CVE-2026-68868 | Medium | 6.5 | 2026-08-12 | The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the… |
CVE-2026-62721 | High | 7.8 | 2026-08-11 | Insufficient granularity of access control in User-Mode Power Service (UMPS) allows an authorized attacker to elevate privileges locally. |
CVE-2025-31938 | | | 2026-08-11 | Insufficient granularity of access control in some subsystem for some Intel(R) Xeon(R) 6 Scalable processors with Intel(R) TDX may allow an information disclos… |
CVE-2026-16560 | Medium | 5.3 | 2026-07-22 | A heap-buffer-overflow flaw was found in Directory Server (389-ds-base). When a DN contains a legacy-quoted value, the server won't close the heap allocation a… |
CVE-2026-50502 | High | 8.0 | 2026-07-14 | Insufficient granularity of access control in Windows Event Logging Service allows an authorized attacker to execute code over a network. |
CVE-2026-50405 | High | 7.8 | 2026-07-14 | Insufficient granularity of access control in Windows Filtering Platform (WFP) allows an authorized attacker to elevate privileges locally. |
CVE-2026-56155 | High | 7.8 | 2026-07-14 | Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally. |
CVE-2026-55006 | High | 7.8 | 2026-07-14 | Insufficient granularity of access control in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally. |
CVE-2026-49170 | High | 7.8 | 2026-07-14 | Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate privileges locally. |
CVE-2026-48581 | High | 7.8 | 2026-07-14 | Insufficient granularity of access control in Microsoft Surface allows an authorized attacker to elevate privileges locally. |
CVE-2026-14615 | Medium | 4.3 | 2026-07-03 | A flaw was found in the Fine-Grained Admin Permissions (FGAP) v2 implementation within Keycloak's administrative services. When FGAP v2 is enabled, the system… |
CVE-2026-9088 | Low | 2.7 | 2026-06-05 | A flaw was found in org.keycloak.services. An administrator with delegated access to read group memberships and users can bypass user profile permissions by ac… |
CVE-2021-46747 | | | 2026-06-01 | Insufficient granularity of access control in ASP (AMD Secure Processor) may allow an attacker with an untrusted user space application to map sensitive SMN (S… |
CVE-2026-2651 | Critical | 9.0 | 2026-05-25 | A vulnerability in MLflow versions <=3.10.1.dev0 allows unauthorized access to multipart upload (MPU) endpoints when the `--serve-artifacts` mode is enabled. T… |
CVE-2026-37981 | Medium | 4.3 | 2026-05-19 | A flaw was found in Keycloak. A broken access control vulnerability in the Account Resources user lookup endpoint allows a remote authenticated user, who owns… |
CVE-2025-54518 | High | 7.0 | 2026-05-15 | Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker to corrupt instructions executed at a dif… |
CVE-2024-21962 | | | 2026-05-15 | Improper Input Validation in the AMD RAID driver could allow an attacker to point to an arbitrary memory location potentially resulting in privilege escalation… |
CVE-2026-40365 | High | 8.8 | 2026-05-12 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2026-35436 | High | 8.8 | 2026-05-12 | Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally. |
CVE-2026-40981 | High | 7.5 | 2026-05-07 | When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing secret… |
CVE-2026-41326 | High | 8.2 | 2026-04-24 | Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. From v3.4.0… |
CVE-2026-40690 | Medium | 4.3 | 2026-04-24 | The asset dependency graph did not restrict nodes by the viewer's DAG read permissions: a user with read access to at least one DAG could browse the asset grap… |
CVE-2026-38743 | Medium | 4.3 | 2026-04-24 | The authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and TaskInstance records: a logged-in Airflow u… |
CVE-2026-6356 | Critical | 9.6 | 2026-04-22 | A vulnerability in the web application allows standard users to escalate their privileges to those of a super administrator through parameter manipulation, ena… |
CVE-2026-6388 | Critical | 9.1 | 2026-04-15 | A flaw was found in ArgoCD Image Updater. This vulnerability allows an attacker, with permissions to create or modify an ImageUpdater resource in a multi-tenan… |
CVE-2026-33825 | High | 7.8 | 2026-04-14 | Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally. |
CVE-2025-20628 | | | 2026-04-07 | An insufficient granularity of access control vulnerability exists in PingIDM (formerly ForgeRock Identity Management) where administrators cannot properly con… |
CVE-2026-39363 | High | 7.5 | 2026-04-07 | Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite dev server’s WebSoc… |
CVE-2025-69196 | Medium | 6.5 | 2026-03-16 | FastMCP is the standard framework for building MCP applications. Prior to version 2.14.2, the server does not properly respect the resource parameter submitted… |
CVE-2026-20107 | Medium | 5.5 | 2026-02-25 | A vulnerability in the Object Model CLI component of Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, local attacker to… |
CVE-2025-48517 | | | 2026-02-10 | Insufficient Granularity of Access Control in SEV firmware could allow a privileged user with a malicious hypervisor to create a SEV-ES guest with an ASID in t… |
CVE-2025-48514 | | | 2026-02-10 | Insufficient Granularity of Access Control in SEV firmware can allow a privileged attacker to create a SEV-ES Guest to attack SNP guest, potentially resulting… |
CVE-2025-35998 | High | 7.9 | 2026-02-10 | Missing protection mechanism for alternate hardware interface in the Intel(R) Quick Assist Technology for some Intel(R) Platforms within Ring 0: Kernel may all… |
CVE-2026-0873 | | | 2026-02-04 | On a Cryptobox platform where administrator segregation based on entities is used, some vulnerabilities in Ercom Cryptobox administration console allows an aut… |
CVE-2024-4147 | Medium | 6.5 | 2026-02-02 | In lunary-ai/lunary version 1.2.13, an insufficient granularity of access control vulnerability allows users to delete prompts created in other organizations t… |
CVE-2025-11246 | Medium | 5.4 | 2026-01-09 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.4 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allow… |
CVE-2025-8306 | | | 2026-01-08 | Asseco InfoMedica is a comprehensive solution used to manage both administrative and medical tasks in the healthcare sector. A low privileged user is able to o… |
CVE-2025-20305 | Medium | 4.3 | 2025-11-05 | A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to obtain sensitive information from an affect… |
CVE-2025-8053 | Critical | 9.1 | 2025-10-20 | Insufficient Granularity of Access Control vulnerability in opentext Flipper allows Exploiting Incorrectly Configured Access Control Security Levels. The vulne… |
CVE-2025-8049 | High | 8.8 | 2025-10-20 | Insufficient Granularity of Access Control vulnerability in opentext Flipper allows Exploiting Incorrectly Configured Access Control Security Levels. The vulne… |
CVE-2025-54461 | Medium | 5.3 | 2025-10-16 | ChatLuck contains an insufficient granularity of access control vulnerability in Invitation of Guest Users. If exploited, an uninvited guest user may register… |
CVE-2025-7493 | Critical | 9.1 | 2025-09-30 | A privilege escalation flaw from host to domain administrator was found in FreeIPA. This vulnerability is similar to CVE-2025-4404, where it fails to validate… |
CVE-2024-21947 | High | 7.5 | 2025-09-06 | Improper input validation in the system management mode (SMM) could allow a privileged attacker to overwrite arbitrary memory potentially resulting in arbitrar… |
CVE-2025-31961 | Low | 3.7 | 2025-08-15 | HCL Connections contains a broken access control vulnerability that may allow unauthorized user to update data in certain scenarios. |
CVE-2025-2498 | Low | 3.1 | 2025-08-13 | An improper access control in Gitlab EE affecting all versions from 12.0 prior to 18.0.6, 18.1 prior to 18.1.4, and 18.2 prior to 18.2.2 that under certain con… |
CVE-2025-22839 | High | 7.5 | 2025-08-12 | Insufficient granularity of access control in the OOB-MSM for some Intel(R) Xeon(R) 6 Scalable processors may allow a privileged user to potentially enable esc… |
CVE-2025-7001 | Medium | 4.3 | 2025-07-24 | An issue has been discovered in GitLab CE/EE affecting all versions from 15.0 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that could have allowed… |
CVE-2025-3648 | | | 2025-07-08 | A vulnerability has been identified in the Now Platform that could result in data being inferred without authorization. Under certain conditional access contro… |
CVE-2025-27026 | Medium | 4.9 | 2025-07-02 | A missing double-check feature in the WebGUI for CLI deactivation in Infinera G42
version R6.1.3 allows an authenticated administrator to make other
manageme… |
CVE-2025-4404 | Critical | 9.1 | 2025-06-17 | A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the `krbCano… |
CVE-2025-5982 | Low | 3.7 | 2025-06-12 | An issue has been discovered in GitLab EE affecting all versions from 12.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. Under certain conditio… |
CVE-2025-4979 | Medium | 4.9 | 2025-05-22 | An issue has been discovered in GitLab CE/EE affecting all versions before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. An attacker may be able to re… |
CVE-2025-1110 | Low | 2.7 | 2025-05-22 | An issue has been discovered in GitLab CE/EE affecting all versions from 18.0 before 18.0.1. In certain circumstances, a user with limited permissions could ac… |
CVE-2025-32703 | Medium | 5.5 | 2025-05-13 | Insufficient granularity of access control in Visual Studio allows an authorized attacker to disclose information locally. |
CVE-2025-1278 | Medium | 5.3 | 2025-05-09 | An issue has been discovered in GitLab CE/EE affecting all versions from 12.0 before 17.9.8, 17.10 before 17.10.6, and 17.11 before 17.11.2. Under certain cond… |
CVE-2025-31201 | Critical | 9.8 | 2025-04-16 | This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4… |
CVE-2025-2408 | Medium | 5.3 | 2025-04-10 | An issue has been discovered in GitLab CE/EE affecting all versions from 13.12 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4. Under certain condi… |
CVE-2024-33058 | High | 7.5 | 2025-04-07 | Memory corruption while assigning memory from the source DDR memory(HLOS) to ADSP. |
CVE-2025-29987 | High | 8.8 | 2025-04-03 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) versions prior to 8.3.0.15 contain an Insufficient Granularity of Access Control vulner… |
CVE-2024-12619 | Medium | 5.2 | 2025-03-28 | An issue has been discovered in GitLab CE/EE affecting all versions from 16.0 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1, allowing internal us… |
CVE-2025-20111 | High | 7.4 | 2025-02-26 | A vulnerability in the health monitoring diagnostics of Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could al… |
CVE-2024-6696 | Medium | 4.9 | 2025-02-20 | The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a sy… |
CVE-2024-39279 | Medium | 6.5 | 2025-02-12 | Insufficient granularity of access control in UEFI firmware in some Intel(R) processors may allow a authenticated user to potentially enable denial of service… |
CVE-2024-21971 | Medium | 5.5 | 2025-02-12 | Improper input validation in AMD Crash Defender could allow an attacker to provide the Windows® system process ID to a kernel-mode driver, resulting in an oper… |
CVE-2023-31343 | High | 7.5 | 2025-02-11 | Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execution. |
CVE-2023-31342 | High | 7.5 | 2025-02-11 | Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execution. |
CVE-2024-53295 | High | 7.8 | 2025-02-01 | Dell PowerProtect DD versions prior to 8.3.0.0, 7.10.1.50, and 7.13.1.20 contain an improper access control vulnerability. A local malicious user with low priv… |
CVE-2024-11931 | Medium | 6.4 | 2025-01-24 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 17.0 prior to 17.6.4, from 17.7 prior to 17.7.3, and from 17.8 prior to 17.8… |
CVE-2024-6437 | Medium | 5.8 | 2025-01-10 | On affected platforms running Arista EOS with one of the following features configured to redirect IP traffic to a next hop: policy-based routing (PBR), BGP Fl… |
CVE-2024-13272 | Medium | 6.3 | 2025-01-09 | Insufficient Granularity of Access Control vulnerability in Drupal Paragraphs table allows Content Spoofing.This issue affects Paragraphs table: from 0.0.0 bef… |
CVE-2024-13256 | High | 7.5 | 2025-01-09 | Insufficient Granularity of Access Control vulnerability in Drupal Email Contact allows Forceful Browsing.This issue affects Email Contact: from 0.0.0 before 2… |
CVE-2024-52814 | Low | 2.8 | 2024-11-22 | Argo Helm is a collection of community maintained charts for `argoproj.github.io` projects. Prior to version 0.45.0, the `workflow-role`) lacks granularity in… |
CVE-2024-52799 | High | 8.2 | 2024-11-21 | Argo Workflows Chart is used to set up argo and its needed dependencies through one command. Prior to 0.44.0, the workflow-role has excessive privileges, the w… |
CVE-2024-43604 | Medium | 5.7 | 2024-10-08 | Outlook for Android Elevation of Privilege Vulnerability |
CVE-2024-8927 | High | 7.5 | 2024-10-08 | In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is bein… |
CVE-2024-6867 | Medium | 6.5 | 2024-09-13 | An information disclosure vulnerability exists in the lunary-ai/lunary, specifically in the `runs/{run_id}/related` endpoint. This endpoint does not verify tha… |
CVE-2024-42365 | High | 7.4 | 2024-08-08 | Asterisk is an open source private branch exchange (PBX) and telephony toolkit. Prior to asterisk versions 18.24.2, 20.9.2, and 21.4.2 and certified-asterisk v… |
CVE-2024-39324 | Low | 3.8 | 2024-07-02 | aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.1 and prior to versions 2022.10.10, 2023.10.6, and 2024.4.2, imp… |
CVE-2024-39323 | High | 7.1 | 2024-07-02 | aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.01 and prior to versions 2022.10.10, 2023.10.6, and 2024.04.6, a… |
CVE-2024-5389 | High | 8.1 | 2024-06-09 | In lunary-ai/lunary version 1.2.13, an insufficient granularity of access control vulnerability allows users to create, update, get, and delete prompt variatio… |
CVE-2023-45217 | High | 8.8 | 2024-05-16 | Improper access control in Intel(R) Power Gadget software for Windows all versions may allow an authenticated user to potentially enable escalation of privileg… |
CVE-2023-40070 | High | 8.8 | 2024-05-16 | Improper access control in some Intel(R) Power Gadget software for macOS all versions may allow an authenticated user to potentially enable escalation of privi… |
CVE-2023-43040 | Medium | 6.5 | 2024-05-14 | IBM Spectrum Fusion HCI 2.5.2 through 2.7.2 could allow an attacker to perform unauthorized actions in RGW for Ceph due to improper bucket access. IBM X-Force… |
CVE-2024-29200 | Medium | 6.8 | 2024-03-28 | Kimai is a web-based multi-user time-tracking application. The permission `view_other_timesheet` performs differently for the Kimai UI and the API, thus return… |
CVE-2023-32259 | Medium | 6.5 | 2024-03-19 | Insufficient Granularity of Access Control vulnerability in OpenText™ Service Management Automation X (SMAX), OpenText™ Asset Management X (AMX) allows Exploit… |
CVE-2023-6725 | Medium | 5.5 | 2024-03-15 | An access-control flaw was found in the OpenStack Designate component where private configuration information including access keys to BIND were improperly mad… |
CVE-2024-26246 | Low | 3.9 | 2024-03-14 | Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability |
CVE-2024-2412 | Medium | 5.3 | 2024-03-13 | The disabling function of the user registration page for Heimavista Rpage and Epage is not properly implemented, allowing remote attackers to complete user reg… |
CVE-2023-50713 | Medium | 6.5 | 2023-12-14 | Speckle Server provides server, frontend, 3D viewer, and other JavaScript utilities for the Speckle 3D data platform. A vulnerability in versions prior to 2.17… |
CVE-2023-44285 | High | 7.8 | 2023-12-14 |
Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an improper access control vulnerability. A local malicious… |
CVE-2023-4456 | Medium | 5.7 | 2023-08-21 | A flaw was found in openshift-logging LokiStack. The key used for caching is just the token, which is too broad. This issue allows a user with a token valid fo… |
CVE-2023-39418 | Low | 3.1 | 2023-08-11 | A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SE… |
CVE-2023-33127 | High | 8.1 | 2023-07-11 | .NET and Visual Studio Elevation of Privilege Vulnerability |
CVE-2023-3227 | Medium | 5.7 | 2023-06-14 | Insufficient Granularity of Access Control in GitHub repository fossbilling/fossbilling prior to 0.5.0. |
CVE-2023-0205 | Medium | 5.0 | 2023-04-22 | NVIDIA ConnectX-5, ConnectX-6, and ConnectX6-DX contain a vulnerability in the NIC firmware, where an unprivileged user can exploit insufficient granularity of… |
CVE-2023-0203 | Medium | 5.0 | 2023-04-22 | NVIDIA ConnectX-5, ConnectX-6, and ConnectX6-DX contain a vulnerability in the NIC firmware, where an unprivileged user can exploit insufficient granularity of… |
CVE-2023-27591 | High | 7.5 | 2023-03-17 | Miniflux is a feed reader. Prior to version 2.0.43, an unauthenticated user can retrieve Prometheus metrics from a publicly reachable Miniflux instance where t… |
CVE-2022-4813 | Medium | 4.3 | 2022-12-28 | Insufficient Granularity of Access Control in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4801 | Medium | 5.3 | 2022-12-28 | Insufficient Granularity of Access Control in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-2475 | Critical | 9.8 | 2022-10-28 | Haas Controller version 100.20.000.1110 has insufficient granularity of access control when using the "Ethernet Q Commands" service. Any user is able to write… |