CWE-284 · Improper Access Control (page 29)
Page 29 of 82 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-13547 | High | 7.3 | 2026-06-29 | A vulnerability was determined in Hanwang e-Face General Management Platform 6.3.5.4. This issue affects some unknown processing of the file /manage/resourceUp… |
CVE-2026-13544 | Medium | 6.3 | 2026-06-29 | A flaw has been found in Feehi CMS up to 2.1.1. Affected by this issue is some unknown functionality of the file /api/users of the component API. This manipula… |
CVE-2026-50132 | High | 7.3 | 2026-06-26 | Budibase is an open-source low-code platform. Prior to 3.39.0, `GET /api/chat-links/:instance/:token/handoff` is a public endpoint (no auth required) that perf… |
CVE-2026-56823 | Medium | 5.4 | 2026-06-26 | AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to , the `POST /api/integratio… |
CVE-2026-48529 | Medium | 6.0 | 2026-06-26 | GitHub MCP Server is GitHub's official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is impl… |
CVE-2026-50744 | Medium | 4.3 | 2026-06-26 | A bypass to the admin‑only restriction of the XML‑RPC API in Revive Adserver 6.0.7. The API response for the ox.login method returned a session ID cookie in th… |
CVE-2026-50739 | Medium | 4.3 | 2026-06-26 | A bypass for CVE‑2026‑34913 exists with proper ownership validation that had not been applied to the reverse operation of linking campaigns and trackers throug… |
CVE-2026-48936 | Low | 3.3 | 2026-06-26 | A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `--allow-net` permission. This vulnerab… |
CVE-2026-48930 | Critical | 9.8 | 2026-06-26 | A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings… |
CVE-2026-48928 | Medium | 5.4 | 2026-06-26 | A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnerability affects all supported release… |
CVE-2026-56050 | Medium | 6.5 | 2026-06-25 | Improper Access Control vulnerability in Themeisle PPOM for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue af… |
CVE-2026-46733 | High | 7.8 | 2026-06-25 | Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3, contain an Improper Access Control vulnerability. A low privileged attacker with loc… |
CVE-2026-12490 | High | 7.5 | 2026-06-25 | When a provide-xfr is given with a tls-auth-name, a secondary requesting a transfer should provide a client certificate with that name. However, no client cert… |
CVE-2026-52810 | | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, Git smart HTTP authorizes POST …/git-receive-pack using the client-supplied service query stri… | |
CVE-2026-31978 | Medium | 6.5 | 2026-06-24 | motionEye (mEye) is an online interface for motion software, which is a video surveillance program with motion detection. Versions prior to 0.44.0 are vulnerab… |
CVE-2026-27708 | | 2026-06-24 | FOSSBilling is a free, open-source billing and client management system. In versions 0.7.2 and prior, the Servicecustom Client API's __call method accepts an o… | |
CVE-2026-56302 | Medium | 6.5 | 2026-06-24 | Capgo before 12.128.2 contains an unsecured images bucket lacking any row level security controls, allowing unauthenticated attackers to read, insert, and dele… |
CVE-2026-56257 | High | 7.1 | 2026-06-24 | Capgo before 12.128.2 allows direct patching of public.apps.owner_org through PostgREST, bypassing the transfer_app() workflow and creating split-brain ownersh… |
CVE-2026-47279 | | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the public shared-view relation endpoints accepted a caller-supplied column ID w… | |
CVE-2026-54761 | High | 7.1 | 2026-06-23 | Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.21 and 3.7.5, there is a high severity vulnerability in Traefik's Kubernetes Gateway provider… |
CVE-2026-54015 | Medium | 6.4 | 2026-06-23 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI's prompt version-history endpoint… |
CVE-2026-54012 | High | 7.1 | 2026-06-23 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI lets a user who can create, updat… |
CVE-2026-54010 | High | 8.3 | 2026-06-23 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI lets an authenticated user attach… |
CVE-2026-52844 | High | 7.5 | 2026-06-23 | Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, on Windows, Caddy path matchers treat /private\secret.txt as outside /private… |
CVE-2026-49411 | Medium | 6.5 | 2026-06-23 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.0, the Node.js compatibility TCP path checked the permission against the original hostn… |
CVE-2026-54305 | Critical | 9.9 | 2026-06-23 | n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, three EE endpoints used by the Dynamic Credentials feature accepted… |
CVE-2026-44958 | Medium | 5.4 | 2026-06-23 | An access control bypass allows an advertiser‑level user to activate or deactivate a banner in Revive Adserver 6.0.6 and earlier, even when such permissions we… |
CVE-2026-44957 | Medium | 4.3 | 2026-06-23 | A missing access control check when invoking various modify methods in the XML‑RPC API of Revive Adserver 6.0.6 and earlier. The API allowed entities to be rea… |
CVE-2026-34913 | Medium | 4.3 | 2026-06-23 | A missing access control check when linking trackers to campaigns through the campaign-trackers.php script of Revive Adserver 6.0.6 and earlier could allow a l… |
CVE-2026-34912 | Medium | 4.3 | 2026-06-23 | A missing access control check when linking banners or campaigns to a zone through the zone-include.php script of Revive Adserver 6.0.6 and earlier, or via its… |
CVE-2025-15619 | Low | 3.5 | 2026-06-23 | HCL Connections contains a broken access control vulnerability that may allow an unauthorized user to view data in a single specific scenario. |
CVE-2026-28381 | Critical | 9.6 | 2026-06-22 | The Snowflake datasource allows for GET/PUT commands, which can allow any user with access to run queries against the data source to read/write files between t… |
CVE-2026-56253 | High | 7.5 | 2026-06-21 | Capgo before 12.128.2 contains an improper access control vulnerability in the public.get_org_members RPC function that allows unauthenticated attackers to enu… |
CVE-2026-12786 | High | 7.8 | 2026-06-21 | A vulnerability has been found in Ezbsystems UltraISO Premium Edition up to 9.76. Affected by this issue is some unknown functionality in the library bootpt64… |
CVE-2026-12784 | High | 7.8 | 2026-06-21 | A weakness has been identified in IM-Magic Partition Resizer up to 7.9.0. This affects an unknown function in the library MDA_NTDRV.sys of the component Kernel… |
CVE-2026-12782 | High | 7.8 | 2026-06-21 | A security flaw has been discovered in EaseUS Partition Master up to 14.5. The impacted element is an unknown function in the library EUEDKEPM.sys of the compo… |
CVE-2026-12781 | High | 7.8 | 2026-06-21 | A vulnerability was identified in EaseUS Partition Master up to 14.5. The affected element is an unknown function in the library epmntdrv.sys of the component… |
CVE-2026-12780 | High | 7.8 | 2026-06-21 | A vulnerability was determined in AOMEI Backupper up to 8.3.0. Impacted is an unknown function in the library amwrtdrv.sys of the component Kernel Driver. Exec… |
CVE-2026-12779 | High | 7.8 | 2026-06-21 | A vulnerability was found in AOMEI Dynamic Disk Manager up to 10.10.1. This issue affects some unknown processing in the library ddmdrv.sys of the component Ke… |
CVE-2026-12778 | High | 7.8 | 2026-06-21 | A vulnerability has been found in AOMEI Partition Assistant up to 10.10.1. This vulnerability affects unknown code in the library ampa10.sys of the component K… |
CVE-2026-56082 | High | 7.5 | 2026-06-19 | Capgo (Cap-go/capgo) before 12.128.2 contains an improper access control vulnerability in the SECURITY DEFINER PostgREST RPC function public.record_build_time… |
CVE-2026-4027 | | 2026-06-19 | A security vulnerability has been identified in FlexNet Manager Suite 2025 R1 and R2 that could allow unauthorized access to attachment files due to insufficie… | |
CVE-2026-4026 | | 2026-06-19 | A security vulnerability has been identified in FlexNet Manager Suite 2025 R1 that could allow an authenticated user with read-only access to account settings… | |
CVE-2026-46461 | High | 7.8 | 2026-06-19 | Dell Server Hardware Manager, versions prior to 3.2.2, contains an Improper Access Control vulnerability. A low privileged attacker with local access could pot… |
CVE-2026-47647 | Critical | 9.9 | 2026-06-18 | Improper access control in Microsoft Dynamics 365 allows an authorized attacker to elevate privileges over a network. |
CVE-2026-46699 | High | 7.6 | 2026-06-18 | conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. Prior to version 3.6… |
CVE-2026-48617 | High | 8.2 | 2026-06-18 | A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation. This can lead to confidentiality impact or… |
CVE-2026-54533 | | 2026-06-17 | vantage6 is an open-source infrastructure for privacy preserving analysis. Prior to version 5.0.0, malicious algorithms can potentially access other algorithms… | |
CVE-2026-8049 | Medium | 5.3 | 2026-06-17 | In SignalRGB versions prior to 1.3.7.0, the \\.\SignalIo device object is created without an explicit SDDL security descriptor and without FILE_DEVICE_SECURE_O… |
CVE-2026-12529 | High | 7.3 | 2026-06-17 | A security vulnerability has been detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. Affected is an unknown function of… |
CVE-2026-35162 | Medium | 4.3 | 2026-06-17 | Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Improper Access Control vulnerability. A low privileged attacker with remote access could po… |
CVE-2026-35067 | Medium | 5.7 | 2026-06-17 | Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Improper Access Control vulnerability. A low privileged attacker with adjacent network acces… |
CVE-2026-35066 | High | 7.1 | 2026-06-17 | Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Improper Access Control vulnerability. A low privileged attacker with remote access could po… |
CVE-2025-66391 | High | 8.8 | 2026-06-17 | In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of a workflow for write operations, e.g., the system will send a… |
CVE-2026-48616 | Critical | 9.3 | 2026-06-17 | Rocket.Chat versions <8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, 7.10.13 has an access control vulnerability in Livechat files. Protected file downloads… |
CVE-2026-12460 | Medium | 4.2 | 2026-06-17 | Insufficient policy enforcement in File System Access in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer proce… |
CVE-2026-46979 | Medium | 6.5 | 2026-06-17 | Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Integration and Interfaces). The supported version th… |
CVE-2026-46978 | Critical | 10.0 | 2026-06-17 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Remote Administration Daemon). The supported version that is affected is 11.4. Easi… |
CVE-2026-46976 | High | 7.2 | 2026-06-17 | Vulnerability in the Oracle Public Sector Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected ar… |
CVE-2026-46974 | High | 7.5 | 2026-06-17 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.8. Difficult to e… |
CVE-2026-46971 | High | 7.5 | 2026-06-17 | Vulnerability in the Oracle HR Intelligence product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2… |
CVE-2026-46969 | High | 7.2 | 2026-06-17 | Vulnerability in the Oracle Financials for EMEA product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are… |
CVE-2026-46967 | High | 8.8 | 2026-06-17 | Vulnerability in the Oracle Public Sector Financials (International) product of Oracle E-Business Suite (component: Authorization). Supported versions that ar… |
CVE-2026-46966 | High | 7.5 | 2026-06-17 | Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Site Level Administration). Supported versions t… |
CVE-2026-46965 | High | 8.8 | 2026-06-17 | Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Site Level Administration). Supported versions t… |
CVE-2026-46964 | Critical | 9.9 | 2026-06-17 | Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Site Level Administration). Supported versions t… |
CVE-2026-46963 | Critical | 9.9 | 2026-06-17 | Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Site Level Administration). Supported versions t… |
CVE-2026-46960 | High | 7.2 | 2026-06-17 | Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affect… |
CVE-2026-46959 | High | 7.5 | 2026-06-17 | Vulnerability in the Oracle Subledger Accounting product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are… |
CVE-2026-46958 | High | 7.5 | 2026-06-17 | Vulnerability in the Oracle Subledger Accounting product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are… |
CVE-2026-46957 | High | 7.5 | 2026-06-17 | Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12… |
CVE-2026-46956 | High | 7.2 | 2026-06-17 | Vulnerability in the Oracle Property Manager product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12… |
CVE-2026-46950 | High | 8.8 | 2026-06-17 | Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affec… |
CVE-2026-46949 | Critical | 9.1 | 2026-06-17 | Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affec… |
CVE-2026-46947 | High | 8.8 | 2026-06-17 | Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affec… |
CVE-2026-46946 | Critical | 9.1 | 2026-06-17 | Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2… |
CVE-2026-46945 | Critical | 9.1 | 2026-06-17 | Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2… |
CVE-2026-46944 | Critical | 9.1 | 2026-06-17 | Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2… |
CVE-2026-46942 | High | 8.8 | 2026-06-17 | Vulnerability in the Oracle Process Manufacturing Process Planning product of Oracle E-Business Suite (component: Internal Operations). Supported versions tha… |
CVE-2026-46940 | High | 8.8 | 2026-06-17 | Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning). Supported versions that are affected are 12.2.3-12… |
CVE-2026-46939 | High | 8.1 | 2026-06-17 | Vulnerability in the Oracle Configure to Order product of Oracle E-Business Suite (component: Supply to Order Workbench). Supported versions that are affected… |
CVE-2026-46938 | High | 7.2 | 2026-06-17 | Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning). Supported versions that are affected are 12.2.3-12… |
CVE-2026-46935 | High | 7.5 | 2026-06-17 | Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite (component: Internal Operations). Supported versions t… |
CVE-2026-46934 | High | 7.5 | 2026-06-17 | Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite (component: Internal Operations). Supported versions t… |
CVE-2026-46933 | Critical | 9.9 | 2026-06-17 | Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are… |
CVE-2026-46932 | High | 7.1 | 2026-06-17 | Vulnerability in the Oracle Enterprise Asset Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affec… |
CVE-2026-46931 | High | 8.8 | 2026-06-17 | Vulnerability in the Oracle Enterprise Asset Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affec… |
CVE-2026-46930 | Critical | 9.1 | 2026-06-17 | Vulnerability in the Oracle In-Memory Cost Management for Discrete Industries product of Oracle E-Business Suite (component: Internal Operations). Supported v… |
CVE-2026-46929 | High | 8.8 | 2026-06-17 | Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning). Supported versions that are affected are 12.2.3-12… |
CVE-2026-46927 | High | 8.1 | 2026-06-17 | Vulnerability in the Oracle Receivables product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-1… |
CVE-2026-46926 | High | 8.8 | 2026-06-17 | Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 17… |
CVE-2026-46925 | High | 8.3 | 2026-06-17 | Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 17… |
CVE-2026-46922 | High | 7.2 | 2026-06-17 | Vulnerability in the Oracle HR Intelligence product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2… |
CVE-2026-46921 | High | 8.8 | 2026-06-17 | Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 17… |
CVE-2026-46920 | High | 8.1 | 2026-06-17 | Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 17… |
CVE-2026-46919 | Critical | 9.8 | 2026-06-17 | Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 17… |
CVE-2026-46918 | Critical | 9.9 | 2026-06-17 | Vulnerability in the Oracle Process Manufacturing Product Development product of Oracle E-Business Suite (component: Internal Operations). Supported versions… |
CVE-2026-46916 | High | 8.8 | 2026-06-17 | Vulnerability in the Oracle Process Manufacturing Product Development product of Oracle E-Business Suite (component: Quality Management Specs). Supported vers… |
CVE-2026-46915 | High | 8.5 | 2026-06-17 | Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite (component: Production). Supported versions that are a… |
CVE-2026-46913 | Critical | 9.3 | 2026-06-17 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are… |