CWE-284 · Improper Access Control (page 19)
Page 19 of 64 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-0898 | | 2026-03-23 | An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robot Studio developers who are automating Google Chrome and Microsoft Edge… | |
CVE-2026-33478 | Critical | 10.0 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, multiple vulnerabilities in AVideo's CloneSite plugin chain together to all… |
CVE-2026-4586 | Medium | 6.3 | 2026-03-23 | A vulnerability was found in CodePhiliaX Chat2DB up to 0.3.7. This affects the function Upload of the file chat2db-server/chat2db-server-web/chat2db-server-web… |
CVE-2026-4628 | Medium | 4.3 | 2026-03-23 | A flaw was found in Keycloak. An improper Access Control vulnerability in Keycloak’s User-Managed Access (UMA) resource_set endpoint allows attackers with vali… |
CVE-2026-4536 | High | 7.3 | 2026-03-22 | A vulnerability was found in Acrel Environmental Monitoring Cloud Platform 1.1.0. This issue affects some unknown processing. Performing a manipulation results… |
CVE-2026-4514 | Medium | 6.3 | 2026-03-21 | A flaw has been found in PbootCMS up to 3.2.12. Affected by this issue is some unknown functionality of the file apps/admin/controller/system/UserController.ph… |
CVE-2026-4505 | Medium | 6.3 | 2026-03-20 | A vulnerability has been found in eosphoros-ai DB-GPT up to 0.7.5. This issue affects the function module_plugin.refresh_plugins of the file packages/dbgpt-ser… |
CVE-2026-32768 | Critical | 9.9 | 2026-03-20 | Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. In versions prior to 0.6.5, due to a miswritten NetworkPolicy, a ma… |
CVE-2026-32938 | Critical | 9.9 | 2026-03-20 | SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the /api/lute/html2BlockDOM on the desktop copies local files pointed to by file… |
CVE-2026-33062 | High | 7.5 | 2026-03-20 | free5GC is an open source 5G core network. free5GC NRF prior to version 1.4.2 has an Improper Input Validation vulnerability leading to Denial of Service. All… |
CVE-2026-32769 | Critical | 9.8 | 2026-03-20 | Fullchain is an umbrella project for deploying a ready-to-use CTF platform. In versions prior to 0.1.1, due to a mis-written NetworkPolicy, a malicious actor… |
CVE-2026-32761 | Medium | 6.5 | 2026-03-20 | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Versions 2.61.0 and be… |
CVE-2026-32760 | Critical | 9.8 | 2026-03-20 | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. In versions 2.61.2 and… |
CVE-2026-33393 | Medium | 4.3 | 2026-03-19 | Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the `allowed_spam_host_domains` check used `Strin… |
CVE-2026-32752 | Unrated | | 2026-03-19 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. In versions 1.8.208 and below, the ThreadPolicy::edit() method contains a br… |
CVE-2026-32038 | Critical | 9.8 | 2026-03-19 | OpenClaw before 2026.2.24 contains a sandbox network isolation bypass vulnerability that allows trusted operators to join another container's network namespace… |
CVE-2026-32737 | Critical | 10.0 | 2026-03-18 | Romeo gives the capability to reach high code coverage of Go ≥1.20 apps by helping to measure code coverage for functional and integration tests within GitHub… |
CVE-2026-32693 | High | 8.8 | 2026-03-18 | In Juju from version 3.0.0 through 3.6.18, the authorization of the "secret-set" tool is not performed correctly, which allows a grantee to update the secret c… |
CVE-2025-41258 | High | 8.0 | 2026-03-18 | LibreChat version 0.8.1-rc2 uses the same JWT secret for the user session mechanism and RAG API which compromises the service-level authentication of the RAG A… |
CVE-2026-32254 | High | 7.1 | 2026-03-18 | Kube-router is a turnkey solution for Kubernetes networking. Prior to version 2.8.0, Kube-router's proxy module does not validate externalIPs or loadBalancer I… |
CVE-2026-21994 | Critical | 9.8 | 2026-03-17 | Vulnerability in the Oracle Edge Cloud Infrastructure Designer and Visualisation Toolkit product of Oracle Open Source Projects (component: Desktop). The sup… |
CVE-2026-30707 | High | 8.1 | 2026-03-17 | An issue was discovered in SpeedExam Online Examination System (SaaS) after v.FEV2026. It allows Broken Access Control via the ReviewAnswerDetails ASP.NET Page… |
CVE-2025-69727 | Medium | 5.3 | 2026-03-16 | An Incorrect Access Control vulnerability exists in INDEX-EDUCATION PRONOTE prior to 2025.2.8. The affected components (index.js and composeUrlImgPhotoIndividu… |
CVE-2026-4221 | High | 7.3 | 2026-03-16 | A vulnerability was found in Tiandy Easy7 Integrated Management Platform 7.17.0. This affects an unknown part of the file /rest/file/uploadLedImage of the comp… |
CVE-2026-4220 | High | 7.3 | 2026-03-16 | A vulnerability has been found in Technologies Integrated Management Platform 7.17.0. Affected by this issue is some unknown functionality of the file /SetWebp… |
CVE-2026-4218 | Low | 2.5 | 2026-03-16 | A vulnerability was detected in myAEDES App up to 1.18.4 on Android. Affected is an unknown function of the file aedes/me/beta/utils/EngageBayUtils.java of the… |
CVE-2026-4201 | High | 7.3 | 2026-03-16 | A weakness has been identified in glowxq glowxq-oj up to 6f7c723090472057252040fd2bbbdaa1b5ed2393. This vulnerability affects the function Upload of the file b… |
CVE-2026-4194 | High | 7.3 | 2026-03-16 | A vulnerability was detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-3… |
CVE-2026-4193 | High | 7.3 | 2026-03-16 | A security vulnerability has been detected in D-Link DIR-823G 1.0.2B05. The affected element is the function GetDDNSSettings/GetDeviceDomainName/GetDeviceSetti… |
CVE-2026-4191 | High | 7.3 | 2026-03-16 | A flaw has been found in JawherKl node-api-postgres up to 2.5. Affected is the function path.extname of the file index.js of the component Profile Picture Hand… |
CVE-2026-4180 | High | 7.3 | 2026-03-16 | A vulnerability was identified in D-Link DIR-816 1.10CNB05. The impacted element is an unknown function of the file redirect.asp of the component goahead. The… |
CVE-2026-3111 | | 2026-03-16 | Insecure Direct Object Reference (IDOR) vulnerability in Campus Educativa specifically at the endpoint '/archivos/usuarios/[ID]/[username]/thumb_AAxAA.jpg' (tr… | |
CVE-2026-3110 | | 2026-03-16 | Insecure Direct Object Reference (IDOR) vulnerability in Campus Educativa specifically at the endpoint '/administracion/admin_usuarios.cgi?filtro_estado=T&wAcc… | |
CVE-2026-32720 | | 2026-03-16 | The CTFer.io Monitoring component is in charge of the collection, process and storage of various signals (i.e. logs, metrics and distributed traces). Prior to… | |
CVE-2026-0977 | Medium | 5.1 | 2026-03-16 | IBM CICS Transaction Gateway for Multiplatforms 9.3 and 10.1 could allow a user to transfer or view files due to improper access controls. |
CVE-2026-4105 | Medium | 6.7 | 2026-03-13 | A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class paramet… |
CVE-2026-32138 | High | 8.2 | 2026-03-12 | NEXULEAN is a cybersecurity portfolio & service platform for an Ethical Hacker, AI Enthusiast, and Penetration Tester. Prior to 2.0.0, a security vulnerability… |
CVE-2026-21667 | Critical | 9.9 | 2026-03-12 | A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server. |
CVE-2026-21666 | Critical | 9.9 | 2026-03-12 | A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server. |
CVE-2026-3940 | Medium | 5.3 | 2026-03-11 | Insufficient policy enforcement in DevTools in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions via a crafted H… |
CVE-2026-3939 | Medium | 5.3 | 2026-03-11 | Insufficient policy enforcement in PDF in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions via a crafted PDF fi… |
CVE-2026-3938 | Medium | 4.3 | 2026-03-11 | Insufficient policy enforcement in Clipboard in Google Chrome prior to 146.0.7680.71 allowed a remote attacker who had compromised the renderer process to leak… |
CVE-2026-3934 | Medium | 6.5 | 2026-03-11 | Insufficient policy enforcement in ChromeDriver in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass same origin policy via a crafted HT… |
CVE-2026-3932 | High | 7.5 | 2026-03-11 | Insufficient policy enforcement in PDF in Google Chrome on Android prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions via a cra… |
CVE-2026-27591 | Critical | 9.9 | 2026-03-11 | Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Prior to 1.0.477, 1.1.12, and 1.2.12, Winter CMS allowed auth… |
CVE-2026-32102 | Medium | 6.5 | 2026-03-11 | OliveTin gives access to predefined shell commands from a web interface. In 3000.10.2 and earlier, OliveTin’s live EventStream broadcasts execution events and… |
CVE-2025-66956 | Critical | 9.9 | 2026-03-11 | Insecure Access Control in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote attackers to access and execute attachments via a… |
CVE-2026-31874 | Critical | 9.8 | 2026-03-11 | Taskosaur is an open source project management platform with conversational AI for task execution in-app. In 1.0.0, the application does not properly validate… |
CVE-2026-24509 | Low | 3.6 | 2026-03-11 | Dell Alienware Command Center (AWCC), versions prior to 6.12.24.0, contain an Improper Access Control vulnerability. A low privileged attacker with local acces… |
CVE-2026-31872 | High | 7.5 | 2026-03-11 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.6 and 8.6.32, the protectedFields… |
CVE-2026-3429 | Medium | 4.2 | 2026-03-11 | A flaw was identified in the Account REST API of Keycloak that allows a user authenticated at a lower security level to perform sensitive actions intended only… |
CVE-2025-68623 | High | 8.8 | 2026-03-11 | In Microsoft DirectX End-User Runtime Web Installer 9.29.1974.0, a low-privilege user can replace an executable file during the installation process, which may… |
CVE-2026-28803 | Medium | 6.5 | 2026-03-11 | Open Forms allows users create and publish smart forms. Prior to 3.3.13 and 3.4.5, to be able to cosign, the cosigner receives an e-mail with instructions or a… |
CVE-2026-31834 | High | 7.2 | 2026-03-10 | Umbraco is an ASP.NET CMS. From 15.3.1 to before 16.5.1 and 17.2.2, A privilege escalation vulnerability has been identified in Umbraco CMS. Under certain cond… |
CVE-2026-31815 | Medium | 5.3 | 2026-03-10 | Unicorn adds modern reactive component functionality to your Django templates. Prior to 0.67.0, component state manipulation is possible in django-unicorn due… |
CVE-2026-30966 | Critical | 10.0 | 2026-03-10 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.7 and 8.6.20, Parse Server's inter… |
CVE-2026-30962 | Medium | 6.5 | 2026-03-10 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.6 and 8.6.19, the validation for p… |
CVE-2026-0108 | Medium | 4.0 | 2026-03-10 | The register protection of the PowerVR GPU is incorrectly configured. This could lead to local information disclosure with no additional execution privileges n… |
CVE-2026-2742 | Medium | 5.3 | 2026-03-10 | An authentication bypass vulnerability exists in Vaadin 14.0.0 through 14.14.0, 23.0.0 through 23.6.6, 24.0.0 through 24.9.7 and 25.0.0 through 25.0.1, applica… |
CVE-2026-25176 | High | 7.8 | 2026-03-10 | Improper access control in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2026-24290 | High | 7.8 | 2026-03-10 | Improper access control in Windows Projected File System allows an authorized attacker to elevate privileges locally. |
CVE-2026-23660 | High | 7.8 | 2026-03-10 | Improper access control in Azure Portal Windows Admin Center allows an authorized attacker to elevate privileges locally. |
CVE-2026-22628 | Medium | 5.3 | 2026-03-10 | An improper access control vulnerability in Fortinet FortiSwitchAXFixed 1.0.0 through 1.0.1 may allow an authenticated admin to execute system commands via a s… |
CVE-2026-21262 | High | 8.8 | 2026-03-10 | Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network. |
CVE-2026-30926 | High | 7.1 | 2026-03-10 | SiYuan is a personal knowledge management system. Prior to 3.5.10, a privilege escalation vulnerability exists in the publish service of SiYuan Note that allow… |
CVE-2025-62166 | High | 7.5 | 2026-03-09 | FreshRSS is a free, self-hostable RSS aggregator. Prior 1.28.0, a bug in the auth logic related to master authentication tokens, this restriction is bypassed… |
CVE-2026-30140 | High | 7.5 | 2026-03-09 | An incorrect access control vulnerability exists in Tenda W15E V02.03.01.26_cn. An unauthenticated attacker can access the /cgi-bin/DownloadCfg/RouterCfm.jpg e… |
CVE-2026-3800 | Medium | 6.3 | 2026-03-09 | A vulnerability has been found in SourceCodester/janobe Resort Reservation System 1.0. Affected is the function doInsert of the file /controller.php?action=add… |
CVE-2026-3797 | Medium | 6.3 | 2026-03-09 | A security vulnerability has been detected in Tiandy Video Surveillance System 视频监控平台 7.17.0. The impacted element is the function uploadFile of the file /src/… |
CVE-2026-3796 | Medium | 5.3 | 2026-03-09 | A weakness has been identified in Qi-ANXIN QAX Virus Removal up to 2025-10-22. The affected element is the function ZwTerminateProcess in the library QKSecureI… |
CVE-2026-3749 | Medium | 6.3 | 2026-03-08 | A weakness has been identified in Bytedesk up to 1.3.9. This vulnerability affects the function handleFileUpload of the file source-code/src/main/java/com/byte… |
CVE-2026-3748 | Medium | 6.3 | 2026-03-08 | A security flaw has been discovered in Bytedesk up to 1.3.9. This affects the function uploadFile of the file source-code/src/main/java/com/bytedesk/core/uploa… |
CVE-2026-30859 | Medium | 5.3 | 2026-03-07 | WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.2.12, a broken access control vulnerabi… |
CVE-2026-30855 | High | 8.8 | 2026-03-07 | WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.3.2, an authorization bypass in tenant… |
CVE-2026-3668 | Low | 3.1 | 2026-03-07 | A weakness has been identified in Freedom Factory dGEN1 up to 20260221. This affects the function AndroidEthereum of the component org.ethosmobile.webpwaemul… |
CVE-2026-30244 | High | 7.5 | 2026-03-06 | Plane is an an open-source project management tool. Prior to version 1.2.2, unauthenticated attackers can enumerate workspace members and extract sensitive inf… |
CVE-2025-70363 | High | 7.5 | 2026-03-06 | Incorrect access control in the REST API of Ibexa & Ciril GROUP eZ Platform / Ciril Platform 2.x allows unauthenticated attackers to access sensitive data via… |
CVE-2026-29061 | Medium | 5.4 | 2026-03-06 | Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, a privilege escalation vulnerability in t… |
CVE-2026-29060 | Medium | 5.0 | 2026-03-06 | Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, a registered user without privileges to c… |
CVE-2026-28682 | Medium | 6.4 | 2026-03-06 | Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, the upload status SSE implementation on /… |
CVE-2026-25877 | Medium | 6.5 | 2026-03-06 | Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.1, the appl… |
CVE-2026-29188 | Critical | 9.1 | 2026-03-05 | File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to ver… |
CVE-2026-29077 | High | 7.1 | 2026-03-05 | Frappe is a full-stack web application framework. Prior to versions 15.98.0 and 14.100.0, due to a lack of validation when sharing documents, a user could shar… |
CVE-2026-28410 | High | 8.1 | 2026-03-05 | The Graph is an indexing protocol for querying networks like Ethereum, IPFS, Polygon, and other blockchains. Prior to version 3.0.0, a flaw in the token vestin… |
CVE-2025-70614 | High | 8.1 | 2026-03-05 | OpenCode Systems OC Messaging / USSD Gateway OC Release 6.32.2 contains a broken access control vulnerability in the web-based control panel allowing authentic… |
CVE-2026-28790 | High | 7.5 | 2026-03-05 | OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.0, OliveTin allows an unauthenticated guest to terminate runn… |
CVE-2026-27723 | Medium | 4.3 | 2026-03-05 | OpenProject is an open-source, web-based project management software. Prior to versions 17.0.5 and 17.1.2, an attacker can create wiki pages belonging to unper… |
CVE-2026-26418 | High | 7.5 | 2026-03-05 | Missing authentication and authorization in the web API of Tata Consultancy Services Cognix Recon Client v3.0 allows remote attackers to access application fun… |
CVE-2026-26417 | High | 8.1 | 2026-03-05 | A broken access control vulnerability in the password reset functionality of Tata Consultancy Services Cognix Recon Client v3.0 allows authenticated users to r… |
CVE-2026-25702 | High | 7.3 | 2026-03-05 | A Improper Access Control vulnerability in the kernel of SUSE SUSE Linux Enterprise Server 12 SP5 breaks nftables, causing firewall rules applied via nftables… |
CVE-2026-3543 | High | 8.8 | 2026-03-04 | Inappropriate implementation in V8 in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds memory access via a… |
CVE-2026-3542 | High | 8.8 | 2026-03-04 | Inappropriate implementation in WebAssembly in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform out of bounds memory access via a cra… |
CVE-2026-3541 | High | 8.8 | 2026-03-04 | Inappropriate implementation in CSS in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform an out of bounds memory read via a crafted HT… |
CVE-2026-20073 | Medium | 5.8 | 2026-03-04 | A vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unau… |
CVE-2026-20007 | Medium | 5.8 | 2026-03-04 | A vulnerability in the Snort 2 and Snort 3 deep packet inspection of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote… |
CVE-2024-55025 | Medium | 6.5 | 2026-03-03 | Incorrect access control in the VNC component of Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 allows unauthorized attackers to access the HMI system. |
CVE-2024-55019 | High | 7.5 | 2026-03-03 | Incorrect access control in the component download_wb.cgi of Weintek cMT-3072XH2 easyweb Web Version v2.1.53, OS v20231011 allows unauthenticated attack to dow… |
CVE-2026-0012 | Medium | 6.2 | 2026-03-02 | In setHideSensitive of ExpandableNotificationRow.java, there is a possible contact name leak due due to a logic error in the code. This could lead to local inf… |
CVE-2025-48619 | High | 8.4 | 2026-03-02 | In multiple functions of ContentProvider.java, there is a possible way for an app with read-only access to truncate files due to a logic error in the code. Thi… |
CVE-2025-15597 | Medium | 6.3 | 2026-03-02 | A vulnerability has been found in Dataease SQLBot up to 1.4.0. This affects an unknown function of the file backend/apps/system/api/assistant.py of the compone… |