CWE-284 · Improper Access Control (page 11)
Page 11 of 64 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-48948 | High | 8.8 | 2026-07-07 | An improper access check allows user to download vcard exports of com_contact contacts that are inaccessible. |
CVE-2026-48947 | Medium | 4.9 | 2026-07-07 | An improper access check allows privileged users to overwrite media files without editing permissions. |
CVE-2026-54765 | High | 8.5 | 2026-07-06 | Traefik is an open source HTTP reverse proxy and load balancer. From v3.7.0 prior to v3.7.6, Traefik's Kubernetes Gateway API provider may resolve two accepted… |
CVE-2026-48204 | Critical | 9.8 | 2026-07-06 | Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel Mongodb Gridfs component. The camel-mongodb-gridfs producer selects… |
CVE-2026-24014 | Critical | 9.8 | 2026-07-06 | Apache IoTDB DataNode’s internal RPC interface for creating Trigger instances uses the uploaded Trigger JAR name to build a file path without sufficient valida… |
CVE-2026-14792 | Medium | 6.5 | 2026-07-06 | A security vulnerability has been detected in Formbricks 5.0.0. This impacts an unknown function of the file apps/web/modules/survey/link/actions.ts of the com… |
CVE-2026-14777 | Medium | 6.3 | 2026-07-06 | A weakness has been identified in SourceCodester Onlne Examination & Learning Management System 1.0. Affected by this issue is some unknown functionality of th… |
CVE-2026-14776 | Medium | 6.3 | 2026-07-05 | A security flaw has been discovered in SourceCodester Onlne Examination & Learning Management System 1.0. Affected by this vulnerability is the function pathin… |
CVE-2026-14775 | Medium | 6.3 | 2026-07-05 | A vulnerability was identified in SourceCodester Onlne Examination & Learning Management System 1.0. Affected is an unknown function of the file /process_lesso… |
CVE-2026-9085 | High | 8.8 | 2026-07-05 | Incorrect Permission Assignment for Critical Resource, Improper Access Control vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus-… |
CVE-2026-14736 | High | 7.3 | 2026-07-05 | A vulnerability was found in Ruijie RG-UAC up to 1.0-R1.8.2.p5. The impacted element is an unknown function of the file user_auth_commit.php. Performing a mani… |
CVE-2026-14698 | Medium | 6.3 | 2026-07-05 | A security flaw has been discovered in SourceCodester Syllabus-Aligned Learning Management and Examination System 1.0. Impacted is an unknown function of the f… |
CVE-2025-71380 | High | 8.8 | 2026-07-04 | The Execute Command node in n8n allows authenticated users to execute arbitrary commands on the host system where n8n runs. Attackers with user access or compr… |
CVE-2026-58523 | Medium | 6.5 | 2026-07-03 | Improper access control in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-58422 | Critical | 9.8 | 2026-07-03 | Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts |
CVE-2026-58421 | High | 7.5 | 2026-07-03 | Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service |
CVE-2026-58286 | High | 8.1 | 2026-07-03 | Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-58282 | High | 8.1 | 2026-07-03 | Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-28699 | High | 8.1 | 2026-07-03 | Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed through HTTP Basic authentication. |
CVE-2026-27779 | High | 7.5 | 2026-07-03 | Gitea versions before 1.25.5 accept malformed or injected forwarded-proto values when detecting public URLs, allowing spoofed canonical URL generation. |
CVE-2026-27660 | High | 7.5 | 2026-07-03 | Gitea versions before 1.25.5 allow draft release data or attachments to be accessed without the required write permission. |
CVE-2026-26292 | Critical | 9.8 | 2026-07-03 | Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport prot… |
CVE-2026-26247 | Critical | 9.1 | 2026-07-03 | Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected… |
CVE-2026-25712 | High | 7.5 | 2026-07-03 | Gitea versions before 1.25.5 have insufficient visibility checks in organization permission APIs for hidden members and private organizations. |
CVE-2026-24690 | High | 7.5 | 2026-07-03 | Gitea versions before 1.25.5 have insufficient permission checks for updating or rebasing pull request branches. |
CVE-2026-24451 | High | 7.5 | 2026-07-03 | Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public to private, exposing data to a fork that should no longer be… |
CVE-2026-22555 | High | 8.1 | 2026-07-03 | Gitea versions before 1.26.0 allow API users to fork a repository into an organization without first passing the CanCreateOrgRepo check, which can expose organ… |
CVE-2026-20909 | Medium | 5.3 | 2026-07-03 | Gitea versions before 1.25.5 have insufficient permission checks when listing tracked time entries. |
CVE-2026-20896 | Critical | 9.8 | 2026-07-03 | Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when revers… |
CVE-2026-20706 | Critical | 9.1 | 2026-07-03 | Gitea versions up to and including 1.26.1 allow repository archive downloads to bypass token scope checks on the web archive download endpoint. |
CVE-2026-14614 | Medium | 5.4 | 2026-07-03 | A flaw was found in the ClientResource component of Keycloak's admin services when Fine-Grained Admin Permissions (FGAP) v2 is enabled. This issue allows a del… |
CVE-2026-14613 | Medium | 4.3 | 2026-07-03 | A vulnerability was discovered in Keycloak's administrative interface that allows certain administrators to see information about groups they shouldn't have ac… |
CVE-2026-41123 | Medium | 4.3 | 2026-07-03 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30… |
CVE-2026-26145 | Medium | 4.8 | 2026-07-02 | Improper access control in Azure Synapse allows an authorized attacker to elevate privileges over a network. |
CVE-2026-55119 | High | 8.1 | 2026-07-02 | A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Talk Application to escal… |
CVE-2026-55118 | High | 8.3 | 2026-07-02 | A malicious actor with access to the network,low privileges and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi… |
CVE-2026-55116 | Critical | 9.0 | 2026-07-02 | A malicious actor with access to the network and under certain network configurations could exploit an Improper Access Control vulnerability found in certain d… |
CVE-2026-55114 | High | 8.8 | 2026-07-02 | A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Network Application to es… |
CVE-2026-55112 | High | 7.5 | 2026-07-02 | A malicious actor with access to the network and low privileges and under certain conditions could exploit an Improper Access Control vulnerability found in Un… |
CVE-2026-54408 | High | 8.6 | 2026-07-02 | A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect Application to bypass authentication… |
CVE-2026-54407 | High | 8.6 | 2026-07-02 | A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect Application to bypass authentication… |
CVE-2026-54400 | Critical | 9.1 | 2026-07-02 | A malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerability found in UniFi Access Application to es… |
CVE-2026-50746 | Critical | 10.0 | 2026-07-02 | A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Connect Application to execute a Command Inj… |
CVE-2026-8147 | High | 8.1 | 2026-07-02 | In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoints lack proper authorization validators. This allows any aut… |
CVE-2026-50280 | | 2026-07-02 | Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 and above prior to 5.9.21, the EntriesController::actionMoveToSection() endpoint gates th… | |
CVE-2026-56334 | Medium | 4.3 | 2026-06-30 | Capgo before 12.128.2 lacks an UPDATE row-level security policy for the build_requests table, preventing API-key and anonymous access from persisting builder s… |
CVE-2026-14156 | Medium | 6.5 | 2026-06-30 | Insufficient policy enforcement in StorageAccessAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-14155 | Medium | 6.5 | 2026-06-30 | Insufficient policy enforcement in StorageAccessAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted H… |
CVE-2026-14061 | Medium | 6.5 | 2026-06-30 | Inappropriate implementation in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process… |
CVE-2026-14052 | Medium | 4.3 | 2026-06-30 | Insufficient policy enforcement in FileSystem in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass discretionary access control via a cr… |
CVE-2026-14035 | Medium | 6.5 | 2026-06-30 | Insufficient policy enforcement in Bluetooth in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from… |
CVE-2026-14034 | Medium | 4.3 | 2026-06-30 | Inappropriate implementation in WebXR in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a craf… |
CVE-2026-14003 | Medium | 4.3 | 2026-06-30 | Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2026-13964 | Medium | 6.5 | 2026-06-30 | Insufficient policy enforcement in WebView in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a… |
CVE-2026-13954 | Medium | 6.5 | 2026-06-30 | Insufficient policy enforcement in XML in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information… |
CVE-2026-13953 | Medium | 6.5 | 2026-06-30 | Inappropriate implementation in SplitView in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass… |
CVE-2026-13949 | Medium | 6.5 | 2026-06-30 | Insufficient policy enforcement in Payments in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive inform… |
CVE-2026-13937 | Medium | 6.5 | 2026-06-30 | Insufficient policy enforcement in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to leak… |
CVE-2026-13936 | Medium | 6.5 | 2026-06-30 | Inappropriate implementation in Passwords in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive informat… |
CVE-2026-13933 | Medium | 5.3 | 2026-06-30 | Insufficient policy enforcement in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obta… |
CVE-2026-13932 | Medium | 6.5 | 2026-06-30 | Inappropriate implementation in Sharing in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process t… |
CVE-2026-13931 | Medium | 6.5 | 2026-06-30 | Inappropriate implementation in Media in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to… |
CVE-2026-13914 | Medium | 5.5 | 2026-06-30 | Inappropriate implementation in Passwords in Google Chrome on Mac prior to 150.0.7871.47 allowed a local attacker to obtain potentially sensitive information f… |
CVE-2026-13897 | High | 8.8 | 2026-06-30 | Insufficient policy enforcement in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalation via a crafted H… |
CVE-2026-13864 | High | 8.1 | 2026-06-30 | Insufficient policy enforcement in WebHID in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to… |
CVE-2026-13828 | Medium | 6.5 | 2026-06-30 | Inappropriate implementation in Enterprise in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from p… |
CVE-2026-13818 | Medium | 6.5 | 2026-06-30 | Inappropriate implementation in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a crafted HTM… |
CVE-2026-13800 | High | 7.8 | 2026-06-30 | Inappropriate implementation in Updater in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to perform OS-level privilege escalation vi… |
CVE-2025-24816 | Medium | 6.5 | 2026-06-30 | Nokia MantaRay is subject to an Improper Access Control vulnerability due to insufficient authorization within the API. Successful exploitation could allow an… |
CVE-2026-51221 | High | 7.5 | 2026-06-29 | A buffer overflow in the Get_Attribute_List function of EIPStackGroup OpENer commit 76b95c allows attackers to cause a Denial of Service (DoS) via supplying a… |
CVE-2026-43713 | Medium | 6.5 | 2026-06-29 | A permissions issue was addressed with additional restrictions. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26… |
CVE-2026-43701 | High | 7.1 | 2026-06-29 | The issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 2… |
CVE-2026-49049 | High | 7.5 | 2026-06-29 | The Helix3 plugin for Joomla exposes an ajax handler task, that allows unauthenticated attackers to delete arbitrary files, write arbitrary JSON files and upda… |
CVE-2026-13568 | High | 7.3 | 2026-06-29 | A weakness has been identified in SourceCodester Inventory Management System 1.0. This vulnerability affects unknown code of the file /api/users_handler.php of… |
CVE-2026-13553 | High | 7.3 | 2026-06-29 | A flaw has been found in itsourcecode Online Hotel Management System 1.0. Affected is an unknown function of the file /admin/mod_amenities/controller.php?actio… |
CVE-2026-13547 | High | 7.3 | 2026-06-29 | A vulnerability was determined in Hanwang e-Face General Management Platform 6.3.5.4. This issue affects some unknown processing of the file /manage/resourceUp… |
CVE-2026-13544 | Medium | 6.3 | 2026-06-29 | A flaw has been found in Feehi CMS up to 2.1.1. Affected by this issue is some unknown functionality of the file /api/users of the component API. This manipula… |
CVE-2026-50132 | High | 7.3 | 2026-06-26 | Budibase is an open-source low-code platform. Prior to 3.39.0, `GET /api/chat-links/:instance/:token/handoff` is a public endpoint (no auth required) that perf… |
CVE-2026-56823 | Medium | 5.4 | 2026-06-26 | AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to , the `POST /api/integratio… |
CVE-2026-48529 | Medium | 6.0 | 2026-06-26 | GitHub MCP Server is GitHub's official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is impl… |
CVE-2026-50744 | Medium | 4.3 | 2026-06-26 | A bypass to the admin‑only restriction of the XML‑RPC API in Revive Adserver 6.0.7. The API response for the ox.login method returned a session ID cookie in th… |
CVE-2026-50739 | Medium | 4.3 | 2026-06-26 | A bypass for CVE‑2026‑34913 exists with proper ownership validation that had not been applied to the reverse operation of linking campaigns and trackers throug… |
CVE-2026-48936 | Low | 3.3 | 2026-06-26 | A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `--allow-net` permission. This vulnerab… |
CVE-2026-48930 | Critical | 9.8 | 2026-06-26 | A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings… |
CVE-2026-48928 | Medium | 5.4 | 2026-06-26 | A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnerability affects all supported release… |
CVE-2026-56050 | Medium | 6.5 | 2026-06-25 | Improper Access Control vulnerability in Themeisle PPOM for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue af… |
CVE-2026-46733 | High | 7.8 | 2026-06-25 | Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3, contain an Improper Access Control vulnerability. A low privileged attacker with loc… |
CVE-2026-12490 | High | 7.5 | 2026-06-25 | When a provide-xfr is given with a tls-auth-name, a secondary requesting a transfer should provide a client certificate with that name. However, no client cert… |
CVE-2026-52810 | | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, Git smart HTTP authorizes POST …/git-receive-pack using the client-supplied service query stri… | |
CVE-2026-31978 | Medium | 6.5 | 2026-06-24 | motionEye (mEye) is an online interface for motion software, which is a video surveillance program with motion detection. Versions prior to 0.44.0 are vulnerab… |
CVE-2026-27708 | | 2026-06-24 | FOSSBilling is a free, open-source billing and client management system. In versions 0.7.2 and prior, the Servicecustom Client API's __call method accepts an o… | |
CVE-2026-56302 | Medium | 6.5 | 2026-06-24 | Capgo before 12.128.2 contains an unsecured images bucket lacking any row level security controls, allowing unauthenticated attackers to read, insert, and dele… |
CVE-2026-56257 | High | 7.1 | 2026-06-24 | Capgo before 12.128.2 allows direct patching of public.apps.owner_org through PostgREST, bypassing the transfer_app() workflow and creating split-brain ownersh… |
CVE-2026-47279 | | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the public shared-view relation endpoints accepted a caller-supplied column ID w… | |
CVE-2026-54761 | High | 7.1 | 2026-06-23 | Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.21 and 3.7.5, there is a high severity vulnerability in Traefik's Kubernetes Gateway provider… |
CVE-2026-54015 | Medium | 6.4 | 2026-06-23 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI's prompt version-history endpoint… |
CVE-2026-54012 | High | 7.1 | 2026-06-23 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI lets a user who can create, updat… |
CVE-2026-54010 | High | 8.3 | 2026-06-23 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI lets an authenticated user attach… |
CVE-2026-52844 | High | 7.5 | 2026-06-23 | Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, on Windows, Caddy path matchers treat /private\secret.txt as outside /private… |
CVE-2026-49411 | Medium | 6.5 | 2026-06-23 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.0, the Node.js compatibility TCP path checked the permission against the original hostn… |