Base de CVEs

CVE-2026-79107 Média · 6.5 CWE-863 25/08/2026

Incorrect Authorization em Google Chrome

Incorrect authorization in TabGroups in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially leak sensitive information via crafted network traffic. (Chromium security severity: Medium)

CVE-2026-79093 Média · 4.3 CWE-863 25/08/2026

Incorrect Authorization em Google Chrome

Incorrect authorization in Paint in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: High)

CVE-2026-79088 Média · 6.5 CWE-863 25/08/2026

Incorrect Authorization em Google Chrome

Incorrect authorization in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-79082 Média · 4.3 CWE-863 25/08/2026

Incorrect Authorization em Google Chrome

Incorrect authorization in Transactions Platform in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)

CVE-2026-79077 Média · 4.3 CWE-863 25/08/2026

Incorrect Authorization em Google Chrome

Incorrect authorization in WebProtect in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-79060 Média · 6.5 CWE-863 25/08/2026

Incorrect Authorization em Google Chrome

Incorrect authorization in StorageAccessAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-79051 Média · 4.3 CWE-863 25/08/2026

Incorrect Authorization em Google Chrome

Incorrect authorization in Loader in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-79050 Média · 4.3 CWE-863 25/08/2026

Incorrect Authorization em Google Chrome

Incorrect authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-79038 Média · 6.5 CWE-863 25/08/2026

Incorrect Authorization em Google Chrome

Incorrect authorization in WebProtect in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-79023 Média · 6.5 CWE-863 25/08/2026

Incorrect Authorization em Google Chrome

Incorrect authorization in Editing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-79005 Média · 6.5 CWE-863 25/08/2026

Incorrect Authorization em Google Chrome

Incorrect authorization in StorageAccessAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-79003 Média · 4.3 CWE-863 25/08/2026

Incorrect Authorization em Google Chrome

Incorrect authorization in Device in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-79002 Baixa · 3.1 CWE-863 25/08/2026

Incorrect Authorization em Google Chrome

Incorrect authorization in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-78975 Média · 6.5 CWE-863 25/08/2026

Incorrect Authorization em Google Chrome

Incorrect authorization in DOM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-78961 Média · 4.3 CWE-863 25/08/2026

Incorrect Authorization em Google Chrome

Incorrect authorization in Core in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-78954 Média · 4.3 CWE-863 25/08/2026

Incorrect Authorization em Google Chrome

Incorrect authorization in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)

CVE-2026-78946 Média · 4.3 CWE-863 25/08/2026

Incorrect Authorization em Google Chrome

Incorrect authorization in Select in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-78911 Alta · 8.3 CWE-863 25/08/2026

Incorrect Authorization em Google Chrome

Incorrect authorization in USB in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-78907 Média · 6.5 CWE-863 25/08/2026

Incorrect Authorization em Google Chrome

Incorrect authorization in WebProtect in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-78898 Média · 5.4 CWE-863 25/08/2026

Incorrect Authorization em Google Chrome

Incorrect authorization in Downloads in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-78892 Alta · 7.1 CWE-863 25/08/2026

Incorrect Authorization em Google Chrome

Incorrect authorization in Chromoting in Google Chrome on on Windows prior to 152.0.7977.65 allowed a local attacker to bypass system access restrictions via a local program. (Chromium security severity: Medium)

CVE-2026-79673 Média · 6.5 CWE-863 25/08/2026

Ech0 before 4.4.3 Scope Bypass via profile:read Token

Ech0 before 4.4.3 protects the PUT /user endpoint with the profile:read scope, a read-only scope, but allows write operations including password changes. An attacker with an admin's profile:read access token can change the admin's password and login to obtain an unrestricted session token that bypasses all scope enforcement.

CVE-2026-49050 Alta · 8.8 CWE-863 25/08/2026

Apache DolphinScheduler: General user can mint admin access tokens via /access-tokens

General user can mint admin access tokens via /access-tokens This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the issue.

CVE-2026-77134 Alta · 8.3 CWE-863 25/08/2026

Broken Access Control in extension "femanager" (femanager)

The extension fails to require the dedicated admin confirmation token when processing an admin-approval request, so a regular user confirmation hash, obtainable by any visitor through the public resend-confirmation action, is sufficient to self-approve a pending account awaiting admin approval.

CVE-2026-56710 Crítica · 9.8 CWE-863 24/08/2026

Grav Login Plugin before 1.0.16 Privilege Escalation via Unlock

Grav Login plugin versions before 1.0.16 fail to validate the target account's privilege level in the onApiUserListRowAction unlock handler. An attacker with api.users.write permission can clear login lockout counters on admin.super accounts, removing brute-force protection from the highest-privilege accounts without requiring equivalent permissions.