Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Medium6.5Missing authorization in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page.EPSS 0.3%Oct 6, 2026
- High8.3Missing authorization in FullScreen in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social eng…EPSS 0.3%Oct 6, 2026
- Medium6.5Missing authorization in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a cra…EPSS 0.3%Oct 6, 2026
- Medium4.6Missing authorization in CredentialProvider in Google Chrome on on Windows prior to 155.0.8059.39 allowed a local attacker to obtain sensitive information via physical access.EPSS 0.1%Oct 6, 2026
- Medium5.3Missing authorization in Media in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensi…EPSS 0.3%Oct 6, 2026
- Medium5.4Missing authorization in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social en…EPSS 0.2%Oct 6, 2026
- High7.1Payload is a free and open source headless content management system.EPSS 0.2%Oct 6, 2026
- Critical9.8Payload is a free and open source headless content management system.EPSS 0.4%Oct 6, 2026
- Medium6.9Payload is a free and open source headless content management system.EPSS 0.3%Oct 6, 2026
- High7.7Payload is a free and open source headless content management system.EPSS 0.3%Oct 6, 2026
- Medium6.4Payload is a free and open source headless content management system.EPSS 0.2%Oct 6, 2026
- Medium6.9Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4EPSS 0.3%Oct 5, 2026
- High8.5CopyAPIView (awx/awx/api/generics.py:873) sets permission_classes = (IsAuthenticated,), so DRF's get_object() performs no object-level RBAC.Sep 23, 2026
- Critical9.8IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote unauthenticated attacker to view and modify sensitive information and cause a denial…Sep 22, 2026
- Medium5.3The Handily plugin for WordPress is vulnerable to unauthorized payment settings modification due to missing authorization checks in all versions up to, and including, 1.0.3.EPSS 0.2%Sep 22, 2026
- Medium5.3The PixelPlay plugin for WordPress is vulnerable to unauthorized API key deletion due to missing authorization checks in all versions up to, and including, 1.0.2.EPSS 0.2%Sep 22, 2026
- Medium5.3The Image Buzz plugin for WordPress is vulnerable to unauthorized API key modification due to missing authorization checks in all versions up to, and including, 1.0.3.EPSS 0.2%Sep 22, 2026
- Critical9.9ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization VulnerabilityKEVEPSS 0.9%Sep 8, 2026
- Critical9.3MOOS essential-moos pShare through 10.0.1 fails to properly authorize PSHARE_CMD messages, allowing any publisher to reconfigure network routes and listeners at runtime.EPSS 0.8%Sep 3, 2026
- Critical9.4RansomLook contains an authorization weakness in the web-based configuration editor exposed through the /admin/config endpoint.EPSS 0.6%Aug 24, 2026
- High8.7RansomLook fails to enforce the privacy status of ransomware groups and markets when distributing newly collected victim posts to external notification channels.EPSS 0.4%Aug 24, 2026
- Critical9.2RansomLook does not consistently enforce authorization checks when accessing groups, markets, and ransom notes marked as private.EPSS 0.7%Aug 24, 2026
- Critical9.2RansomLook contains an authorization flaw in its legacy database export functionality that can allow unauthenticated remote users to retrieve information intended to r…EPSS 0.7%Aug 24, 2026
- Critical9.1Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no authorization path reads them.Aug 22, 2026
- Critical9.2Jet Admin allows an attacker to create a malicious app and connect it to a target user's custom domain, edit the authentication configuration, and reroute traffic to t…Aug 21, 2026