CWE-284 · Improper Access Control (page 31)
Page 31 of 82 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-35298 | Critical | 9.1 | 2026-06-17 | Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 1… |
CVE-2026-35294 | Critical | 9.9 | 2026-06-17 | Vulnerability in the Identity Manager Connector product of Oracle Fusion Middleware (component: Mainframe Connectors). Supported versions that are affected ar… |
CVE-2026-35285 | Critical | 9.9 | 2026-06-17 | Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected… |
CVE-2026-35284 | Critical | 9.9 | 2026-06-17 | Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected… |
CVE-2026-35283 | Critical | 9.9 | 2026-06-17 | Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected… |
CVE-2026-35282 | Critical | 9.9 | 2026-06-17 | Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected… |
CVE-2026-35281 | Critical | 9.9 | 2026-06-17 | Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected… |
CVE-2026-35280 | Critical | 9.9 | 2026-06-17 | Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected… |
CVE-2026-35275 | High | 7.5 | 2026-06-17 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Shared Folders). The supported version that is affected is 7.2.8. Diff… |
CVE-2026-35271 | High | 8.7 | 2026-06-17 | Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Weblogic). Supported versions that are affected are 8.61 an… |
CVE-2026-35270 | Critical | 9.1 | 2026-06-17 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1… |
CVE-2026-35269 | High | 7.5 | 2026-06-17 | Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 a… |
CVE-2026-35268 | Critical | 9.9 | 2026-06-17 | Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1… |
CVE-2026-35263 | Critical | 9.9 | 2026-06-17 | Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 14.1.2.0.0 and 15.1.1.0… |
CVE-2026-35262 | High | 8.3 | 2026-06-17 | Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Market Place). Supported versions that are affected are 12.2.1.4.0… |
CVE-2026-11890 | Medium | 4.3 | 2026-06-16 | Improper access control in PAM account discovery results in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to retrieve account discovery… |
CVE-2026-47261 | High | 7.5 | 2026-06-15 | Wasmtime is a runtime for WebAssembly. In versions prior to 24.0.9, 36.0.10, and 44.0.2, when a filesystem preopen is given DirPerms::all() and FilePerms::READ… |
CVE-2026-50892 | Medium | 6.5 | 2026-06-15 | Incorrect access control in the "Let's Encrypt" certificate download endpoint of Nginx Proxy Manager v2.14.0 allows authenticated attackers to obtain the TLS p… |
CVE-2026-50891 | High | 8.1 | 2026-06-15 | Incorrect access control in the /admin/api/config component of Filestash v0.4.0 allows attackers to escalate privileges via sending a crafted request. |
CVE-2026-50886 | Critical | 9.1 | 2026-06-15 | Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST reque… |
CVE-2026-50885 | High | 7.5 | 2026-06-15 | Incorrect access control in the share-based read endpoints of Sismics Docs (Teedy) v1.11 allow unauthorized attackers to access sensitive endpoints via a craft… |
CVE-2026-50884 | High | 8.8 | 2026-06-15 | Incorrect access control in statping-ng v0.93.0 allows attackers to escalate privileges to Administrator and access sensitive components. |
CVE-2026-50881 | High | 8.1 | 2026-06-15 | Incorrect access control in the impworks Bonsai v6.0 allows authenticated attackers with Editor privileges to escalate privileges to Administrator and execute… |
CVE-2026-50875 | High | 8.1 | 2026-06-15 | Incorrect access control in the /{form}/webhooks/{webhook} endpoint of Deck9 Input v2.0.1 allows authenticated attackers to arbitrarily modify or delete anothe… |
CVE-2026-39006 | Critical | 9.8 | 2026-06-15 | An issue in SNMP4J-Agent 3.8.3 allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component. |
CVE-2026-36933 | Medium | 6.8 | 2026-06-15 | An issue in Boyleep K11, y108 firmware v.2.3.0.11291 allows a physically proximate attacker to execute arbitrary code via the factory test feature. |
CVE-2026-5230 | High | 7.1 | 2026-06-15 | Improper Access Control, Missing Authorization vulnerability in MIA Technology Inc. Pizzy Library allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2026-12212 | Medium | 4.3 | 2026-06-15 | A vulnerability has been found in hcengineering Huly Platform up to 0.7.0. Affected is the function getMailboxSecret of the file server/account/src/operations… |
CVE-2026-12203 | Medium | 5.3 | 2026-06-15 | A vulnerability was found in HKUDS AI-Trader up to 74caf996f78dcc0c657df8365c8544678a16e215. This affects an unknown part of the file /api/research/agents.csv… |
CVE-2026-53520 | Medium | 6.5 | 2026-06-12 | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 2.0.14 to before version 2.1.0, authenticated user… |
CVE-2026-44783 | Medium | 5.4 | 2026-06-12 | Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to b… |
CVE-2026-47182 | | 2026-06-12 | Frappe is a full-stack web application framework. Prior to version 16.17.4, any authenticated user can access private files by guessing the file path. This iss… | |
CVE-2026-44976 | | 2026-06-12 | Frappe is a full-stack web application framework. Prior to version 16.17.4, any user can modify any field in any Onboarding Step record. This issue has been pa… | |
CVE-2026-44208 | | 2026-06-12 | Frappe is a full-stack web application framework. Prior to versions 15.107.0 and 16.17.0, lack of validations in the "submit_discussion()" endpoint allows for… | |
CVE-2026-47200 | Medium | 5.3 | 2026-06-12 | Nuxt is an open-source web development framework for Vue.js. In Nuxt versions 3.11.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6 and @nuxt/nitro-server… |
CVE-2026-48610 | High | 8.1 | 2026-06-12 | Under certain network configurations, a malicious actor with access to network could exploit an Improper Access Control vulnerability found in certain devices… |
CVE-2026-47366 | High | 7.2 | 2026-06-12 | Improper verification of access permissions when modifying permissions through the Administration Control Panel (ACP) allowed an authenticated administrator to… |
CVE-2026-44249 | High | 8.1 | 2026-06-11 | Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an… |
CVE-2026-45178 | High | 8.1 | 2026-06-11 | Idira Secrets Manager Self-Hosted versions 13.8.0 and lower exhibit improper access control within internal cluster endpoints. A remote, authenticated attacker… |
CVE-2026-45177 | Critical | 9.1 | 2026-06-11 | Idira Secrets Manager SaaS Edge versions prior to 1.8 exhibit improper access control within its internal authentication components. A remote, unauthenticated… |
CVE-2025-46315 | High | 7.5 | 2026-06-11 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.1. An app may be able to access protected user data. |
CVE-2025-46308 | Medium | 5.3 | 2026-06-11 | An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. An app may be able to… |
CVE-2025-43339 | Medium | 5.5 | 2026-06-11 | An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Tahoe 26.1. A malicious app may be able to access sensitive us… |
CVE-2025-24165 | Medium | 5.5 | 2026-06-11 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app ma… |
CVE-2026-41856 | High | 7.5 | 2026-06-11 | The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This… |
CVE-2026-46695 | Critical | 10.0 | 2026-06-10 | Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and launch OCI containers within them to run untrusted code. Prio… |
CVE-2026-50564 | Critical | 9.9 | 2026-06-10 | Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version… |
CVE-2026-50563 | Critical | 9.9 | 2026-06-10 | Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version… |
CVE-2026-50545 | Critical | 9.9 | 2026-06-10 | Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version… |
CVE-2026-49824 | High | 8.5 | 2026-06-10 | Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version… |
CVE-2026-49823 | High | 7.7 | 2026-06-10 | Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version… |
CVE-2026-49822 | High | 7.7 | 2026-06-10 | Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version… |
CVE-2026-46614 | Critical | 9.8 | 2026-06-10 | Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version… |
CVE-2026-20259 | Medium | 5.5 | 2026-06-10 | In Splunk Enterprise versions below 10.2.4 and 10.0.7, and Splunk Cloud Platform versions below 10.4.2604.0, 10.3.2512.12, 10.2.2510.15, 10.1.2507.23, 10.0.250… |
CVE-2026-41837 | Medium | 5.3 | 2026-06-10 | Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizatio… |
CVE-2026-41728 | High | 7.5 | 2026-06-10 | Spring Data REST's JSON Patch (application/json-patch+json) implementation does not apply the write-access filter to intermediate path segments when resolving… |
CVE-2026-47907 | High | 8.6 | 2026-06-09 | Dreamweaver Desktop versions 21.7 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the con… |
CVE-2026-39169 | High | 7.5 | 2026-06-09 | SEMCMS 5.0 is vulnerable to unauthorized access in SEMCMS_copy.php. |
CVE-2026-36720 | High | 8.1 | 2026-06-09 | Insecure permissions in bookcars v8.3 allows authenticated attackers to escalate privileges from user to admin via modifying their user type. |
CVE-2026-49161 | High | 7.8 | 2026-06-09 | Improper access control in Microsoft PC Manager allows an authorized attacker to bypass a security feature locally. |
CVE-2026-48578 | High | 7.9 | 2026-06-09 | Improper access control in Windows Secure Boot allows an authorized attacker to elevate privileges locally. |
CVE-2026-45658 | High | 7.8 | 2026-06-09 | Improper access control in Windows BitLocker allows an authorized attacker to bypass a security feature locally. |
CVE-2026-45654 | High | 7.9 | 2026-06-09 | Improper access control in Windows Secure Boot allows an authorized attacker to bypass a security feature locally. |
CVE-2026-45649 | High | 7.1 | 2026-06-09 | Improper access control in Office for Android allows an unauthorized attacker to perform spoofing locally. |
CVE-2026-42829 | High | 7.8 | 2026-06-09 | Improper access control in Windows Administrator Protection allows an authorized attacker to bypass a security feature locally. |
CVE-2026-41092 | High | 7.8 | 2026-06-09 | Improper access control in Microsoft Kinect allows an authorized attacker to elevate privileges locally. |
CVE-2026-49938 | Medium | 6.5 | 2026-06-09 | A improper access control vulnerability in Fortinet FortiPortal 7.4.0 through 7.4.7, FortiPortal 7.2.0 through 7.2.8, FortiPortal 7.0 all versions may allow at… |
CVE-2026-41985 | Medium | 5.1 | 2026-06-09 | UAF vulnerability in the package management module. Impact: Successful exploitation of this vulnerability may affect service integrity. |
CVE-2026-41984 | Medium | 5.2 | 2026-06-09 | UAF vulnerability in the package management module. Impact: Successful exploitation of this vulnerability may affect service integrity. |
CVE-2026-41847 | Medium | 4.8 | 2026-06-09 | Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL. Affected versions: Spring Framework 5.3.0 through 5.3.48. |
CVE-2026-41006 | High | 7.5 | 2026-06-09 | Spring HATEOAS's internal PropertyUtils.createObjectFromProperties method, used by the Collection+JSON and UBER media type deserializers, performs bean propert… |
CVE-2026-11621 | Medium | 4.7 | 2026-06-09 | A weakness has been identified in Dcat-Admin up to 2.2.3-beta. This impacts the function editorMDUpload of the file /admin/dcat-api/editor-md/upload of the com… |
CVE-2026-11532 | Medium | 6.3 | 2026-06-08 | A weakness has been identified in imvks786 student_management_system up to 9599b560ad3c3b83e75d328b76bedcd489ef1f46. Affected is an unknown function of the fil… |
CVE-2026-46441 | Critical | 9.6 | 2026-06-08 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerability exists in the… |
CVE-2026-42863 | High | 8.1 | 2026-06-08 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerability exists in the… |
CVE-2026-42862 | Medium | 5.0 | 2026-06-08 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerability exists in the… |
CVE-2026-42861 | Critical | 9.6 | 2026-06-08 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerability exists in the… |
CVE-2026-11474 | High | 7.3 | 2026-06-08 | A security flaw has been discovered in Kushan2k student-management-system up to f16a4ceaddd6729c4b306ed4641cda3176c1ef2a. Affected is an unknown function of th… |
CVE-2026-11466 | Medium | 5.4 | 2026-06-07 | A weakness has been identified in zilliztech deep-searcher up to 0.0.2. This affects the function CollectionRouter.invoke of the file deepsearcher/agent/collec… |
CVE-2026-11464 | Low | 3.1 | 2026-06-07 | A vulnerability was identified in JeecgBoot up to 3.9.2. Affected by this vulnerability is the function queryPageList of the file src\main\java\org\jeecg\modul… |
CVE-2026-11459 | Low | 3.3 | 2026-06-07 | A security vulnerability has been detected in SecureAge CatchPulse up to 10.9.3. Impacted is an unknown function in the library saappctl.sys of the component I… |
CVE-2026-11458 | Medium | 5.3 | 2026-06-07 | A weakness has been identified in erzhongxmu JeeWMS up to 141740afb2ba14d441c82a833d0a418d07ca2d69. This issue affects some unknown processing of the file /bas… |
CVE-2026-45776 | Medium | 4.3 | 2026-06-05 | OpenXDMoD is an open framework for collecting and analyzing HPC metrics. Prior to version 11.0.3, a flaw in Open XDMoD's access control logic allows an attacke… |
CVE-2026-45746 | Critical | 9.0 | 2026-06-05 | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the File Manager function… |
CVE-2026-11344 | High | 7.3 | 2026-06-05 | A vulnerability was found in code-projects Vehicle Management System 1.0. This impacts an unknown function of the file newdriver.php of the component New Drive… |
CVE-2026-11333 | Medium | 6.3 | 2026-06-05 | A security vulnerability has been detected in tittuvarghese CollegeManagementSystem 3e476335cfbfb9a049e09f474c7ec885f69a9df3/a38852979f7e27ae67b610dce5979500ef… |
CVE-2026-48907 | Critical | 9.8 | 2026-06-05 | A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resulting in PHP code u… |
CVE-2026-11326 | | 2026-06-05 | OpenAI Atlas before 1.2025.288.15 exposed privileged browser APIs to web content on *.openai.com origins. A cross-site scripting vulnerability in forum.openai… | |
CVE-2026-11302 | Medium | 4.3 | 2026-06-05 | Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to bypass discretionary access contr… |
CVE-2026-11277 | Medium | 4.3 | 2026-06-05 | Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to bypass discretionary access contr… |
CVE-2026-11275 | Medium | 6.5 | 2026-06-05 | Inappropriate implementation in Page Info in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-11274 | Medium | 4.3 | 2026-06-05 | Inappropriate implementation in DOM Distiller in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a… |
CVE-2026-11258 | Medium | 6.5 | 2026-06-05 | Inappropriate implementation in File System Access in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific… |
CVE-2026-11257 | Medium | 4.3 | 2026-06-05 | Inappropriate implementation in Browser in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a crafted HTML… |
CVE-2026-11252 | Medium | 4.3 | 2026-06-05 | Insufficient policy enforcement in Content Settings in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass discretionary access control vi… |
CVE-2026-11212 | Medium | 4.3 | 2026-06-04 | Insufficient policy enforcement in DevTools in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension t… |
CVE-2026-11210 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Safe Browsing in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass discretionary access control via a cr… |
CVE-2026-11204 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Signin in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a crafted… |
CVE-2026-11197 | Medium | 6.5 | 2026-06-04 | Insufficient policy enforcement in Workers in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass… |
CVE-2026-11193 | Medium | 6.5 | 2026-06-04 | Insufficient policy enforcement in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass discretionary access control vi… |