CVE-2026-121159

chromium-browser: Incorrect authorization in History

Incorrect authorization in History in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-121164

chromium-browser: Incorrect authorization in Views

Incorrect authorization in Views in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Google

Products

Macos Chrome

CVE-2026-121193

chromium-browser: Incorrect authorization in Extensions

Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-121220

chromium-browser: Incorrect authorization in Core

Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-124431

Craft CMS 5.10.0 before 5.11.2 Unauthorized Volume Browsing via Asset Replacement

Craft CMS from 5.10.0 before 5.11.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to browse volumes they lack permissions for. Attackers can delete a linked asset and use the replacement volume browser modal to view directory structures of all volumes, though not file contents.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Craftcms

Products

Craft Cms

CVE-2026-124486

OpenEMR before 8.3.0 Missing Authorization in Classic Document Controller

OpenEMR before 8.3.0 contains a missing authorization vulnerability in the classic document controller that allows low-privilege authenticated users to recategorize other patients' documents. Attackers can invoke move_action_process to move a document into a patients|demo category, then retrieve it with an empty patient_id to exfiltrate PHI and tamper with charts.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Open-emr

Products

Openemr

CVE-2026-124478

OpenEMR before 8.3.0 Missing Authorization via addRecall in save.php

OpenEMR before 8.3.0 contains a missing authorization vulnerability in the addRecall action of /interface/main/messages/save.php that allows low-privileged authenticated users to modify arbitrary patients' recall data. Attackers can submit a crafted new_pid with recall, contact, provider, facility, and notification preference fields to overwrite records of patients they cannot access.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Open-emr

Products

Openemr

CVE-2026-124456

OpenEMR before 8.3.0 Missing Authorization and IDOR in Prior-Authorizations Module

OpenEMR before 8.3.0 contains missing authorization and insecure direct object reference vulnerabilities in the oe-module-prior-authorizations module that allow authenticated low-privilege users to access and modify other patients' records. Attackers can request public/reports/list_report.php to view all patients' names, MRNs, insurance and prior-auth data, or submit arbitrary id values to public/index.php to overwrite other patients' prior-authorization records.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Open-emr

Products

Openemr

CVE-2026-82902

Apache OFBiz: Unfiltered server-side URL fetch in webtools viewdatafile

Server-Side Request Forgery in ViewDataFile in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the base webtools permissions (OFBTOOLS_VIEW, WEBTOOLS_VIEW) to cause the server to issue arbitrary outbound HTTP requests, and an attacker additionally holding ENTITY_MAINT and DATAFILE_MAINT to read arbitrary local files via a file: URL, by supplying the DEFINITION_LOCATION or DATAFILE_LOCATION request parameter to the viewdatafile screen, because ViewDataFile.groovy dereferences both parameters as java.net.URL objects with no scheme allow-list, host filter, or egress control inside a screen action that runs before the screen's and template's permission checks are evaluated, so the fetch executes regardless of whether the requesting account is authorized to view its result. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apache Apache Software Foundation

Products

Ofbiz Apache Ofbiz

CVE-2026-82904

Apache OFBiz: Unbounded multi-form row count from a parameter name

Uncontrolled Resource Consumption in ServiceMultiEventHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to pin a server request thread for an attacker-chosen number of synchronous service dispatches, up to the signed-integer maximum, by submitting a single small HTTP request whose parameter names encode a row count via the "o" suffix used by multi-form submissions, because UtilHttp.getMultiFormRowCount derives that count from the largest such suffix with no upper bound and ServiceMultiEventHandler.invoke then loops that many times calling dispatcher.runSync, with the request-map for getFinAccountTransRunningTotalAndBalances reaching this handler with no authentication or CSRF requirement on a stock deployment. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Apache Apache Software Foundation

Products

Ofbiz Apache Ofbiz

CVE-2026-82916

Apache OFBiz: webtools xmldsdump exports any entity to any path

Missing Authorization in XmlDsDump in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the webtools base permissions (OFBTOOLS_VIEW, WEBTOOLS_VIEW) — explicitly not the ENTITY_MAINT permission the export feature declares and visibly refuses to render for — to export the contents of any database entity, including UserLogin with its currentPassword hashes, to any filesystem path the OFBiz process can write, including a web-served docroot, and to create arbitrary directories or truncate arbitrary existing files at those paths, because the XmlDsDump screen action writes the requested entity data via new FileOutputStream on unvalidated outpath and filename request parameters before the screen's ENTITY_MAINT permission check runs, unlike the equivalent Java service entityExportAll, which enforces both a permission check and a file-path allow-list. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Apache Apache Software Foundation

Products

Ofbiz Apache Ofbiz

CVE-2026-83538

Apache OFBiz: Unauthenticated disclosure through HR, Catalog, and Order Manager helpers

Missing Authorization in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to disclose internal business records — including organization, employee, product catalog, and product-store data — by requesting several helper endpoints across the Human Resources, Catalog, and Order Manager applications that are configured to skip authentication and perform no permission check before returning the requested record. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apache Apache Software Foundation

Products

Ofbiz Apache Ofbiz

CVE-2026-84183

Apache OFBiz: Content Manager VIEW-only RCE in updateLayout

Incorrect Authorization in the updateLayout simple-method in applications/content/minilang/layout/LayoutEvents.xml in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLS_VIEW and CONTENTMGR_VIEW to execute arbitrary commands as the OFBiz process user, by using updateLayout's authorization check — which validates only the fixed CONTENT_CREATE operation rather than an update permission on the actual Content record and an independently selected DataResource — to relink an existing RESPONSE-purpose Content record and convert an arbitrary, independently selected DataResource into an OFBIZ_FILE/FTL resource pointed at the OFBiz access log, poisoned via a crafted User-Agent header and evaluated through the normal authenticated showContent route. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

CVSS 3.1 · 8.8 High EPSS 1.2% KEV · Not listed

Vendors

Apache Apache Software Foundation

Products

Ofbiz Apache Ofbiz

CVE-2026-84728

Apache OFBiz: Cross-tenant authorization bypass in mapped-domain login

Incorrect Authorization in Apache OFBiz 24.09 before 24.09.08 on all platforms, when documented multitenancy is enabled, allows a remote authenticated attacker holding only a valid low-privilege account in one tenant to read and write data belonging to a different tenant, by submitting their own tenant's userTenantId alongside their own credentials to the normal Party Manager login against a hostname mapped to a different tenant: ContextFilter resolves the tenant from the hostname via TenantDomainName, but LoginWorker gives priority to the conflicting userTenantId request parameter and authenticates against the attacker's own tenant, so a subsequent ordinary request to the same hostname combines the hostname-mapped tenant's Entity Engine delegator with the attacker's tenant's session dispatcher, security object, and identity, letting the permission check run against the attacker's own tenant while the resulting read or write is performed against the hostname-mapped tenant's data. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Apache Apache Software Foundation

Products

Ofbiz Apache Ofbiz

CVE-2026-94618

FileGator: Missing authorization in GET /batchdownload allows cross-user retrieval of another user's archive

FileGator is a multi-user file manager. Prior to 7.15.0, GET /batchdownload in backend/Controllers/DownloadController.php uses batchDownloadStart() to stream a shared temporary archive selected by the request-supplied uniqid without checking that the current session created it. In deployments with distinct per-user home directories, a valid user with read, download, and batchdownload permissions who obtains another user's active archive id can cross that boundary and retrieve the victim's batch archive. The archive lifetime and id-acquisition requirement limit exploitation, but a successful replay also deletes the victim's pending archive. This issue is fixed in version 7.15.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Filegator

Products

Filegator

CVE-2026-70098

Visual Studio Code Remote Code Execution Vulnerability

Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Visual Studio Code

CVE-2026-124314

Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_open_activities

Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in erpnext.crm.utils.get_open_activities that exposes ToDo and Event records. Any authenticated user, including portal or no-role users, can supply arbitrary ref_doctype and ref_docname values to enumerate activities and private calendar event details.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Frappe

Products

Erpnext

CVE-2026-121761

WordPress VOD Infomaniak plugin <= 1.5.15 - Broken Access Control vulnerability

Missing Authorization vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VOD Infomaniak: from n/a through 1.5.15.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-111453

Apache Airflow: API: asset queuedEvents DELETE checks Dag edit on a ?dag_id query value but deletes rows for every readable Dag

Apache Airflow's API endpoint for deleting an asset's queued events checked Dag edit permission against the `dag_id` query parameter, but deleted the queued events of every Dag the caller could read. An authenticated user with edit permission on one Dag and read access to others could suppress asset-triggered runs of Dags they cannot edit. This is an incomplete fix for CVE-2026-75157: users who upgraded to apache-airflow 3.3.2 for that fix are still affected and should upgrade to apache-airflow 3.4.0 or later.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Airflow

CVE-2026-121062

chromium-browser: Incorrect authorization in API

Incorrect authorization in API in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome