CWE-284 · Improper Access Control (page 2)
Page 2 of 82 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-85057 | High | 8.7 | 2026-09-24 | ZITADEL is an open source identity management platform. From 3.0.0 until 3.4.13 and 4.16.1, ZITADEL Actions V1 enables the goja Node-compatible require() regis… |
CVE-2026-79758 | Medium | 5.4 | 2026-09-24 | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.8.0 until 2.5.1, authenticated Termix user… |
CVE-2026-97179 | Medium | 4.3 | 2026-09-24 | A security vulnerability has been detected in O2OA up to 9.5.3/10.0.2. This vulnerability affects the function list of the file o2server/x_base_core_project/sr… |
CVE-2026-78313 | Medium | 6.5 | 2026-09-24 | Improper Access Control in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022. |
CVE-2026-74991 | Medium | 6.8 | 2026-09-24 | The WPForms WordPress plugin before 2.0.2 does not verify that a Stripe payment object supplied during a public form submission belongs to it before acting on… |
CVE-2026-96774 | Medium | 5.3 | 2026-09-24 | A vulnerability was found in SPON Communications IP Network Audio Device XC-9603 1.2.3_20181106 Build 107. This affects the function loadCfg of the file /ini/s… |
CVE-2026-96772 | Medium | 5.3 | 2026-09-24 | A security flaw has been discovered in Intelliants Subrion CMS up to 4.2.1. This affects an unknown part of the file /actions.json?action=assign-owner. The man… |
CVE-2026-96763 | Medium | 5.4 | 2026-09-24 | A security flaw has been discovered in kvcache-ai mooncake up to 0.3.12/0.3.13.post1/0.3.14-rc1. This issue affects the function ScopedSegmentAccess::MountSegm… |
CVE-2026-96606 | Medium | 5.3 | 2026-09-23 | A security flaw has been discovered in LB-Link BL-CPE600EU 5.8.13. This vulnerability affects unknown code of the file Mifi_config.bin of the component Configu… |
CVE-2026-90905 | | 2026-09-23 | Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0 - The endpoint administrat… | |
CVE-2026-90904 | | 2026-09-23 | Joomla Extension - joomshaper.com - Broken Access Control (ACL Bypass) in ApiController Record Editing in Easy Store extension 1.0.0-3.0.0 - The allowEdit() me… | |
CVE-2026-82368 | | 2026-09-23 | Insecure access controls on internal service ports in Brocade SANnav versions before 3.0.1a allow local, non-administrative host users to communicate directly… | |
CVE-2026-96513 | High | 7.3 | 2026-09-23 | A security flaw has been discovered in Neethuharii CafeManagement. This issue affects some unknown processing of the file AddProductCode.php. The manipulation… |
CVE-2026-91077 | Low | 2.7 | 2026-09-23 | The Event Booking Manager for WooCommerce WordPress plugin before 5.7.3 does not restrict its event listing query to events the requesting user is permitted t… |
CVE-2026-77765 | Medium | 5.3 | 2026-09-23 | The Better Payment WordPress plugin before 2.3.4 does not validate the submitted payment amount server-side against the merchant's configured fixed price befo… |
CVE-2026-95830 | Medium | 6.3 | 2026-09-23 | A security flaw has been discovered in theRealSain Pixtream up to 866afd4f0cea812b918780fb74b67dccf8c4d6a0. This issue affects some unknown processing of the f… |
CVE-2026-95820 | Medium | 6.3 | 2026-09-22 | A vulnerability was found in anirbandutta9 College-Notes-Gallery up to 8c1cf3d98f30982d069c88ca172612c001eb39f6. Affected by this issue is some unknown functio… |
CVE-2026-76709 | Critical | 9.8 | 2026-09-22 | A vulnerability exists in the internal administrative component of Analytics and Location Engine (ALE). Successful exploitation of this vulnerability could all… |
CVE-2026-95624 | Medium | 6.8 | 2026-09-22 | The Tauri updater plugin's 'check' IPC command accepts an allowDowngrades boolean parameter directly from frontend JavaScript code. When set to true, it replac… |
CVE-2026-77252 | Medium | 6.5 | 2026-09-22 | MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, caller-supplied projects_filter and space… |
CVE-2026-18462 | | 2026-09-22 | Integer Overflow or Wraparound, Improper Access Control vulnerability in RTI Connext Professional (Core Libraries) allows Shared Resource Manipulation. This is… | |
CVE-2026-83602 | Medium | 6.5 | 2026-09-22 | Netdata is an open source observability tool. From 2.0.0 until 2.11.0, Netdata registers /api/v3/settings in src/web/api/v3/web_api_v3.c with HTTP_ACL_NOCHECK… |
CVE-2026-76804 | Medium | 5.5 | 2026-09-22 | Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the workflow template loading path does not enforce the -file capa… |
CVE-2026-76803 | Medium | 5.3 | 2026-09-22 | Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the nuclei/mysql JavaScript library does not enforce the local-fil… |
CVE-2026-95500 | High | 7.3 | 2026-09-22 | A vulnerability has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. Impacted is the function file_put_contents of the file codeEditor.ph… |
CVE-2026-79314 | High | 8.8 | 2026-09-22 | A horizontal privilege escalation vulnerability exists in x-ui 0.3.2. An authenticated user can modify the inbound proxy configurations of other users, includi… |
CVE-2026-95499 | High | 7.3 | 2026-09-22 | A flaw has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. This issue affects the function move_uploaded_file of the file filemanager.ph… |
CVE-2026-79316 | High | 7.6 | 2026-09-21 | An improper access control vulnerability exists in x-ui 0.3.2. Any authenticated panel user can modify the xray configuration template through the settings int… |
CVE-2026-91164 | Medium | 4.3 | 2026-09-21 | Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.23.0 until 0.27.3, HTTP API token authentication resolves ConfigProvider::valida… |
CVE-2026-77165 | Medium | 6.5 | 2026-09-21 | File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database. |
CVE-2026-94393 | | 2026-09-21 | When a user creates or edits a report inside an event, MISP can identify an existing report using its UUID without properly checking whether that report actual… | |
CVE-2026-94148 | Medium | 5.3 | 2026-09-21 | A vulnerability was determined in ScadaBR up to 1.1. Impacted is the function EmportDwr.createExportJSON of the file /ScadaBR/export_project.htm of the compone… |
CVE-2026-94050 | Medium | 4.3 | 2026-09-20 | A vulnerability has been found in D-Link DIR-X1860Z up to 1.0.2.220120.165402. Affected is the function routerd.wificfg_get/routerd.get_rand_key of the compone… |
CVE-2026-94036 | High | 8.8 | 2026-09-20 | A security flaw has been discovered in D-Link DIR-X1860 and DIR-X1860Z up to 1.0.2.220120.165402. The impacted element is an unknown function of the file /ubus… |
CVE-2026-93971 | Medium | 5.3 | 2026-09-20 | A weakness has been identified in aiyiyi121 SxDevOps 1.0/1.1. Impacted is an unknown function of the file backend/sxdevops/settings.py. This manipulation cause… |
CVE-2026-87840 | Medium | 5.3 | 2026-09-20 | The Tripzzy WordPress plugin before 1.5.1 does not perform any capability or ownership checks on its administrative booking-management actions, which are addi… |
CVE-2026-87839 | High | 7.5 | 2026-09-20 | The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX act… |
CVE-2026-92099 | Medium | 6.5 | 2026-09-19 | The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authorisation or validate a caller-supplied query identifier before storing a persiste… |
CVE-2026-11549 | Medium | 6.5 | 2026-09-18 | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a virtual host bypass vulnerability. |
CVE-2026-58197 | High | 8.8 | 2026-09-18 | ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol servers. Prior to ToolHive CLI 0.30.1 and ToolHive Studio 0… |
CVE-2026-93676 | Low | 3.2 | 2026-09-18 | xdg-dbus-proxy incorrectly filters D-Bus broadcast messages, bypassing configured path, interface, and member restrictions. This allows a sandboxed Flatpak app… |
CVE-2026-93604 | High | 7.2 | 2026-09-18 | vm2 through 3.12.0 exposes Node.js's crypto.setFips() function to untrusted guest code when an embedder explicitly allowlists the crypto builtin for a NodeVM (… |
CVE-2026-93504 | Medium | 6.3 | 2026-09-18 | A vulnerability has been found in SveltyCMS 0.0.6. This affects an unknown part of the file src/routes/api/[...path]/+server.ts of the component User Attribute… |
CVE-2026-21848 | Medium | 5.0 | 2026-09-18 | HCL BigFix Service Management is affected by a Security Misconfiguration vulnerability, which could allow an authenticated attacker to exploit improper access… |
CVE-2026-90976 | Medium | 5.3 | 2026-09-18 | The Clean Login WordPress plugin before 1.19 does not check whether user registration is enabled before creating an account in its registration handler, allowi… |
CVE-2026-90978 | High | 7.1 | 2026-09-18 | The Filter Gallery WordPress plugin before 1.1.5 does not verify the nonce on several of its AJAX handlers when the nonce field is omitted, and applies no capa… |
CVE-2026-87965 | Medium | 4.8 | 2026-09-18 | The Easy Appointments WordPress plugin before 4.0.2.2 does not use an unguessable token to authorize its mail-link appointment cancellation and confirmation ac… |
CVE-2026-85123 | Medium | 5.3 | 2026-09-18 | The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form t… |
CVE-2026-82985 | Medium | 6.5 | 2026-09-18 | The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSourceFolders) of the user viewing the album, rathe… |
CVE-2026-77170 | Medium | 4.3 | 2026-09-18 | The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether the user owns or has p… |
CVE-2026-77169 | Medium | 6.5 | 2026-09-18 | A vulnerability in the team folders (formerly group folders) app when used in combination with the workspace app allowed API/REST-only delegated administrators… |
CVE-2026-83944 | Critical | 10.0 | 2026-09-17 | Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-92927 | Medium | 5.3 | 2026-09-17 | A vulnerability was found in SourceCodester Drug Recommendation System 1.0. This issue affects some unknown processing of the file /db/drug_recommendor.sql. Pe… |
CVE-2026-61700 | Low | 3.7 | 2026-09-17 | MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, ClientMessage.r… |
CVE-2026-50610 | | 2026-09-17 | A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense due to insufficient access controls in a… | |
CVE-2026-50609 | | 2026-09-17 | A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. Insufficient access controls within a p… | |
CVE-2026-50605 | | 2026-09-17 | A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. Insufficient access controls within a privi… | |
CVE-2026-90982 | Medium | 5.3 | 2026-09-17 | @fastify/static is a Fastify plugin that serves static files from a configured root directory. In versions before 10.1.4, on a case-insensitive filesystem such… |
CVE-2026-91019 | Medium | 4.9 | 2026-09-17 | The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing user… |
CVE-2026-90922 | Medium | 5.3 | 2026-09-17 | The Paid Membership Subscriptions WordPress plugin before 3.0.9 does not verify that the amount and currency reported by the payment provider match the pendin… |
CVE-2026-20332 | Critical | 9.9 | 2026-09-16 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall T… |
CVE-2026-20121 | Medium | 5.3 | 2026-09-16 | A vulnerability in the access control list (ACL) Object Group Search (OGS) implementation of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software a… |
CVE-2026-20120 | Medium | 5.8 | 2026-09-16 | A vulnerability in the access control list (ACL) Object Group Search (OGS) implementation of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software a… |
CVE-2026-20322 | Critical | 9.9 | 2026-09-16 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive… |
CVE-2026-20192 | Critical | 10.0 | 2026-09-16 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connec… |
CVE-2026-88817 | | 2026-09-16 | An authenticated, non-guest user of Curiosity Workspace could enroll themselves as an administrator and member of an existing access group without an invitatio… | |
CVE-2026-92357 | Medium | 4.3 | 2026-09-16 | A vulnerability was identified in a2ui-project a2ui 0.8/0.9/1.0. Impacted is an unknown function of the file model-processor.ts of the component Model Processo… |
CVE-2026-89328 | Low | 3.8 | 2026-09-16 | The FluentBoards WordPress plugin before 2.0.15 does not properly verify that a user holds board-manager privileges before performing several board-management… |
CVE-2026-87959 | Medium | 5.4 | 2026-09-16 | The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with… |
CVE-2026-82126 | Low | 2.7 | 2026-09-16 | The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check that a user is allowed to edit the specific post they request schema gene… |
CVE-2026-92247 | Medium | 4.7 | 2026-09-16 | A security vulnerability has been detected in synaptikcms synaptik-cms up to 1.3.4.4. This affects the function rename of the file admin/file-manager.php of th… |
CVE-2026-83368 | High | 7.0 | 2026-09-15 | Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, Oracle GraalVM product of Oracle Java SE (component: Compiler). The supported… |
CVE-2026-87288 | High | 8.1 | 2026-09-15 | Vulnerability in the Oracle GraalVM product of Oracle Java SE (component: Compiler). The supported version that is affected is Oracle GraalVM: 25.0.4.1. Diff… |
CVE-2026-87287 | High | 8.1 | 2026-09-15 | Vulnerability in the Oracle GraalVM product of Oracle Java SE (component: Compiler). The supported version that is affected is Oracle GraalVM: 25.0.4.1. Diff… |
CVE-2026-87286 | High | 8.1 | 2026-09-15 | Vulnerability in the Oracle GraalVM product of Oracle Java SE (component: Compiler). The supported version that is affected is Oracle GraalVM: 25.0.4.1. Diff… |
CVE-2026-87284 | Low | 3.2 | 2026-09-15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploi… |
CVE-2026-87281 | Low | 3.2 | 2026-09-15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploi… |
CVE-2026-87280 | Medium | 4.2 | 2026-09-15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploi… |
CVE-2026-87278 | Medium | 6.1 | 2026-09-15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploi… |
CVE-2026-87276 | High | 7.5 | 2026-09-15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Difficult to… |
CVE-2026-87275 | Medium | 4.6 | 2026-09-15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploi… |
CVE-2026-87266 | High | 8.2 | 2026-09-15 | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Application Server). The supported version that is affected is 9.3.6. Easily… |
CVE-2026-87265 | High | 8.1 | 2026-09-15 | Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Other issue). Supported versions that are affected are 12.2.3-12.2.15. E… |
CVE-2026-87264 | High | 7.7 | 2026-09-15 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Integration Broker). Supported versions that are affected are… |
CVE-2026-87262 | High | 7.1 | 2026-09-15 | Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface). The supported… |
CVE-2026-87261 | High | 7.3 | 2026-09-15 | Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface). The supported… |
CVE-2026-87260 | High | 7.3 | 2026-09-15 | Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface). The supported… |
CVE-2026-87259 | High | 8.4 | 2026-09-15 | Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface). The supported… |
CVE-2026-87258 | High | 7.6 | 2026-09-15 | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Folders, Files & Attachments). The supported version that is affected is 9.3… |
CVE-2026-87257 | High | 7.7 | 2026-09-15 | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: SDK). The supported version that is affected is 9.3.6. Easily exploitable vu… |
CVE-2026-87256 | High | 7.7 | 2026-09-15 | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Application Server). The supported version that is affected is 9.3.6. Easily… |
CVE-2026-87254 | High | 7.5 | 2026-09-15 | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Folders, Files & Attachments). The supported version that is affected is 9.3… |
CVE-2026-87253 | Medium | 6.1 | 2026-09-15 | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Web Client). The supported version that is affected is 9.3.6. Easily exploit… |
CVE-2026-87252 | Medium | 6.8 | 2026-09-15 | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Application Server). The supported version that is affected is 9.3.6. Diffic… |
CVE-2026-87250 | High | 7.6 | 2026-09-15 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26… |
CVE-2026-87249 | High | 7.1 | 2026-09-15 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26… |
CVE-2026-87243 | High | 8.0 | 2026-09-15 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26… |
CVE-2026-87242 | High | 7.4 | 2026-09-15 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26… |
CVE-2026-87241 | High | 8.1 | 2026-09-15 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26… |
CVE-2026-87236 | High | 7.1 | 2026-09-15 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26… |