CVE-2026-100278

Privilege Escalation Allowing Comment Modification in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Jetbrains

Products

Youtrack

CVE-2026-95374

chromium-browser: Incorrect authorization in Network

Incorrect authorization in Network in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-78210

Arbitrary Script Execution Through Scoped Permission Flaws in Octopus Server

In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts in an environment without possessing the required authorization.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Octopus

Products

Octopus Server

CVE-2026-104443

YesWiki before 4.6.7 Scope Bypass via Triples Delete API

YesWiki before 4.6.7 contains an empty-filter scope bypass in the triples delete API that allows any authenticated user to delete or forge arbitrary semantic triples regardless of ownership. Attackers can send an empty filter to the triples delete endpoint to remove the admins-group membership triple, emptying the admin group and causing a site-wide authorization lockout.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Yeswiki

Products

Yeswiki

CVE-2026-93379

Chrome Site Isolation Bypass via ORB Authorization Flaw

Incorrect authorization in ORB in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-103259

n8n before 2.39.6 and 2.40.x before 2.40.1 Session Token Leak via Dynamic Credentials

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a session token leakage vulnerability in the Dynamic Credentials authorize and revoke endpoints. Attackers with resolver registration capability can capture collaborators' session tokens by setting a fallback resolver to an attacker-controlled endpoint during the account connection flow, enabling unauthorized credential access.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

N8n

Products

N8n

CVE-2026-71899

Apache DolphinScheduler: Missing Authorization in query-dynamic-sub-workflows API Leads to Information Disclosure

A missing authorization vulnerability exists in the `query-dynamic-sub-workflows` API of Apache DolphinScheduler. The API does not properly verify whether the authenticated user has permission to access the workflows being queried. An authenticated user who does not have permission to access a specific project can invoke the API with parameters referencing workflows belonging to that project and retrieve workflow information. This allows users to access workflow data outside their authorized project scope, resulting in unauthorized information disclosure. This issue affects Apache DolphinScheduler: from 3.2.0 before 3.4.3. Users are recommended to upgrade to version 3.4.3, which fixes the issue.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Dolphinscheduler

CVE-2026-95358

chromium-browser: Incorrect authorization in Mobile

Incorrect authorization in Mobile in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker to bypass system access restrictions into a privileged page via a co-installed app. (Chromium security severity: Medium)

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Android Chrome

CVE-2026-81439

OpenManage Server Administrator Remote Authorization Bypass

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Dell

Products

Dell Openmanage Server Administrator Managed Node For Rhel 8.10 Dell Openmanage Server Administrator Managed Node For Rhel 9.4 Dell Openmanage Server Administrator Managed Node For Sles 15 and 3 more

CVE-2026-58159

Apache Traffic Server: Listener and ACL handling allow access-control bypass

Apache Traffic Server can bypass IP access controls on UDS listeners and through ACL matching errors. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Apache Traffic Server Traffic Server

CVE-2026-58156

Apache Traffic Server: URL and port parsing errors allow access-control bypass

Apache Traffic Server mis-parses ports in URLs and userinfo, allowing port-based access-control bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Traffic Server

CVE-2026-82828

Improper authorization may allow a general user to perform operations equivalent to those available with administrator privileges

Hitachi Coding Software Suite contains an Incorrect Authorization vulnerability that allows an unprivileged user to perform administrator-level operations. This issue affects Hitachi Coding Software Suite: through 3.3.0.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Hitachi Industrial Equipment Systems

Products

Hitachi Coding Software Suite

CVE-2026-102249

REBUILD file-editor-save authorization

A security flaw has been discovered in REBUILD up to 4.4.11. This vulnerability affects unknown code of the file /commons/file-editor-save. The manipulation of the argument url/fileKey results in missing authorization. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Rebuild

Products

Rebuild

CVE-2026-101880

OpenClaw Windows Node before 2026.7.1 Authorization Bypass

OpenClaw Windows Node before 2026.7.1 contains an incorrect authorization vulnerability in the system.run exec-approval policy where ExecShellWrapperParser fails to split commands on pipe operators or extract command substitutions. Connected gateways or agents can bypass approval rules by placing denied commands behind allowed prefixes using pipe operators or command substitution syntax, achieving arbitrary command execution on Windows hosts.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Openclaw

Products

Openclaw Windows Node

CVE-2026-89032

BerriAI LiteLLM < 1.101.0-rc.1 Tenant Isolation Bypass via Semantic Cache Layer

BerriAI LiteLLM before 1.101.0-rc.1 contains a tenant isolation bypass vulnerability in the semantic cache layer that allows authenticated users to read other tenants' cached responses by exploiting a metadata key mismatch between _get_semantic_cache_tenant_scope() and _get_metadata_variable_name(). Attackers holding a valid virtual key can submit semantically similar prompts on affected routes such as /v1/responses and /bedrock/* to retrieve cached responses containing other tenants' personally identifiable information, financial data, or source code, and can cause agentic front-ends to auto-execute attacker-supplied tool calls under victim credentials by returning cached function_call or tool_calls payloads to a different principal.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Berriai Litellm

Products

Litellm Litellm

CVE-2026-89013

Dolibarr 23.0.4 < 24.0.1 Authorization Bypass via hashp Parameter in document.php

Dolibarr 23.0.4 before 24.0.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read arbitrary files through the document storage endpoints by supplying a crafted hashp parameter value. Attackers can send a request with hashp=shared to skip token validation while satisfying the authorization condition in htdocs/document.php and htdocs/viewimage.php, gaining access to application logs, uploaded business documents, database backups containing password hashes, and files belonging to other multicompany entities.

CVSS 4.0 · 8.7 High EPSS 1.6% KEV · Not listed

Vendors

Dolibarr

Products

Dolibarr Dolibarr Erp\/crm

CVE-2026-82023

LearnPress WordPress Plugin < 4.4.6 Broken Object-Level Authorization via Quiz Answer Insert

LearnPress WordPress Plugin before 4.4.6 contains a broken object-level authorization vulnerability that allows authenticated attackers with the Instructor role to add answers to quiz questions owned by other instructors by exploiting a missing ownership check on the question answer insert path. Attackers can supply arbitrary question identifiers during answer insertion, bypassing instructor-boundary restrictions to persistently modify quiz content across courses they do not own.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Thimpress Wordpress

Products

Learnpress Wordpress

CVE-2026-71518

Typemill < 2.26.0 Authorization Bypass via Media File Download Route

Typemill before 2.26.0 contains an authorization bypass vulnerability in the media file download route that allows unauthenticated attackers to access restricted files by submitting path-equivalent URL variants. Attackers can substitute normalized path forms such as dot-slash prefixes, double slashes, or percent-encoded sequences to pass role-based restriction checks while the filesystem resolves the request to the protected file, enabling unauthorized file download without credentials.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Typemill

Products

Typemill

CVE-2026-71510

Dolibarr < 24.0.0 Users REST API SQL Injection via filter parameter

Dolibarr before 24.0.0 contains a SQL injection vulnerability in the users REST API that allows authenticated attackers with user-read rights to extract sensitive data by splicing unsanitized filter parameters into SQL WHERE clauses without column restrictions. Attackers can perform binary search on numeric fields and LIKE prefix iteration on string fields to recover salary figures and password verifiers omitted from normal API responses, while raw database error messages in the same endpoint enable column name enumeration.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Dolibarr

Products

Dolibarr Dolibarr Erp\/crm

CVE-2026-71506

Dolibarr < 24.0.0 Payments REST API Improper Authorization via Delete Endpoint

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the payments REST API delete endpoint that allows authenticated attackers with invoice-deletion rights to permanently delete any payment record by bypassing the intended payment-issuance rights check. Attackers can exploit this misconfigured permission check to zero paid amounts on invoices and remove entries from accounting exports, causing financial data integrity loss.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Dolibarr

Products

Dolibarr Dolibarr Erp\/crm