CWE-284 · Improper Access Control (page 21)
Page 21 of 64 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-60865 | High | 7.8 | 2026-02-03 | Insecure Permissions vulnerability in avanquest Driver Updater v.9.1.57803.1174 allows a local attacker to escalate privileges via the Driver Updater Service w… |
CVE-2020-37116 | High | 8.8 | 2026-02-03 | GUnet OpenEclass 1.7.3 includes phpMyAdmin 2.10.0.2 by default, which allows remote logins. Attackers with access to the platform can remotely access phpMyAdmi… |
CVE-2025-6592 | | 2026-02-02 | Vulnerability in Wikimedia Foundation AbuseFilter. This vulnerability is associated with program files includes/auth/AuthManager.Php. This issue affects Abuse… | |
CVE-2026-1117 | High | 8.2 | 2026-02-02 | A vulnerability in the `lollms_generation_events.py` component of parisneo/lollms version 5.9.0 allows unauthenticated access to sensitive Socket.IO events. Th… |
CVE-2026-1742 | Medium | 4.7 | 2026-02-02 | A vulnerability was identified in EFM ipTIME A8004T 14.18.2. Affected by this vulnerability is the function commit_vpncli_file_upload of the file /cgi/timepro… |
CVE-2026-24904 | Medium | 5.3 | 2026-01-29 | TrustTunnel is an open-source VPN protocol with a rule bypass issue in versions prior to 0.9.115. In `tls_listener.rs`, `TlsListener::listen()` peeks 1024 byte… |
CVE-2025-7016 | High | 8.0 | 2026-01-29 | Improper Access Control vulnerability in Akın Software Computer Import Export Industry and Trade Ltd. QR Menu allows Authentication Abuse. This issue affects… |
CVE-2025-46691 | High | 7.8 | 2026-01-28 | Dell PremierColor Panel Driver, versions prior to 1.0.0.1 A01, contains an Improper Access Control vulnerability. A low privileged attacker with local access c… |
CVE-2026-0844 | High | 8.8 | 2026-01-28 | The Simple User Registration plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 6.7 due to insufficient restriction o… |
CVE-2025-67645 | High | 8.8 | 2026-01-28 | OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 7.0.4 have a broken access control i… |
CVE-2026-24740 | Critical | 9.9 | 2026-01-27 | Dozzle is a realtime log viewer for docker containers. Prior to version 9.0.3, a flaw in Dozzle’s agent-backed shell endpoints allows a user restricted by labe… |
CVE-2026-24473 | Medium | 5.3 | 2026-01-27 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, Serve static Middleware for the Cloudflare Worke… |
CVE-2026-1445 | Medium | 4.7 | 2026-01-26 | A vulnerability was found in iJason-Liu Books_Manager up to 298ba736387ca37810466349af13a0fdf828e99c. This vulnerability affects unknown code of the file contr… |
CVE-2025-70982 | Critical | 9.9 | 2026-01-26 | Incorrect access control in the importUser function of SpringBlade v4.5.0 allows attackers with low-level privileges to arbitrarily import sensitive user data. |
CVE-2026-1424 | Medium | 4.7 | 2026-01-26 | A vulnerability was identified in PHPGurukul News Portal 1.0. This affects an unknown part of the component Profile Pic Handler. The manipulation leads to unre… |
CVE-2026-1423 | Medium | 6.3 | 2026-01-26 | A vulnerability was determined in code-projects Online Examination System 1.0. Affected by this issue is some unknown functionality of the file /admin_pic.php… |
CVE-2026-1411 | Medium | 6.1 | 2026-01-26 | A flaw has been found in Beetel 777VR1 up to 01.00.09/01.00.09_55. The affected element is an unknown function of the component UART Interface. This manipulati… |
CVE-2026-1407 | Low | 2.0 | 2026-01-25 | A security flaw has been discovered in Beetel 777VR1 up to 01.00.09/01.00.09_55. This affects an unknown part of the component UART Interface. Performing a man… |
CVE-2026-24420 | Medium | 6.5 | 2026-01-24 | phpMyFAQ is an open source FAQ web application. Versions 4.0.16 and below allow an authenticated user without the dlattachment permission to download FAQ attac… |
CVE-2025-70986 | High | 7.5 | 2026-01-23 | Incorrect access control in the selectDept function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily access sensitive department data. |
CVE-2025-70985 | Critical | 9.1 | 2026-01-23 | Incorrect access control in the update function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily modify data outside of their scope. |
CVE-2025-70983 | Critical | 9.9 | 2026-01-23 | Incorrect access control in the authRoutes function of SpringBlade v4.5.0 allows attackers with low-level privileges to escalate privileges. |
CVE-2025-69908 | High | 7.5 | 2026-01-23 | An unauthenticated information disclosure vulnerability in Newgen OmniApp allows attackers to enumerate valid privileged usernames via a publicly accessible cl… |
CVE-2025-69907 | High | 7.5 | 2026-01-23 | An unauthenticated information disclosure vulnerability exists in Newgen OmniDocs due to missing authentication and access control on the /omnidocs/GetListofCa… |
CVE-2026-24304 | Critical | 9.9 | 2026-01-23 | Improper access control in Azure Resource Manager allows an authorized attacker to elevate privileges over a network. |
CVE-2026-24306 | Critical | 9.8 | 2026-01-22 | Improper access control in Azure Front Door (AFD) allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-20912 | Critical | 9.1 | 2026-01-22 | Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be… |
CVE-2026-20904 | Medium | 6.5 | 2026-01-22 | Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other us… |
CVE-2026-20897 | Critical | 9.1 | 2026-01-22 | Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks b… |
CVE-2026-20888 | Medium | 4.3 | 2026-01-22 | Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface. A user with read access to pull requests may be able t… |
CVE-2026-20883 | Medium | 6.5 | 2026-01-22 | Gitea's stopwatch API does not re-validate repository access permissions. After a user's access to a private repository is revoked, they may still view issue t… |
CVE-2026-20750 | Critical | 9.1 | 2026-01-22 | Gitea does not properly validate project ownership in organization project operations. A user with project write access in one organization may be able to modi… |
CVE-2026-20736 | High | 7.5 | 2026-01-22 | Gitea does not properly verify repository context when deleting attachments. A user who previously uploaded an attachment to a repository may be able to delete… |
CVE-2026-0798 | Low | 3.5 | 2026-01-22 | Gitea may send release notification emails for private repositories to users whose access has been revoked. When a repository is changed from public to private… |
CVE-2025-69822 | High | 7.4 | 2026-01-22 | An issue in Atomberg Atomberg Erica Smart Fan Firmware Version: V1.0.36 allows an attacker to obtain sensitive information and escalate privileges via a crafte… |
CVE-2025-65098 | High | 7.4 | 2026-01-22 | Typebot is an open-source chatbot builder. In versions prior to 3.13.2, client-side script execution in Typebot allows stealing all stored credentials from any… |
CVE-2026-24055 | Medium | 5.3 | 2026-01-22 | Langfuse is an open source large language model engineering platform. In versions 3.146.0 and below, the /api/public/slack/install endpoint initiates Slack OAu… |
CVE-2026-24039 | Medium | 4.3 | 2026-01-22 | Horilla is a free and open source Human Resource Management System (HRMS). Version 1.4.0 has Improper Access Control, allowing low-privileged employees to self… |
CVE-2026-24036 | Medium | 5.3 | 2026-01-22 | Horilla is a free and open source Human Resource Management System (HRMS). Versions 1.4.0 and above expose unpublished job postings through the /recruitment/re… |
CVE-2026-24035 | Medium | 4.3 | 2026-01-22 | Horilla is a free and open source Human Resource Management System (HRMS). An Improper Access Control vulnerability exists in Horilla HR Software starting in v… |
CVE-2025-14083 | Low | 2.7 | 2026-01-21 | A flaw was found in the Keycloak Admin REST API. This vulnerability allows the exposure of backend schema and rules, potentially leading to targeted attacks or… |
CVE-2026-21984 | High | 7.5 | 2026-01-20 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Diff… |
CVE-2026-21982 | High | 7.5 | 2026-01-20 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Diff… |
CVE-2026-21962 | Critical | 10.0 | 2026-01-20 | Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for… |
CVE-2026-21961 | Medium | 6.1 | 2026-01-20 | Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Company Dir / Org Chart Viewer, Employee Snapshot). T… |
CVE-2026-21960 | Medium | 6.5 | 2026-01-20 | Vulnerability in the Oracle Applications DBA product of Oracle E-Business Suite (component: Java utils). Supported versions that are affected are 12.2.3-12.2… |
CVE-2026-21959 | Medium | 4.9 | 2026-01-20 | Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Loader). Supported versions that are affected are 12.2.3-12.2.15… |
CVE-2026-21636 | Critical | 10.0 | 2026-01-20 | A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even without `-… |
CVE-2025-14977 | High | 8.1 | 2026-01-20 | The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Ob… |
CVE-2026-1197 | Low | 3.1 | 2026-01-20 | A vulnerability was detected in MineAdmin 1.x/2.x. Affected by this vulnerability is an unknown functionality of the file /system/downloadById. Performing a ma… |
CVE-2026-1196 | Low | 3.1 | 2026-01-20 | A security vulnerability has been detected in MineAdmin 1.x/2.x. Affected is an unknown function of the file /system/getFileInfoById. Such manipulation of the… |
CVE-2026-1194 | Medium | 5.3 | 2026-01-20 | A security flaw has been discovered in MineAdmin 1.x/2.x. This affects an unknown function of the component Swagger. The manipulation results in information di… |
CVE-2026-23877 | Medium | 4.3 | 2026-01-19 | Swing Music is a self-hosted music player for local audio files. Prior to version 2.1.4, Swing Music's `list_folders()` function in the `/folder/dir-browser` e… |
CVE-2026-1170 | Medium | 5.3 | 2026-01-19 | A vulnerability was detected in birkir prime up to 0.4.0.beta.0. This issue affects some unknown processing of the file /graphql of the component GraphQL API… |
CVE-2026-23522 | Low | 3.7 | 2026-01-19 | LobeChat is an open source chat application platform. Prior to version 2.0.0-next.193, `knowledgeBase.removeFilesFromKnowledgeBase` tRPC ep allows authenticate… |
CVE-2026-1181 | Critical | 9.0 | 2026-01-19 | Altium 365 workspace endpoints were configured with an overly permissive Cross-Origin Resource Sharing (CORS) policy that allowed credentialed cross-origin req… |
CVE-2026-1152 | Medium | 4.7 | 2026-01-19 | A security vulnerability has been detected in technical-laohu mpay up to 1.2.4. The impacted element is an unknown function of the component QR Code Image Hand… |
CVE-2026-1126 | Medium | 6.3 | 2026-01-18 | A security vulnerability has been detected in lwj flow up to a3d2fe8133db9d3b50fda4f66f68634640344641. This affects the function uploadFile of the file \flow-m… |
CVE-2026-1107 | Medium | 6.3 | 2026-01-18 | A weakness has been identified in EyouCMS up to 1.7.1/5.0. Impacted is the function check_userinfo of the file Diyajax.php of the component Member Avatar Handl… |
CVE-2026-1061 | Medium | 6.3 | 2026-01-17 | A vulnerability was detected in xiweicheng TMS up to 2.28.0. Affected by this issue is the function Upload of the file src/main/java/com/lhjz/portal/controller… |
CVE-2025-31186 | Low | 3.3 | 2026-01-16 | A permissions issue was addressed with additional restrictions. This issue is fixed in Xcode 16.3. An app may be able to bypass Privacy preferences. |
CVE-2025-24090 | Low | 3.3 | 2026-01-16 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.3 and iPadOS 18.3. An app may be able to enumerate a user's insta… |
CVE-2024-54556 | Low | 2.4 | 2026-01-16 | This issue was addressed through improved state management. This issue is fixed in iOS 18.1 and iPadOS 18.1. A user may be able to view restricted content from… |
CVE-2024-44210 | Low | 3.3 | 2026-01-16 | This issue was addressed with improved permissions checking. This issue is fixed in macOS Sequoia 15.1. An app may be able to access user-sensitive data. |
CVE-2026-1009 | Critical | 9.0 | 2026-01-15 | A stored cross-site scripting (XSS) vulnerability exists in the Altium Forum due to missing server-side input sanitization in forum post content. An authentica… |
CVE-2026-23496 | Medium | 5.4 | 2026-01-15 | Pimcore Web2Print Tools Bundle adds tools for web-to-print use cases to Pimcore. Prior to 5.2.2 and 6.1.1, the application fails to enforce proper server-side… |
CVE-2026-23495 | Medium | 4.3 | 2026-01-15 | Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Prior to 2.2.3 and 1.7.16, the API endpoint for listing Predefined Properties in the Pimcore… |
CVE-2026-23494 | Medium | 4.3 | 2026-01-15 | Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, the application fails to enforce proper server-side authorization… |
CVE-2025-64516 | High | 7.5 | 2026-01-15 | GLPI is a free asset and IT management software package. Prior to 10.0.21 and 11.0.3, an unauthorized user can access GLPI documents attached to any item (tick… |
CVE-2025-61973 | High | 8.8 | 2026-01-15 | A local privilege escalation vulnerability exists during the installation of Epic Games Store via the Microsoft Store. A low-privilege user can replace a DLL f… |
CVE-2026-22909 | High | 7.5 | 2026-01-15 | Certain system functions may be accessed without proper authorization, allowing attackers to start, stop, or delete installed applications, potentially disrupt… |
CVE-2026-21889 | High | 7.5 | 2026-01-14 | Weblate is a web based localization tool. Prior to 5.15.2, the screenshot images were served directly by the HTTP server without proper access control. This co… |
CVE-2025-14338 | | 2026-01-14 | Polkit authentication dis isabled by default and a race condition in the Polkit authorization check in versions before v0.69.0 can lead to the same issues as i… | |
CVE-2025-68949 | Medium | 5.3 | 2026-01-13 | n8n is an open source workflow automation platform. From 1.36.0 to before 2.2.0, the Webhook node’s IP whitelist validation performed partial string matching i… |
CVE-2026-20949 | High | 7.8 | 2026-01-13 | Improper access control in Microsoft Office Excel allows an unauthorized attacker to bypass a security feature locally. |
CVE-2026-20929 | High | 7.5 | 2026-01-13 | Improper access control in Windows HTTP.sys allows an authorized attacker to elevate privileges over a network. |
CVE-2026-20843 | High | 7.8 | 2026-01-13 | Improper access control in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally. |
CVE-2026-20839 | Medium | 5.5 | 2026-01-13 | Improper access control in Windows Client-Side Caching (CSC) Service allows an authorized attacker to disclose information locally. |
CVE-2026-20825 | Medium | 4.4 | 2026-01-13 | Improper access control in Windows Hyper-V allows an authorized attacker to disclose information locally. |
CVE-2026-0386 | High | 7.5 | 2026-01-13 | Improper access control in Windows Deployment Services allows an unauthorized attacker to execute code over an adjacent network. |
CVE-2026-0881 | Critical | 10.0 | 2026-01-13 | Sandbox escape in the Messaging System component. This vulnerability was fixed in Firefox 147 and Thunderbird 147. |
CVE-2026-22033 | Medium | 5.4 | 2026-01-12 | Label Studio is a multi-type data labeling and annotation tool. In 1.22.0 and earlier, a persistent stored cross-site scripting (XSS) vulnerability exists in t… |
CVE-2025-15503 | High | 7.3 | 2026-01-10 | A security flaw has been discovered in Sangfor Operation and Maintenance Management System up to 3.0.8. The impacted element is an unknown function of the file… |
CVE-2026-22605 | Medium | 4.3 | 2026-01-10 | OpenProject is an open-source, web-based project management software. OpenProject versions prior to version 16.6.3, allowed users with the View Meetings permis… |
CVE-2025-46299 | Medium | 4.3 | 2026-01-09 | A memory initialization issue was addressed with improved memory handling. This issue is fixed in Safari 26.2, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS… |
CVE-2025-46297 | Medium | 5.5 | 2026-01-09 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.2. An app may be able to access protected files within an… |
CVE-2025-15495 | Medium | 4.7 | 2026-01-09 | A vulnerability was found in BiggiDroid Simple PHP CMS 1.0. This impacts an unknown function of the file /admin/editsite.php. The manipulation of the argument… |
CVE-2025-68716 | High | 8.4 | 2026-01-08 | KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 enable the SSH service enabled by default on the LAN interface. The root account is configured with no passwor… |
CVE-2026-22043 | Critical | 9.8 | 2026-01-08 | RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 through 1.0.0-alpha.78, a flawed `deny_only` short-circuit in RustFS IA… |
CVE-2026-21694 | Medium | 6.8 | 2026-01-08 | Titra is open source project time tracking software. Versions 0.99.49 and below have Improper Access Control, allowing users to view and edit other users' time… |
CVE-2025-69221 | Medium | 4.3 | 2026-01-07 | LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control when querying agent permissions. An authenticat… |
CVE-2025-69220 | High | 7.1 | 2026-01-07 | LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control for file uploads to an agents file context and… |
CVE-2026-0643 | High | 7.3 | 2026-01-07 | A flaw has been found in projectworlds House Rental and Property Listing 1.0. Impacted is an unknown function of the file /app/register.php?action=reg of the c… |
CVE-2025-0980 | Medium | 6.4 | 2026-01-07 | Nokia SR Linux is vulnerable to an authentication vulnerability allowing unauthorized access to the JSON-RPC service. When exploited, an invalid validation al… |
CVE-2026-21635 | Medium | 5.3 | 2026-01-05 | An Improper Access Control could allow a malicious actor in Wi-Fi range to the EV Station Lite (v1.5.2 and earlier) to use WiFi AutoLink feature on a device th… |
CVE-2025-15448 | Medium | 6.3 | 2026-01-05 | A vulnerability was found in cld378632668 JavaMall up to 994f1e2b019378ec9444cdf3fce2d5b5f72d28f0. This impacts the function Upload of the file src/main/java/c… |
CVE-2026-0577 | Medium | 6.3 | 2026-01-04 | A flaw has been found in code-projects Online Product Reservation System 1.0. Affected by this vulnerability is an unknown functionality of the file /handgunne… |
CVE-2026-21447 | High | 7.1 | 2026-01-02 | Bagisto is an open source laravel eCommerce platform. Prior to version 2.3.10, an Insecure Direct Object Reference vulnerability in the customer order reorder… |
CVE-2026-0566 | Medium | 4.7 | 2026-01-02 | A security vulnerability has been detected in code-projects Content Management System 1.0. Impacted is an unknown function of the file /admin/edit_posts.php. T… |
CVE-2025-69284 | Medium | 4.3 | 2026-01-02 | Plane is an an open-source project management tool. In plane.io, a guest user doesn't have a permission to access https[:]//app[.]plane[.]so/[:]slug/settings… |