CVE-2026-121248

chromium-browser: Incorrect authorization in API

Incorrect authorization in API in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-121253

chromium-browser: Missing authorization in DevTools

Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass site isolation via a crafted Chrome extension. (Chromium security severity: Low)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-125347

chromium-browser: Incorrect authorization in FileSystem

Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.50 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-125782

WordPress PowerPress Podcasting plugin <= 11.18.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PowerPress Podcasting: from n/a through 11.18.2.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-120471

Joomla Extension - acymailing.com - Site modules rendered outside their access level in AcyMailing 1.0.0 - 11.1.1

Joomla Extension - acymailing.com - Site modules rendered outside their access level in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated visitor can cause a site module to be rendered regardless of the Joomla access level that module is restricted to, which discloses content reserved for a higher view level. The WordPress plugin is not affected.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-120470

Joomla / WordPress Extension - acymailing.com - Online version of an email readable without the visibility check in AcyMailing 1.0.0 - 11.1.1

Joomla / WordPress Extension - acymailing.com - Online version of an email readable without the visibility check in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated attacker can read the online version of campaigns that were never made public, including campaigns unpublished after being sent and campaigns sent to a restricted audience.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-120466

Joomla / WordPress Extension - acymailing.com - Missing authorization on subscription changes in AcyMailing 1.0.0 - 11.1.1

Joomla / WordPress Extension - acymailing.com - Missing authorization on subscription changes in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated attacker who knows a subscriber's email address can unsubscribe that subscriber from one mailing list or from every mailing lists, without proving that the address is theirs. The affected feature also lets an attacker determine whether a given email address belongs to a subscriber of the site.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-121014

WordPress WP Job Portal plugin <= 2.7.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through 2.7.2.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ahmad Wordpress-extensions

Products

Wp Job Portal Wp Job Portal

CVE-2026-122300

Apache Roller: Limited weblog members can remove or change published entries

Missing Authorization vulnerability in Apache Roller 4.0 through 6.1.6 allows a weblog member with the Limited role to remove or change entries that member may only read, including entries published by other members. The entry editor checked the member's weblog role but not whether that role permits work on the entry. Users are recommended to upgrade to Apache Roller 6.1.7 or later.

CVSS n/a EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Roller

CVE-2026-121352

Adobe Connect | Incorrect Authorization (CWE-863)

Adobe Connect is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access to sensitive resources. Exploitation of this issue does not require user interaction. Scope is changed.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Adobe Connect

CVE-2026-121913

Adobe Connect | Incorrect Authorization (CWE-863)

Adobe Connect is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to sensitive information or functionality. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Adobe Connect

CVE-2026-119017

Adobe Experience Manager | Incorrect Authorization (CWE-863)

Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

CVSS 3.1 · 9.9 Critical EPSS 1.1% KEV · Not listed

Vendors

Adobe

Products

Adobe Experience Manager Experience Manager

CVE-2026-114371

Adobe Experience Manager | Incorrect Authorization (CWE-863)

Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

CVSS 3.1 · 9.9 Critical EPSS 1.1% KEV · Not listed

Vendors

Adobe

Products

Adobe Experience Manager Experience Manager Experience Manager Cloud Service

CVE-2026-113368

Nexus Repository 3 - Group Repository Member Authorization Bypass

Sonatype Nexus Repository 3 does not check that a user account is authorized to access a repository before the repository is added as a member of a group repository. A user account that has signed in with valid credentials and holds the add or edit privilege on a group repository can add a repository that the account cannot read or browse, and then read the content of that repository through the group. The anonymous user can only do this if an administrator has explicitly granted it that privilege.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Sonatype

Products

Nexus Repository Manager

CVE-2026-71367

Awx: websocket broadcast groups leak cross-organization job metadata

An incorrect authorization vulnerability was found in AWX's WebSocket consumer. The consumer_access() function only enforces access controls for object-level event groups (job_events, workflow_events, ad_hoc_command_events) but does not restrict subscriptions to global broadcast groups such as 'jobs-status_changed'. When an authenticated user subscribes to a global broadcast group, the server accepts the subscription without verifying that the user has permission to view the associated resources. In multi-organization deployments, this allows a low-privilege user in one organization to receive real-time job status metadata from all organizations, including job IDs, status transitions, timestamps, and infrastructure topology details such as instance group names, bypassing the organization isolation enforced by the REST API.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Ansible Automation Platform

CVE-2026-118196

Apache Allura: OAuth1 rebinding

OAuth 1 rebinding vulnerability in Apache Allura. This issue affects Apache Allura: through 1.22.0. Users are recommended to upgrade to version 1.22.1, which fixes the issue.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Allura

CVE-2026-119491

WordPress Media LIbrary Assistant plugin <= 3.43 - Broken Access Control vulnerability

Missing Authorization vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Media LIbrary Assistant: from n/a through 3.43.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Davidlingren Wordpress-extensions

Products

Media Library Assistant Media Library Assistant

CVE-2026-120853

WordPress CartFlows plugin <= 3.3.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Brainstorm Force CartFlows cartflows allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CartFlows: from n/a through 3.3.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Brainstormforce Wordpress-extensions

Products

Cartflows Cartflows

CVE-2026-122668

WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mycred Wordpress-extensions

Products

Mycred Mycred

CVE-2026-120842

WordPress SureForms plugin <= 2.13.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureForms: from n/a through 2.13.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Brainstormforce Wordpress-extensions

Products

Sureforms Sureforms