cve.bz

OWASP A01:2025 Broken Access Control vulnerabilities, newest first, page 48

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A01:2025 at MITRE.

Its weaknesses: 40

CWE-22, CWE-23, CWE-36, CWE-59, CWE-61, CWE-65, CWE-200, CWE-201, CWE-219, CWE-276, CWE-281, CWE-282, CWE-283, CWE-284, CWE-285, CWE-352, CWE-359, CWE-377, CWE-379, CWE-402, CWE-424, CWE-425, CWE-441, CWE-497, CWE-538, CWE-540, CWE-548, CWE-552, CWE-566, CWE-601, CWE-615, CWE-639, CWE-668, CWE-732, CWE-749, CWE-862, CWE-863, CWE-918, CWE-922, CWE-1275

  1. 8.8CVE-2026-113097EPSS 0.3%

    Missing authorization in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: High)

  2. 8.8CVE-2026-113092EPSS 0.3%

    Missing authorization in Passwords in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: H…

  3. 8.8CVE-2026-113091EPSS 0.4%

    Information leak in PerformanceAPIs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

  4. 9.6CVE-2026-113089EPSS 0.3%

    Incorrect authorization in PrintPreview in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Medium)

  5. 8.8CVE-2026-113085EPSS 0.3%

    Information leak in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

  6. 9.6CVE-2026-113084EPSS 0.3%

    Incorrect authorization in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

  7. 8.8CVE-2026-113083EPSS 0.2%

    Missing authorization in Actor in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker to spoof UI elements via a co-installed app. (Chromium security severity: Low)

  8. 6.5CVE-2026-113077EPSS 0.3%

    Incorrect authorization in Core in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass web origin policy via a crafted HTML page. (Chr…

  9. 8.8CVE-2026-113074EPSS 0.3%

    Incorrect authorization in Media in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

  10. 8.8CVE-2026-113069EPSS 0.3%

    Missing authorization in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass site isolation via a crafted HTML page. (Chromium se…

  11. 8.8CVE-2026-113062EPSS 0.3%

    Missing authorization in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

  12. 8.8CVE-2026-113058EPSS 0.4%

    Missing authorization in WebUI in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

  13. 6.5CVE-2026-113054EPSS 0.3%

    Incorrect authorization in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

  14. 8.8CVE-2026-113053EPSS 0.4%

    Incorrect authorization in Cookies in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

  15. 6.5CVE-2026-113051EPSS 0.3%

    Incorrect authorization in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

  16. 8.8CVE-2026-113049EPSS 0.3%

    Information leak in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

  17. 8.8CVE-2026-113048EPSS 0.3%

    Missing authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions into a privileged page via a crafted Chrome extension. (Chromium securit…

  18. 6.5CVE-2026-113047EPSS 0.3%

    Missing authorization in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

  19. 8.8CVE-2026-113042EPSS 0.3%

    Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)

  20. 8.8CVE-2026-113036EPSS 0.3%

    Incorrect authorization in HTML in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

  21. 6.5CVE-2026-113035EPSS 0.4%

    Missing authorization in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security s…

  22. 8.8CVE-2026-113024EPSS 0.4%

    Confused deputy in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

  23. 9.6CVE-2026-113023EPSS 0.3%

    Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Low)

  24. 8.8CVE-2026-113022EPSS 0.3%

    Incorrect authorization in PDFium in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted PDF file. (Chromium security severity: Medium)

  25. 8.8CVE-2026-113021EPSS 0.4%

    Incorrect authorization in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

  26. 8.8CVE-2026-113018EPSS 0.4%

    Missing authorization in IME in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

  27. 8.8CVE-2026-113015EPSS 0.4%

    Incorrect authorization in Workers in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

  28. 9.6CVE-2026-113014EPSS 0.4%

    Missing authorization in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

  29. 8.8CVE-2026-113013EPSS 0.3%

    Incorrect authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Low)

  30. 8.8CVE-2026-113011EPSS 0.3%

    Incorrect authorization in CredentialProvider in Google Chrome on on Windows prior to 156.0.8078.47 allowed a local attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a local program. (Chrom…

  31. 8.8CVE-2026-113006EPSS 0.3%

    Incorrect authorization in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Medium)

  32. 8.8CVE-2026-113005EPSS 0.3%

    Missing authorization in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially bypass system access restrictions via a crafted H…

  33. 6.5CVE-2026-113002EPSS 0.3%

    Incorrect authorization in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

  34. 8.8CVE-2026-113001EPSS 0.4%

    Incorrect authorization in Workers in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

  35. 8.8CVE-2026-113000EPSS 0.3%

    Information leak in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)

  36. 8.8CVE-2026-112999EPSS 0.3%

    Incorrect authorization in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

  37. 8.8CVE-2026-112997EPSS 0.3%

    Information leak in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)

  38. 8.8CVE-2026-112996EPSS 0.4%

    Incorrect authorization in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

  39. 8.8CVE-2026-112993EPSS 0.4%

    Missing authorization in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)

  40. 6.5CVE-2026-101857EPSS 0.4%

    Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacke…

  41. 6.5CVE-2026-101856EPSS 0.4%

    Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacke…

  42. 6.5CVE-2026-101855EPSS 0.4%

    Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with net…

  43. 8.8CVE-2026-101854EPSS 0.4%

    Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with net…

  44. 8.8CVE-2026-101853EPSS 0.4%

    Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with net…

  45. 8.8CVE-2026-101852EPSS 0.4%

    Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with net…

  46. 7.1CVE-2026-101851EPSS 0.2%

    Vulnerability in the Installed Base product of Oracle E-Business Suite (component: Data Provider UI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network ac…

  47. 6.1CVE-2026-101850EPSS 0.2%

    Vulnerability in the Installed Base product of Oracle E-Business Suite (component: HTML UI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via…

  48. 7.6CVE-2026-101849EPSS 0.3%

    Vulnerability in the Installed Base product of Oracle E-Business Suite (component: Create Item Instance). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with networ…

  49. 7.5CVE-2026-101847EPSS 0.3%

    Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker …

  50. 3.5CVE-2026-101846EPSS 0.2%

    Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with netw…