CWE-284 · Improper Access Control (page 27)
Page 27 of 82 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-47003 | Medium | 5.9 | 2026-07-21 | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: UI Framework). Supported versions that are affec… |
CVE-2026-47001 | Medium | 5.4 | 2026-07-21 | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Web Services Framework). Supported versions that… |
CVE-2026-46996 | High | 7.1 | 2026-07-21 | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin). Supported versions that are af… |
CVE-2026-46994 | Critical | 9.8 | 2026-07-21 | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen). Supported versions that are aff… |
CVE-2026-46993 | High | 8.2 | 2026-07-21 | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen). Supported versions that are aff… |
CVE-2026-46991 | Medium | 4.4 | 2026-07-21 | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Enterprise Config Management). Supported version… |
CVE-2026-46990 | High | 7.3 | 2026-07-21 | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Enterprise Config Management). Supported version… |
CVE-2026-46989 | Critical | 9.1 | 2026-07-21 | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: UI Framework). Supported versions that are affec… |
CVE-2026-46988 | High | 7.2 | 2026-07-21 | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Connector Framework). Supported versions that ar… |
CVE-2026-46987 | High | 7.7 | 2026-07-21 | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Application Service Level Mgmt). Supported versi… |
CVE-2026-46986 | Medium | 5.3 | 2026-07-21 | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen). Supported versions that are aff… |
CVE-2026-46985 | Medium | 5.3 | 2026-07-21 | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen). Supported versions that are aff… |
CVE-2026-46984 | Medium | 5.3 | 2026-07-21 | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen). Supported versions that are aff… |
CVE-2026-46983 | Critical | 9.8 | 2026-07-21 | Vulnerability in the Oracle Retail Integration Bus product of Oracle Retail Applications (component: RIB Kernal). The supported version that is affected is 1… |
CVE-2026-46982 | Critical | 9.8 | 2026-07-21 | Vulnerability in the Oracle Retail Integration Bus product of Oracle Retail Applications (component: RIB Kernal). The supported version that is affected is 1… |
CVE-2026-46981 | High | 7.2 | 2026-07-21 | Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: Mobile). Supported versions that are affe… |
CVE-2026-46980 | Medium | 4.3 | 2026-07-21 | Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: Mobile). Supported versions that are affe… |
CVE-2026-46975 | Medium | 5.8 | 2026-07-21 | Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 19.3-19.31, 21.3-21.22 and 23.4.0-23.26.2. Easily ex… |
CVE-2026-46968 | Medium | 5.9 | 2026-07-21 | Vulnerability in Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0… |
CVE-2026-46954 | High | 7.2 | 2026-07-21 | Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: Data Removal Tool). Supported versions that are affected are 12.2.3… |
CVE-2026-46948 | Medium | 4.6 | 2026-07-21 | Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: Security). Supported versions that are af… |
CVE-2026-46943 | High | 7.4 | 2026-07-21 | Vulnerability in the Oracle Retail EFTLink product of Oracle Retail Applications (component: Core/Plugin). Supported versions that are affected are 21.0.0-25… |
CVE-2026-46941 | High | 7.5 | 2026-07-21 | Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Maintenance). Supported versions that are affected are 12.2.3-… |
CVE-2026-46936 | Medium | 4.4 | 2026-07-21 | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are MySQL Server: 8.4… |
CVE-2026-46924 | Critical | 9.8 | 2026-07-21 | Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows unauthenticate… |
CVE-2026-46923 | High | 8.0 | 2026-07-21 | Vulnerability in the Oracle Public Sector Financials (International) product of Oracle E-Business Suite (component: Authorization). Supported versions that ar… |
CVE-2026-46917 | Medium | 5.3 | 2026-07-21 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions… |
CVE-2026-46876 | Critical | 9.8 | 2026-07-21 | Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows unauthenticate… |
CVE-2026-43945 | | 2026-07-21 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Versions 1.2.11 until 1.3.1 allow an unauthenticated remote attacker to achieve Full… | |
CVE-2026-35290 | Critical | 9.8 | 2026-07-21 | Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows unauthenticate… |
CVE-2026-35287 | High | 7.5 | 2026-07-21 | Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows unauthenticate… |
CVE-2026-34316 | Medium | 6.1 | 2026-07-21 | Vulnerability in the Oracle Commerce Service Center product of Oracle Commerce (component: Commerce Service Center). The supported version that is affected i… |
CVE-2026-21954 | Medium | 4.3 | 2026-07-21 | Vulnerability in the Oracle Retail Xstore Point of Service product of Oracle Retail Applications (component: Xstore Mobile). The supported version that is af… |
CVE-2026-21953 | Low | 3.3 | 2026-07-21 | Vulnerability in the Oracle Retail Xstore Point of Service product of Oracle Retail Applications (component: Xstore Mobile). The supported version that is af… |
CVE-2026-47405 | High | 8.8 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have a broken workspace authorization check that a… |
CVE-2026-47399 | High | 8.8 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the workspace-scoped REST routes contain a systemi… |
CVE-2026-16454 | Medium | 4.3 | 2026-07-21 | In Eclipse hawkBit versions 1.0.3 and prior, a privilege escalation vulnerability (CWE-284 / CWE-862) has been identified in the Direct Device Integration (DDI… |
CVE-2026-16451 | Medium | 6.3 | 2026-07-21 | A security flaw has been discovered in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. This impacts an unknown function of the file /api/s… |
CVE-2026-47396 | Critical | 9.8 | 2026-07-21 | PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's call server exposes a network-facing agent control API without authentication whe… |
CVE-2026-28321 | Critical | 9.1 | 2026-07-21 | SolarWinds Serv-U is affected by a broken access control vulnerability that could allow arbitrary file read and write, which can then be used to escalate privi… |
CVE-2026-28307 | Critical | 9.1 | 2026-07-21 | SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain user group to be elevated into an administrator group. The impact is… |
CVE-2026-28306 | Critical | 9.1 | 2026-07-21 | SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to elevate their privileges to a system administrator… |
CVE-2026-28304 | Critical | 9.1 | 2026-07-21 | SolarWinds Serv-U is affected by a remote code execution vulnerability that, when exploited, can allow the arbitrary execution of code remotely as root. The im… |
CVE-2026-16447 | High | 7.3 | 2026-07-21 | A vulnerability has been found in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file /web/jquery/uploader/multi_uploadify.php. The manipulation… |
CVE-2025-66390 | Critical | 9.8 | 2026-07-21 | In Microsoft Azure API Management through 2025-10-17, when self-service signup (username/password Basic Authentication) is enabled in Tenant A, an attacker can… |
CVE-2026-16407 | Critical | 9.8 | 2026-07-21 | Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16387 | Critical | 9.8 | 2026-07-21 | Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
CVE-2026-16365 | High | 8.8 | 2026-07-21 | Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 153, Thunderbird 153, Firefox ESR 140.15, and Thunderbird 140.15. |
CVE-2026-16332 | High | 7.3 | 2026-07-21 | A vulnerability was detected in D-Link DNS-320 1.0.2. This impacts an unknown function of the file /mydlink/multi_uploadify.php. Performing a manipulation of t… |
CVE-2026-16331 | High | 7.3 | 2026-07-21 | A security vulnerability has been detected in D-Link DNS-320 1.0.2. This affects an unknown function of the file /web/function/save_ajax.php. Such manipulation… |
CVE-2026-16330 | High | 7.3 | 2026-07-21 | A weakness has been identified in D-Link DNS-320 1.0.2. The impacted element is an unknown function of the file /web/jquery/uploader/uploadify.php. This manipu… |
CVE-2026-16329 | High | 7.3 | 2026-07-21 | A vulnerability was identified in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file /photo_center/php/uploadify.php. The manipulation of the ar… |
CVE-2026-16327 | High | 7.3 | 2026-07-21 | A vulnerability was determined in D-Link DNS-320 1.0.2. This issue affects some unknown processing of the file /web/web_file/upload.php. Executing a manipulati… |
CVE-2026-55550 | High | 7.1 | 2026-07-20 | NextCRM is open-source customer relationship management (CRM) software. The CRM product catalog is an organization-wide business object. Normal application ser… |
CVE-2026-55544 | High | 7.6 | 2026-07-20 | NextCRM is open-source customer relationship management (CRM) software. In version 0.12.1, the MCP campaign tools expose campaign read and write operations ove… |
CVE-2026-47255 | High | 8.2 | 2026-07-20 | AgenticMail gives AI agents real email addresses and phone numbers. @agenticmail/api prior to version 0.9.32 and @agenticmail/core prior to version 0.9.10 had… |
CVE-2026-16324 | High | 7.3 | 2026-07-20 | A vulnerability was identified in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. The impacted element is an unknown function of the file /business/qnaire/upload.jsp… |
CVE-2026-62414 | Critical | 9.1 | 2026-07-20 | Joomla Extension - joomlack.fr - Improper access control in Page Builder CK < 3.6.2 - The Joomla extension Page Builder CK does not properly apply access contr… |
CVE-2026-60030 | | 2026-07-20 | Joomla Extension - themexpert.com - Broken Access Control for media management in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page Builder Pro is vul… | |
CVE-2026-46415 | High | 8.2 | 2026-07-20 | The Caddy Defender plugin is a middleware for Caddy that allows users to block or manipulate requests based on the client's IP address. Prior to version 0.10.1… |
CVE-2026-12972 | Medium | 5.3 | 2026-07-20 | The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to… |
CVE-2026-16226 | Medium | 4.7 | 2026-07-19 | A weakness has been identified in SourceCodester Pizzafy Ecommerce System 1.0. This affects the function save_settings of the file /admin/admin_class_novo.php… |
CVE-2026-16201 | Medium | 5.3 | 2026-07-19 | A vulnerability was found in zevorn rt-claw up to 0.2.0. Affected is the function claw_net_get/claw_net_post of the file claw/services/tools/net.c of the compo… |
CVE-2026-51083 | Medium | 6.5 | 2026-07-17 | Incorrect access control in Proxmox Virtual Environment (PVE) 9.x qemu-server before 9.1.8 and 8.x before 8.4.8 allows users within limited privileges to obtai… |
CVE-2026-16072 | Medium | 4.9 | 2026-07-17 | A flaw was found in the organization management component of Keycloak. A delegated administrator with permission to manage organizations can create an invitati… |
CVE-2026-41993 | Medium | 4.4 | 2026-07-17 | Improper Access Control vulnerability in the Removable Media Validation function of TXOne Networks products allows a local attacker with administrator privileg… |
CVE-2026-54526 | Critical | 9.9 | 2026-07-16 | Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 3.7.15 and 4.0.6, the allow-list fix… |
CVE-2026-46353 | High | 8.1 | 2026-07-16 | BigBlueButton is an open-source virtual classroom. Prior to 3.0.21, bbb-web checksum validation could be bypassed when a presentationUploadExternalUrl paramete… |
CVE-2026-55548 | Medium | 4.3 | 2026-07-16 | Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, the PacketsApi.exportPackets endpoint in yamcs-core/src/main/java/org/yamcs/http/api/PacketsA… |
CVE-2026-35148 | Medium | 6.3 | 2026-07-16 | HCL DFXServer is affected by a Missing Access Control vulnerability. This vulnerability states that certain endpoints are accessible without any form of authen… |
CVE-2026-1609 | High | 8.1 | 2026-07-16 | A flaw was found in Keycloak. When the JSON Web Token (JWT) authorization grant preview feature is enabled and a user account is disabled, Keycloak fails to va… |
CVE-2026-62314 | Medium | 5.8 | 2026-07-15 | Anubis is a Web AI Firewall Utility that challenges users' connections in order to protect upstream resources from scraper bots. From 1.22.0 until 1.26.0-pre1… |
CVE-2026-55234 | High | 8.5 | 2026-07-15 | Wekan is open source kanban built with Meteor. Prior to 9.37, Wekan DDP update allow rules in server/permissions/cards.js, server/permissions/lists.js, and ser… |
CVE-2026-45313 | High | 7.7 | 2026-07-15 | Sandboxie-Plus is an open source sandbox-based isolation software for Windows. Prior to 1.17.6, GuiServer::WndHookRegisterSlave in Sandboxie/core/svc/GuiServer… |
CVE-2026-46485 | High | 8.2 | 2026-07-15 | Dashy is a self-hostable personal dashboard. Prior to 4.0.8, Dashy deployments using OIDC can allow unauthenticated users or non-admin authenticated users to w… |
CVE-2026-14960 | Critical | 9.8 | 2026-07-15 | Pegatron `Tdelo64.sys` improperly exposes privileged hardware access functionality through the `\\.\TdeIo` device interface. IOCTL handlers including `TDE_IOCT… |
CVE-2026-20150 | High | 8.8 | 2026-07-15 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal secur… |
CVE-2026-47164 | High | 7.7 | 2026-07-15 | Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO login flow checked the IdP email_verified claim only for new-u… |
CVE-2026-36035 | Medium | 6.5 | 2026-07-14 | Incorrect access control in the /api/License/deactivateOffline endpoint of CAXPerts UniversalPlantViewer WebServices Server v2.7.6 allows authenticated attacke… |
CVE-2026-47301 | High | 8.8 | 2026-07-14 | Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network. |
CVE-2026-58617 | High | 8.1 | 2026-07-14 | Improper access control in Microsoft 365 Copilot for iOS allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-58545 | Medium | 5.5 | 2026-07-14 | Improper access control in Windows Kernel allows an authorized attacker to bypass a security feature locally. |
CVE-2026-57088 | High | 7.8 | 2026-07-14 | Improper access control in Extensible Storage Engine (ESENT) allows an authorized attacker to elevate privileges locally. |
CVE-2026-56157 | Medium | 5.4 | 2026-07-14 | Improper access control in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. |
CVE-2026-50495 | Medium | 6.1 | 2026-07-14 | Improper access control in Microsoft Windows DNS allows an authorized attacker to perform tampering locally. |
CVE-2026-50465 | High | 7.1 | 2026-07-14 | Improper access control in Microsoft Windows DNS allows an authorized attacker to perform tampering locally. |
CVE-2026-50423 | High | 7.8 | 2026-07-14 | Improper access control in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-50418 | Medium | 5.1 | 2026-07-14 | Improper access control in Windows System allows an unauthorized attacker to bypass a security feature locally. |
CVE-2026-50373 | High | 7.8 | 2026-07-14 | Improper access control in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. |
CVE-2026-50335 | High | 7.8 | 2026-07-14 | Improper access control in Windows Operating Systems allows an authorized attacker to elevate privileges locally. |
CVE-2026-55014 | High | 7.8 | 2026-07-14 | Improper access control in Windows Remote Help Defense allows an authorized attacker to elevate privileges locally. |
CVE-2026-50351 | High | 7.8 | 2026-07-14 | Improper access control in Windows Audio Compression Manager (ACM) allows an authorized attacker to elevate privileges locally. |
CVE-2026-50342 | High | 8.8 | 2026-07-14 | Improper access control in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally. |
CVE-2026-50325 | High | 7.0 | 2026-07-14 | Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally. |
CVE-2026-50311 | High | 7.8 | 2026-07-14 | Improper access control in Windows Server allows an authorized attacker to elevate privileges locally. |
CVE-2026-50297 | High | 7.0 | 2026-07-14 | Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally. |
CVE-2026-49805 | High | 7.0 | 2026-07-14 | Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally. |
CVE-2026-15677 | High | 7.3 | 2026-07-14 | A weakness has been identified in code-projects Online Job Portal 1.0. This affects an unknown function of the file /JobSeekerInsert.php. Executing a manipulat… |
CVE-2026-15627 | Medium | 4.3 | 2026-07-14 | A vulnerability was identified in nextlevelbuilder GoClaw up to 3.13.3-beta.3. This vulnerability affects the function handleNavigate of the file pkg/browser/t… |
CVE-2026-57855 | High | 8.8 | 2026-07-13 | Cockpit CMS contains a missing authorization vulnerability in the Bucket file storage API (/system/buckets/api). The api() method in modules/System/Controller/… |