CWE-284 · Improper Access Control (page 18)
Page 18 of 82 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-60752 | High | 7.1 | 2026-08-18 | Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 17.0-26.6. Easily e… |
CVE-2026-60751 | High | 8.8 | 2026-08-18 | Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 17.0-26.6. Easily e… |
CVE-2026-60748 | High | 7.6 | 2026-08-18 | Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2… |
CVE-2026-60742 | High | 8.1 | 2026-08-18 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology). Supported versions that are affected are… |
CVE-2026-60737 | Critical | 9.1 | 2026-08-18 | Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Security). Supported versions that are affected… |
CVE-2026-60733 | High | 7.7 | 2026-08-18 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). Supported versions that are affected are 12.2.1.4.0 an… |
CVE-2026-60730 | Critical | 9.9 | 2026-08-18 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). Supported versions that are affected are 12.2.1.4.0 an… |
CVE-2026-60729 | High | 8.8 | 2026-08-18 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). Supported versions that are affected are 12.2.1.4.0 an… |
CVE-2026-60728 | Critical | 9.1 | 2026-08-18 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). Supported versions that are affected are 12.2… |
CVE-2026-60727 | Critical | 9.8 | 2026-08-18 | Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4… |
CVE-2026-60726 | High | 8.8 | 2026-08-18 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12… |
CVE-2026-60715 | High | 8.8 | 2026-08-18 | Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4… |
CVE-2026-60707 | High | 8.7 | 2026-08-18 | Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Security). Supported versions that are affected are 12.2.1.4.0 an… |
CVE-2026-60702 | Critical | 9.9 | 2026-08-18 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1… |
CVE-2026-60699 | High | 8.6 | 2026-08-18 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1… |
CVE-2026-60693 | High | 7.1 | 2026-08-18 | Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2… |
CVE-2026-60680 | High | 8.1 | 2026-08-18 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1… |
CVE-2026-60592 | High | 8.2 | 2026-08-18 | Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: NDB Operator). Supported versions that are affected are 8.0.0-8.0.47, 8.4.0-8… |
CVE-2026-60590 | High | 7.5 | 2026-08-18 | Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beverage Applications (component: POS). Supported versions that are affected are 1… |
CVE-2026-60391 | High | 7.5 | 2026-08-18 | Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is affected is 11.2.25.0… |
CVE-2026-63641 | | 2026-08-18 | MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, MagicMirror applies ipWhitelist only as Express middleware, while the Socket.IO… | |
CVE-2026-52608 | Critical | 9.8 | 2026-08-18 | An incorrect access control vulnerability in reportico-web <= 8.1.0 allows an unauthenticated attacker to inject arbitrary php code into the PreExecuteCode att… |
CVE-2026-73372 | Medium | 4.3 | 2026-08-18 | Joomla! Core - [20260809] - Improper ACL checks when injection schema.org contact data in Joomla 5.1.0-5.4.7 and 6.0.0-6.1.2 - An improper access check injects… |
CVE-2026-72531 | Medium | 5.4 | 2026-08-18 | Joomla! Core - [20260804] - Improper ACL checks for custom fields webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows una… |
CVE-2026-54730 | | 2026-08-18 | authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, the enterprise Google Chrome device-trust stages advance the flow without confir… | |
CVE-2026-73371 | Medium | 4.3 | 2026-08-18 | Joomla! Core - [20260808] - Improper ACL checks for batch copy actions in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users… |
CVE-2026-72532 | Medium | 5.4 | 2026-08-18 | Joomla! Core - [20260806] - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthor… |
CVE-2026-71574 | Medium | 6.5 | 2026-08-18 | Joomla! Core - [20260803] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unau… |
CVE-2026-50138 | High | 8.1 | 2026-08-18 | goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when `goshs` is launched with WebDAV enabled (`-w`), the mode-restriction flags `--read-only… |
CVE-2026-74979 | Critical | 9.8 | 2026-08-18 | Mitigation bypass in the Add-ons Manager component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
CVE-2026-74960 | High | 8.1 | 2026-08-18 | Site isolation issue in the WebExtensions component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thund… |
CVE-2026-74934 | High | 7.5 | 2026-08-18 | Site isolation issue in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 1… |
CVE-2024-14046 | Medium | 6.3 | 2026-08-18 | A security vulnerability has been detected in OpenBoxes up to 0.9.1. This issue affects the function DocumentController of the file grails-app/controllers/org/… |
CVE-2026-42163 | Critical | 9.8 | 2026-08-17 | Mahara before 25.04.5 and 26.04.0 is vulnerable to unauthorized access to internal accounts via Learning Tools Interoperability (LTI) under certain circumstanc… |
CVE-2026-68004 | Critical | 9.8 | 2026-08-17 | An issue in OSSRS SRS (Simple Realtime Server) <v5.0.213 allows a remote attacker to execute arbitrary code via RTMP publish authorization, vhost-level securit… |
CVE-2026-19992 | Low | 3.1 | 2026-08-17 | A flaw has been found in Orange View Limited DualSafe Password Manager & Digital Vault Extension up to 1.4.35 on Chrome. Affected is an unknown function of the… |
CVE-2026-73061 | Critical | 9.8 | 2026-08-16 | Scriban before 7.2.2 contains an access-modifier bypass vulnerability in TypedObjectAccessor that allows template code to write CLR object properties without s… |
CVE-2026-19711 | Medium | 6.5 | 2026-08-16 | The Premium Packages WordPress plugin before 7.0.7 does not validate a withdrawal request against the requesting user's actual earned balance, allowing any au… |
CVE-2026-19918 | Medium | 6.3 | 2026-08-16 | A vulnerability has been found in SpaceX Starlink Router Gen 3 2025.11.14.mr64708.3. This affects the function get_status of the component gRPC Management Inte… |
CVE-2026-14229 | Medium | 5.3 | 2026-08-15 | The ECS WordPress plugin before 4.3.8 does not check the post status or any capability when rendering an Elementor document requested through one of its AJAX… |
CVE-2026-69414 | High | 7.8 | 2026-08-14 | Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "ShieldBreak &quo… |
CVE-2026-71570 | | 2026-08-14 | Joomla Extension - icagenda.com - ACL bypass allowing arbitrary user enumeration < 2.0.0-4.0.11 - A backend operator granted access scoped to `com_icagenda` on… | |
CVE-2026-19839 | Medium | 4.7 | 2026-08-14 | A vulnerability was detected in SourceCodester Simple Doctors Appointment System 1.0. This issue affects the function save_doctor of the file /save_file.php. T… |
CVE-2026-19837 | Low | 2.7 | 2026-08-14 | A weakness has been identified in Webkul Bagisto up to 2.4.4. This affects an unknown part of the file /admin/customers/search of the component Customer Search… |
CVE-2026-19835 | Low | 3.8 | 2026-08-14 | A vulnerability was identified in Webkul Bagisto up to 2.4.4. Affected by this vulnerability is an unknown functionality of the component Customer Item Deletio… |
CVE-2026-72837 | High | 8.8 | 2026-08-14 | File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid u… |
CVE-2026-73664 | | 2026-08-13 | FreePBX is an open source IP PBX. From 17.0.5.34 until 17.0.11, the publicKeySave AJAX endpoint in Backup.class.php accepts an authenticated administrator's SS… | |
CVE-2026-59763 | Medium | 4.3 | 2026-08-13 | Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads |
CVE-2026-58508 | Critical | 9.1 | 2026-08-13 | Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation) |
CVE-2026-58507 | Medium | 5.3 | 2026-08-13 | Private Repository Existence Disclosure via go-get Meta Endpoint |
CVE-2026-58440 | Medium | 6.8 | 2026-08-13 | Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocati… |
CVE-2026-58439 | High | 8.1 | 2026-08-13 | Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag |
CVE-2026-58437 | High | 7.1 | 2026-08-13 | Repository Visibility Manipulation via Git Push Options |
CVE-2026-58429 | Medium | 4.9 | 2026-08-13 | Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints |
CVE-2026-58420 | Medium | 4.4 | 2026-08-13 | Local File Inclusion via file:// URI in Migration Restore |
CVE-2026-58417 | High | 7.5 | 2026-08-13 | REST API exposes organization membership of private organizations to public |
CVE-2026-56755 | Medium | 6.2 | 2026-08-13 | Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload |
CVE-2026-56750 | Critical | 9.1 | 2026-08-13 | Gitea Remember-Me Token Theft Not Invalidating Attacker Session |
CVE-2026-56657 | Medium | 6.2 | 2026-08-13 | Gitea SSH Key Parser Denial of Service |
CVE-2026-56654 | Critical | 9.8 | 2026-08-13 | Privilege Escalation via Access Token Scope Escalation in API |
CVE-2026-55986 | Medium | 5.4 | 2026-08-13 | Email Management API Bypasses ManageCredentials Feature Restrictions |
CVE-2026-55984 | Low | 2.7 | 2026-08-13 | Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service |
CVE-2026-73626 | High | 7.5 | 2026-08-13 | JupyterLab versions >=4.6.0,<=4.6.1 and <=4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install(). A missing 'await' caused the… |
CVE-2026-59505 | High | 8.6 | 2026-08-13 | : Improper Access Control vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions). This issue affects Portal Generator… |
CVE-2026-59501 | High | 8.2 | 2026-08-13 | : Improper Access Control vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions). This issue affects Portal Generator… |
CVE-2026-13328 | Medium | 5.3 | 2026-08-13 | The Food Menu WordPress plugin before 6.0.2 does not perform any capability or ownership check on its reservation-status update action, which is also exposed… |
CVE-2026-13367 | High | 7.8 | 2026-08-12 | IBM Informix Dynamic Server 14.10, and 15.0 contain a local privilege escalation vulnerability in the oninit setuid-root utility. |
CVE-2026-59917 | High | 7.8 | 2026-08-12 | Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain Improper Access Control vulnerability. A low privileged attacker with l… |
CVE-2026-59914 | High | 7.8 | 2026-08-12 | Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain an Authentication Bypass by Spoofing vulnerability. A low privileged at… |
CVE-2026-67287 | | 2026-08-12 | Joomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder < 6.8.0 - An unauthenticated attacker can create comments on instances… | |
CVE-2026-67284 | | 2026-08-12 | Joomla Extension - tabaoca.org - Improper ACL implementation allows file operations in Cotton Cloud < 2.0.3 - Authenticated users could perform various file-re… | |
CVE-2026-67283 | | 2026-08-12 | Joomla Extension - tabaoca.org - Improper ACL implementation allows file operations in Cotton Cloud < 2.0.2 - Unauthenticated users could perform various file-… | |
CVE-2026-16538 | Critical | 9.1 | 2026-08-12 | The Wallet for WooCommerce WordPress plugin before 1.6.10 does not verify the amount actually collected for a wallet top-up before crediting the wallet, allowi… |
CVE-2026-14859 | Medium | 4.3 | 2026-08-12 | The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX actions, allowing any authenticated user… |
CVE-2026-13171 | High | 8.2 | 2026-08-12 | The Eventin WordPress plugin before 4.1.20 does not perform an authorization check on its waiting-list registration handler, allowing unauthenticated users to… |
CVE-2026-73212 | | 2026-08-11 | Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.1, good_peer_addr() in src/server/ns_turn_server.c uses ioa_addr_in_range()… | |
CVE-2026-66804 | High | 7.8 | 2026-08-11 | Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-65773 | High | 7.8 | 2026-08-11 | Improper access control in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-65675 | High | 7.1 | 2026-08-11 | No cwe for this issue in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-20898 | High | 7.2 | 2026-08-11 | Improper access control in the firmware for some in Alias Checking Trusted Module for some Intel(R) Xeon(R) processors may allow an escalation of privilege. St… |
CVE-2026-20789 | High | 7.8 | 2026-08-11 | Improper access control for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow an escalation of privilege. Unprivi… |
CVE-2026-20741 | High | 7.4 | 2026-08-11 | Improper access control for some Intel(R) PROSet/Wireless WiFi Software within Ring 2: Device Drivers may allow a denial of service. Unprivileged software adve… |
CVE-2026-20716 | High | 7.0 | 2026-08-11 | Improper access control for some Intel(R) Processors within Ring 3: User Applications may allow an escalation of privilege. Simple hardware adversary with an a… |
CVE-2026-72601 | High | 7.5 | 2026-08-11 | A broken access control vulnerability in CSZ CMS 1.3.2 allows unauthenticated remote attackers to read all form submissions including personally identifiable i… |
CVE-2026-72600 | High | 7.5 | 2026-08-11 | A broken access control vulnerability in Idurar IDURAR ERP CRM 4.1.0 allows unauthenticated remote attackers to download invoice PDF files containing customer… |
CVE-2026-72596 | High | 8.1 | 2026-08-11 | A broken access control vulnerability in Ghost Foundation Ghost 5.x allows authenticated Author-role users to delete posts owned by other users. The post model… |
CVE-2026-72595 | High | 8.1 | 2026-08-11 | A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any authenticated agent to update ticket records belonging to other teams vi… |
CVE-2026-72563 | High | 8.1 | 2026-08-11 | A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any authenticated agent to overwrite lead records belonging to other teams v… |
CVE-2026-72561 | High | 8.8 | 2026-08-11 | A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 allows any authenticated non-administrative user to reconfigure the p… |
CVE-2026-72555 | High | 8.1 | 2026-08-11 | A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 exists because the Config.roles_active flag defaults to false, causin… |
CVE-2026-72554 | Medium | 6.5 | 2026-08-11 | A broken access control vulnerability in Ladybird Web Solution Faveo Helpdesk 2.0.3 allows any self-registered customer to read ticket conversations belonging… |
CVE-2026-72693 | High | 7.8 | 2026-08-11 | `openvt -u` is intended to identify the owner of the current VT and then execute `login` as that user from a privileged context. In the documented `kbrequest`/… |
CVE-2026-72909 | | 2026-08-10 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.23.0, the ReceivablePayableReport prepare_conditions path in erpn… | |
CVE-2026-18951 | High | 8.8 | 2026-08-10 | A flaw was found in the Red Hat OpenShift AI (RHOAI) overlay for the training operator. The RHOAI overlay incorrectly aggregates `trainjobs` management permiss… |
CVE-2026-13717 | High | 8.8 | 2026-08-10 | A flaw was found in the Red Hat OpenShift AI (RHOAI) MaaS Gateway. Improper configuration of the Gateway in a model-serving context allows a standard user with… |
CVE-2026-15060 | Medium | 4.7 | 2026-08-10 | When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged use… |
CVE-2026-72575 | Critical | 9.1 | 2026-08-10 | An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read, create, update, and delete usergroup record… |
CVE-2026-21084 | | 2026-08-10 | Improper access control in SmartThings prior to version 1.8.47.24 allows local attackers to access sensitive information. | |
CVE-2026-21064 | Medium | 5.5 | 2026-08-10 | Improper access control in Weaver prior to SMR Aug-2026 Release 1 allows local attackers to cause device inoperability. |
CVE-2026-17540 | High | 8.8 | 2026-08-10 | The File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber… |