Total
4691 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-21296 | 1 Adobe | 3 Commerce, Commerce B2b, Magento | 2026-08-28 | N/A | 4.3 MEDIUM |
| Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized view access of data. Exploitation of this issue does not require user interaction. | |||||
| CVE-2026-21289 | 1 Adobe | 3 Commerce, Commerce B2b, Magento | 2026-08-28 | N/A | 7.5 HIGH |
| Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized view access of data. Exploitation of this issue does not require user interaction. | |||||
| CVE-2026-21286 | 1 Adobe | 3 Commerce, Commerce B2b, Magento | 2026-08-28 | N/A | 5.3 MEDIUM |
| Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized view access of data. Exploitation of this issue does not require user interaction. | |||||
| CVE-2026-21285 | 1 Adobe | 3 Commerce, Commerce B2b, Magento | 2026-08-28 | N/A | 4.3 MEDIUM |
| Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized access to a feature. Exploitation of this issue does not require user interaction. | |||||
| CVE-2026-21274 | 3 Adobe, Apple, Microsoft | 3 Dreamweaver, Macos, Windows | 2026-08-28 | N/A | 7.8 HIGH |
| Dreamweaver Desktop versions 21.6 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could leverage this vulnerability to bypass security measures and execute unauthorized code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | |||||
| CVE-2026-79152 | 1 Google | 2 Android, Chrome | 2026-08-27 | N/A | 9.8 CRITICAL |
| Incorrect authorization in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to bypass web origin policy via a co-installed app. (Chromium security severity: Low) | |||||
| CVE-2026-79179 | 1 Google | 1 Chrome | 2026-08-27 | N/A | 6.5 MEDIUM |
| Incorrect authorization in DOM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially leak sensitive information via a crafted HTML page. (Chromium security severity: Low) | |||||
| CVE-2026-79005 | 1 Google | 1 Chrome | 2026-08-27 | N/A | 6.5 MEDIUM |
| Incorrect authorization in StorageAccessAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) | |||||
| CVE-2026-78946 | 1 Google | 1 Chrome | 2026-08-27 | N/A | 4.3 MEDIUM |
| Incorrect authorization in Select in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) | |||||
| CVE-2026-78975 | 1 Google | 1 Chrome | 2026-08-27 | N/A | 6.5 MEDIUM |
| Incorrect authorization in DOM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-78907 | 1 Google | 1 Chrome | 2026-08-27 | N/A | 6.5 MEDIUM |
| Incorrect authorization in WebProtect in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-78911 | 1 Google | 1 Chrome | 2026-08-27 | N/A | 8.3 HIGH |
| Incorrect authorization in USB in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2026-65182 | 1 Apache | 1 Tomcat | 2026-08-27 | N/A | 9.1 CRITICAL |
| Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue. | |||||
| CVE-2026-68525 | 1 Apache | 1 Tomcat | 2026-08-27 | N/A | 9.1 CRITICAL |
| Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fixes the issue. | |||||
| CVE-2026-79225 | 1 Google | 2 Android, Chrome | 2026-08-27 | N/A | 4.3 MEDIUM |
| Incorrect authorization in Browser in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via UI Interaction. (Chromium security severity: Low) | |||||
| CVE-2026-79133 | 1 Google | 1 Chrome | 2026-08-27 | N/A | 6.5 MEDIUM |
| Incorrect authorization in Forms in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) | |||||
| CVE-2026-79218 | 1 Google | 1 Chrome | 2026-08-27 | N/A | 8.3 HIGH |
| Incorrect authorization in Sandbox in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2026-79023 | 1 Google | 1 Chrome | 2026-08-27 | N/A | 6.5 MEDIUM |
| Incorrect authorization in Editing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-79038 | 1 Google | 1 Chrome | 2026-08-27 | N/A | 6.5 MEDIUM |
| Incorrect authorization in WebProtect in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-77134 | 2026-08-26 | N/A | N/A | ||
| The extension fails to require the dedicated admin confirmation token when processing an admin-approval request, so a regular user confirmation hash, obtainable by any visitor through the public resend-confirmation action, is sufficient to self-approve a pending account awaiting admin approval. | |||||