CWE-284 · Improper Access Control (page 19)
Page 19 of 82 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-17023 | Medium | 4.8 | 2026-08-10 | The Salon Booking System WordPress plugin through 10.30.33 does not perform any capability check or validate an OAuth state value on its Google Calendar autho… |
CVE-2026-17016 | Low | 3.7 | 2026-08-10 | The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not validate the amount actually paid against the order total… |
CVE-2026-17012 | Medium | 5.3 | 2026-08-10 | The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not verify that the PayPal account which received a payment m… |
CVE-2026-19383 | Medium | 4.7 | 2026-08-10 | A security vulnerability has been detected in saithink/saigroup SaiAdmin up to 5.0.1. This impacts the function shell_exec of the file /app/saipackage/install/… |
CVE-2026-19359 | Medium | 4.7 | 2026-08-09 | A security vulnerability has been detected in nxp-auto-goldvip gvip up to 1.4.0. Affected by this issue is the function SitewiseCustomFunction of the component… |
CVE-2026-19358 | Medium | 6.3 | 2026-08-09 | A weakness has been identified in 3CORESec Trapdoor up to 1.2.2. Affected by this vulnerability is the function DefaultFunction. This manipulation causes impro… |
CVE-2026-19357 | Medium | 5.3 | 2026-08-09 | A security flaw has been discovered in MingSoft MCMS up to 3.0.6. Affected is an unknown function of the file /mdiy/form/get of the component ms-mdiy. The mani… |
CVE-2026-19356 | Medium | 5.3 | 2026-08-09 | A vulnerability was identified in MingSoft MCMS up to 3.0.6. This impacts an unknown function of the file /mdiy/form/data/list of the component ms-mdiy. The ma… |
CVE-2026-16948 | High | 8.1 | 2026-08-08 | The Solace Extra WordPress plugin before 1.6.1 does not perform capability checks in several of its AJAX actions and exposes the nonce that protects them on ad… |
CVE-2026-19245 | Low | 3.3 | 2026-08-07 | A flaw has been found in HKUDS nanobot up to 0.2.1. The impacted element is the function ExecTool._prepare_command of the file nanobot/agent/tools/shell.py of… |
CVE-2026-19244 | Medium | 4.7 | 2026-08-07 | A vulnerability was detected in HKUDS nanobot up to 0.2.1. The affected element is the function connect_mcp_servers of the file nanobot/agent/tools/mcp.py of t… |
CVE-2026-19210 | Medium | 6.3 | 2026-08-07 | A vulnerability has been found in SourceCodester Photo Share Website 1.0. The impacted element is an unknown function of the file /social/ajax.php?action=save_… |
CVE-2026-66494 | | 2026-08-07 | Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.0 - An unauthenticated attacker can store malicious… | |
CVE-2026-54213 | | 2026-08-07 | Tobit Laboratories AG TeamDavid's Webbox application exposes a functionality that allows the server to be shut down when a specific endpoint (/internalRestart… | |
CVE-2026-54208 | | 2026-08-07 | Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to arbitrary file write, allowing an unauthenticated attacker to create or write into exist… | |
CVE-2026-12261 | Medium | 6.5 | 2026-08-07 | A vulnerability in `nltk.downloader` in nltk/nltk versions <= 3.9.4 allows for cross-package resource and model poisoning. The downloader extracts package arch… |
CVE-2026-19195 | High | 7.8 | 2026-08-07 | A vulnerability has been found in V-Secure Jingyun Antivirus 2.4.2.39. The affected element is an unknown function in the library ZyArk.sys of the component Ke… |
CVE-2026-19193 | High | 7.8 | 2026-08-07 | A flaw has been found in Jiangmin Antivirus 21. Impacted is the function MessageNotifyCallback in the library kvcore.sys of the component Minifilter Port. Exec… |
CVE-2026-19192 | High | 7.8 | 2026-08-07 | A vulnerability was detected in DeepCool DisplayService 1.2.12. This issue affects some unknown processing of the file C:\DeepCool\resources\service\x64\DeepCo… |
CVE-2026-65668 | High | 8.8 | 2026-08-07 | Improper access control in Microsoft Purview eDiscovery allows an authorized attacker to elevate privileges over a network. |
CVE-2026-56161 | Critical | 9.6 | 2026-08-07 | Improper access control in Azure Logic Apps allows an authorized attacker to disclose information over a network. |
CVE-2026-67687 | High | 8.8 | 2026-08-06 | Insecure Permissions vulnerability in ics-park v.2.0 allows a remote attacker to escalate privileges via the /system/role/save endpoint in RoleController.java… |
CVE-2026-19065 | Medium | 6.3 | 2026-08-06 | A vulnerability was determined in SourceCodester Online Examination & Learning Management System 1.0. This issue affects some unknown processing of the file up… |
CVE-2025-14561 | Critical | 9.0 | 2026-08-06 | In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privil… |
CVE-2026-55979 | Medium | 5.2 | 2026-08-06 | An improper access control check in CatchPulse's named pipe communication interface could allow an attacker to invoke CatchPulse functions. This is limited to… |
CVE-2026-55978 | High | 8.4 | 2026-08-06 | An improper access control vulnerability in CatchPulse could allow a non-administrative local attacker to connect to an unrestricted kernel filter communicatio… |
CVE-2026-14829 | High | 8.2 | 2026-08-06 | The Checkimate — WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps WordPress plugin through 1.0.13 does not properly restrict access to its license-m… |
CVE-2026-13703 | Medium | 5.4 | 2026-08-06 | The SEO Redirection Plugin WordPress plugin before 9.19 does not perform a capability check in one of its authenticated AJAX actions, allowing any logged-in u… |
CVE-2026-18995 | Medium | 4.3 | 2026-08-06 | A flaw has been found in netease-youdao LobsterAI 2026.6.10. This affects the function parseMediaTokensFromText of the file src/renderer/services/artifactParse… |
CVE-2026-18993 | Medium | 6.3 | 2026-08-06 | A vulnerability was detected in NousResearch hermes-agent up to 0.16.0. Affected by this issue is some unknown functionality of the file hermes-agent/model_too… |
CVE-2026-18974 | Medium | 5.3 | 2026-08-06 | A vulnerability was found in heshengtao super-agent-party up to 0.4.1. This affects the function get_file_content of the file server.py of the component execut… |
CVE-2026-18969 | High | 7.3 | 2026-08-06 | A vulnerability was detected in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617. Impacted is an unknown function of the file /dm/dis… |
CVE-2025-63822 | High | 8.1 | 2026-08-05 | SirenGPS Android Application 2.19.44 is vulnerable to Incorrect Access Control. An authenticated attacker can manipulate user identifier parameters to bypass a… |
CVE-2026-70612 | Medium | 5.4 | 2026-08-05 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, req… |
CVE-2026-10547 | Medium | 5.9 | 2026-08-05 | IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate ownership in the deprecated POST /api/v1/build/{flow_id}/vertices endpoint, allowing an authen… |
CVE-2026-70430 | Low | 2.7 | 2026-08-05 | Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy confi… |
CVE-2026-20304 | Critical | 9.9 | 2026-08-05 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive inter… |
CVE-2026-20267 | Critical | 9.0 | 2026-08-05 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive inter… |
CVE-2026-18927 | Medium | 6.3 | 2026-08-05 | A vulnerability was determined in imranrisal-dev Student-Management-System 18ea7904c339e0c7b0234724a79c939ce6191def/a8d43a29aaf267e7ca97171d6dbb44057bcd7f8c. T… |
CVE-2026-70602 | Medium | 6.6 | 2026-08-05 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, ext… |
CVE-2026-16102 | High | 8.1 | 2026-08-05 | A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access management solution. The default DCR policy fails to pr… |
CVE-2025-70962 | High | 7.5 | 2026-08-05 | Zosi C519M V4.2.8.823C01450BA is vulnerable to Incorrect Access Control. The application contains hardcoded credentials in the RTSP authentication mechanism. A… |
CVE-2026-71204 | Medium | 6.2 | 2026-08-05 | changedetection.io's /settings save handler builds an update dict from form.data['application'] and blind-merges it into the stored application settings via .u… |
CVE-2026-16736 | High | 7.5 | 2026-08-05 | The User Registration & Membership WordPress plugin before 5.2.6 does not enforce the site's registration-disabled setting when processing registration-form s… |
CVE-2026-15230 | High | 8.1 | 2026-08-05 | The YayPricing WordPress plugin before 3.5.7 does not perform capability checks on several of its REST API routes, relying only on a shared nonce, allowing an… |
CVE-2026-67979 | Critical | 9.1 | 2026-08-04 | Incorrect access control in the Executive Services dynamic application start path component of NASA cFS v7.0.1 allows attackers to execute arbitrary code via p… |
CVE-2026-70481 | Medium | 5.4 | 2026-08-04 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.0, the standard channel message update and delete h… |
CVE-2026-70476 | High | 8.2 | 2026-08-04 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, several organization billing endpoints in packages/ser… |
CVE-2026-18788 | High | 7.3 | 2026-08-04 | A security flaw has been discovered in Trippo ResponsiveFilemanager up to 9.14.0. The impacted element is an unknown function of the file filemanager/dialog.ph… |
CVE-2026-16547 | Medium | 5.9 | 2026-08-04 | The REST API Log WordPress plugin before 1.7.1 does not bind the token protecting its log download feature to the log entry being requested, nor does it check… |
CVE-2026-16295 | Medium | 4.3 | 2026-08-04 | The Clearfy Cache WordPress plugin before 2.4.3 does not perform a capability check in one of its admin-page dispatch paths, allowing any authenticated user s… |
CVE-2026-14848 | Medium | 5.4 | 2026-08-04 | The Paid Membership Subscriptions WordPress plugin before 3.0.8 does not verify that the subscription being modified through its change-subscription checkout… |
CVE-2026-14816 | Medium | 6.5 | 2026-08-04 | The GDPR Framework By Data443 WordPress plugin before 2.4.0 does not properly verify authorization or the identity of the data subject when recording cookie-co… |
CVE-2026-12698 | Medium | 4.3 | 2026-08-04 | The wpForo Forum WordPress plugin before 3.1.3 does not restrict which profile fields a member may set when editing their own account, allowing users with a su… |
CVE-2026-67975 | High | 7.5 | 2026-08-03 | Incorrect access control in NASA cFS v7.0.1 allows attackers to arbitrarily remove low-index subscriptions and add new streams via sending TO_LAB add/remove su… |
CVE-2026-67970 | High | 7.5 | 2026-08-03 | Incorrect access control in the DS_SetDestPathCmd() component of NASA cFS v7.0.1 allows attackers to access sensitive components via a path traversal. |
CVE-2026-59912 | High | 7.8 | 2026-08-03 | Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain an Improper Access Control vulnerability. A low privileged attacker with… |
CVE-2026-15430 | Medium | 6.2 | 2026-08-03 | Improper access control in the IRP_MJ_WRITE command interface in Wellbia XIGNCODE3 xhunter2.sys, version 2026.6.1.192, allows a local, unprivileged attacker t… |
CVE-2026-56608 | Low | 3.7 | 2026-08-03 | HCL iControl is affected by Missing Access Control vulnerability. The application failed to enforce proper granular access controls, allowing users to access o… |
CVE-2026-16563 | Medium | 6.5 | 2026-08-03 | The Academy LMS WordPress plugin before 3.8.3 does not verify course enrollment or lesson publication status when returning a single lesson through its REST AP… |
CVE-2026-15241 | High | 7.5 | 2026-08-02 | The AI ChatBot for WooCommerce WordPress plugin before 4.8.4 does not perform any authorization or nonce check on one of its AJAX actions, allowing unauthenti… |
CVE-2026-15151 | High | 7.5 | 2026-08-02 | The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not perform a capability check on one of its AJAX actions, allowing users with the l… |
CVE-2026-11872 | Medium | 4.3 | 2026-08-02 | The Clever Mega Menu for Visual Composer WordPress plugin through 1.0.1 does not perform a nonce or capability check in an AJAX action that updates navigation… |
CVE-2026-14822 | Medium | 5.3 | 2026-08-01 | The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not perform any authorization check on one of its order-management REST endpoints, all… |
CVE-2026-14315 | Medium | 6.5 | 2026-08-01 | The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.1 does not perform an authorization check on one of its AJAX actions, allowing unauthenticat… |
CVE-2026-13329 | Medium | 6.5 | 2026-08-01 | The Buckaroo Woocommerce Payments Plugin WordPress plugin before 4.9.0 does not perform any capability check or nonce validation on an AJAX action that process… |
CVE-2026-12966 | Medium | 5.3 | 2026-08-01 | The Direct Payments for WooCommerce WordPress plugin before 2.5.3 does not verify that the requester owns the targeted WooCommerce order in several unauthenti… |
CVE-2026-11882 | Low | 3.7 | 2026-08-01 | The Builderall for WordPress plugin before 3.0.2 does not bind the state value of its public OAuth authentication routes to the initiating user session, allowi… |
CVE-2026-45377 | Medium | 6.5 | 2026-07-31 | Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the normal download_your_data… |
CVE-2026-52134 | Critical | 9.8 | 2026-07-31 | An issue in the parseGoosePayload() function (/goose/goose_receiver.c) of libiec61850 v1.6 allows attackers to bypass authentication via a captured GOOSE frame. |
CVE-2026-65311 | Medium | 5.3 | 2026-07-31 | The HTTP server component of ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions exposes an undocumented endpoint that changes the server's logging le… |
CVE-2026-14834 | Medium | 6.5 | 2026-07-31 | The Mailgun for WordPress plugin before 2.2.1 does not perform any capability or nonce check on an unauthenticated AJAX action that adds subscribers to the sit… |
CVE-2026-58039 | Low | 3.3 | 2026-07-31 | A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths. This can lead to confidenti… |
CVE-2026-62246 | High | 8.5 | 2026-07-30 | Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, Kamaji derives a TenantControlPlane datastore schema, database user, and etcd… |
CVE-2026-66803 | Critical | 10.0 | 2026-07-30 | Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network. |
CVE-2026-58043 | High | 8.4 | 2026-07-30 | A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attacker who i… |
CVE-2026-16527 | High | 7.3 | 2026-07-30 | An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overw… |
CVE-2026-15250 | Medium | 5.3 | 2026-07-30 | The Appointment Booking Plugin WordPress plugin before 5.6.8 does not restrict which booking fields an unauthenticated visitor can set through its public book… |
CVE-2026-14222 | Low | 3.8 | 2026-07-30 | The Easy Appointments WordPress plugin before 3.12.28 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users… |
CVE-2026-14221 | Low | 3.8 | 2026-07-30 | The Easy Appointments WordPress plugin through 4.0 does not perform capability checks in several of its appointment-management actions, relying only on a nonce… |
CVE-2026-11782 | Medium | 5.9 | 2026-07-30 | The Points and Rewards for WooCommerce WordPress plugin before 2.10.1 does not have authorisation checks in place on a wallet and points update action that is… |
CVE-2026-18004 | Medium | 4.3 | 2026-07-30 | Insufficient policy enforcement in Speech in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cr… |
CVE-2026-17996 | Medium | 6.2 | 2026-07-30 | Inappropriate implementation in Browser in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to bypass navigation restrictions via a malicio… |
CVE-2026-17994 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in Media in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a craf… |
CVE-2026-17986 | Medium | 6.5 | 2026-07-30 | Insufficient policy enforcement in Bluetooth in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to bypa… |
CVE-2026-17976 | Medium | 4.3 | 2026-07-30 | Insufficient policy enforcement in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2026-17961 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in Session in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a cr… |
CVE-2026-17944 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a… |
CVE-2026-17917 | Medium | 6.5 | 2026-07-30 | Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass discretionary access contr… |
CVE-2026-17873 | Medium | 6.5 | 2026-07-30 | Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass discretionary access contr… |
CVE-2026-17830 | Medium | 6.5 | 2026-07-30 | Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a… |
CVE-2026-17825 | Medium | 6.5 | 2026-07-30 | Insufficient policy enforcement in Passwords in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass discretionary access contro… |
CVE-2026-17824 | Medium | 6.5 | 2026-07-30 | Insufficient policy enforcement in ServiceWorker in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted H… |
CVE-2026-17781 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to… |
CVE-2026-17780 | Medium | 6.3 | 2026-07-30 | Inappropriate implementation in Isolated Web Apps in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a cra… |
CVE-2026-67431 | | 2026-07-29 | MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the… | |
CVE-2026-65888 | Critical | 9.8 | 2026-07-29 | Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2 - The socialLogin method allows actors to login as any given user on the ta… |
CVE-2026-65887 | Critical | 9.8 | 2026-07-29 | Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2 - The resetPassword method allows actors to reset any user passwo… |
CVE-2026-65889 | High | 7.5 | 2026-07-29 | Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion < 2.20.2 - The generateNewApp method allows actors to recursively delete director… |
CVE-2026-65943 | High | 7.5 | 2026-07-29 | Joomla Extension - rolandd.com - Unauthenticated directory creation RO CSVI < 9.11.0 |