CWE-284 · Improper Access Control (page 20)
Page 20 of 82 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-65884 | Critical | 9.8 | 2026-07-29 | Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2 - The registration method allows users provided usergroup IDs, allowing unauthenticat… |
CVE-2026-41920 | Critical | 9.3 | 2026-07-29 | Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.14, from 10.0.0 through 10.1… |
CVE-2026-63236 | Low | 3.7 | 2026-07-29 | An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to read another user's name, internal identifier, scores, lesson st… |
CVE-2026-63235 | Low | 3.7 | 2026-07-29 | An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to forcibly terminate the session of any user given their email add… |
CVE-2026-64863 | Critical | 9.1 | 2026-07-28 | goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled WebDAV MOVE as a wri… |
CVE-2026-7362 | Medium | 4.3 | 2026-07-28 | IBM Sterling B2B Integrator 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 throu… |
CVE-2026-62427 | High | 8.8 | 2026-07-28 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To manage the system, sysctl… |
CVE-2026-18038 | Medium | 4.3 | 2026-07-28 | A flaw has been found in nextlevelbuilder GoClaw up to 3.13.2. Affected by this vulnerability is the function ExecTool.Execute of the file goclaw/internal/http… |
CVE-2026-14926 | Medium | 4.2 | 2026-07-28 | The FluentCart A New Era of eCommerce WordPress plugin before 1.4.0 does not verify that a subscription belongs to the requesting customer in several of its p… |
CVE-2021-32084 | Critical | 9.8 | 2026-07-27 | An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. If a customer restricts access to the web console by IP address or subnets… |
CVE-2026-64738 | Critical | 9.8 | 2026-07-27 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, macOS Sequoia 15.7.8, macOS Sonoma 14.8… |
CVE-2026-64737 | High | 8.2 | 2026-07-27 | An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A mali… |
CVE-2026-64732 | Medium | 4.6 | 2026-07-27 | This issue was addressed through improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7… |
CVE-2026-64723 | Medium | 5.5 | 2026-07-27 | A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe… |
CVE-2026-64702 | Critical | 9.8 | 2026-07-27 | An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app… |
CVE-2026-43821 | Medium | 6.5 | 2026-07-27 | An access issue was addressed with improved access restrictions. This issue is fixed in Safari 26.6, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6… |
CVE-2026-43819 | Medium | 5.5 | 2026-07-27 | An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Tahoe 26.6. An app may be able to access sensitive user data. |
CVE-2026-43779 | Critical | 9.8 | 2026-07-27 | A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able… |
CVE-2026-43763 | Medium | 5.5 | 2026-07-27 | A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.7.8, macOS Sequoia 15.8, macOS Sonoma 14.8.8, macOS… |
CVE-2026-43760 | High | 8.6 | 2026-07-27 | An access issue was addressed with improved access restrictions. This issue is fixed in macOS Sonoma 14.8.8, macOS Tahoe 26.6, macOS Tahoe 26.7. An app may be… |
CVE-2026-28945 | High | 7.1 | 2026-07-27 | A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An… |
CVE-2026-12990 | | 2026-07-27 | An access control vulnerability in the mobile app (APK v5.5.0) for Ghost Robotics' Vision 60 robot allows multiple simultaneous sessions to run without proper… | |
CVE-2026-14235 | High | 7.5 | 2026-07-27 | The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting session nor expire it promptly, making the tok… |
CVE-2026-17457 | Medium | 4.3 | 2026-07-26 | A vulnerability has been found in mf-yang openclaw-cn up to 0.2.1. Affected by this issue is the function assertBrowserNavigationAllowed of the file src/browse… |
CVE-2026-17432 | Medium | 5.0 | 2026-07-26 | A vulnerability was detected in NousResearch hermes-agent 2026.6.5. Affected by this vulnerability is an unknown functionality of the file hermes-agent/plugins… |
CVE-2026-48034 | | 2026-07-24 | Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, there is a bypas… | |
CVE-2026-58630 | Critical | 10.0 | 2026-07-24 | Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-9765 | High | 7.1 | 2026-07-24 | Note: The CVE and blog post don't exist because we determined this is actually a cloud-only issue. Access Controls are “Broken” when a user can access resourc… |
CVE-2026-15704 | Critical | 9.8 | 2026-07-24 | In Eclipse BaSyx Go Components versions up to and including 1.0.0, ABAC-enabled deployments are vulnerable to an authorization bypass caused by inconsistent tr… |
CVE-2026-12702 | Medium | 4.9 | 2026-07-24 | In affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows an unauthorized user to trigger a deployment. |
CVE-2026-14603 | High | 7.5 | 2026-07-24 | The WowOptin: Next-Gen Popup Maker WordPress plugin before 1.4.38 does not have proper authorization on a REST endpoint, allowing unauthenticated users to dis… |
CVE-2026-12688 | Medium | 6.5 | 2026-07-24 | The ProfileGrid WordPress plugin before 5.9.9.7 does not verify PayPal IPN notifications before granting paid group membership, allowing unauthenticated attac… |
CVE-2026-35425 | High | 8.0 | 2026-07-24 | Improper access control in Azure API Management (APIM) allows an authorized attacker to execute code over a network. |
CVE-2026-65760 | | 2026-07-23 | Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1 - Improper access checks allow… | |
CVE-2026-65759 | | 2026-07-23 | Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store extension 1.0.0-2.0.1 - Critical order and payment information, includi… | |
CVE-2026-65758 | | 2026-07-23 | Joomla Extension - tassos.gr - Sensitive data exposure in Convert Forms extension 2.5.0-5.2.2 - The front-end Submissions view did not enforce access control… | |
CVE-2026-65757 | High | 8.1 | 2026-07-23 | Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Modules Anywhere extension - The editor popup could expose restricted… |
CVE-2026-64876 | High | 8.8 | 2026-07-23 | Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in GeoIP extension - Database-update requests lacked consistent token a… |
CVE-2026-64871 | Medium | 5.4 | 2026-07-23 | Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Cache Cleaner extension - Administrator URL purges did not consistent… |
CVE-2024-58330 | High | 7.5 | 2026-07-23 | A missing authentication check in Bosch IP cameras of families CPP13 and CPP14 allows an unauthenticated attacker to retrieve video analytics event data. |
CVE-2026-60372 | Critical | 9.8 | 2026-07-22 | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that a… |
CVE-2026-60371 | High | 8.0 | 2026-07-22 | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that a… |
CVE-2026-60369 | Critical | 9.9 | 2026-07-22 | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that a… |
CVE-2026-60366 | Critical | 10.0 | 2026-07-22 | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that a… |
CVE-2026-64796 | Critical | 9.8 | 2026-07-22 | Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension - Free did not require both the article creator and last modifier to… |
CVE-2026-64794 | Medium | 6.5 | 2026-07-22 | Joomla Extension - regularlabs.com - restricted user-data exposure in Users Anywhere and Articles Anywhere extensions - User tags, filters and conditions allow… |
CVE-2026-64793 | Critical | 9.1 | 2026-07-22 | Joomla Extension - regularlabs.com - Content access and publication bypass in Articles Anywhere and Modules Anywhere extensions - Content tags could use ignore… |
CVE-2026-64791 | High | 8.8 | 2026-07-22 | Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs Extension Manager - Administrator routes and install/upd… |
CVE-2026-63685 | High | 8.8 | 2026-07-22 | Joomla Extension - regularlabs.com - Authorization bypass in DB Replacer extension - Administrator routes and replacement requests did not consistently require… |
CVE-2026-63684 | High | 8.8 | 2026-07-22 | Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various admin/import/export actions of multiple Regular Labs extensio… |
CVE-2026-63280 | High | 8.8 | 2026-07-22 | Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs conditions manager - Conditions administration did not c… |
CVE-2026-63265 | High | 8.0 | 2026-07-22 | Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various Regular Labs extension AJAX endpoints - Privileged Regular La… |
CVE-2026-63047 | High | 7.5 | 2026-07-22 | Joomla Extension - joomdonation.com - Invoice data exfiltration via incorrect ACL check in Events Booking 5.0.0-5.8.1 - The Joomla extension Events Booking pri… |
CVE-2026-14322 | Medium | 5.3 | 2026-07-22 | The Timetics WordPress plugin before 1.0.57 does not enforce a pending or unpaid status for new bookings created through a payment method other than its recog… |
CVE-2026-62574 | High | 7.8 | 2026-07-21 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Install). Supported versi… |
CVE-2026-62567 | High | 7.7 | 2026-07-21 | Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: UK Payroll). Supported versions that are affected are 12.2.3-12.2.15. Eas… |
CVE-2026-62565 | High | 7.1 | 2026-07-21 | Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: US Payroll Year End). Supported versions that are affected are 12.2.3-12… |
CVE-2026-62562 | Medium | 6.5 | 2026-07-21 | Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12… |
CVE-2026-62560 | High | 7.7 | 2026-07-21 | Vulnerability in the Oracle HRMS (Norway) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3… |
CVE-2026-62559 | Medium | 6.8 | 2026-07-21 | Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12… |
CVE-2026-62557 | High | 7.1 | 2026-07-21 | Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: UK Payroll). Supported versions that are affected are 12.2.3-12.2.15. Eas… |
CVE-2026-62556 | Medium | 6.5 | 2026-07-21 | Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.6-12… |
CVE-2026-62549 | Critical | 9.6 | 2026-07-21 | Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: UK Payroll). Supported versions that are affected are 12.2.3-12.2.15. Eas… |
CVE-2026-62546 | Critical | 9.1 | 2026-07-21 | Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Web Utilities). Supported versions that are affected are 12… |
CVE-2026-62542 | Medium | 6.3 | 2026-07-21 | Vulnerability in the Oracle Advanced Benefits product of Oracle E-Business Suite (component: Self Service Benefits). Supported versions that are affected are… |
CVE-2026-62534 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Web Utilities). Supported versions that are affected are 12… |
CVE-2026-62530 | High | 8.1 | 2026-07-21 | Vulnerability in the Oracle HRMS (France) product of Oracle E-Business Suite (component: French HR). Supported versions that are affected are 12.2.3-12.2.15… |
CVE-2026-62528 | Medium | 6.3 | 2026-07-21 | Vulnerability in the Oracle HCM Configuration Workbench product of Oracle E-Business Suite (component: Install). Supported versions that are affected are 12.2… |
CVE-2026-62527 | Medium | 6.3 | 2026-07-21 | Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite (component: Import And Export). Supported versions that are affected are 12… |
CVE-2026-62525 | Medium | 6.3 | 2026-07-21 | Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Quality Workbench HTML system). Supported versions that are affected are 12… |
CVE-2026-62524 | Medium | 6.3 | 2026-07-21 | Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: US Payroll - General). Supported versions that are affected are 12.2.3-12… |
CVE-2026-62521 | High | 7.5 | 2026-07-21 | Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: US Payroll - General). Supported versions that are affected are 12.2.7-12… |
CVE-2026-62519 | Medium | 6.3 | 2026-07-21 | Vulnerability in the Oracle Succession planning product of Oracle E-Business Suite (component: Succession plan). Supported versions that are affected are 12.2… |
CVE-2026-62518 | High | 7.6 | 2026-07-21 | Vulnerability in the Oracle Production Scheduling product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected ar… |
CVE-2026-62516 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle Demantra Demand Management product of Oracle Supply Chain (component: Product Security). Supported versions that are affected are… |
CVE-2026-62515 | High | 7.6 | 2026-07-21 | Vulnerability in the Oracle Advanced Planning Command Center product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are… |
CVE-2026-62514 | High | 8.1 | 2026-07-21 | Vulnerability in the Oracle Process Manufacturing Regulatory Management product of Oracle E-Business Suite (component: Internal Operations). Supported version… |
CVE-2026-62513 | High | 8.5 | 2026-07-21 | Vulnerability in the Oracle Process Manufacturing Regulatory Management product of Oracle E-Business Suite (component: Internal Operations). Supported version… |
CVE-2026-62507 | Medium | 5.3 | 2026-07-21 | Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2… |
CVE-2026-62505 | Medium | 6.1 | 2026-07-21 | Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2… |
CVE-2026-62504 | High | 8.1 | 2026-07-21 | Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2… |
CVE-2026-62503 | Medium | 6.7 | 2026-07-21 | Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2… |
CVE-2026-62497 | High | 8.1 | 2026-07-21 | Vulnerability in the Oracle Flow Manufacturing product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 1… |
CVE-2026-62495 | High | 7.5 | 2026-07-21 | Vulnerability in the Oracle Process Manufacturing Process Execution product of Oracle E-Business Suite (component: Internal Operations). The supported versio… |
CVE-2026-62494 | High | 8.1 | 2026-07-21 | Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2… |
CVE-2026-62493 | High | 7.5 | 2026-07-21 | Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.11-1… |
CVE-2026-62489 | Medium | 4.2 | 2026-07-21 | Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected ar… |
CVE-2026-62488 | Medium | 6.5 | 2026-07-21 | Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected ar… |
CVE-2026-62486 | Medium | 5.0 | 2026-07-21 | Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected ar… |
CVE-2026-62484 | Medium | 5.9 | 2026-07-21 | Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected ar… |
CVE-2026-62483 | Medium | 4.3 | 2026-07-21 | Vulnerability in the Oracle Project Contracts product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12… |
CVE-2026-62482 | Medium | 5.4 | 2026-07-21 | Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected… |
CVE-2026-62480 | Medium | 6.5 | 2026-07-21 | Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected… |
CVE-2026-62479 | Medium | 5.4 | 2026-07-21 | Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected… |
CVE-2026-62478 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected… |
CVE-2026-62476 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle Public Sector Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected ar… |
CVE-2026-62474 | Medium | 6.3 | 2026-07-21 | Vulnerability in the Oracle Lease and Finance Management product of Oracle E-Business Suite (component: Lease Authoring). Supported versions that are affected… |
CVE-2026-62473 | High | 8.3 | 2026-07-21 | Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Create Item Instance). Supported versions that are affected are 12.2… |
CVE-2026-62472 | High | 8.1 | 2026-07-21 | Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Create Item Instance). Supported versions that are affected are 12.2… |
CVE-2026-62469 | High | 7.1 | 2026-07-21 | Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: Enterprise Command Center). Supported versions that are affected ar… |