CWE-284 · Improper Access Control (page 16)
Page 16 of 64 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-24711 | Medium | 5.3 | 2026-05-14 | Northern.tech CFEngine Enterprise before 3.21.8, 3.24.3, and 3.27.0 has Incorrect Access Control. |
CVE-2026-44478 | High | 7.5 | 2026-05-13 | hoppscotch is an open source API development ecosystem. The fix for CVE-2026-28215 in version 2026.2.0 addresses the unauthenticated POST /v1/onboarding/config… |
CVE-2026-33381 | Medium | 5.9 | 2026-05-13 | When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will… |
CVE-2026-33377 | High | 7.1 | 2026-05-13 | An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate… |
CVE-2026-28374 | Medium | 4.3 | 2026-05-13 | Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations. |
CVE-2026-44007 | Critical | 9.1 | 2026-05-13 | vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.1, when a NodeVM is created with nesting: true, sandbox code can unconditionally require('vm2') reg… |
CVE-2026-36738 | Medium | 6.8 | 2026-05-13 | U-SPEED AC1200 Gigabit Wi-Fi Router (Model: T18-21K) V1.0 is vulnerable to Incorrect Access Control. The device exposes a UART interface that lacks authenticat… |
CVE-2026-44352 | | 2026-05-12 | Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Prior to 1.2.3, Broken Access… | |
CVE-2026-44341 | Medium | 5.3 | 2026-05-12 | GoJobs is a REST API for a Job Board platform. The application exposes a job retrieval endpoint that allows unauthenticated users to access job details by dire… |
CVE-2026-42158 | | 2026-05-12 | Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Prior to 1.2.3, an adversary… | |
CVE-2026-44874 | Medium | 4.9 | 2026-05-12 | A vulnerability exists in the web-based management interface of an AOS-10 Gateway that could allow an authenticated remote attacker to access sensitive files o… |
CVE-2026-44225 | Critical | 9.3 | 2026-05-12 | Pulpy is a lightweight, cross-platform desktop application packager for web apps. Prior to 0.1.1, Pulpy injects a pulpy.fs JavaScript API into every packaged w… |
CVE-2026-44277 | Critical | 9.8 | 2026-05-12 | A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthenticator 6.6.0 through 6.6.8, FortiAuthentica… |
CVE-2026-42832 | High | 7.7 | 2026-05-12 | Improper access control in Microsoft Office allows an unauthorized attacker to perform spoofing locally. |
CVE-2026-42823 | Critical | 9.9 | 2026-05-12 | Improper access control in Azure Logic Apps allows an authorized attacker to elevate privileges over a network. |
CVE-2026-42177 | Medium | 5.3 | 2026-05-12 | linux-entra-sso is a browser plugin for Linux to SSO on Microsoft Entra ID. Prior to 1.8.1, platform/chrome/js/platform-chrome.js:69-88 registers a single decl… |
CVE-2026-41614 | Medium | 6.2 | 2026-05-12 | Improper access control in M365 Copilot for Desktop allows an unauthorized attacker to perform spoofing locally. |
CVE-2026-41102 | High | 7.1 | 2026-05-12 | Improper access control in Microsoft Office PowerPoint allows an authorized attacker to perform spoofing locally. |
CVE-2026-41101 | High | 7.1 | 2026-05-12 | Improper access control in Microsoft Office Word allows an authorized attacker to perform spoofing locally. |
CVE-2026-41100 | Medium | 4.4 | 2026-05-12 | Improper access control in M365 Copilot allows an authorized attacker to perform spoofing locally. |
CVE-2026-41086 | High | 8.8 | 2026-05-12 | Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges over a network. |
CVE-2026-40420 | High | 8.8 | 2026-05-12 | Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally. |
CVE-2026-40381 | High | 7.8 | 2026-05-12 | Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally. |
CVE-2026-33834 | High | 7.8 | 2026-05-12 | Improper access control in Windows Event Logging Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-32209 | Medium | 4.4 | 2026-05-12 | Improper access control in Windows Filtering Platform (WFP) allows an authorized attacker to bypass a security feature locally. |
CVE-2025-43524 | High | 8.8 | 2026-05-12 | An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.2. An app… |
CVE-2026-40300 | Medium | 6.5 | 2026-05-12 | Zulip is an open-source team collaboration tool. Prior to 12.0, With message_edit_history_visibility_policy set to "moves", /api/v1/messages/{id}/history still… |
CVE-2026-20887 | | 2026-05-12 | Improper access control for some Intel Vision software for all versions within Ring 3: User Applications may allow a denial of service. Unprivileged software a… | |
CVE-2026-40020 | Low | 3.1 | 2026-05-12 | Attacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl file even if imap_acl_allow_anyone=no. This causes folders to be… |
CVE-2026-43652 | High | 7.5 | 2026-05-11 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.5. An app may be able to access protected user data. |
CVE-2026-28993 | Medium | 5.5 | 2026-05-11 | This issue was addressed by adding an additional prompt for user consent. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS… |
CVE-2026-28988 | Medium | 5.5 | 2026-05-11 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, visionOS 26.5, watchOS 26.5… |
CVE-2026-28978 | High | 8.8 | 2026-05-11 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. A malicious… |
CVE-2026-28974 | High | 7.5 | 2026-05-11 | This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Tah… |
CVE-2026-28965 | High | 7.5 | 2026-05-11 | A privacy issue was addressed with improved checks. This issue is fixed in iOS 26.5 and iPadOS 26.5. A user may be able to view restricted content from the loc… |
CVE-2026-28957 | Low | 3.3 | 2026-05-11 | An issue with app access to camera metadata was addressed with improved logic. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, v… |
CVE-2026-28930 | High | 7.5 | 2026-05-11 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.5. An app may be able to access protected user data. |
CVE-2026-28922 | Medium | 6.5 | 2026-05-11 | This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be a… |
CVE-2026-28910 | Low | 3.3 | 2026-05-11 | This issue was addressed with improved permissions checking. This issue is fixed in macOS Tahoe 26.4. A malicious app may be able to access arbitrary files. |
CVE-2026-7813 | Critical | 9.9 | 2026-05-11 | Authorization vulnerability in pgAdmin 4 server mode affecting Server Groups, Servers, Shared Servers, Background Processes, and Debugger modules. Multiple en… |
CVE-2025-9973 | Medium | 6.4 | 2026-05-11 | Due to not validating the organization context when executing adaptive authentication flows, the WSO2 Identity Server allows adaptive authentication logic to b… |
CVE-2026-8233 | Medium | 4.6 | 2026-05-10 | A vulnerability was determined in Dotouch XproUPF 2.0.0-release-088aa7c4. Affected is an unknown function of the component UPF. This manipulation causes improp… |
CVE-2026-42569 | Critical | 9.4 | 2026-05-09 | phpVMS is a PHP application to run and simulate an airline. Prior to version 7.0.6, a critical vulnerability in phpVMS allowed unauthenticated access to a lega… |
CVE-2026-1749 | Medium | 6.8 | 2026-05-09 | There is an Access Control Vulnerability in some HikCentral Professional versions. This could allow an unauthenticated user to obtain the admin permission. |
CVE-2026-42205 | High | 8.8 | 2026-05-08 | Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.31.2, a broken access control vulnerability was identified in the ActionsC… |
CVE-2026-41487 | Medium | 5.4 | 2026-05-08 | Langfuse is an open source large language model engineering platform. From version 3.68.0 to before version 3.167.0, there is a role-based-access control flaw… |
CVE-2026-41491 | High | 8.1 | 2026-05-08 | Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. From versions 1.3.0 to before 1.15.14, 1.16.0-rc.1 to be… |
CVE-2026-8069 | High | 7.8 | 2026-05-08 | PredatorSense version 3.00.3136 to 3.00.3196 contain Local Privilege Escalation (LPE) vulnerability.The program exposes a Windows Named Pipe that uses a custom… |
CVE-2025-69691 | Critical | 9.9 | 2026-05-08 | Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php. NOTE: the Supplier disputes this because the API call is only available… |
CVE-2026-42278 | | 2026-05-08 | UltraDAG is a minimal DAG-BFT blockchain in Rust. Prior to commit fb6ef59, the UltraDAG StateEngine implementation of SmartTransferTx contains a critical logic… | |
CVE-2026-41900 | High | 8.8 | 2026-05-08 | OpenLearnX is an open-source, decentralized learning and assessment platform. Prior to version 2.0.3, a remote code execution (RCE) vulnerability was identifie… |
CVE-2026-41646 | Medium | 5.5 | 2026-05-08 | Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From version 3.0.0 to before version 3.8.0, a vulnerability in Nuclei's JavaScript protocol… |
CVE-2026-8127 | Medium | 6.3 | 2026-05-08 | A vulnerability has been found in eladmin up to 2.7. Impacted is the function checkLevel of the file /rest/UserController.java of the component Users API Endpo… |
CVE-2026-35435 | High | 8.6 | 2026-05-07 | Improper access control in Azure AI Foundry M365 published agents allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-33109 | Critical | 9.9 | 2026-05-07 | Improper access control in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code over a network. |
CVE-2026-37709 | Critical | 9.8 | 2026-05-07 | Insecure Permissions vulnerability in grokability snipe-it v.8.4.0 and before and fixed after 2026-03-10 commit 676a9958 allows a remote attacker to execute ar… |
CVE-2026-5788 | High | 7.0 | 2026-05-07 | An Improper Access Control in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to invoke arbitrary methods. |
CVE-2026-5786 | High | 8.8 | 2026-05-07 | An Improper Access Control vulnerability in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote authenticated attacker to gain adminis… |
CVE-2026-41641 | High | 7.2 | 2026-05-07 | NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.39, the checkSQL() valida… |
CVE-2026-8033 | Medium | 5.3 | 2026-05-06 | A vulnerability has been found in PicoTronica e-Clinic Healthcare System ECHS 5.7. This affects an unknown function of the file /cdemos/echs/api/v2/ of the com… |
CVE-2026-7959 | Low | 3.1 | 2026-05-06 | Inappropriate implementation in Navigation in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass… |
CVE-2026-20167 | High | 7.7 | 2026-05-06 | A vulnerability in the web-based management interface of Cisco IoT Field Network Director could allow an authenticated, remote attacker with low privileges to… |
CVE-2026-8028 | Low | 3.7 | 2026-05-06 | A vulnerability was detected in FlowiseAI Flowise up to 3.0.12. This affects the function verify of the file packages/server/src/enterprise/services/account.se… |
CVE-2026-8026 | Low | 3.7 | 2026-05-06 | A security flaw has been discovered in FlowiseAI Flowise up to 3.0.12. Affected is the function Login of the file packages/server/src/enterprise/services/accou… |
CVE-2024-52911 | High | 7.5 | 2026-05-05 | Bitcoin Core through 28.x has a security issue, the details of which are not disclosed. The earliest affected version is 0.14. |
CVE-2026-42222 | High | 8.1 | 2026-05-04 | Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated bootstrap takeover exists in nginx-ui during the initial instal… |
CVE-2025-67796 | High | 8.1 | 2026-05-04 | IKUS Rdiffweb before 2.10.5 has an improper authorization flaw that allows an attacker with any valid or stolen access token to act as other users. The API doe… |
CVE-2026-42812 | Critical | 9.9 | 2026-05-04 | In Apache Iceberg, the table's metadata files are control files: they tell readers which data files belong to the table and which table version to read. `wr… |
CVE-2026-7733 | High | 7.3 | 2026-05-04 | A flaw has been found in funadmin up to 7.1.0-rc6. This affects the function UploadService::chunkUpload of the file app/common/service/UploadService.php of the… |
CVE-2026-7732 | Medium | 6.3 | 2026-05-04 | A vulnerability was detected in code-projects BloodBank Managing System 1.0. The impacted element is an unknown function of the file request_blood.php. The man… |
CVE-2026-7711 | High | 7.3 | 2026-05-04 | A weakness has been identified in MindsDB up to 26.01. This impacts the function exec of the file mindsdb/integrations/handlers/byom_handler/proc_wrapper.py of… |
CVE-2026-7696 | Medium | 6.3 | 2026-05-03 | A vulnerability was found in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 1.3.0. This impacts an unknown function of the fil… |
CVE-2026-7686 | Medium | 5.3 | 2026-05-03 | A vulnerability was found in eyeo Adblock Plus up to 4.36.2 on Chrome. Affected by this vulnerability is the function postMessage of the file premium.preload.j… |
CVE-2026-7673 | Medium | 4.7 | 2026-05-03 | A vulnerability was detected in crmeb_java up to 1.3.4. This vulnerability affects unknown code of the file crmeb/crmeb-service/src/main/java/com/zbkj/service/… |
CVE-2026-37526 | High | 7.8 | 2026-05-01 | AGL app-framework-binder (afb-daemon) through v19.90.0 allows any local process to execute privileged supervision commands (Exit, Do, Sclose, Config, Trace, De… |
CVE-2026-7578 | Medium | 4.7 | 2026-05-01 | A weakness has been identified in MacCMS Pro up to 2022.1.3. This vulnerability affects the function install of the file /admi.php/admin/addon/add.html of the… |
CVE-2026-2311 | Medium | 6.4 | 2026-04-30 | IBM i 7.6, 7.5, 7.4, 7.3, and 7.2 s vulnerable to privilege escalation caused by an invalid IBM i Web Administration GUI authorization check. A malicious acto… |
CVE-2026-40904 | High | 8.1 | 2026-04-30 | Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, Chartbrew expo… |
CVE-2026-40603 | Medium | 6.5 | 2026-04-30 | Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, Chartbrew expo… |
CVE-2026-40595 | High | 7.5 | 2026-04-30 | Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, Chartbrew expo… |
CVE-2026-7468 | High | 7.3 | 2026-04-30 | A security vulnerability has been detected in 1024-lab smart-admin up to 3.30.0. This affects an unknown function of the file /smart-admin-api/druid/index.html… |
CVE-2026-7393 | Medium | 4.7 | 2026-04-29 | A vulnerability was found in SourceCodester Pizzafy Ecommerce System 1.0. Affected is the function save_menu of the file /admin/admin_class_novo.php of the com… |
CVE-2026-5141 | High | 8.8 | 2026-04-29 | Improper Privilege Management, Improper Access Control, Incorrect privilege assignment vulnerability in TUBITAK BILGEM Software Technologies Research Institute… |
CVE-2026-5780 | High | 8.1 | 2026-04-28 | An insecure direct object reference (IDOR) vulnerability in MphRx's Minerva V3.6.0, specifically in the endpoint '/minerva/moUser/show/'. If this vulnerability… |
CVE-2026-5779 | High | 8.8 | 2026-04-28 | An insecure direct object reference (IDOR) vulnerability in MphRx's Minerva V3.6.0, specifically in the '/minerva/user/updateUserProfile' endpoint. This allows… |
CVE-2026-7238 | Medium | 4.7 | 2026-04-28 | A flaw has been found in code-projects Online Music Site 1.0. This affects an unknown part of the file /Administrator/PHP/AdminUpdateAlbum.php. This manipulati… |
CVE-2026-40966 | Medium | 5.9 | 2026-04-28 | In Spring AI, an attacker can bypass conversation isolation and exfiltrate sensitive memory from other users’ chat histories, including secrets and credentials… |
CVE-2026-7134 | Medium | 4.7 | 2026-04-27 | A vulnerability was identified in code-projects Online Lot Reservation System 1.0. Affected is an unknown function of the file /edithousepic.php. Such manipula… |
CVE-2026-7133 | Medium | 4.7 | 2026-04-27 | A vulnerability was determined in code-projects Online Lot Reservation System 1.0. This impacts an unknown function of the file /activity.php. This manipulatio… |
CVE-2026-7107 | Medium | 6.3 | 2026-04-27 | A weakness has been identified in code-projects Invoice System in Laravel 1.0. The impacted element is an unknown function of the file /company. This manipulat… |
CVE-2026-7044 | Medium | 6.3 | 2026-04-26 | A vulnerability was found in GreenCMS up to 2.3. Affected is the function themeadd of the file /index.php?m=admin&c=custom&a=themeadd. The manipulation results… |
CVE-2026-7043 | Medium | 6.3 | 2026-04-26 | A vulnerability has been found in GreenCMS up to 2.3. This impacts the function pluginAddLocal of the file /index.php?m=admin&c=custom&a=pluginadd. The manipul… |
CVE-2026-7041 | Low | 3.7 | 2026-04-26 | A vulnerability was detected in 666ghj MiroFish up to 0.1.2. The impacted element is an unknown function of the file /console of the component Werkzeug Debugge… |
CVE-2026-7021 | Low | 3.5 | 2026-04-26 | A weakness has been identified in SmythOS sre up to 0.0.15. This impacts an unknown function of the file packages/sdk/src/LLM/utils.ts of the component Connect… |
CVE-2025-67259 | Medium | 6.5 | 2026-04-24 | A Broken Access Control vulnerability exists in ClassroomIO v0.1.13 where an authenticated low-privileged "student" user can access unauthorized course-level i… |
CVE-2025-59308 | Medium | 4.7 | 2026-04-24 | In Mahara before 24.04.10 and 25 before 25.04.1, an institution administrator or institution support administrator on a multi-tenanted site can masquerade as a… |
CVE-2026-33318 | High | 8.8 | 2026-04-24 | Actual is a local-first personal finance tool. Prior to version 26.4.0, any authenticated user (including `BASIC` role) can escalate to `ADMIN` on servers migr… |
CVE-2026-29197 | Medium | 4.3 | 2026-04-24 | In versions <8.4.0, <8.3.2, <8.2.2, <8.1.3, <8.0.4, <7.13.6, <7.12.7, <7.11.7, and <7.10.10, the endpoints /api/apps/logs and /api/apps/:id/logs have a typo in… |
CVE-2026-24303 | Critical | 9.6 | 2026-04-23 | Improper access control in Microsoft Partner Center allows an authorized attacker to elevate privileges over a network. |
CVE-2026-41277 | High | 8.8 | 2026-04-23 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, a Mass Assignment vulnerability in the DocumentStore c… |