CWE-284 · Improper Access Control (page 10)
Page 10 of 64 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-46923 | High | 8.0 | 2026-07-21 | Vulnerability in the Oracle Public Sector Financials (International) product of Oracle E-Business Suite (component: Authorization). Supported versions that ar… |
CVE-2026-46917 | Medium | 5.3 | 2026-07-21 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions… |
CVE-2026-46876 | Critical | 9.8 | 2026-07-21 | Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows unauthenticate… |
CVE-2026-43945 | | 2026-07-21 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Versions 1.2.11 until 1.3.1 allow an unauthenticated remote attacker to achieve Full… | |
CVE-2026-35290 | Critical | 9.8 | 2026-07-21 | Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows unauthenticate… |
CVE-2026-35287 | High | 7.5 | 2026-07-21 | Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows unauthenticate… |
CVE-2026-34316 | Medium | 6.1 | 2026-07-21 | Vulnerability in the Oracle Commerce Service Center product of Oracle Commerce (component: Commerce Service Center). The supported version that is affected i… |
CVE-2026-21954 | Medium | 4.3 | 2026-07-21 | Vulnerability in the Oracle Retail Xstore Point of Service product of Oracle Retail Applications (component: Xstore Mobile). The supported version that is af… |
CVE-2026-21953 | Low | 3.3 | 2026-07-21 | Vulnerability in the Oracle Retail Xstore Point of Service product of Oracle Retail Applications (component: Xstore Mobile). The supported version that is af… |
CVE-2026-47405 | High | 8.8 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have a broken workspace authorization check that a… |
CVE-2026-47399 | High | 8.8 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the workspace-scoped REST routes contain a systemi… |
CVE-2026-16454 | Medium | 4.3 | 2026-07-21 | In Eclipse hawkBit versions 1.0.3 and prior, a privilege escalation vulnerability (CWE-284 / CWE-862) has been identified in the Direct Device Integration (DDI… |
CVE-2026-16451 | Medium | 6.3 | 2026-07-21 | A security flaw has been discovered in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. This impacts an unknown function of the file /api/s… |
CVE-2026-47396 | Critical | 9.8 | 2026-07-21 | PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's call server exposes a network-facing agent control API without authentication whe… |
CVE-2026-28321 | Critical | 9.1 | 2026-07-21 | SolarWinds Serv-U is affected by a broken access control vulnerability that could allow arbitrary file read and write, which can then be used to escalate privi… |
CVE-2026-28307 | Critical | 9.1 | 2026-07-21 | SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain user group to be elevated into an administrator group. The impact is… |
CVE-2026-28306 | Critical | 9.1 | 2026-07-21 | SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to elevate their privileges to a system administrator… |
CVE-2026-28304 | Critical | 9.1 | 2026-07-21 | SolarWinds Serv-U is affected by a remote code execution vulnerability that, when exploited, can allow the arbitrary execution of code remotely as root. The im… |
CVE-2026-16447 | High | 7.3 | 2026-07-21 | A vulnerability has been found in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file /web/jquery/uploader/multi_uploadify.php. The manipulation… |
CVE-2025-66390 | Critical | 9.8 | 2026-07-21 | In Microsoft Azure API Management through 2025-10-17, when self-service signup (username/password Basic Authentication) is enabled in Tenant A, an attacker can… |
CVE-2026-16407 | Critical | 9.8 | 2026-07-21 | Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16387 | Critical | 9.8 | 2026-07-21 | Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
CVE-2026-16365 | High | 8.8 | 2026-07-21 | Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16332 | High | 7.3 | 2026-07-21 | A vulnerability was detected in D-Link DNS-320 1.0.2. This impacts an unknown function of the file /mydlink/multi_uploadify.php. Performing a manipulation of t… |
CVE-2026-16331 | High | 7.3 | 2026-07-21 | A security vulnerability has been detected in D-Link DNS-320 1.0.2. This affects an unknown function of the file /web/function/save_ajax.php. Such manipulation… |
CVE-2026-16330 | High | 7.3 | 2026-07-21 | A weakness has been identified in D-Link DNS-320 1.0.2. The impacted element is an unknown function of the file /web/jquery/uploader/uploadify.php. This manipu… |
CVE-2026-16329 | High | 7.3 | 2026-07-21 | A vulnerability was identified in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file /photo_center/php/uploadify.php. The manipulation of the ar… |
CVE-2026-16327 | High | 7.3 | 2026-07-21 | A vulnerability was determined in D-Link DNS-320 1.0.2. This issue affects some unknown processing of the file /web/web_file/upload.php. Executing a manipulati… |
CVE-2026-55550 | High | 7.1 | 2026-07-20 | NextCRM is open-source customer relationship management (CRM) software. The CRM product catalog is an organization-wide business object. Normal application ser… |
CVE-2026-55544 | High | 7.6 | 2026-07-20 | NextCRM is open-source customer relationship management (CRM) software. In version 0.12.1, the MCP campaign tools expose campaign read and write operations ove… |
CVE-2026-47255 | High | 8.2 | 2026-07-20 | AgenticMail gives AI agents real email addresses and phone numbers. @agenticmail/api prior to version 0.9.32 and @agenticmail/core prior to version 0.9.10 had… |
CVE-2026-16324 | High | 7.3 | 2026-07-20 | A vulnerability was identified in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. The impacted element is an unknown function of the file /business/qnaire/upload.jsp… |
CVE-2026-62414 | Critical | 9.1 | 2026-07-20 | Joomla Extension - joomlack.fr - Improper access control in Page Builder CK < 3.6.2 - The Joomla extension Page Builder CK does not properly apply access contr… |
CVE-2026-60030 | | 2026-07-20 | Joomla Extension - themexpert.com - Broken Access Control for media management in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page Builder Pro is vul… | |
CVE-2026-46415 | High | 8.2 | 2026-07-20 | The Caddy Defender plugin is a middleware for Caddy that allows users to block or manipulate requests based on the client's IP address. Prior to version 0.10.1… |
CVE-2026-12972 | Medium | 5.3 | 2026-07-20 | The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to… |
CVE-2026-16226 | Medium | 4.7 | 2026-07-19 | A weakness has been identified in SourceCodester Pizzafy Ecommerce System 1.0. This affects the function save_settings of the file /admin/admin_class_novo.php… |
CVE-2026-16201 | Medium | 5.3 | 2026-07-19 | A vulnerability was found in zevorn rt-claw up to 0.2.0. Affected is the function claw_net_get/claw_net_post of the file claw/services/tools/net.c of the compo… |
CVE-2026-51083 | Medium | 6.5 | 2026-07-17 | Incorrect access control in Proxmox Virtual Environment (PVE) 9.x qemu-server before 9.1.8 and 8.x before 8.4.8 allows users within limited privileges to obtai… |
CVE-2026-16072 | Medium | 4.9 | 2026-07-17 | A flaw was found in the organization management component of Keycloak. A delegated administrator with permission to manage organizations can create an invitati… |
CVE-2026-41993 | Medium | 4.4 | 2026-07-17 | Improper Access Control vulnerability in the Removable Media Validation function of TXOne Networks products allows a local attacker with administrator privileg… |
CVE-2026-54526 | Critical | 9.9 | 2026-07-16 | Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 3.7.15 and 4.0.6, the allow-list fix… |
CVE-2026-46353 | High | 8.1 | 2026-07-16 | BigBlueButton is an open-source virtual classroom. Prior to 3.0.21, bbb-web checksum validation could be bypassed when a presentationUploadExternalUrl paramete… |
CVE-2026-55548 | Medium | 4.3 | 2026-07-16 | Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, the PacketsApi.exportPackets endpoint in yamcs-core/src/main/java/org/yamcs/http/api/PacketsA… |
CVE-2026-35148 | Medium | 6.3 | 2026-07-16 | HCL DFXServer is affected by a Missing Access Control vulnerability. This vulnerability states that certain endpoints are accessible without any form of authen… |
CVE-2026-1609 | High | 8.1 | 2026-07-16 | A flaw was found in Keycloak. When the JSON Web Token (JWT) authorization grant preview feature is enabled and a user account is disabled, Keycloak fails to va… |
CVE-2026-62314 | Medium | 5.8 | 2026-07-15 | Anubis is a Web AI Firewall Utility that challenges users' connections in order to protect upstream resources from scraper bots. From 1.22.0 until 1.26.0-pre1… |
CVE-2026-55234 | High | 8.5 | 2026-07-15 | Wekan is open source kanban built with Meteor. Prior to 9.37, Wekan DDP update allow rules in server/permissions/cards.js, server/permissions/lists.js, and ser… |
CVE-2026-45313 | High | 7.7 | 2026-07-15 | Sandboxie-Plus is an open source sandbox-based isolation software for Windows. Prior to 1.17.6, GuiServer::WndHookRegisterSlave in Sandboxie/core/svc/GuiServer… |
CVE-2026-46485 | High | 8.2 | 2026-07-15 | Dashy is a self-hostable personal dashboard. Prior to 4.0.8, Dashy deployments using OIDC can allow unauthenticated users or non-admin authenticated users to w… |
CVE-2026-14960 | Critical | 9.8 | 2026-07-15 | Pegatron `Tdelo64.sys` improperly exposes privileged hardware access functionality through the `\\.\TdeIo` device interface. IOCTL handlers including `TDE_IOCT… |
CVE-2026-20150 | High | 8.8 | 2026-07-15 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal secur… |
CVE-2026-47164 | High | 7.7 | 2026-07-15 | Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO login flow checked the IdP email_verified claim only for new-u… |
CVE-2026-36035 | Medium | 6.5 | 2026-07-14 | Incorrect access control in the /api/License/deactivateOffline endpoint of CAXPerts UniversalPlantViewer WebServices Server v2.7.6 allows authenticated attacke… |
CVE-2026-47301 | High | 8.8 | 2026-07-14 | Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network. |
CVE-2026-58617 | High | 8.1 | 2026-07-14 | Improper access control in Microsoft 365 Copilot for iOS allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-58545 | Medium | 5.5 | 2026-07-14 | Improper access control in Windows Kernel allows an authorized attacker to bypass a security feature locally. |
CVE-2026-57088 | High | 7.8 | 2026-07-14 | Improper access control in Extensible Storage Engine (ESENT) allows an authorized attacker to elevate privileges locally. |
CVE-2026-56157 | Medium | 5.4 | 2026-07-14 | Improper access control in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. |
CVE-2026-50495 | Medium | 6.1 | 2026-07-14 | Improper access control in Microsoft Windows DNS allows an authorized attacker to perform tampering locally. |
CVE-2026-50465 | High | 7.1 | 2026-07-14 | Improper access control in Microsoft Windows DNS allows an authorized attacker to perform tampering locally. |
CVE-2026-50423 | High | 7.8 | 2026-07-14 | Improper access control in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-50418 | Medium | 5.1 | 2026-07-14 | Improper access control in Windows System allows an unauthorized attacker to bypass a security feature locally. |
CVE-2026-50373 | High | 7.8 | 2026-07-14 | Improper access control in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. |
CVE-2026-50335 | High | 7.8 | 2026-07-14 | Improper access control in Windows Operating Systems allows an authorized attacker to elevate privileges locally. |
CVE-2026-55014 | High | 7.8 | 2026-07-14 | Improper access control in Windows Remote Help Defense allows an authorized attacker to elevate privileges locally. |
CVE-2026-50351 | High | 7.8 | 2026-07-14 | Improper access control in Windows Audio Compression Manager (ACM) allows an authorized attacker to elevate privileges locally. |
CVE-2026-50342 | High | 8.8 | 2026-07-14 | Improper access control in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally. |
CVE-2026-50325 | High | 7.0 | 2026-07-14 | Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally. |
CVE-2026-50311 | High | 7.8 | 2026-07-14 | Improper access control in Windows Server allows an authorized attacker to elevate privileges locally. |
CVE-2026-50297 | High | 7.0 | 2026-07-14 | Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally. |
CVE-2026-49805 | High | 7.0 | 2026-07-14 | Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally. |
CVE-2026-15677 | High | 7.3 | 2026-07-14 | A weakness has been identified in code-projects Online Job Portal 1.0. This affects an unknown function of the file /JobSeekerInsert.php. Executing a manipulat… |
CVE-2026-15627 | Medium | 4.3 | 2026-07-14 | A vulnerability was identified in nextlevelbuilder GoClaw up to 3.13.3-beta.3. This vulnerability affects the function handleNavigate of the file pkg/browser/t… |
CVE-2026-57855 | High | 8.8 | 2026-07-13 | Cockpit CMS contains a missing authorization vulnerability in the Bucket file storage API (/system/buckets/api). The api() method in modules/System/Controller/… |
CVE-2026-51538 | Critical | 9.1 | 2026-07-13 | EIPStackGroup OpENer 2.3.0 (commit 76b95cf) suffers from an Incorrect Access Control vulnerability in its handling of encapsulation sessions. When the server p… |
CVE-2026-15539 | Medium | 4.7 | 2026-07-13 | A security vulnerability has been detected in SourceCodester Online Book Store System 1.0. Impacted is an unknown function of the file /admin/index.php?page=bo… |
CVE-2026-15530 | Medium | 5.3 | 2026-07-13 | A flaw has been found in WuzhiCMS up to 4.1.0. Affected by this vulnerability is the function config/listimage of the file /index.php?m=attachment&f=index&v=up… |
CVE-2026-15518 | Medium | 4.7 | 2026-07-13 | A vulnerability has been found in AREA 17 Twill CMS up to 3.6.0. The impacted element is the function FileLibraryController::storeFile of the file src/Http/Con… |
CVE-2026-15488 | High | 7.3 | 2026-07-12 | A vulnerability was determined in hcr707305003 shiroiAdmin 1.1/1.3. Affected is the function FileController::upload of the file app/common/controller/FileContr… |
CVE-2026-15476 | Medium | 5.3 | 2026-07-12 | A security vulnerability has been detected in QILING Disk Master 6.0.0.0. The impacted element is an unknown function in the library diskbckp.sys of the compon… |
CVE-2026-15475 | Medium | 5.3 | 2026-07-12 | A weakness has been identified in MiniTool Partition Wizard up to 13.6. The affected element is an unknown function in the library pwdrvio.sys of the component… |
CVE-2026-20744 | Critical | 9.8 | 2026-07-10 | The charging station websocket endpoint accepts connections without proper authentication, which could lead to privilege escalation. |
CVE-2026-55670 | | 2026-07-10 | ZITADEL is an open source identity management platform. Prior to 4.15.1, ZITADEL's event store validation can retain the original resource owner for a deleted… | |
CVE-2026-56335 | Medium | 6.5 | 2026-07-10 | Capgo before 12.128.2 contains an authorization bypass vulnerability where write-scoped API keys can directly mutate protected channel configuration fields thr… |
CVE-2026-40452 | High | 7.5 | 2026-07-10 | Incorrect Authorization, Improper Access Control vulnerability in Apache IoTDB. Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to unaut… |
CVE-2026-40009 | Medium | 6.5 | 2026-07-10 | Improper Privilege Management, Improper Access Control vulnerability in Apache IoTDB. Authenticated users can escalate to full tree-path access by renaming the… |
CVE-2026-15329 | Medium | 4.3 | 2026-07-10 | A vulnerability was found in zhayujie CowAgent up to 2.1.0. This issue affects the function BrowserTool._do_navigate of the file agent/tools/browser/browser_to… |
CVE-2026-15319 | High | 7.3 | 2026-07-10 | A security vulnerability has been detected in Sipeed PicoClaw up to 0.2.9. This affects the function IPAllowlist of the file web/backend/middleware/access_cont… |
CVE-2025-45422 | High | 8.1 | 2026-07-09 | Incorrect access control in Proximus b-box v8c.725A allows authenticated attackers to bypass normal restrictions and make arbitrary changes to port forwarding… |
CVE-2025-63579 | High | 7.5 | 2026-07-09 | Unauthorized use of Kyocera printers, allows all information stored in the Kyocera address book to be exported. The security measure that encrypts incoming dat… |
CVE-2026-59720 | High | 7.5 | 2026-07-09 | Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, mock server creation in mock-server.service.ts does not persist the isPublic input f… |
CVE-2026-15188 | Medium | 6.3 | 2026-07-09 | A weakness has been identified in manjurulhoque django-job-portal up to dfa352f305bba44445ac5dc12e9b2a98c9dcd71f. Affected by this vulnerability is the functio… |
CVE-2026-58525 | High | 8.2 | 2026-07-08 | Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-56217 | Medium | 4.3 | 2026-07-08 | Capgo before 12.128.2 contains a policy bypass vulnerability in app_versions update enforcement that allows app-scoped API keys to downgrade encrypted bundles… |
CVE-2026-28378 | Low | 3.1 | 2026-07-07 | The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging… |
CVE-2026-48958 | High | 8.8 | 2026-07-07 | An improper access check allows unauthorized users to create custom fields via webservices endpoints. |
CVE-2026-48957 | High | 8.8 | 2026-07-07 | An improper access check allows unauthorized users to access com_privacy datasets. |
CVE-2026-48956 | Medium | 5.0 | 2026-07-07 | An improper access check allows users to display a list of modules in the frontend. |
CVE-2026-48955 | Medium | 6.5 | 2026-07-07 | An improper access check allows unauthorized users to access workflow stage and transition information. |