensitive internal and console scopes, without requiring explicit authorization, bypassing intended access controls. Exploitation of this vulnerability can lead to privilege escalation, enabling unprivileged clients to perform unauthorized administrative actions, access confidential organizational data, and potentially achieve full account takeover in deployments where the `authorize_all_scopes` configuration deviates from its default disabled state.

Auth & access

NetBox from 2.9.0 before 4.7.4 contains a broken access control vulnerability in BulkComponentCreateView that allows authenticated users to bypass view permissions on parent devices and virtual machines. Attackers with add-component permission can submit arbitrary device or VM IDs, or _all with filters, to view out-of-scope device details and create components on them.

Auth & access

madong-admin-saas through 5.1.4 contains an incorrect authorization vulnerability in AccessTokenMiddleware that allows authenticated tenant users to access the platform management API in multi-tenant mode. Attackers can reuse a tenant login JWT against /platformapi controllers to create platform administrator accounts, read tenant database settings, and take control of every tenant.

Auth & access Web app

Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.

Auth & access Web app

boneIO black_debian_images ships with a Mosquitto MQTT broker that uses the same default credentials on all devices. These credentials are publicly documented on github, and there is no indication in the instructions to change them. A remote attacker can use them to gain full read and write access to the broker, allowing control of connected relays, blinds, and gates, and injection of fake entities into a linked Home Assistant installation. This issue was fixed in version 1.6.0 of the image: MQTT passwords are generated per device at first boot. Devices upgraded from earlier versions keep their existing broker credentials; from boneio 1.6.0 the web panel reports credentials that are still the published defaults, and the owner has to change them.

Auth & access Device

An unauthenticated file write vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation could allow an unauthenticated remote attacker to make limited modifications to files on the affected system and to disrupt the availability of the affected service.

Auth & access

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

Auth & access Server Oracle MySQL Cluster

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

Auth & access Server Oracle MySQL Cluster

Vikunja 2.3.0 before 2.7.0 contains an improper session validation vulnerability that allows attackers to keep WebSocket access after revocation because handleAuth never checks the JWT sid claim against the sessions table. Attackers holding a stolen access token can open or maintain connections to /api/v2/ws after session deletion or TOTP enrollment, continuing to receive the victim's notification.created pushes, including comment, task and project content.

Auth & access Web app

n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains an authentication bypass because dynamic-path webhook resolution matched requests on the path alone, ignoring the server-generated identifier that is the URL's only unguessable component. Unauthenticated attackers can omit this identifier in requests to webhook, form, or MCP routes to execute workflows in unrelated projects under those projects' credentials.

Auth & access Web app

An authorization bypass in Revive Adserver 6.0.0 through 6.0.8 allows an authenticated manager restricted to one agency to access or modify resources belonging to another agency. Global input registration gives GET parameters precedence over POST parameters, while submitted administration forms use POST values. By supplying authorized object identifiers in the query string and different identifiers in the POST body, an attacker can cause permission checks and subsequent operations to target different objects. This permits unauthorized cross-agency changes, campaign ownership reassignment and disclosure of campaign and banner data. The regression was introduced in commit 156dee7bc3283c128f35e5a31bb305054cc8de1b and is fixed in Revive Adserver 6.0.9 by restoring POST precedence in global input registration.

Auth & access Web app

BeeS Software Solutions ERP before 04 September 2026 allows any low-privileged user to navigate directly to the administrative dashboard endpoint and gain access to the administrative console, including unrestricted access to institutional, employee, and student data.

Auth & access Web app