Total
3969 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-43901 | 1 Emudhra | 1 Emsigner | 2026-08-28 | N/A | 7.5 HIGH |
| Incorrect access control in the AdHoc User creation form of eMudhra emSigner v2.8.7 allows unauthenticated attackers to arbitrarily modify usernames and privileges by using the email address of a registered user. | |||||
| CVE-2026-70408 | 2026-08-28 | N/A | 8.8 HIGH | ||
| An incorrect authorization vulnerability exists in acmailer, which may allow a user to create a sub-account that has administrative privileges. | |||||
| CVE-2026-1524 | 1 Neo4j | 1 Neo4j | 2026-08-28 | N/A | 9.8 CRITICAL |
| An edgecase in SSO implementation in Neo4j Enterprise edition versions prior to version 2026.02 can lead to unauthorised access under the following conditions: If a neo4j admin configures two or more OIDC providers AND configures one or more of them to be an authorization provider AND configures one or more of them to be authentication-only, then those that are authentication-only will also provide authorization. This edgecase becomes a security problem only if the authentication-only provider contains groups which have higher privileges than provided by the intended (configured) authorization provider. When using multiple plugins for authentication and authorisation, prior to the fix the issue could lead to a plugin configured to provide only authentication or authorisation capabilities erroneously providing both capabilities. We recommend upgrading to versions 2026.02 (or 5.26.22) where the issue is fixed. | |||||
| CVE-2026-1497 | 1 Neo4j | 1 Neo4j | 2026-08-28 | N/A | 7.2 HIGH |
| Incorrect resolving of namespaces in composite databases in Neo4j Enterprise edition prior to versions 2026.02 and 5.26.22 can lead to the following scenario: an admin that intends to give a user an access to a remote database constituent "namespace.name" will inadvertently grant access to any local database or remote alias called "name". If such database or alias doesn't exist when the command is run, the privileges will apply if it's created in the future. | |||||
| CVE-2026-12624 | 2026-08-28 | N/A | 4.3 MEDIUM | ||
| Vault’s ACL policy engine did not consistently enforce a wildcard (glob) deny rule against LIST requests made with a trailing slash on the denied path. This may allow a token holding a broader allow rule alongside a narrower wildcard deny rule to enumerate the names of entries beneath a path it was intended to be denied access to. This vulnerability (CVE-2026-12624) is fixed in Vault Community Edition 2.0.3 and Vault Enterprise 2.0.3, 1.21.8, 1.20.13, and 1.19.19. | |||||
| CVE-2026-19198 | 2026-08-28 | N/A | N/A | ||
| Akaunting 3.1.21 contains an authenticated improper authorization vulnerability in the common BulkActions dispatcher.This issue affects Akaunting: 3.1.21. | |||||
| CVE-2026-18985 | 2026-08-28 | N/A | 8.1 HIGH | ||
| Incorrect Authorization vulnerability in Drupal Edit in-place field allows Forceful Browsing. This issue affects Edit in-place field versions: from 0.0.0 to 2.1.1. | |||||
| CVE-2026-16644 | 2026-08-28 | N/A | 9.1 CRITICAL | ||
| Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0. | |||||
| CVE-2025-63080 | 2026-08-28 | N/A | N/A | ||
| Firmware in KAON PG5298A and PG5298B routers allow an authenticated user to send crafted JSON-RPC requests and perform operations not possible via GUI, e.g. system file read or command execution. This vulnerability has been fixed in firmware version: 3.0.82 for PG5298A and 4.0.82 for PG5298B. | |||||
| CVE-2026-79619 | 2026-08-28 | N/A | N/A | ||
| On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root. Affected operations include pool-administrative operations (eg create, import, destroy), pool event log access (zpool events) and fault injection (zinject). Exploiting the problem requires only that the local user is permitted to open /dev/zfs (governed by local device permissions) and that the kernel permits unprivileged user namespace creation. No prior access to the target pool or its underlying devices is needed. | |||||
| CVE-2026-79002 | 1 Google | 1 Chrome | 2026-08-28 | N/A | 3.1 LOW |
| Incorrect authorization in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-79174 | 1 Google | 1 Chrome | 2026-08-28 | N/A | 4.3 MEDIUM |
| Incorrect authorization in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2026-79177 | 2 Google, Microsoft | 2 Chrome, Windows | 2026-08-28 | N/A | 6.5 MEDIUM |
| Incorrect authorization in Media in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low) | |||||
| CVE-2026-79178 | 1 Google | 1 Chrome | 2026-08-28 | N/A | 4.3 MEDIUM |
| Incorrect authorization in Web Authentication (Passkeys & Security Keys) in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-79190 | 1 Google | 1 Chrome | 2026-08-28 | N/A | 4.3 MEDIUM |
| Incorrect authorization in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) | |||||
| CVE-2026-79191 | 1 Google | 1 Chrome | 2026-08-28 | N/A | 3.1 LOW |
| Incorrect authorization in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-79205 | 1 Google | 1 Chrome | 2026-08-28 | N/A | 4.3 MEDIUM |
| Incorrect authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-79222 | 1 Google | 2 Android, Chrome | 2026-08-28 | N/A | 4.3 MEDIUM |
| Incorrect authorization in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to bypass web origin policy via a co-installed app. (Chromium security severity: Medium) | |||||
| CVE-2026-79228 | 1 Google | 1 Chrome | 2026-08-28 | N/A | 3.1 LOW |
| Incorrect authorization in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation into a privileged page via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-79237 | 1 Google | 1 Chrome | 2026-08-28 | N/A | 4.3 MEDIUM |
| Incorrect authorization in Navigation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) | |||||