CWE-284 · Improper Access Control (page 17)
Page 17 of 64 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-41270 | High | 7.1 | 2026-04-23 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, a Server-Side Request Forgery (SSRF) protection bypass… |
CVE-2026-41243 | Medium | 5.4 | 2026-04-23 | OpenLearn is open-source educational forum software. Prior to commit 844b2a40a69d0c4911580fe501923f0b391313ab, when `safeMode` is enabled, unapproved forum pos… |
CVE-2026-41166 | High | 7.0 | 2026-04-22 | OpenRemote is an open-source internet-of-things platform. Prior to version 1.22.1, a user who has `write:admin` in one Keycloak realm can call the Manager API… |
CVE-2026-31192 | Medium | 6.5 | 2026-04-22 | Insufficient validation of Chrome extension identifiers in Raindrop.io Bookmark Manager Web App 5.6.76.0 allows attackers to obtain sensitive user data via a c… |
CVE-2026-22754 | High | 7.5 | 2026-04-22 | Vulnerability in Spring Spring Security. If an application uses <sec:intercept-url servlet-path="/servlet-path" pattern="/endpoint/**"/> to define the servlet… |
CVE-2026-35252 | Medium | 6.4 | 2026-04-21 | Vulnerability in the Oracle Security Service product of Oracle Fusion Middleware (component: C Oracle SSL API). Supported versions that are affected are 12.2… |
CVE-2026-35251 | High | 7.5 | 2026-04-21 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.6. Difficult to e… |
CVE-2026-35250 | Low | 2.3 | 2026-04-21 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.6. Easily exploit… |
CVE-2026-35249 | Low | 3.2 | 2026-04-21 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.6. Easily exploit… |
CVE-2026-35248 | Medium | 5.0 | 2026-04-21 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.6. Difficult to e… |
CVE-2026-35247 | Medium | 6.0 | 2026-04-21 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.6. Easily exploit… |
CVE-2026-35246 | High | 7.5 | 2026-04-21 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.6. Difficult to e… |
CVE-2026-35245 | High | 7.5 | 2026-04-21 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.6. Easily exploit… |
CVE-2026-35244 | Medium | 5.2 | 2026-04-21 | Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Lifecycle Management). The supported version that is af… |
CVE-2026-35243 | High | 7.8 | 2026-04-21 | Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are af… |
CVE-2026-35242 | High | 7.5 | 2026-04-21 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.6. Difficult to e… |
CVE-2026-35241 | Medium | 5.7 | 2026-04-21 | Vulnerability in the PeopleSoft Enterprise CS Student Records product of Oracle PeopleSoft (component: Research Tracking). The supported version that is affe… |
CVE-2026-35240 | Medium | 4.9 | 2026-04-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 a… |
CVE-2026-35239 | Medium | 4.9 | 2026-04-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9… |
CVE-2026-35238 | Medium | 4.9 | 2026-04-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9… |
CVE-2026-35237 | Medium | 4.9 | 2026-04-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9… |
CVE-2026-35236 | Medium | 4.9 | 2026-04-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9… |
CVE-2026-35235 | Medium | 4.9 | 2026-04-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: GIS). Supported versions that are affected are 9.0.0-9.6.0. Easily exploitable v… |
CVE-2026-35234 | Medium | 4.9 | 2026-04-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Partition). Supported versions that are affected are 9.0.0-9.6.0. Easily exploit… |
CVE-2026-35232 | Medium | 5.4 | 2026-04-21 | Vulnerability in Oracle Fusion Middleware (component: Dynamic Monitoring Service). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily… |
CVE-2026-35231 | High | 7.5 | 2026-04-21 | Vulnerability in the Oracle Financial Services Transaction Filtering product of Oracle Financial Services Applications (component: User Interface). The suppo… |
CVE-2026-35230 | High | 7.5 | 2026-04-21 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.6. Difficult to e… |
CVE-2026-35229 | High | 7.5 | 2026-04-21 | Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.30 and 21.3-21.21. Easily exploitable vuln… |
CVE-2026-34325 | Medium | 6.8 | 2026-04-21 | Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: User Interf… |
CVE-2026-34324 | Medium | 6.5 | 2026-04-21 | Vulnerability in the Oracle Life Sciences InForm product of Oracle Life Science Applications (component: App Server). Supported versions that are affected are… |
CVE-2026-34323 | Medium | 6.3 | 2026-04-21 | Vulnerability in the Oracle Life Sciences InForm product of Oracle Life Science Applications (component: IDM Authentication). Supported versions that are affe… |
CVE-2026-34314 | Medium | 6.8 | 2026-04-21 | Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform)… |
CVE-2026-34312 | Low | 2.4 | 2026-04-21 | Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 19.3-19.30. Easily exploitable vulnerability allows h… |
CVE-2026-34310 | High | 7.5 | 2026-04-21 | Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform)… |
CVE-2026-34309 | High | 8.1 | 2026-04-21 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security). Supported versions that are affected are 8.61-8.62… |
CVE-2026-34307 | Medium | 5.4 | 2026-04-21 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Workflow). Supported versions that are affected are 8.61-8.62… |
CVE-2026-34306 | Medium | 6.5 | 2026-04-21 | Vulnerability in the PeopleSoft Enterprise FIN Project Costing product of Oracle PeopleSoft (component: Projects). The supported version that is affected is… |
CVE-2026-34302 | Medium | 5.5 | 2026-04-21 | Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Loader). Supported versions that are affected are 12.2.3-12.2.15… |
CVE-2026-34301 | Medium | 6.5 | 2026-04-21 | Vulnerability in the PeopleSoft Enterprise FIN Maintenance Management product of Oracle PeopleSoft (component: Work Order Management). The supported version… |
CVE-2026-34299 | Medium | 6.5 | 2026-04-21 | Vulnerability in the PeopleSoft Enterprise FIN Maintenance Management product of Oracle PeopleSoft (component: Work Order Management). The supported version… |
CVE-2026-34298 | Medium | 4.7 | 2026-04-21 | Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization). Supported versions that are affected are 1… |
CVE-2026-34295 | Medium | 6.5 | 2026-04-21 | Vulnerability in the PeopleSoft Enterprise SCM Purchasing product of Oracle PeopleSoft (component: Purchasing). The supported version that is affected is 9.2… |
CVE-2026-34294 | Medium | 5.9 | 2026-04-21 | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Microsoft Active Directory). The supported version tha… |
CVE-2026-34292 | High | 7.2 | 2026-04-21 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14… |
CVE-2026-34291 | High | 8.7 | 2026-04-21 | Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2… |
CVE-2026-34287 | Critical | 9.1 | 2026-04-21 | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 12.2… |
CVE-2026-34284 | Medium | 6.1 | 2026-04-21 | Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Human workflow 11g+). Supported versions that ar… |
CVE-2026-34283 | Medium | 6.1 | 2026-04-21 | Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Identity Console). Supported versions that are affected are 12.2… |
CVE-2026-34277 | Medium | 6.6 | 2026-04-21 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Fluid Core). Supported versions that are affected are 8.61-8.6… |
CVE-2026-34274 | Medium | 6.1 | 2026-04-21 | Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: User Interface). Supported versions that are affected are 12.2.3-12.2… |
CVE-2026-34269 | Medium | 6.1 | 2026-04-21 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.61-8.62. E… |
CVE-2026-22019 | Medium | 5.4 | 2026-04-21 | Vulnerability in the PeopleSoft Enterprise HCM Shared Components product of Oracle PeopleSoft (component: Person Search). The supported version that is affec… |
CVE-2026-22014 | Low | 3.8 | 2026-04-21 | Vulnerability in the Oracle User Management product of Oracle E-Business Suite (component: Workflow and Business Events). Supported versions that are affected… |
CVE-2026-22011 | High | 7.6 | 2026-04-21 | Vulnerability in the Oracle Applications DBA product of Oracle E-Business Suite (component: ADPatch). Supported versions that are affected are 12.2.3-12.2.15… |
CVE-2026-22010 | High | 7.5 | 2026-04-21 | Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform)… |
CVE-2026-21997 | High | 8.5 | 2026-04-21 | Vulnerability in the Oracle Life Sciences Empirica Signal product of Oracle Life Science Applications (component: Common Core). Supported versions that are af… |
CVE-2026-40889 | Medium | 6.5 | 2026-04-21 | Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.58.2 and 16.4.2, authenticated users can access unauthorized files… |
CVE-2026-40888 | Medium | 6.5 | 2026-04-21 | Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.58.1 and 16.4.1, an authenticated user with default role can acces… |
CVE-2026-40874 | | 2026-04-21 | mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, no administrator verification takes place when dele… | |
CVE-2026-40867 | | 2026-04-21 | Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, a broken access control vulnerability in the helpdesk attachment viewer al… | |
CVE-2026-40866 | | 2026-04-21 | Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, an insecure direct object reference in the employee document upload endpoi… | |
CVE-2026-40865 | | 2026-04-21 | Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, an insecure direct object reference in the employee document viewer allows… | |
CVE-2026-40569 | Critical | 9.0 | 2026-04-21 | FreeScout is a free self-hosted help desk and shared mailbox. Versions prior to 1.8.213 have a mass assignment vulnerability in the mailbox connection settings… |
CVE-2026-30452 | Medium | 6.5 | 2026-04-21 | Textpattern CMS 4.9.0 contains a Broken Access Control vulnerability in the article management system that allows authenticated users with low privileges to mo… |
CVE-2026-40498 | Critical | 9.8 | 2026-04-21 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, an unauthenticated attacker can access diagnostic and system tools that… |
CVE-2026-31018 | High | 8.8 | 2026-04-21 | In Dolibarr ERP & CRM <= 22.0.4, PHP code detection and editing permission enforcement in the Website module is not applied consistently to all input parameter… |
CVE-2026-29644 | Medium | 5.3 | 2026-04-21 | XiangShan (open-source high-performance RISC-V processor) commit edb1dfaf7d290ae99724594507dc46c2c2125384 (2024-11-28) has improper gating of its distributed C… |
CVE-2026-39386 | High | 8.8 | 2026-04-21 | Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC In versions 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1, any authenticated user ca… |
CVE-2026-35570 | High | 8.4 | 2026-04-21 | OpenClaude is an open-source coding-agent command line interface for cloud and local model providers. Versions prior to 0.5.1 have a logic flaw in `bashToolHas… |
CVE-2026-34082 | Medium | 4.3 | 2026-04-20 | Dify is an open-source LLM app development platform. Prior to 1.13.1, the method `DELETE /console/api/installed-apps/<appId>/conversations/<conversationId>` ha… |
CVE-2026-33031 | High | 8.1 | 2026-04-20 | Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, a user who was disabled by an administrator can use previously issued API to… |
CVE-2026-6650 | Medium | 4.7 | 2026-04-20 | A vulnerability was identified in Z-BlogPHP 1.7.5. This affects the function App::UnPack of the file /zb_users/plugin/AppCentre/app_upload.php of the component… |
CVE-2026-6602 | High | 7.3 | 2026-04-20 | A vulnerability was found in rickxy Hospital Management System up to 88a4290d957dc5bdde8a56e5ad451ad14f7f90f4. Affected is an unknown function of the file /bac… |
CVE-2026-6596 | High | 7.3 | 2026-04-20 | A security flaw has been discovered in langflow-ai langflow up to 1.1.0. This issue affects the function create_upload_file of the file src/backend/base/Langfl… |
CVE-2026-6561 | Medium | 4.7 | 2026-04-19 | A vulnerability was detected in EyouCMS up to 1.7.1. This issue affects the function edit_adminlogo of the file application/admin/controller/Index.php. Perform… |
CVE-2026-40474 | High | 7.6 | 2026-04-17 | wger is a free, open-source workout and fitness manager. In versions 2.5 and below, the GymConfigUpdateView declares permission_required = 'config.change_gymco… |
CVE-2026-40304 | Medium | 5.3 | 2026-04-17 | zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the unaccess handler (controller/unaccess.go) contains a logic… |
CVE-2026-35402 | | 2026-04-17 | mcp-neo4j-cypher is an MCP server for executing Cypher queries against Neo4j databases. In versions prior to 0.6.0, the read_only mode enforcement can be bypas… | |
CVE-2026-6492 | Medium | 5.3 | 2026-04-17 | A vulnerability was detected in arnobt78 Hotel Booking Management System up to f8922d0e0f6ac1cc761974c7616f44c2bbc04bea. The impacted element is an unknown fun… |
CVE-2026-6489 | Medium | 6.3 | 2026-04-17 | A security flaw has been discovered in QueryMine sms up to 7ab5a9ea196209611134525ffc18de25c57d9593. This issue affects some unknown processing of the file adm… |
CVE-2026-37100 | Medium | 6.5 | 2026-04-16 | An issue in the Bluetooth Low Energy (BLE) control interface of the Yamaha SR-B30A sound bar firmware 2.40 (Mobile App: Sound Bar Remote / version: 2.40) allow… |
CVE-2026-31843 | Critical | 9.8 | 2026-04-16 | The goodoneuz/pay-uz Laravel package (<= 2.2.24) contains a critical vulnerability in the /payment/api/editable/update endpoint that allows unauthenticated att… |
CVE-2026-6313 | Low | 3.1 | 2026-04-15 | Insufficient policy enforcement in CORS in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to leak cro… |
CVE-2026-6312 | Low | 3.1 | 2026-04-15 | Insufficient policy enforcement in Passwords in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to lea… |
CVE-2026-33212 | Low | 3.1 | 2026-04-15 | Weblate is a web based localization tool. In versions prior to 5.17, the tasks API didn't verify user access for pending tasks. This could expose logs of in-pr… |
CVE-2026-30994 | High | 7.5 | 2026-04-15 | Incorrect access control in the config.php component of Slah v1.5.0 and below allows unauthenticated attackers to access sensitive information, including activ… |
CVE-2026-20203 | Medium | 4.3 | 2026-04-15 | In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.10, and 9.3.11, and Splunk Cloud Platform versions below 10.4.2603.0, 10.3.2512.6, 10.2.2510.10, 10.1.2… |
CVE-2026-33103 | Medium | 5.5 | 2026-04-14 | Improper access control in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to disclose information locally. |
CVE-2026-32220 | Medium | 4.4 | 2026-04-14 | Improper access control in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to bypass a security feature locally. |
CVE-2026-32214 | Medium | 5.5 | 2026-04-14 | Improper access control in Universal Plug and Play (upnp.dll) allows an authorized attacker to disclose information locally. |
CVE-2026-27914 | High | 7.8 | 2026-04-14 | Improper access control in Microsoft Management Console allows an authorized attacker to elevate privileges locally. |
CVE-2026-26183 | High | 7.8 | 2026-04-14 | Improper access control in Windows RPC API allows an authorized attacker to elevate privileges locally. |
CVE-2026-22692 | Medium | 4.9 | 2026-04-14 | October is a Content Management System (CMS) and web platform. Versions prior to 3.7.13 and versions 4.0.0 through 4.1.4 contain a sandbox bypass vulnerability… |
CVE-2026-22566 | High | 7.5 | 2026-04-13 | An Improper Access Control vulnerability could allow a malicious actor with access to the UniFi Play network to obtain UniFi Play WiFi credentials. Affected… |
CVE-2026-22564 | Critical | 9.8 | 2026-04-13 | An Improper Access Control vulnerability could allow a malicious actor with access to the UniFi Play network to enable SSH to make unauthorized changes to the… |
CVE-2026-6201 | Medium | 5.4 | 2026-04-13 | A vulnerability was identified in CodeAstro Online Job Portal 1.0. The impacted element is an unknown function of the file /jobs/job-delete.php of the componen… |
CVE-2026-31282 | Critical | 9.8 | 2026-04-13 | Totara LMS v19.1.5 and before is vulnerable to Incorrect Access Control. The login page code can be manipulated to reveal the login form. An attacker can chain… |
CVE-2026-34860 | Medium | 4.1 | 2026-04-13 | Access control vulnerability in the memo module. Impact: Successful exploitation of this vulnerability will affect availability and confidentiality. |
CVE-2026-40252 | High | 8.1 | 2026-04-10 | FastGPT is an AI Agent building platform. Prior to 4.14.10.4, Broken Access Control vulnerability (IDOR/BOLA) allows any authenticated team to access and execu… |
CVE-2026-23782 | High | 7.5 | 2026-04-10 | An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. An API management endpoint allows unauthenticated users to obtain both an API identifier an… |