Base de CVEs

CVE-2026-85298 Alta · 7.3 CWE-863 14/10/2026

Improper Authorization in Google Cloud Application Integration Leads to Privilege Escalation

An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Google Cloud Application Integration versions prior to 2026-08-27 allows an authenticated user to escalate privileges and impersonate a service account in the project. This vulnerability was patched on 27 August 2026, and no customer action is needed.

CVE-2026-92426 Média · 4.9 CWE-863 14/10/2026

YITH WooCommerce Popup < 1.60.0 - Contributor+ Arbitrary Post Meta Deletion

The YITH WooCommerce Popup WordPress plugin before 1.60.0 does not check the capability of the requesting user before deleting post meta, allowing users with the Contributor role and above to delete arbitrary post meta from any post, including content owned by higher-privileged users.

CVE-2026-106098 Média · 5.3 CWE-863 14/10/2026

WP Data Access < 5.5.77 - Unauthenticated Incorrect Authorization via Inline App Update

The WP Data Access WordPress plugin before 5.5.77 does not correctly check authorization on one of its application REST endpoints, verifying only read permission before performing a write, which allows unauthenticated attackers to modify data in an application exposed for anonymous read access even when update actions have been disabled by the administrator.

CVE-2026-110453 Média · 4.3 CWE-863 14/10/2026

Nix before 2.35.3, when unsandboxed on macOS or FreeBSD, incorrectly allows connections made by...

Nix before 2.35.3, when unsandboxed on macOS or FreeBSD, incorrectly allows connections made by build users from daemon clients.

CVE-2026-110451 Média · 4.3 CWE-863 14/10/2026

Nix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbelt sandbox escape (for an...

Nix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbelt sandbox escape (for an unconfined build) because a certain size threshold is mishandled.

CVE-2026-92817 Alta · 8.8 CWE-863 13/10/2026

Inductive Automation Ignition Software Incorrect Authorization

The Ignition Perspective module does not properly validate session privileges when determining Designer-level access. An authenticated user with access to a Vision project could provide their valid Vision session identifier and gain Designer-level privileges. An attacker could exploit these elevated privileges to execute arbitrary code in the context of the Ignition Gateway process.

CVE-2026-110159 Crítica · 9.6 CWE-863 13/10/2026

Incorrect authorization in Updater in Google Chrome prior to 155.0.8059.79 allowed a local...

Incorrect authorization in Updater in Google Chrome prior to 155.0.8059.79 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)

CVE-2026-110144 Alta · 8.6 CWE-863 13/10/2026

Incorrect authorization in Mojo in Google Chrome on on Windows prior to 155.0.8059.79 allowed a...

Incorrect authorization in Mojo in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)

CVE-2026-95695 Alta · 7.4 CWE-863 13/10/2026

IBM WebSphere Application Server Liberty Incorrect Authorization

IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization.

CVE-2026-95639 Alta · 8.6 CWE-863 13/10/2026

Photoshop Desktop | Incorrect Authorization (CWE-863)

Photoshop Desktop is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

CVE-2026-75994 Crítica · 9.6 CWE-863 13/10/2026

ColdFusion | Incorrect Authorization (CWE-863)

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.

CVE-2026-71385 Alta · 8.4 CWE-863 13/10/2026

ColdFusion | Incorrect Authorization (CWE-863)

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.

CVE-2026-11713 Média · 5.4 CWE-863 13/10/2026

IBM WebSphere Application Server Liberty Incorrect Authorization

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by a privilege escalation vulnerability with the restConnector-2.0 feature enabled.

CVE-2026-108388 Baixa · 3.5 CWE-863 13/10/2026

Indico legacy contribution export cache poisoning discloses restricted metadata

Indico is a feature-rich event management system. Indico 3.3.3 through 3.3.13 incorrectly uses the ambient web-session user instead of the user supplied to Contribution.can_manage when checking inherited event contribution-management permission. A low-privileged user can induce a privileged user to request a crafted legacy contribution export and cause speaker or author email addresses and contribution access-control entries to be stored in an API cache entry retrievable with less privilege. This issue was fixed in Indico 3.3.14.

CVE-2026-106623 Alta · 7.5 CWE-863 13/10/2026

ColdFusion | Incorrect Authorization (CWE-863)

ColdFusion is affected by an Incorrect Authorization vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue does not require user interaction.

CVE-2026-106620 Crítica · 9.6 CWE-863 13/10/2026

ColdFusion | Incorrect Authorization (CWE-863)

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction. Scope is changed.

CVE-2026-106618 Alta · 8.8 CWE-863 13/10/2026

ColdFusion | Incorrect Authorization (CWE-863)

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

CVE-2026-106617 Alta · 8.8 CWE-863 13/10/2026

ColdFusion | Incorrect Authorization (CWE-863)

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

CVE-2026-106615 Alta · 8.8 CWE-863 13/10/2026

ColdFusion | Incorrect Authorization (CWE-863)

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

CVE-2026-106614 Alta · 7.8 CWE-863 13/10/2026

ColdFusion | Incorrect Authorization (CWE-863)

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.

CVE-2026-106612 Crítica · 9.9 CWE-863 13/10/2026

ColdFusion | Incorrect Authorization (CWE-863)

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

CVE-2026-106090 Alta · 8.8 CWE-863 13/10/2026

ColdFusion | Incorrect Authorization (CWE-863)

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

CVE-2026-106089 Alta · 8.8 CWE-863 13/10/2026

ColdFusion | Incorrect Authorization (CWE-863)

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

CVE-2026-105994 Alta · 7.7 CWE-863 13/10/2026

ColdFusion | Incorrect Authorization (CWE-863)

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction. Scope is changed.

CVE-2026-105901 Alta · 8.8 CWE-863 13/10/2026

ColdFusion | Incorrect Authorization (CWE-863)

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.