CVE-2026-69836

Microsoft Entra ID Remote Code Execution Vulnerability

Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 10 Critical EPSS 1.8% KEV · Not listed

Vendors

Microsoft

Products

Entra Id Microsoft Entra Id

CVE-2026-125298

AsiaInfo Business Support System (BSS) Missing JWT Signature Verification

AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 does not correctly verify cryptographic signatures for JSON Web Tokens (JWT). A remote, unauthenticated attacker could forge a well-formed JWT without a valid signature and use it to execute privileged actions. Fixed in 9.2.41.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-125297

AsiaInfo Business Support System (BSS) Missing Authentication

AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 accepts unauthenticated requests via the management API '/bss/sysmgnt/api/'. A remote, unauthenticated attacker could provision a new account with administrative privileges or take over existing accounts, and perform other administrative actions. Fixed in 9.2.41.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-105614

PostgreSQL Anonymizer: Unbounded image-decode memory allocation (DoS) in anon.image_blur()

PostgreSQL Anonymizer's `anon.image_blur()` function doesn't check the declared dimension of the provided image, allowing an attacker to provide a small image with enormous declared dimensions. This vulnerability can be exploited to exhaust the memory of a backend and OOM-kill it (when ovecommit is on), which results in a cluster-wide crash recovery. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Dalibo

Products

Postgresql Anonymizer

CVE-2026-126123

BeeS ERP administrative console IDOR

BeeS Software Solutions ERP before 04 September 2026 allows any low-privileged user to navigate directly to the administrative dashboard endpoint and gain access to the administrative console, including unrestricted access to institutional, employee, and student data.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-105615

PostgreSQL Anonymizer: Masked roles can read the statistics of masked columns in pg_stats

PostgreSQL's optimized statistics on a table are visible as long as you have SELECT privilege on said table. A masked role can therefore read a limited subset of the data through the statistics view's histograms and mcvs. The vulnerability is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Dalibo

Products

Postgresql Anonymizer

CVE-2026-121029

chromium-browser: Incorrect authorization in ORB

Incorrect authorization in ORB in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-121031

chromium-browser: Missing authorization in PDF

Missing authorization in PDF in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted Chrome extension. (Chromium security severity: Medium)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-121032

chromium-browser: Out of bounds read in Skia

Out of bounds read in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-121033

chromium-browser: Uninitialized resource in GPU

Uninitialized resource in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Android Chrome

CVE-2026-121040

chromium-browser: Incorrect authorization in Core

Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-121042

chromium-browser: Incorrect authorization in Permissions

Incorrect authorization in Permissions in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Android Chrome

CVE-2026-121046

chromium-browser: Incorrect authorization in WebAppInstalls

Incorrect authorization in WebAppInstalls in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof address bar via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-121051

chromium-browser: UI misrepresentation in iOSWeb

UI misrepresentation in iOSWeb in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Google

Products

Iphone Os Chrome

CVE-2026-121055

chromium-browser: Incomplete cleanup in DevTools

Incomplete cleanup in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Low)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-105616

PostgreSQL Anonymizer: The secret salt and shift of anon are readable by any role in pg_roles or pg_db_role_setting

PostgreSQL restricts acces to the salt and shift via the `SHOW` command for users not member of `pg_read_all_settings`. But they are visible in `pg_db_role_setting` or `pg_roles` if they were set on the database, user or both. PostgreSQL Anonymizer's documentation recommends to use ALTER DATABASE / ALTER ROLE for the salt. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Dalibo

Products

Postgresql Anonymizer

CVE-2026-121157

chromium-browser: Incorrect authorization in Chromoting

Incorrect authorization in Chromoting in Google Chrome prior to 157.0.8103.38 allowed a local attacker to bypass system access restrictions via a local program. (Chromium security severity: Low)

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-121159

chromium-browser: Incorrect authorization in History

Incorrect authorization in History in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-121164

chromium-browser: Incorrect authorization in Views

Incorrect authorization in Views in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Google

Products

Macos Chrome

CVE-2026-121193

chromium-browser: Incorrect authorization in Extensions

Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome