chromium-browser: chromium-browser: System access restriction bypass via missing authorization in NFC

Missing authorization in NFC in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

chromium-browser: chromium-browser: Missing authorization in Contextual Tasks

Missing authorization in Contextual Tasks in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

chromium-browser: Missing authorization in DevTools

Missing authorization in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. (Chromium security severity: Medium)

chromium-browser: chromium-browser: Missing authorization in Extensions

Missing authorization in Extensions in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

chromium-browser: chromium-browser: Web origin policy bypass via crafted HTML page

Incorrect authorization in PictureInPicture in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

chromium-browser: chromium-browser: Missing authorization in V8

Missing authorization in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

chromium-browser: Race condition in DevTools

Race condition in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass site isolation via a crafted Chrome extension. (Chromium security severity: Medium)

Moodle: missing capability check allows unauthorised grade penalty recalculation

A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without holding the required permissions. This issue allows unauthorized users to modify grade penalty records, potentially altering student assessment scores.

Moodle: group validation missing when enrolling user to course

A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether the selected group actually belongs to that course. An authenticated user with teacher privileges could exploit this flaw to add users to groups within courses they do not have authorization to access.

Moodle: sql injection in question bank web service

A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL (Structured Query Language) injection vulnerability. This issue could allow an attacker to view, alter, or delete sensitive data stored in the underlying database.

Moodle: arbitrary class instantiation via report builder audience classname

A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder component, allowing arbitrary class instantiation. This vulnerability enables the unauthorized creation of internal program objects, which may result in unexpected application behavior.

nvidia-driver: xorg-x11-drv-nvidia: nvidia-driver: privilege escalation via out-of-bounds read in kernel mode layer

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause an out-of-bounds read leading to kernel information disclosure. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

Moodle: user list filters bypass profile field visibility

A flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user with manager privileges can filter user lists using profile attributes they are not permitted to view directly, resulting in unauthorized information disclosure by inferring hidden user data.

In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues

JetBrains YouTrack Server Side Request Forgery via GitHub Integration

In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration

YouTrack Unauthorized Notification Disclosure via iDOR in Inbox Threads

In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications

Unauthorized Reload of Translation Catalogs in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs

Privilege Escalation via User Group Membership Changes in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes

chromium-browser: Use of released resource in Core

Use of released resource in Core in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

Moodle: user profile information disclosure via grade web service

A flaw was found in Moodle. An incorrect capability check in the grade web service allows an authenticated student to access profile information of other students enrolled in the same course that they should not have permission to view. This issue leads to unauthorized information disclosure.