Monthly
Unauthenticated abuse of client-trusted logic in the Biletiva Ticketing Platform lets remote attackers bypass security and authorization checks that exist only in the browser client, then directly manipulate server-side state such as ticket, order, or pricing data. The flaw (CWE-602) carries a CVSS 3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L), meaning no credentials, no user interaction, and only ordinary request tampering are needed to reach the integrity-critical impact, while confidentiality and availability effects remain limited. Exploitation is constrained chiefly by the product's narrow deployment footprint rather than by any technical barrier, and no public exploit code or confirmed active exploitation was identified at time of analysis; the issue was reported to national authorities by TR-CERT.
Unauthorized ManagedCluster deletion in Red Hat Multicluster Engine (MCE) allows any tenant with standard ClusterClaim permissions to destroy clusters belonging to other tenants or the hub itself, including the hub's local-cluster. The clusterclaims-controller fails to verify ownership before acting on the spec.namespace field, meaning a low-privileged tenant can target arbitrary ManagedClusters by crafting that field and then deleting the ClusterClaim. No public exploit or CISA KEV listing exists at time of analysis, but the attack requires only standard tenant credentials and no special configuration, making it a realistic insider or compromised-tenant threat.
Unauthenticated information disclosure in the Portal Generator add-on to Priority ERP (developed by Soft Solutions) allows remote attackers to retrieve restricted data by bypassing security controls that are enforced only in the client rather than on the server. Any actor who can reach the portal over the network can craft direct server requests that skip the intended access checks, exposing sensitive data without credentials or user interaction. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 expose an improper authorization flaw in certain database commands, enabling a low-privileged authenticated user to bypass server-side authority checks and directly modify database catalog data. The root cause is CWE-602 (client-side enforcement of server-side security), where authorization validation is not properly enforced at the server layer. No public exploit has been identified and SSVC rates exploitation as none currently, though the high integrity impact against catalog metadata - which governs schema definitions and access control structures - makes this a meaningful patching priority for all affected Db2 deployments.
Denial of service in Quick.CMS allows an authenticated administrator to delete the primary language by sending a direct HTTP request to the language-deletion API endpoint, bypassing the UI restriction, which renders the application unusable. The vendor deems a fix unnecessary due to very low exploitation likelihood, but chaining with a separate Cross-Site Request Forgery vulnerability (CVE-2026-1468) enables an unauthenticated remote attacker to craft a malicious link that, if visited by an authenticated admin, triggers the same DoS condition.
Unauthorized settings modification in JetBrains IntelliJ IDEA before 2026.2 allows attackers to alter configuration within an active Remote Development session without proper authorization, tagged by the vendor as an authentication bypass. Because Remote Development connects a local client to a remote backend IDE, tampering with settings can subvert the security boundary between client and host. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the vendor-assigned CVSS of 10.0 with scope change signals maximum theoretical severity.
Sandbox escape in Google Chrome desktop before 150.0.7871.47 lets an attacker who has already compromised the renderer process bypass Mojo IPC policy enforcement and break out of the sandbox using a crafted HTML page. This is a second-stage flaw in the Mojo inter-process communication layer rather than an initial-access bug, and Google itself rated the Chromium security severity as Low despite the NVD CVSS of 9.6. No public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile).
Remote code execution in Google Chrome desktop versions prior to 150.0.7871.47 stems from insufficient policy enforcement in the WebHID component, letting a remote attacker who lures a victim to a crafted HTML page break out of intended HID access controls and run arbitrary code. Exploitation requires user interaction (visiting a malicious page) but no authentication, and no public exploit has been identified at time of analysis; EPSS is low at 0.21% (12th percentile). Notably, Google rates the Chromium security severity as 'Low' while the NVD-style CVSS is 8.8, a discrepancy worth weighing when prioritizing.
Privilege escalation in Google Chrome desktop before 150.0.7871.47 stems from insufficient policy enforcement in the Serial (Web Serial API) component, allowing a remote attacker who lures a victim to a crafted HTML page to escalate privileges within the browser. Note the signal conflict: NVD scores this 8.8 (High) with high confidentiality/integrity/availability impact, yet Chromium's own triage rates the security severity as Low. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is very low at 0.17% (7th percentile).
Privilege escalation in Google Chrome desktop before 150.0.7871.47 stems from insufficient policy enforcement in the Bluetooth subsystem, letting a remote attacker who lures a victim to a crafted HTML page cross a security boundary the browser is supposed to guard. Google's Chrome release channel and the NVD-assigned CVSS 3.1 base score of 8.8 (High) diverge from Chromium's own internal 'Low' severity rating, signaling the practical impact is likely narrower than the raw score implies. There is no public exploit identified at time of analysis, and the EPSS probability is low at 0.17% (7th percentile), consistent with no active exploitation reported.
Unauthenticated abuse of client-trusted logic in the Biletiva Ticketing Platform lets remote attackers bypass security and authorization checks that exist only in the browser client, then directly manipulate server-side state such as ticket, order, or pricing data. The flaw (CWE-602) carries a CVSS 3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L), meaning no credentials, no user interaction, and only ordinary request tampering are needed to reach the integrity-critical impact, while confidentiality and availability effects remain limited. Exploitation is constrained chiefly by the product's narrow deployment footprint rather than by any technical barrier, and no public exploit code or confirmed active exploitation was identified at time of analysis; the issue was reported to national authorities by TR-CERT.
Unauthorized ManagedCluster deletion in Red Hat Multicluster Engine (MCE) allows any tenant with standard ClusterClaim permissions to destroy clusters belonging to other tenants or the hub itself, including the hub's local-cluster. The clusterclaims-controller fails to verify ownership before acting on the spec.namespace field, meaning a low-privileged tenant can target arbitrary ManagedClusters by crafting that field and then deleting the ClusterClaim. No public exploit or CISA KEV listing exists at time of analysis, but the attack requires only standard tenant credentials and no special configuration, making it a realistic insider or compromised-tenant threat.
Unauthenticated information disclosure in the Portal Generator add-on to Priority ERP (developed by Soft Solutions) allows remote attackers to retrieve restricted data by bypassing security controls that are enforced only in the client rather than on the server. Any actor who can reach the portal over the network can craft direct server requests that skip the intended access checks, exposing sensitive data without credentials or user interaction. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 expose an improper authorization flaw in certain database commands, enabling a low-privileged authenticated user to bypass server-side authority checks and directly modify database catalog data. The root cause is CWE-602 (client-side enforcement of server-side security), where authorization validation is not properly enforced at the server layer. No public exploit has been identified and SSVC rates exploitation as none currently, though the high integrity impact against catalog metadata - which governs schema definitions and access control structures - makes this a meaningful patching priority for all affected Db2 deployments.
Denial of service in Quick.CMS allows an authenticated administrator to delete the primary language by sending a direct HTTP request to the language-deletion API endpoint, bypassing the UI restriction, which renders the application unusable. The vendor deems a fix unnecessary due to very low exploitation likelihood, but chaining with a separate Cross-Site Request Forgery vulnerability (CVE-2026-1468) enables an unauthenticated remote attacker to craft a malicious link that, if visited by an authenticated admin, triggers the same DoS condition.
Unauthorized settings modification in JetBrains IntelliJ IDEA before 2026.2 allows attackers to alter configuration within an active Remote Development session without proper authorization, tagged by the vendor as an authentication bypass. Because Remote Development connects a local client to a remote backend IDE, tampering with settings can subvert the security boundary between client and host. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the vendor-assigned CVSS of 10.0 with scope change signals maximum theoretical severity.
Sandbox escape in Google Chrome desktop before 150.0.7871.47 lets an attacker who has already compromised the renderer process bypass Mojo IPC policy enforcement and break out of the sandbox using a crafted HTML page. This is a second-stage flaw in the Mojo inter-process communication layer rather than an initial-access bug, and Google itself rated the Chromium security severity as Low despite the NVD CVSS of 9.6. No public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile).
Remote code execution in Google Chrome desktop versions prior to 150.0.7871.47 stems from insufficient policy enforcement in the WebHID component, letting a remote attacker who lures a victim to a crafted HTML page break out of intended HID access controls and run arbitrary code. Exploitation requires user interaction (visiting a malicious page) but no authentication, and no public exploit has been identified at time of analysis; EPSS is low at 0.21% (12th percentile). Notably, Google rates the Chromium security severity as 'Low' while the NVD-style CVSS is 8.8, a discrepancy worth weighing when prioritizing.
Privilege escalation in Google Chrome desktop before 150.0.7871.47 stems from insufficient policy enforcement in the Serial (Web Serial API) component, allowing a remote attacker who lures a victim to a crafted HTML page to escalate privileges within the browser. Note the signal conflict: NVD scores this 8.8 (High) with high confidentiality/integrity/availability impact, yet Chromium's own triage rates the security severity as Low. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is very low at 0.17% (7th percentile).
Privilege escalation in Google Chrome desktop before 150.0.7871.47 stems from insufficient policy enforcement in the Bluetooth subsystem, letting a remote attacker who lures a victim to a crafted HTML page cross a security boundary the browser is supposed to guard. Google's Chrome release channel and the NVD-assigned CVSS 3.1 base score of 8.8 (High) diverge from Chromium's own internal 'Low' severity rating, signaling the practical impact is likely narrower than the raw score implies. There is no public exploit identified at time of analysis, and the EPSS probability is low at 0.17% (7th percentile), consistent with no active exploitation reported.