cve.bz

OWASP A01:2025 Broken Access Control vulnerabilities, newest first, page 46

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A01:2025 at MITRE.

Its weaknesses: 40

CWE-22, CWE-23, CWE-36, CWE-59, CWE-61, CWE-65, CWE-200, CWE-201, CWE-219, CWE-276, CWE-281, CWE-282, CWE-283, CWE-284, CWE-285, CWE-352, CWE-359, CWE-377, CWE-379, CWE-402, CWE-424, CWE-425, CWE-441, CWE-497, CWE-538, CWE-540, CWE-548, CWE-552, CWE-566, CWE-601, CWE-615, CWE-639, CWE-668, CWE-732, CWE-749, CWE-862, CWE-863, CWE-918, CWE-922, CWE-1275

  1. 7.4CVE-2026-113727EPSS 0.5%

    OpenChoreo is a developer platform for Kubernetes. From 1.0.0 until 1.0.6, 1.1.7, and 1.2.5, the PUT .../workflowruns/{runName} update route authorizes a request using the openchoreo.dev/project and openchoreo.dev/component labels in the s…

  2. 6.9CVE-2026-113704EPSS 0.5%

    A vulnerability has been found in a2aproject a2a-rs up to 0.4.3. This affects the function HttpPushSender of the file crates/server/src/push_notification_sender.rs of the component Push Notification Handler. Such manipulation of the argume…

  3. 8.8CVE-2026-113343EPSS 0.4%

    Incorrect authorization in Sandbox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium secu…

  4. 8.8CVE-2026-113330EPSS 0.3%

    Incorrect authorization in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker to obtain cross-origin data via a co-installed app. (Chromium security severity: Low)

  5. 9.6CVE-2026-113328EPSS 0.4%

    Improper resource exposure in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

  6. 8.8CVE-2026-113327EPSS 0.4%

    Missing authorization in Chromecast in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

  7. 6.5CVE-2026-113325EPSS 0.3%

    Missing authorization in SignIn in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

  8. 8.8CVE-2026-113321EPSS 0.3%

    Missing authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Medium)

  9. 8.8CVE-2026-113319EPSS 0.4%

    Missing authorization in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium …

  10. 8.8CVE-2026-113313EPSS 0.4%

    Incorrect authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

  11. 8.8CVE-2026-113302EPSS 0.3%

    Missing authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Medium)

  12. 8.8CVE-2026-113301EPSS 0.4%

    Confused deputy in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

  13. 8.8CVE-2026-113299EPSS 0.4%

    Incorrect authorization in WebProtect in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)

  14. 6.5CVE-2026-113296EPSS 0.3%

    Missing authorization in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)

  15. 8.8CVE-2026-113294EPSS 0.4%

    Incorrect authorization in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

  16. 8.8CVE-2026-113290EPSS 0.3%

    Missing authorization in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

  17. 8.8CVE-2026-113289EPSS 0.3%

    Incorrect authorization in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

  18. 8.8CVE-2026-113288EPSS 0.4%

    Information leak in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted HTML page. (Chromium security severity: Low)

  19. 8.8CVE-2026-113287EPSS 0.3%

    Incorrect authorization in Prompts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)

  20. 8.8CVE-2026-113286EPSS 0.3%

    Missing authorization in Google Lens in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to leak sensitive information via a crafted HTML page. (Chromi…

  21. 8.8CVE-2026-113281EPSS 0.4%

    Missing authorization in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

  22. 6.5CVE-2026-113277EPSS 0.2%

    Information leak in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker to leak sensitive information via a co-installed app. (Chromium security severity: Medium)

  23. 8.8CVE-2026-113276EPSS 0.3%

    Missing authorization in Passwords in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

  24. 8.8CVE-2026-113275EPSS 0.3%

    Missing authorization in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)

  25. 8.8CVE-2026-113272EPSS 0.4%

    Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via…

  26. 9.6CVE-2026-113270EPSS 0.3%

    Missing authorization in Internals in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

  27. 8.8CVE-2026-113269EPSS 0.4%

    Missing authorization in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)

  28. 8.8CVE-2026-113268EPSS 0.4%

    Information leak in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted HTML page. (Chromium security severity: Low)

  29. 8.8CVE-2026-113265EPSS 0.3%

    Missing authorization in BFCache in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

  30. 8.8CVE-2026-113264EPSS 0.3%

    Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

  31. 9.6CVE-2026-113263EPSS 0.3%

    Missing authorization in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

  32. 8.8CVE-2026-113262EPSS 0.3%

    Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Medium)

  33. 8.8CVE-2026-113259EPSS 0.3%

    Missing authorization in Frames in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Medium)

  34. 8.8CVE-2026-113254EPSS 0.3%

    Incorrect authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

  35. 8.8CVE-2026-113253EPSS 0.3%

    Incorrect authorization in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)

  36. 8.8CVE-2026-113249EPSS 0.4%

    Missing authorization in Mobile in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

  37. 8.8CVE-2026-113247EPSS 0.3%

    Confused deputy in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Low)

  38. 6.5CVE-2026-113246EPSS 0.3%

    Missing authorization in iOSWebView in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

  39. 8.8CVE-2026-113245EPSS 0.4%

    Missing authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low)

  40. 8.8CVE-2026-113244EPSS 0.4%

    Missing authorization in UI in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

  41. 8.8CVE-2026-113243EPSS 0.4%

    Information leak in DOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

  42. 8.8CVE-2026-113240EPSS 0.4%

    Missing authorization in Chromecast in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severi…

  43. 9.6CVE-2026-113235EPSS 0.4%

    Missing authorization in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. (Chromium security…

  44. 8.8CVE-2026-113231EPSS 0.3%

    Missing authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Medium)

  45. 8.8CVE-2026-113228EPSS 0.3%

    Incorrect authorization in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

  46. 8.8CVE-2026-113227EPSS 0.3%

    Missing authorization in Editing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)

  47. 9.6CVE-2026-113222EPSS 0.4%

    Missing authorization in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)

  48. 8.8CVE-2026-113220EPSS 0.3%

    Missing authorization in Extensions in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Me…

  49. 8.8CVE-2026-113219EPSS 0.3%

    Missing authorization in Contacts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially obtain sensitive information via a crafted HTML pa…

  50. 8.8CVE-2026-113215EPSS 0.4%

    Missing authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)