Base de CVEs

CVE-2026-17986 Média · 6.5 CWE-284 29/07/2026

Insufficient policy enforcement in Bluetooth in Google Chrome prior to 151.0.7922.72 allowed a...

Insufficient policy enforcement in Bluetooth in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-17976 Média · 4.3 CWE-284 29/07/2026

Insufficient policy enforcement in Extensions in Google Chrome prior to 151.0.7922.72 allowed an...

Insufficient policy enforcement in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to bypass discretionary access control via a crafted domain name. (Chromium security severity: Low)

CVE-2026-17961 Média · 4.3 CWE-284 29/07/2026

Inappropriate implementation in Session in Google Chrome on Android prior to 151.0.7922.72...

Inappropriate implementation in Session in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-17944 Média · 4.3 CWE-284 29/07/2026

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72...

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-17917 Média · 6.5 CWE-284 29/07/2026

Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72...

Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-17873 Média · 6.5 CWE-284 29/07/2026

Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72...

Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-17830 Média · 6.5 CWE-284 29/07/2026

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72...

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-17825 Média · 6.5 CWE-284 29/07/2026

Insufficient policy enforcement in Passwords in Google Chrome on Android prior to 151.0.7922.72...

Insufficient policy enforcement in Passwords in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-17824 Média · 6.5 CWE-284 29/07/2026

Insufficient policy enforcement in ServiceWorker in Google Chrome prior to 151.0.7922.72 allowed...

Insufficient policy enforcement in ServiceWorker in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-17781 Média · 4.3 CWE-284 29/07/2026

Inappropriate implementation in Extensions in Google Chrome prior to 151.0.7922.72 allowed an...

Inappropriate implementation in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension. (Chromium security severity: Medium)

CVE-2026-17780 Média · 6.3 CWE-284 29/07/2026

Inappropriate implementation in Isolated Web Apps in Google Chrome prior to 151.0.7922.72 allowed...

Inappropriate implementation in Isolated Web Apps in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-67431 Alta · 8.3 CWE-284 29/07/2026

MCP Ruby SDK: Ruby SSE Session Poisoning

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not bind a session ID to a session owner, allowing an attacker with a stolen session ID to send tools/call requests that execute in the victim's session. This issue is fixed in version 0.23.0.

CVE-2026-65888 Crítica · 9.8 CWE-284 29/07/2026

Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2 - The socialLogin method allows actors to login as any given user on the target site.

CVE-2026-65887 Crítica · 9.8 CWE-284 29/07/2026

Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2 - The resetPassword method allows actors to reset any user password, allowing to login and act as these users - excluding super admins.

CVE-2026-65943 Alta · 7.5 CWE-284 29/07/2026

Joomla Extension - rolandd.com - Unauthenticated directory creation RO CSVI < 9.11.0

CVE-2026-65884 Crítica · 9.8 CWE-284 29/07/2026

Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2 - The registration method allows users provided usergroup IDs, allowing unauthenticated actors to register new accounts with administrative permissions.

CVE-2026-41920 Crítica · 9.3 CWE-284 29/07/2026

Apache Traffic Server: SNI to Host header matching policy is not properly enforced

Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.1.15 or 10.1.4, which fixes the issue.

CVE-2026-63236 Baixa · 3.7 CWE-284 29/07/2026

Improper access control vulnerability

An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to read another user's name, internal identifier, scores, lesson status, lesson position, and cached lesson state via the SCORM API endpoint.

CVE-2026-63235 Baixa · 3.7 CWE-284 29/07/2026

Improper access control vulnerability

An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to forcibly terminate the session of any user given their email address via the login kickout endpoint, resulting in a denial of service.

CVE-2026-64863 Crítica · 9.1 CWE-284 28/07/2026

goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled WebDAV MOVE as a write-only method and did not enforce --no-delete, allowing WebDAV clients to delete or overwrite files via MOVE with Overwrite: T. This issue is fixed in version 2.1.4.

CVE-2026-7362 Média · 6.5 CWE-284 28/07/2026

Improper Access Control Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway

IBM Sterling B2B Integrator 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 could allow an authenticated user to obtain sensitive information that should only be available to a privileged user.

CVE-2026-62427 Alta · 8.8 CWE-284 28/07/2026

sysctl and platform-op locks open to abuse

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To manage the system, sysctl and platform operations are used by the control domain or a possible Xenstore domain. Some of these operations may not be executed in parallel, so a system-wide lock each is used. The way those locks are acquired is, however, not providing any fairness. Furthermore, with XSM/Flask in use, the lock acquire will, for some operations, occur ahead of any permission checking. The sysctl issue is CVE-2026-62426. The platform-op issue is CVE-2026-62427.

CVE-2026-14926 Média · 4.2 CWE-284 28/07/2026

FluentCart < 1.4.0 - Subscriber+ Subscription Payment-Method Tampering via IDOR

The FluentCart A New Era of eCommerce WordPress plugin before 1.4.0 does not verify that a subscription belongs to the requesting customer in several of its payment-method endpoints, allowing any authenticated customer to act on another customer's subscription (changing its payment method, or cancelling and re-binding it) when they know the target subscription identifier.

CVE-2021-32084 Crítica · 9.8 CWE-284 27/07/2026

Improper Access Control em Quest Kace Systems Management Appliance

An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. If a customer restricts access to the web console by IP address or subnets, the API endpoints are not restricted. If credentials/API keys are known to an attacker, the appliance can still be accessed via the API, leading to a potential compromise of the entire environment that is configured for KACE.

CVE-2026-64738 Crítica · 9.8 CWE-284 27/07/2026

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS...

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A malicious app may be able to break out of its sandbox.