CWE-284 · Improper Access Control (page 33)
Page 33 of 82 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-34234 | Critical | 10.0 | 2026-05-19 | CtrlPanel is open-source billing software for hosting providers. In versions 1.1.1 and prior, the web-based installer (public/installer/index.php) is vulnerabl… |
CVE-2026-39250 | High | 7.3 | 2026-05-19 | An authorization vulnerability exists in Innoshop 0.6.0. After logging into the frontend, an attacker can directly access backend application interfaces, leadi… |
CVE-2026-34233 | Medium | 6.5 | 2026-05-19 | CtrlPanel is open-source billing software for hosting providers. In versions 1.1.1 and prior, multiple admin controllers expose DataTable endpoints without aut… |
CVE-2026-37979 | Medium | 6.5 | 2026-05-19 | A flaw was found in Keycloak. This access control vulnerability in Keycloak's OpenID Connect (OIDC) token introspection endpoint allows a confidential client t… |
CVE-2026-31388 | Medium | 5.3 | 2026-05-19 | Improper Access Control vulnerability in Apache OFBiz in multi-tenant deployments. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to… |
CVE-2026-32994 | Medium | 5.3 | 2026-05-19 | The /api/v1/autotranslate.translateMessage endpoint in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, <8.1.5, <8.0.6, <7.13.8, and <7.10.12 allows any authenticated… |
CVE-2023-24215 | Critical | 9.1 | 2026-05-18 | Incorrect access control in the /uci/get/ endpoint of NOVUS AirGate 4G firmware v1.1.16 allows unauthenticated attackers to obtain administrator credentials vi… |
CVE-2026-8766 | Medium | 4.3 | 2026-05-17 | A flaw has been found in Kilo-Org kilocode up to 7.0.47. This issue affects the function Load of the file packages/opencode/src/config/config.ts of the compone… |
CVE-2026-8758 | High | 7.3 | 2026-05-17 | A vulnerability was determined in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. This impacts an unknown function of the file /common/jsp/upload3.jsp. Executing a m… |
CVE-2026-8752 | Medium | 5.3 | 2026-05-17 | A weakness has been identified in h2oai h2o-3 up to 7402. This vulnerability affects the function exec of the file h2o-core/src/main/java/water/rapids/ast/prim… |
CVE-2026-8750 | Medium | 5.3 | 2026-05-17 | A vulnerability was identified in h2oai h2o-3 up to 7402. Affected by this issue is the function importFiles of the file h2o-core/src/main/java/water/persist/P… |
CVE-2026-45301 | High | 8.1 | 2026-05-15 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.3.16, a missing permission check in all files rel… |
CVE-2026-44556 | High | 7.1 | 2026-05-15 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the /responses endpoint in the OpenAI router… |
CVE-2026-44774 | Critical | 9.9 | 2026-05-15 | Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.46, 3.6.17, and 3.7.1, Traefik's Kubernetes Gateway API provider allows a tenant with HTTPRou… |
CVE-2025-67437 | Medium | 6.5 | 2026-05-15 | Medical Management System a81df1ce700a9662cb136b27af47f4cbde64156b is vulnerable to Insecure Permissions, which allows arbitrary user password reset. |
CVE-2024-36323 | | 2026-05-15 | Improper isolation of VCN-JPEG HW register space could allow a malicious Guest Virtual Machine (VM) or a process to perform unauthorized access to the register… | |
CVE-2026-7373 | | 2026-05-15 | Rapid7 Metasploit Pro is vulnerable to a local privilege escalation attack that allows a user to gain SYSTEM level control of a Windows host. When started the… | |
CVE-2025-0040 | | 2026-05-15 | Improper access control between the Joint Test Action Group (JTAG) and Advanced Extensible Interface (AXI) could allow an attacker with physical access to read… | |
CVE-2026-8586 | Medium | 5.5 | 2026-05-14 | Inappropriate implementation in Chromoting in Google Chrome prior to 148.0.7778.168 allowed a local attacker to bypass discretionary access control via a malic… |
CVE-2026-8566 | Medium | 4.3 | 2026-05-14 | Insufficient policy enforcement in Payments in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker to bypass discretionary access contro… |
CVE-2026-8556 | Low | 3.1 | 2026-05-14 | Inappropriate implementation in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to… |
CVE-2026-8545 | Low | 3.1 | 2026-05-14 | Object corruption in Compositing in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to leak cross-orig… |
CVE-2026-24711 | Medium | 5.3 | 2026-05-14 | Northern.tech CFEngine Enterprise before 3.21.8, 3.24.3, and 3.27.0 has Incorrect Access Control. |
CVE-2026-44478 | High | 7.5 | 2026-05-13 | hoppscotch is an open source API development ecosystem. The fix for CVE-2026-28215 in version 2026.2.0 addresses the unauthenticated POST /v1/onboarding/config… |
CVE-2026-33381 | Medium | 5.9 | 2026-05-13 | When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will… |
CVE-2026-33377 | High | 7.1 | 2026-05-13 | An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate… |
CVE-2026-28374 | Medium | 4.3 | 2026-05-13 | Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations. |
CVE-2026-44007 | Critical | 9.1 | 2026-05-13 | vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.1, when a NodeVM is created with nesting: true, sandbox code can unconditionally require('vm2') reg… |
CVE-2026-36738 | Medium | 6.8 | 2026-05-13 | U-SPEED AC1200 Gigabit Wi-Fi Router (Model: T18-21K) V1.0 is vulnerable to Incorrect Access Control. The device exposes a UART interface that lacks authenticat… |
CVE-2026-44352 | | 2026-05-12 | Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Prior to 1.2.3, Broken Access… | |
CVE-2026-44341 | Medium | 5.3 | 2026-05-12 | GoJobs is a REST API for a Job Board platform. The application exposes a job retrieval endpoint that allows unauthenticated users to access job details by dire… |
CVE-2026-42158 | | 2026-05-12 | Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Prior to 1.2.3, an adversary… | |
CVE-2026-44874 | Medium | 4.9 | 2026-05-12 | A vulnerability exists in the web-based management interface of an AOS-10 Gateway that could allow an authenticated remote attacker to access sensitive files o… |
CVE-2026-44225 | Critical | 9.3 | 2026-05-12 | Pulpy is a lightweight, cross-platform desktop application packager for web apps. Prior to 0.1.1, Pulpy injects a pulpy.fs JavaScript API into every packaged w… |
CVE-2026-44277 | Critical | 9.8 | 2026-05-12 | A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthenticator 6.6.0 through 6.6.8, FortiAuthentica… |
CVE-2026-42832 | High | 7.7 | 2026-05-12 | Improper access control in Microsoft Office allows an unauthorized attacker to perform spoofing locally. |
CVE-2026-42823 | Critical | 9.9 | 2026-05-12 | Improper access control in Azure Logic Apps allows an authorized attacker to elevate privileges over a network. |
CVE-2026-42177 | Medium | 5.3 | 2026-05-12 | linux-entra-sso is a browser plugin for Linux to SSO on Microsoft Entra ID. Prior to 1.8.1, platform/chrome/js/platform-chrome.js:69-88 registers a single decl… |
CVE-2026-41614 | Medium | 6.2 | 2026-05-12 | Improper access control in M365 Copilot for Desktop allows an unauthorized attacker to perform spoofing locally. |
CVE-2026-41102 | High | 7.1 | 2026-05-12 | Improper access control in Microsoft Office PowerPoint allows an authorized attacker to perform spoofing locally. |
CVE-2026-41101 | High | 7.1 | 2026-05-12 | Improper access control in Microsoft Office Word allows an authorized attacker to perform spoofing locally. |
CVE-2026-41100 | Medium | 4.4 | 2026-05-12 | Improper access control in M365 Copilot allows an authorized attacker to perform spoofing locally. |
CVE-2026-41086 | High | 8.8 | 2026-05-12 | Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges over a network. |
CVE-2026-40420 | High | 8.8 | 2026-05-12 | Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally. |
CVE-2026-40381 | High | 7.8 | 2026-05-12 | Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally. |
CVE-2026-33834 | High | 7.8 | 2026-05-12 | Improper access control in Windows Event Logging Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-32209 | Medium | 4.4 | 2026-05-12 | Improper access control in Windows Filtering Platform (WFP) allows an authorized attacker to bypass a security feature locally. |
CVE-2025-43524 | High | 8.8 | 2026-05-12 | An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.2. An app… |
CVE-2026-40300 | Medium | 6.5 | 2026-05-12 | Zulip is an open-source team collaboration tool. Prior to 12.0, With message_edit_history_visibility_policy set to "moves", /api/v1/messages/{id}/history still… |
CVE-2026-20887 | High | 7.5 | 2026-05-12 | Improper access control for some Intel Vision software for all versions within Ring 3: User Applications may allow a denial of service. Unprivileged software a… |
CVE-2026-40020 | Low | 3.1 | 2026-05-12 | Attacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl file even if imap_acl_allow_anyone=no. This causes folders to be… |
CVE-2026-43652 | High | 7.5 | 2026-05-11 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.5. An app may be able to access protected user data. |
CVE-2026-28993 | Medium | 5.5 | 2026-05-11 | This issue was addressed by adding an additional prompt for user consent. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS… |
CVE-2026-28988 | Medium | 5.5 | 2026-05-11 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, visionOS 26.5, watchOS 26.5… |
CVE-2026-28978 | High | 8.8 | 2026-05-11 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. A malicious… |
CVE-2026-28974 | High | 7.5 | 2026-05-11 | This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Tah… |
CVE-2026-28965 | High | 7.5 | 2026-05-11 | A privacy issue was addressed with improved checks. This issue is fixed in iOS 26.5 and iPadOS 26.5. A user may be able to view restricted content from the loc… |
CVE-2026-28957 | Low | 3.3 | 2026-05-11 | An issue with app access to camera metadata was addressed with improved logic. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, v… |
CVE-2026-28930 | High | 7.5 | 2026-05-11 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.5. An app may be able to access protected user data. |
CVE-2026-28922 | Medium | 6.5 | 2026-05-11 | This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be a… |
CVE-2026-28910 | Low | 3.3 | 2026-05-11 | This issue was addressed with improved permissions checking. This issue is fixed in macOS Tahoe 26.4. A malicious app may be able to access arbitrary files. |
CVE-2026-7813 | Critical | 9.9 | 2026-05-11 | Authorization vulnerability in pgAdmin 4 server mode affecting Server Groups, Servers, Shared Servers, Background Processes, and Debugger modules. Multiple en… |
CVE-2025-9973 | Medium | 6.4 | 2026-05-11 | Due to not validating the organization context when executing adaptive authentication flows, the WSO2 Identity Server allows adaptive authentication logic to b… |
CVE-2026-8233 | Medium | 4.6 | 2026-05-10 | A vulnerability was determined in Dotouch XproUPF 2.0.0-release-088aa7c4. Affected is an unknown function of the component UPF. This manipulation causes improp… |
CVE-2026-42569 | Critical | 9.4 | 2026-05-09 | phpVMS is a PHP application to run and simulate an airline. Prior to version 7.0.6, a critical vulnerability in phpVMS allowed unauthenticated access to a lega… |
CVE-2026-1749 | Medium | 6.8 | 2026-05-09 | There is an Access Control Vulnerability in some HikCentral Professional versions. This could allow an unauthenticated user to obtain the admin permission. |
CVE-2026-42205 | High | 8.8 | 2026-05-08 | Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.31.2, a broken access control vulnerability was identified in the ActionsC… |
CVE-2026-41487 | Medium | 5.4 | 2026-05-08 | Langfuse is an open source large language model engineering platform. From version 3.68.0 to before version 3.167.0, there is a role-based-access control flaw… |
CVE-2026-41491 | High | 8.1 | 2026-05-08 | Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. From versions 1.3.0 to before 1.15.14, 1.16.0-rc.1 to be… |
CVE-2026-8069 | High | 7.8 | 2026-05-08 | PredatorSense version 3.00.3136 to 3.00.3196 contain Local Privilege Escalation (LPE) vulnerability.The program exposes a Windows Named Pipe that uses a custom… |
CVE-2025-69691 | Critical | 9.9 | 2026-05-08 | Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php. NOTE: the Supplier disputes this because the API call is only available… |
CVE-2026-42278 | | 2026-05-08 | UltraDAG is a minimal DAG-BFT blockchain in Rust. Prior to commit fb6ef59, the UltraDAG StateEngine implementation of SmartTransferTx contains a critical logic… | |
CVE-2026-41900 | High | 8.8 | 2026-05-08 | OpenLearnX is an open-source, decentralized learning and assessment platform. Prior to version 2.0.3, a remote code execution (RCE) vulnerability was identifie… |
CVE-2026-41646 | Medium | 5.5 | 2026-05-08 | Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From version 3.0.0 to before version 3.8.0, a vulnerability in Nuclei's JavaScript protocol… |
CVE-2026-8127 | Medium | 6.3 | 2026-05-08 | A vulnerability has been found in eladmin up to 2.7. Impacted is the function checkLevel of the file /rest/UserController.java of the component Users API Endpo… |
CVE-2026-35435 | High | 8.6 | 2026-05-07 | Improper access control in Azure AI Foundry M365 published agents allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-33109 | Critical | 9.9 | 2026-05-07 | Improper access control in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code over a network. |
CVE-2026-37709 | Critical | 9.8 | 2026-05-07 | Insecure Permissions vulnerability in grokability snipe-it v.8.4.0 and before and fixed after 2026-03-10 commit 676a9958 allows a remote attacker to execute ar… |
CVE-2026-5788 | High | 7.0 | 2026-05-07 | An Improper Access Control in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to invoke arbitrary methods. |
CVE-2026-5786 | High | 8.8 | 2026-05-07 | An Improper Access Control vulnerability in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote authenticated attacker to gain adminis… |
CVE-2026-41641 | High | 7.2 | 2026-05-07 | NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.39, the checkSQL() valida… |
CVE-2026-8033 | Medium | 5.3 | 2026-05-06 | A vulnerability has been found in PicoTronica e-Clinic Healthcare System ECHS 5.7. This affects an unknown function of the file /cdemos/echs/api/v2/ of the com… |
CVE-2026-7959 | Low | 3.1 | 2026-05-06 | Inappropriate implementation in Navigation in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass… |
CVE-2026-20167 | High | 7.7 | 2026-05-06 | A vulnerability in the web-based management interface of Cisco IoT Field Network Director could allow an authenticated, remote attacker with low privileges to… |
CVE-2026-8028 | Low | 3.7 | 2026-05-06 | A vulnerability was detected in FlowiseAI Flowise up to 3.0.12. This affects the function verify of the file packages/server/src/enterprise/services/account.se… |
CVE-2026-8026 | Low | 3.7 | 2026-05-06 | A security flaw has been discovered in FlowiseAI Flowise up to 3.0.12. Affected is the function Login of the file packages/server/src/enterprise/services/accou… |
CVE-2024-52911 | High | 7.5 | 2026-05-05 | Bitcoin Core through 28.x has a security issue, the details of which are not disclosed. The earliest affected version is 0.14. |
CVE-2026-42222 | High | 8.1 | 2026-05-04 | Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated bootstrap takeover exists in nginx-ui during the initial instal… |
CVE-2025-67796 | High | 8.1 | 2026-05-04 | IKUS Rdiffweb before 2.10.5 has an improper authorization flaw that allows an attacker with any valid or stolen access token to act as other users. The API doe… |
CVE-2026-42812 | Critical | 9.9 | 2026-05-04 | In Apache Iceberg, the table's metadata files are control files: they tell readers which data files belong to the table and which table version to read. `wr… |
CVE-2026-7733 | High | 7.3 | 2026-05-04 | A flaw has been found in funadmin up to 7.1.0-rc6. This affects the function UploadService::chunkUpload of the file app/common/service/UploadService.php of the… |
CVE-2026-7732 | Medium | 6.3 | 2026-05-04 | A vulnerability was detected in code-projects BloodBank Managing System 1.0. The impacted element is an unknown function of the file request_blood.php. The man… |
CVE-2026-7711 | High | 7.3 | 2026-05-04 | A weakness has been identified in MindsDB up to 26.01. This impacts the function exec of the file mindsdb/integrations/handlers/byom_handler/proc_wrapper.py of… |
CVE-2026-7696 | Medium | 6.3 | 2026-05-03 | A vulnerability was found in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 1.3.0. This impacts an unknown function of the fil… |
CVE-2026-7686 | Medium | 5.3 | 2026-05-03 | A vulnerability was found in eyeo Adblock Plus up to 4.36.2 on Chrome. Affected by this vulnerability is the function postMessage of the file premium.preload.j… |
CVE-2026-7673 | Medium | 4.7 | 2026-05-03 | A vulnerability was detected in crmeb_java up to 1.3.4. This vulnerability affects unknown code of the file crmeb/crmeb-service/src/main/java/com/zbkj/service/… |
CVE-2026-37526 | High | 7.8 | 2026-05-01 | AGL app-framework-binder (afb-daemon) through v19.90.0 allows any local process to execute privileged supervision commands (Exit, Do, Sclose, Config, Trace, De… |
CVE-2026-7578 | Medium | 4.7 | 2026-05-01 | A weakness has been identified in MacCMS Pro up to 2022.1.3. This vulnerability affects the function install of the file /admi.php/admin/addon/add.html of the… |
CVE-2026-2311 | Medium | 6.4 | 2026-04-30 | IBM i 7.6, 7.5, 7.4, 7.3, and 7.2 s vulnerable to privilege escalation caused by an invalid IBM i Web Administration GUI authorization check. A malicious acto… |
CVE-2026-40904 | High | 8.1 | 2026-04-30 | Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, Chartbrew expo… |