CWE-284 · Improper Access Control (page 18)
Page 18 of 64 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-6000 | Medium | 4.3 | 2026-04-10 | A vulnerability was found in code-projects Online Library Management System 1.0. Affected is an unknown function of the file /sql/library.sql of the component… |
CVE-2026-39942 | High | 8.5 | 2026-04-09 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, the PATCH /files/{id} endpoint accepts a user-controlled fil… |
CVE-2026-5960 | Medium | 4.3 | 2026-04-09 | A weakness has been identified in code-projects Patient Record Management System 1.0. This affects an unknown part of the file /db/hcpms.sql of the component S… |
CVE-2026-5847 | Medium | 4.3 | 2026-04-09 | A vulnerability has been found in code-projects Movie Ticketing System 1.0. Impacted is an unknown function of the file /db/moviedb.sql of the component SQL Da… |
CVE-2026-5881 | Medium | 6.5 | 2026-04-08 | Policy bypass in LocalNetworkAccess in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page… |
CVE-2026-5863 | High | 8.8 | 2026-04-08 | Inappropriate implementation in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted H… |
CVE-2026-34723 | High | 7.5 | 2026-04-08 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, unauthenticated remote attackers were able to access the getting… |
CVE-2026-34248 | Medium | 5.7 | 2026-04-08 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, customers in shared organizations (means they can see each other's tickets)… |
CVE-2026-35533 | High | 7.7 | 2026-04-07 | mise manages dev tools like node, python, cmake, and terraform. From 2026.2.18 through 2026.4.5, mise loads trust-control settings from a local project .mise.t… |
CVE-2026-34045 | High | 8.2 | 2026-04-07 | Podman Desktop is a graphical tool for developing on containers and Kubernetes. Prior to 1.26.2, an unauthenticated HTTP server exposed by Podman Desktop allow… |
CVE-2026-39364 | High | 7.5 | 2026-04-07 | Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.de… |
CVE-2025-56015 | High | 7.5 | 2026-04-07 | In GenieACS 1.2.13, an unauthenticated access vulnerability exists in the NBI API endpoint. |
CVE-2026-39346 | Medium | 5.4 | 2026-04-07 | OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source allowed authenticated users to bypass disabled-modu… |
CVE-2026-39339 | Critical | 9.1 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.0, a critical authentication bypass vulnerability in ChurchCRM's API middleware (ChurchCRM/… |
CVE-2026-31272 | Critical | 9.8 | 2026-04-07 | MRCMS 3.1.2 contains an access control vulnerability. The save() method in src/main/java/org/marker/mushroom/controller/UserController.java lacks proper author… |
CVE-2026-1079 | | 2026-04-07 | A native messaging host vulnerability in Pega Browser Extension (PBE) affects users of all versions of Pega Robotic Automation who have installed Pega Browser… | |
CVE-2026-1078 | | 2026-04-07 | An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robotic Automation version 22.1 or R25 users who are running automations tha… | |
CVE-2026-1114 | Critical | 9.8 | 2026-04-07 | In parisneo/lollms version 2.1.0, the application's session management is vulnerable to improper access control due to the use of a weak secret key for signing… |
CVE-2026-35185 | High | 7.5 | 2026-04-06 | HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to 25.0.0, the /server-status endpoint is publicly accessible and exposes sensitive… |
CVE-2026-35172 | High | 7.5 | 2026-04-06 | Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, distribution can restore read access in repo a after an explicit… |
CVE-2026-5670 | Medium | 6.3 | 2026-04-06 | A vulnerability was found in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. This issue affects the function move_uploaded_… |
CVE-2026-34444 | Critical | 10.0 | 2026-04-06 | Lupa integrates the runtimes of Lua or LuaJIT2 into CPython. In 2.6 and earlier, attribute_filter is not consistently applied when attributes are accessed thro… |
CVE-2026-31150 | Medium | 4.3 | 2026-04-06 | Incorrect access control in Kaleris YMS v7.2.2.1 allows authenticated attackers with only the shipping/receiving role to view the truck's dashboard resources. |
CVE-2026-5601 | Medium | 5.3 | 2026-04-05 | A vulnerability was found in Acrel Electrical Prepaid Cloud Platform 1.0. This issue affects some unknown processing of the file /bin.rar of the component Back… |
CVE-2026-5585 | Medium | 5.3 | 2026-04-05 | A vulnerability was found in Tencent AI-Infra-Guard 4.0. The affected element is an unknown function of the file common/websocket/task_manager.go of the compon… |
CVE-2026-5576 | Medium | 4.7 | 2026-04-05 | A flaw has been found in SourceCodester/jkev Record Management System 1.0. Affected by this issue is some unknown functionality of the file save_emp.php of the… |
CVE-2026-5573 | High | 7.3 | 2026-04-05 | A weakness has been identified in Technostrobe HI-LED-WR120-G2 5.5.0.1R6.03.30. This impacts an unknown function of the file /fs. Executing a manipulation of t… |
CVE-2026-5571 | Medium | 5.3 | 2026-04-05 | A vulnerability was identified in Technostrobe HI-LED-WR120-G2 5.5.0.1R6.03.30. The impacted element is an unknown function of the file /fs of the component Co… |
CVE-2026-5569 | High | 7.3 | 2026-04-05 | A vulnerability was found in Technostrobe HI-LED-WR120-G2 5.5.0.1R6.03.30. Impacted is an unknown function of the file /Technostrobe/ of the component Endpoint… |
CVE-2026-5546 | Medium | 6.3 | 2026-04-05 | A flaw has been found in Campcodes Complete Online Learning Management System 1.0. This impacts the function add_lesson of the file /application/models/Crud_mo… |
CVE-2026-5526 | High | 7.3 | 2026-04-04 | A security flaw has been discovered in Tenda 4G03 Pro up to 1.0/1.1/04.03.01.53/192.168.0.1. Affected by this vulnerability is an unknown functionality of the… |
CVE-2026-35616 | Critical | 9.8 | 2026-04-04 | A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or co… |
CVE-2021-4477 | Critical | 9.1 | 2026-04-03 | Hirschmann HiLCOS OpenBAT and BAT450 products contain a firewall bypass vulnerability in IPv6 IPsec deployments that allows traffic from VPN connections to byp… |
CVE-2017-20233 | Medium | 5.4 | 2026-04-03 | Hirschmann HiLCOS products OpenBAT, BAT450, WLC, BAT867 contains a firewall filtering vulnerability that fails to correctly filter IPv4 multicast and broadcast… |
CVE-2026-5484 | Medium | 5.3 | 2026-04-03 | A weakness has been identified in BookStackApp BookStack up to 26.03. Affected is the function chapterToMarkdown of the file app/Exports/ExportFormatter.php of… |
CVE-2026-5472 | Medium | 6.3 | 2026-04-03 | A flaw has been found in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. The affected element is an unknown functi… |
CVE-2024-44303 | High | 7.5 | 2026-04-02 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.1. A malicious application may be able to modify protected parts of the f… |
CVE-2024-44219 | High | 7.5 | 2026-04-02 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.1. A malicious application with root privileges may be… |
CVE-2024-40858 | High | 7.1 | 2026-04-02 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.1. An app may be able to access Contacts without user c… |
CVE-2026-5413 | Low | 3.7 | 2026-04-02 | A vulnerability was identified in Newgen OmniDocs up to 12.0.00. Affected by this vulnerability is an unknown functionality of the file /omnidocs/GetWebApiConf… |
CVE-2026-33951 | High | 7.5 | 2026-04-02 | Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0-beta.1, the SignalK Server exposes an unauthenticated HTT… |
CVE-2026-2699 | Critical | 9.8 | 2026-04-02 | Customer Managed ShareFile Storage Zones Controller (SZC) allows an unauthenticated attacker to access restricted configuration pages. This leads to changing s… |
CVE-2026-5330 | Medium | 6.5 | 2026-04-02 | A vulnerability was found in SourceCodester/mayuri_k Best Courier Management System 1.0. Affected by this issue is some unknown functionality of the file /ajax… |
CVE-2026-34572 | High | 8.8 | 2026-04-01 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version… |
CVE-2026-34570 | High | 8.8 | 2026-04-01 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version… |
CVE-2026-5312 | Medium | 5.3 | 2026-04-01 | A weakness has been identified in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR… |
CVE-2026-5311 | Medium | 5.3 | 2026-04-01 | A security flaw has been discovered in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L… |
CVE-2026-34456 | Critical | 9.1 | 2026-04-01 | Reviactyl is an open-source game server management panel built using Laravel, React, FilamentPHP, Vite, and Go. From version 26.2.0-beta.1 to before version 26… |
CVE-2026-23899 | High | 8.8 | 2026-04-01 | An improper access check allows unauthorized access to webservice endpoints. |
CVE-2026-21629 | High | 7.3 | 2026-04-01 | The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected by 3rd party develop… |
CVE-2026-1879 | Medium | 6.3 | 2026-04-01 | A vulnerability was detected in Harvard University IQSS Dataverse up to 6.8. This affects an unknown function of the file /ThemeAndWidgets.xhtml of the compone… |
CVE-2026-5261 | High | 7.3 | 2026-04-01 | A vulnerability was identified in Shandong Hoteam InforCenter PLM up to 8.3.8. The impacted element is the function uploadFileToIIS of the file /Base/BaseHandl… |
CVE-2026-4947 | High | 7.1 | 2026-04-01 | Addressed a potential insecure direct object reference (IDOR) vulnerability in the signing invitation acceptance process. Under certain conditions, this issue… |
CVE-2026-5215 | Medium | 4.3 | 2026-03-31 | A vulnerability was identified in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR… |
CVE-2026-34733 | Medium | 6.5 | 2026-03-31 | WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo installation script install/deleteSystemdPrivate.php contains a PHP operat… |
CVE-2026-34381 | High | 7.5 | 2026-03-31 | Admidio is an open-source user management solution. From version 5.0.0 to before version 5.0.8, Admidio relies on adm_my_files/.htaccess to deny direct HTTP ac… |
CVE-2026-33415 | Low | 2.7 | 2026-03-31 | Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to b… |
CVE-2026-5181 | Medium | 6.3 | 2026-03-31 | A vulnerability has been found in SourceCodester Simple Doctors Appointment System up to 1.0. This issue affects some unknown processing of the file /doctors_a… |
CVE-2026-21711 | Medium | 5.3 | 2026-03-30 | A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comp… |
CVE-2026-29872 | High | 8.2 | 2026-03-30 | A cross-session information disclosure vulnerability exists in the awesome-llm-apps project in commit e46690f99c3f08be80a9877fab52acacf7ab8251 (2026-01-19). Th… |
CVE-2026-5124 | Low | 3.7 | 2026-03-30 | A security vulnerability has been detected in osrg GoBGP up to 4.3.0. Affected is the function BGPHeader.DecodeFromBytes of the file pkg/packet/bgp/bgp.go of t… |
CVE-2026-29597 | Medium | 6.5 | 2026-03-30 | DDSN Interactive cm3 Acora CMS version 10.7.1 contains an improper access control vulnerability. An editor-privileged user can access sensitive configuration f… |
CVE-2026-5122 | Low | 3.7 | 2026-03-30 | A security flaw has been discovered in osrg GoBGP up to 4.3.0. This affects the function DecodeFromBytes of the file pkg/packet/bgp/bgp.go of the component BGP… |
CVE-2026-5107 | Medium | 4.2 | 2026-03-30 | A vulnerability has been found in FRRouting FRR up to 10.5.1. This affects the function process_type2_route of the file bgpd/bgp_evpn.c of the component EVPN T… |
CVE-2026-5003 | Medium | 5.3 | 2026-03-28 | A vulnerability was found in PromtEngineer localGPT up to 4d41c7d1713b16b216d8e062e51a5dd88b20b054. This affects the function handle_index of the file rag_syst… |
CVE-2026-5001 | High | 7.3 | 2026-03-28 | A flaw has been found in PromtEngineer localGPT up to 4d41c7d1713b16b216d8e062e51a5dd88b20b054. The affected element is the function do_POST of the file backen… |
CVE-2026-31950 | Medium | 5.3 | 2026-03-27 | LibreChat is a ChatGPT clone with additional features. In versions 0.8.2-rc2 through 0.8.2-rc3, the SSE streaming endpoint `/api/agents/chat/stream/:streamId`… |
CVE-2026-30689 | Medium | 4.3 | 2026-03-27 | In Blog.Core through bcb4d17, the getinfobytoken API interface contains improper access control that leads to sensitive data exposure. Unauthorized parties can… |
CVE-2025-69988 | Medium | 6.5 | 2026-03-27 | BS Producten Petcam 33.1.0.0818 is vulnerable to Incorrect Access Control. An unauthenticated attacker in physical proximity can associate with this open netwo… |
CVE-2026-33890 | Critical | 9.8 | 2026-03-27 | MyTube is a self-hosted downloader and player for several video websites Prior to version 1.8.71, an unauthenticated attacker can register an arbitrary passkey… |
CVE-2026-33726 | Medium | 5.4 | 2026-03-27 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.17.14, 1.18.8, and 1.19.2, Ingress Network Polic… |
CVE-2026-0748 | Medium | 4.3 | 2026-03-26 | In the Drupal 7 Internationalization (i18n) module, the i18n_node submodule allows a user with both "Translate content" and "Administer content translations" p… |
CVE-2026-33622 | High | 8.8 | 2026-03-26 | PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab `v0.8.3` through `v0.8.5` allow arbitrary JavaScript e… |
CVE-2025-55261 | High | 8.1 | 2026-03-26 | HCL Aftermarket DPC is affected by Missing Functional Level Access Control which will allow attacker to escalate his privileges and may compromise the applicat… |
CVE-2026-4875 | Medium | 4.7 | 2026-03-26 | A vulnerability was determined in itsourcecode Free Hotel Reservation System 1.0. The affected element is an unknown function of the file /admin/mod_amenities/… |
CVE-2026-4830 | Medium | 5.6 | 2026-03-26 | A vulnerability was identified in kalcaddle kodbox 1.64. This issue affects the function Add of the file app/controller/explorer/userShare.class.php of the com… |
CVE-2026-4823 | Low | 2.5 | 2026-03-25 | A flaw has been found in Enter Software Iperius Backup up to 8.7.3. Affected by this vulnerability is an unknown functionality of the component NTLM2 Handler… |
CVE-2026-28895 | Medium | 4.6 | 2026-03-25 | The issue was addressed with improved checks. This issue is fixed in iOS 26.4 and iPadOS 26.4. An attacker with physical access to an iOS device with Stolen De… |
CVE-2026-28880 | Medium | 6.5 | 2026-03-25 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15… |
CVE-2026-28876 | High | 7.5 | 2026-03-25 | A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 a… |
CVE-2026-28863 | Medium | 6.5 | 2026-03-25 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.4 and iPadOS 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. An app… |
CVE-2026-28862 | Medium | 5.3 | 2026-03-25 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tah… |
CVE-2026-28856 | Medium | 4.6 | 2026-03-25 | The issue was addressed with improved authentication. This issue is fixed in iOS 26.4 and iPadOS 26.4, visionOS 26.4, watchOS 26.4. An attacker with physical a… |
CVE-2026-28855 | High | 7.5 | 2026-03-25 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3. An app may be able to access… |
CVE-2026-28838 | Medium | 5.3 | 2026-03-25 | A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An… |
CVE-2026-28837 | High | 7.5 | 2026-03-25 | A logic issue was addressed with improved checks. This issue is fixed in macOS Tahoe 26.4. An app may be able to access sensitive user data. |
CVE-2026-28833 | Medium | 6.2 | 2026-03-25 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. An app may be… |
CVE-2026-28828 | Medium | 5.3 | 2026-03-25 | A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app m… |
CVE-2026-28824 | Medium | 5.3 | 2026-03-25 | An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app… |
CVE-2026-28823 | Medium | 4.9 | 2026-03-25 | A path handling issue was addressed with improved validation. This issue is fixed in macOS Tahoe 26.4. An app with root privileges may be able to delete protec… |
CVE-2026-28818 | Medium | 5.3 | 2026-03-25 | A logging issue was addressed with improved data redaction. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be a… |
CVE-2026-20697 | Medium | 5.3 | 2026-03-25 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may… |
CVE-2026-20684 | Low | 3.3 | 2026-03-25 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.4. An app may bypass Gatekeeper checks. |
CVE-2026-20632 | Medium | 5.3 | 2026-03-25 | A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Tahoe 26.4. An app may be able to… |
CVE-2026-20622 | High | 7.5 | 2026-03-25 | A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sequoia 15.7.4, macOS Tahoe 26.3. An app may be able to c… |
CVE-2025-43534 | Medium | 6.8 | 2026-03-25 | A path handling issue was addressed with improved validation. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.2 and iPadOS 26.2. A user with physic… |
CVE-2026-33316 | High | 8.1 | 2026-03-24 | Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, a flaw in Vikunja’s password reset logic allows disabled users to regai… |
CVE-2026-33484 | High | 7.5 | 2026-03-24 | Langflow is a tool for building and deploying AI-powered agents and workflows. In versions 1.0.0 through 1.8.1, the `/api/v1/files/images/{flow_id}/{file_name}… |
CVE-2026-33309 | Critical | 9.9 | 2026-03-24 | Langflow is a tool for building and deploying AI-powered agents and workflows. Versions 1.2.0 through 1.8.1 have a bypass of the patch for CVE-2025-68478 (Exte… |
CVE-2026-32299 | High | 7.5 | 2026-03-23 | Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0… |