CWE-284 · Improper Access Control (page 28)
Page 28 of 82 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-51538 | Critical | 9.1 | 2026-07-13 | EIPStackGroup OpENer 2.3.0 (commit 76b95cf) suffers from an Incorrect Access Control vulnerability in its handling of encapsulation sessions. When the server p… |
CVE-2026-15539 | Medium | 4.7 | 2026-07-13 | A security vulnerability has been detected in SourceCodester Online Book Store System 1.0. Impacted is an unknown function of the file /admin/index.php?page=bo… |
CVE-2026-15530 | Medium | 5.3 | 2026-07-13 | A flaw has been found in WuzhiCMS up to 4.1.0. Affected by this vulnerability is the function config/listimage of the file /index.php?m=attachment&f=index&v=up… |
CVE-2026-15518 | Medium | 4.7 | 2026-07-13 | A vulnerability has been found in AREA 17 Twill CMS up to 3.6.0. The impacted element is the function FileLibraryController::storeFile of the file src/Http/Con… |
CVE-2026-15488 | High | 7.3 | 2026-07-12 | A vulnerability was determined in hcr707305003 shiroiAdmin 1.1/1.3. Affected is the function FileController::upload of the file app/common/controller/FileContr… |
CVE-2026-15476 | Medium | 5.3 | 2026-07-12 | A security vulnerability has been detected in QILING Disk Master 6.0.0.0. The impacted element is an unknown function in the library diskbckp.sys of the compon… |
CVE-2026-15475 | Medium | 5.3 | 2026-07-12 | A weakness has been identified in MiniTool Partition Wizard up to 13.6. The affected element is an unknown function in the library pwdrvio.sys of the component… |
CVE-2026-20744 | Critical | 9.8 | 2026-07-10 | The charging station websocket endpoint accepts connections without proper authentication, which could lead to privilege escalation. |
CVE-2026-55670 | | 2026-07-10 | ZITADEL is an open source identity management platform. Prior to 4.15.1, ZITADEL's event store validation can retain the original resource owner for a deleted… | |
CVE-2026-56335 | Medium | 6.5 | 2026-07-10 | Capgo before 12.128.2 contains an authorization bypass vulnerability where write-scoped API keys can directly mutate protected channel configuration fields thr… |
CVE-2026-40452 | High | 7.5 | 2026-07-10 | Incorrect Authorization, Improper Access Control vulnerability in Apache IoTDB. Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to unaut… |
CVE-2026-40009 | Medium | 6.5 | 2026-07-10 | Improper Privilege Management, Improper Access Control vulnerability in Apache IoTDB. Authenticated users can escalate to full tree-path access by renaming the… |
CVE-2026-15329 | Medium | 4.3 | 2026-07-10 | A vulnerability was found in zhayujie CowAgent up to 2.1.0. This issue affects the function BrowserTool._do_navigate of the file agent/tools/browser/browser_to… |
CVE-2026-15319 | High | 7.3 | 2026-07-10 | A security vulnerability has been detected in Sipeed PicoClaw up to 0.2.9. This affects the function IPAllowlist of the file web/backend/middleware/access_cont… |
CVE-2025-45422 | High | 8.1 | 2026-07-09 | Incorrect access control in Proximus b-box v8c.725A allows authenticated attackers to bypass normal restrictions and make arbitrary changes to port forwarding… |
CVE-2025-63579 | High | 7.5 | 2026-07-09 | Unauthorized use of Kyocera printers, allows all information stored in the Kyocera address book to be exported. The security measure that encrypts incoming dat… |
CVE-2026-59720 | High | 7.5 | 2026-07-09 | Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, mock server creation in mock-server.service.ts does not persist the isPublic input f… |
CVE-2026-15188 | Medium | 6.3 | 2026-07-09 | A weakness has been identified in manjurulhoque django-job-portal up to dfa352f305bba44445ac5dc12e9b2a98c9dcd71f. Affected by this vulnerability is the functio… |
CVE-2026-58525 | High | 8.2 | 2026-07-08 | Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-56217 | Medium | 4.3 | 2026-07-08 | Capgo before 12.128.2 contains a policy bypass vulnerability in app_versions update enforcement that allows app-scoped API keys to downgrade encrypted bundles… |
CVE-2026-28378 | Low | 3.1 | 2026-07-07 | The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging… |
CVE-2026-48958 | High | 8.8 | 2026-07-07 | An improper access check allows unauthorized users to create custom fields via webservices endpoints. |
CVE-2026-48957 | High | 8.8 | 2026-07-07 | An improper access check allows unauthorized users to access com_privacy datasets. |
CVE-2026-48956 | Medium | 5.0 | 2026-07-07 | An improper access check allows users to display a list of modules in the frontend. |
CVE-2026-48955 | Medium | 6.5 | 2026-07-07 | An improper access check allows unauthorized users to access workflow stage and transition information. |
CVE-2026-48948 | High | 8.8 | 2026-07-07 | An improper access check allows user to download vcard exports of com_contact contacts that are inaccessible. |
CVE-2026-48947 | Medium | 4.9 | 2026-07-07 | An improper access check allows privileged users to overwrite media files without editing permissions. |
CVE-2026-54765 | High | 8.5 | 2026-07-06 | Traefik is an open source HTTP reverse proxy and load balancer. From v3.7.0 prior to v3.7.6, Traefik's Kubernetes Gateway API provider may resolve two accepted… |
CVE-2026-48204 | Critical | 9.8 | 2026-07-06 | Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel Mongodb Gridfs component. The camel-mongodb-gridfs producer selects… |
CVE-2026-24014 | Critical | 9.8 | 2026-07-06 | Apache IoTDB DataNode’s internal RPC interface for creating Trigger instances uses the uploaded Trigger JAR name to build a file path without sufficient valida… |
CVE-2026-14792 | Medium | 6.5 | 2026-07-06 | A security vulnerability has been detected in Formbricks 5.0.0. This impacts an unknown function of the file apps/web/modules/survey/link/actions.ts of the com… |
CVE-2026-14777 | Medium | 6.3 | 2026-07-06 | A weakness has been identified in SourceCodester Onlne Examination & Learning Management System 1.0. Affected by this issue is some unknown functionality of th… |
CVE-2026-14776 | Medium | 6.3 | 2026-07-05 | A security flaw has been discovered in SourceCodester Onlne Examination & Learning Management System 1.0. Affected by this vulnerability is the function pathin… |
CVE-2026-14775 | Medium | 6.3 | 2026-07-05 | A vulnerability was identified in SourceCodester Onlne Examination & Learning Management System 1.0. Affected is an unknown function of the file /process_lesso… |
CVE-2026-9085 | High | 8.8 | 2026-07-05 | Incorrect Permission Assignment for Critical Resource, Improper Access Control vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus-… |
CVE-2026-14736 | High | 7.3 | 2026-07-05 | A vulnerability was found in Ruijie RG-UAC up to 1.0-R1.8.2.p5. The impacted element is an unknown function of the file user_auth_commit.php. Performing a mani… |
CVE-2026-14698 | Medium | 6.3 | 2026-07-05 | A security flaw has been discovered in SourceCodester Syllabus-Aligned Learning Management and Examination System 1.0. Impacted is an unknown function of the f… |
CVE-2025-71380 | High | 8.8 | 2026-07-04 | The Execute Command node in n8n allows authenticated users to execute arbitrary commands on the host system where n8n runs. Attackers with user access or compr… |
CVE-2026-58523 | Medium | 6.5 | 2026-07-03 | Improper access control in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-58422 | Critical | 9.8 | 2026-07-03 | Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts |
CVE-2026-58421 | High | 7.5 | 2026-07-03 | Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service |
CVE-2026-58286 | High | 8.1 | 2026-07-03 | Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-58282 | High | 8.1 | 2026-07-03 | Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-28699 | High | 8.1 | 2026-07-03 | Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed through HTTP Basic authentication. |
CVE-2026-27779 | High | 7.5 | 2026-07-03 | Gitea versions before 1.25.5 accept malformed or injected forwarded-proto values when detecting public URLs, allowing spoofed canonical URL generation. |
CVE-2026-27660 | High | 7.5 | 2026-07-03 | Gitea versions before 1.25.5 allow draft release data or attachments to be accessed without the required write permission. |
CVE-2026-26292 | Critical | 9.8 | 2026-07-03 | Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport prot… |
CVE-2026-26247 | Critical | 9.1 | 2026-07-03 | Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected… |
CVE-2026-25712 | High | 7.5 | 2026-07-03 | Gitea versions before 1.25.5 have insufficient visibility checks in organization permission APIs for hidden members and private organizations. |
CVE-2026-24690 | High | 7.5 | 2026-07-03 | Gitea versions before 1.25.5 have insufficient permission checks for updating or rebasing pull request branches. |
CVE-2026-24451 | High | 7.5 | 2026-07-03 | Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public to private, exposing data to a fork that should no longer be… |
CVE-2026-22555 | High | 8.1 | 2026-07-03 | Gitea versions before 1.26.0 allow API users to fork a repository into an organization without first passing the CanCreateOrgRepo check, which can expose organ… |
CVE-2026-20909 | Medium | 5.3 | 2026-07-03 | Gitea versions before 1.25.5 have insufficient permission checks when listing tracked time entries. |
CVE-2026-20896 | Critical | 9.8 | 2026-07-03 | Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when revers… |
CVE-2026-20706 | Critical | 9.1 | 2026-07-03 | Gitea versions up to and including 1.26.1 allow repository archive downloads to bypass token scope checks on the web archive download endpoint. |
CVE-2026-14614 | Medium | 5.4 | 2026-07-03 | A flaw was found in the ClientResource component of Keycloak's admin services when Fine-Grained Admin Permissions (FGAP) v2 is enabled. This issue allows a del… |
CVE-2026-14613 | Medium | 4.3 | 2026-07-03 | A vulnerability was discovered in Keycloak's administrative interface that allows certain administrators to see information about groups they shouldn't have ac… |
CVE-2026-41123 | Medium | 4.3 | 2026-07-03 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30… |
CVE-2026-26145 | Medium | 4.8 | 2026-07-02 | Improper access control in Azure Synapse allows an authorized attacker to elevate privileges over a network. |
CVE-2026-55119 | High | 8.1 | 2026-07-02 | A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Talk Application to escal… |
CVE-2026-55118 | High | 8.3 | 2026-07-02 | A malicious actor with access to the network,low privileges and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi… |
CVE-2026-55116 | Critical | 9.0 | 2026-07-02 | A malicious actor with access to the network and under certain network configurations could exploit an Improper Access Control vulnerability found in certain d… |
CVE-2026-55114 | High | 8.8 | 2026-07-02 | A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Network Application to es… |
CVE-2026-55112 | High | 7.5 | 2026-07-02 | A malicious actor with access to the network and low privileges and under certain conditions could exploit an Improper Access Control vulnerability found in Un… |
CVE-2026-54408 | High | 8.6 | 2026-07-02 | A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect Application to bypass authentication… |
CVE-2026-54407 | High | 8.6 | 2026-07-02 | A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect Application to bypass authentication… |
CVE-2026-54400 | Critical | 9.1 | 2026-07-02 | A malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerability found in UniFi Access Application to es… |
CVE-2026-50746 | Critical | 10.0 | 2026-07-02 | A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Connect Application to execute a Command Inj… |
CVE-2026-8147 | High | 8.1 | 2026-07-02 | In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoints lack proper authorization validators. This allows any aut… |
CVE-2026-50280 | | 2026-07-02 | Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 and above prior to 5.9.21, the EntriesController::actionMoveToSection() endpoint gates th… | |
CVE-2026-56334 | Medium | 4.3 | 2026-06-30 | Capgo before 12.128.2 lacks an UPDATE row-level security policy for the build_requests table, preventing API-key and anonymous access from persisting builder s… |
CVE-2026-14156 | Medium | 6.5 | 2026-06-30 | Insufficient policy enforcement in StorageAccessAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-14155 | Medium | 6.5 | 2026-06-30 | Insufficient policy enforcement in StorageAccessAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted H… |
CVE-2026-14061 | Medium | 6.5 | 2026-06-30 | Inappropriate implementation in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process… |
CVE-2026-14052 | Medium | 4.3 | 2026-06-30 | Insufficient policy enforcement in FileSystem in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass discretionary access control via a cr… |
CVE-2026-14035 | Medium | 6.5 | 2026-06-30 | Insufficient policy enforcement in Bluetooth in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from… |
CVE-2026-14034 | Medium | 4.3 | 2026-06-30 | Inappropriate implementation in WebXR in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a craf… |
CVE-2026-14003 | Medium | 4.3 | 2026-06-30 | Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2026-13964 | Medium | 6.5 | 2026-06-30 | Insufficient policy enforcement in WebView in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a… |
CVE-2026-13954 | Medium | 6.5 | 2026-06-30 | Insufficient policy enforcement in XML in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information… |
CVE-2026-13953 | Medium | 6.5 | 2026-06-30 | Inappropriate implementation in SplitView in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass… |
CVE-2026-13949 | Medium | 6.5 | 2026-06-30 | Insufficient policy enforcement in Payments in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive inform… |
CVE-2026-13937 | Medium | 6.5 | 2026-06-30 | Insufficient policy enforcement in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to leak… |
CVE-2026-13936 | Medium | 6.5 | 2026-06-30 | Inappropriate implementation in Passwords in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive informat… |
CVE-2026-13933 | Medium | 5.3 | 2026-06-30 | Insufficient policy enforcement in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obta… |
CVE-2026-13932 | Medium | 6.5 | 2026-06-30 | Inappropriate implementation in Sharing in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process t… |
CVE-2026-13931 | Medium | 6.5 | 2026-06-30 | Inappropriate implementation in Media in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to… |
CVE-2026-13914 | Medium | 5.5 | 2026-06-30 | Inappropriate implementation in Passwords in Google Chrome on Mac prior to 150.0.7871.47 allowed a local attacker to obtain potentially sensitive information f… |
CVE-2026-13897 | High | 8.8 | 2026-06-30 | Insufficient policy enforcement in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalation via a crafted H… |
CVE-2026-13864 | High | 8.1 | 2026-06-30 | Insufficient policy enforcement in WebHID in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to… |
CVE-2026-13828 | Medium | 6.5 | 2026-06-30 | Inappropriate implementation in Enterprise in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from p… |
CVE-2026-13818 | Medium | 6.5 | 2026-06-30 | Inappropriate implementation in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a crafted HTM… |
CVE-2026-13800 | High | 7.8 | 2026-06-30 | Inappropriate implementation in Updater in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to perform OS-level privilege escalation vi… |
CVE-2025-24816 | Medium | 6.5 | 2026-06-30 | Nokia MantaRay is subject to an Improper Access Control vulnerability due to insufficient authorization within the API. Successful exploitation could allow an… |
CVE-2026-51221 | High | 7.5 | 2026-06-29 | A buffer overflow in the Get_Attribute_List function of EIPStackGroup OpENer commit 76b95c allows attackers to cause a Denial of Service (DoS) via supplying a… |
CVE-2026-43713 | Medium | 6.5 | 2026-06-29 | A permissions issue was addressed with additional restrictions. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26… |
CVE-2026-43701 | High | 7.1 | 2026-06-29 | The issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 2… |
CVE-2026-49049 | High | 7.5 | 2026-06-29 | The Helix3 plugin for Joomla exposes an ajax handler task, that allows unauthenticated attackers to delete arbitrary files, write arbitrary JSON files and upda… |
CVE-2026-13568 | High | 7.3 | 2026-06-29 | A weakness has been identified in SourceCodester Inventory Management System 1.0. This vulnerability affects unknown code of the file /api/users_handler.php of… |
CVE-2026-13553 | High | 7.3 | 2026-06-29 | A flaw has been found in itsourcecode Online Hotel Management System 1.0. Affected is an unknown function of the file /admin/mod_amenities/controller.php?actio… |