CWE-284 · Improper Access Control (page 36)
Page 36 of 82 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-28880 | Medium | 6.5 | 2026-03-25 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15… |
CVE-2026-28876 | High | 7.5 | 2026-03-25 | A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 a… |
CVE-2026-28863 | Medium | 6.5 | 2026-03-25 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.4 and iPadOS 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. An app… |
CVE-2026-28862 | Medium | 5.3 | 2026-03-25 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tah… |
CVE-2026-28856 | Medium | 4.6 | 2026-03-25 | The issue was addressed with improved authentication. This issue is fixed in iOS 26.4 and iPadOS 26.4, visionOS 26.4, watchOS 26.4. An attacker with physical a… |
CVE-2026-28855 | High | 7.5 | 2026-03-25 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3. An app may be able to access… |
CVE-2026-28838 | Medium | 5.3 | 2026-03-25 | A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An… |
CVE-2026-28837 | High | 7.5 | 2026-03-25 | A logic issue was addressed with improved checks. This issue is fixed in macOS Tahoe 26.4. An app may be able to access sensitive user data. |
CVE-2026-28833 | Medium | 6.2 | 2026-03-25 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. An app may be… |
CVE-2026-28828 | Medium | 5.3 | 2026-03-25 | A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app m… |
CVE-2026-28824 | Medium | 5.3 | 2026-03-25 | An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app… |
CVE-2026-28823 | Medium | 4.9 | 2026-03-25 | A path handling issue was addressed with improved validation. This issue is fixed in macOS Tahoe 26.4. An app with root privileges may be able to delete protec… |
CVE-2026-28818 | Medium | 5.3 | 2026-03-25 | A logging issue was addressed with improved data redaction. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be a… |
CVE-2026-20697 | Medium | 5.3 | 2026-03-25 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may… |
CVE-2026-20684 | Low | 3.3 | 2026-03-25 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.4. An app may bypass Gatekeeper checks. |
CVE-2026-20632 | Medium | 5.3 | 2026-03-25 | A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Tahoe 26.4. An app may be able to… |
CVE-2026-20622 | High | 7.5 | 2026-03-25 | A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3. An… |
CVE-2025-43534 | Medium | 6.8 | 2026-03-25 | A path handling issue was addressed with improved validation. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.2 and iPadOS 26.2. A user with physic… |
CVE-2026-33316 | High | 8.1 | 2026-03-24 | Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, a flaw in Vikunja’s password reset logic allows disabled users to regai… |
CVE-2026-33484 | High | 7.5 | 2026-03-24 | Langflow is a tool for building and deploying AI-powered agents and workflows. In versions 1.0.0 through 1.8.1, the `/api/v1/files/images/{flow_id}/{file_name}… |
CVE-2026-33309 | Critical | 9.9 | 2026-03-24 | Langflow is a tool for building and deploying AI-powered agents and workflows. Versions 1.2.0 through 1.8.1 have a bypass of the patch for CVE-2025-68478 (Exte… |
CVE-2026-32299 | High | 7.5 | 2026-03-23 | Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0… |
CVE-2026-0898 | | 2026-03-23 | An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robot Studio developers who are automating Google Chrome and Microsoft Edge… | |
CVE-2026-33478 | Critical | 10.0 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, multiple vulnerabilities in AVideo's CloneSite plugin chain together to all… |
CVE-2026-4586 | Medium | 6.3 | 2026-03-23 | A vulnerability was found in CodePhiliaX Chat2DB up to 0.3.7. This affects the function Upload of the file chat2db-server/chat2db-server-web/chat2db-server-web… |
CVE-2026-4628 | Medium | 4.3 | 2026-03-23 | A flaw was found in Keycloak. An improper Access Control vulnerability in Keycloak’s User-Managed Access (UMA) resource_set endpoint allows attackers with vali… |
CVE-2026-4536 | High | 7.3 | 2026-03-22 | A vulnerability was found in Acrel Environmental Monitoring Cloud Platform 1.1.0. This issue affects some unknown processing. Performing a manipulation results… |
CVE-2026-4514 | Medium | 6.3 | 2026-03-21 | A flaw has been found in PbootCMS up to 3.2.12. Affected by this issue is some unknown functionality of the file apps/admin/controller/system/UserController.ph… |
CVE-2026-4505 | Medium | 6.3 | 2026-03-20 | A vulnerability has been found in eosphoros-ai DB-GPT up to 0.7.5. This issue affects the function module_plugin.refresh_plugins of the file packages/dbgpt-ser… |
CVE-2026-32768 | Critical | 9.9 | 2026-03-20 | Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. In versions prior to 0.6.5, due to a miswritten NetworkPolicy, a ma… |
CVE-2026-32938 | Critical | 9.9 | 2026-03-20 | SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the /api/lute/html2BlockDOM on the desktop copies local files pointed to by file… |
CVE-2026-33062 | High | 7.5 | 2026-03-20 | free5GC is an open source 5G core network. free5GC NRF prior to version 1.4.2 has an Improper Input Validation vulnerability leading to Denial of Service. All… |
CVE-2026-32769 | Critical | 9.8 | 2026-03-20 | Fullchain is an umbrella project for deploying a ready-to-use CTF platform. In versions prior to 0.1.1, due to a mis-written NetworkPolicy, a malicious actor… |
CVE-2026-32761 | Medium | 6.5 | 2026-03-20 | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Versions 2.61.0 and be… |
CVE-2026-32760 | Critical | 9.8 | 2026-03-20 | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. In versions 2.61.2 and… |
CVE-2026-33393 | Medium | 4.3 | 2026-03-19 | Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the `allowed_spam_host_domains` check used `Strin… |
CVE-2026-32752 | Unrated | | 2026-03-19 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. In versions 1.8.208 and below, the ThreadPolicy::edit() method contains a br… |
CVE-2026-32038 | Critical | 9.8 | 2026-03-19 | OpenClaw before 2026.2.24 contains a sandbox network isolation bypass vulnerability that allows trusted operators to join another container's network namespace… |
CVE-2026-32737 | Critical | 10.0 | 2026-03-18 | Romeo gives the capability to reach high code coverage of Go ≥1.20 apps by helping to measure code coverage for functional and integration tests within GitHub… |
CVE-2026-32693 | High | 8.8 | 2026-03-18 | In Juju from version 3.0.0 through 3.6.18, the authorization of the "secret-set" tool is not performed correctly, which allows a grantee to update the secret c… |
CVE-2025-41258 | High | 8.0 | 2026-03-18 | LibreChat version 0.8.1-rc2 uses the same JWT secret for the user session mechanism and RAG API which compromises the service-level authentication of the RAG A… |
CVE-2026-32254 | High | 7.1 | 2026-03-18 | Kube-router is a turnkey solution for Kubernetes networking. Prior to version 2.8.0, Kube-router's proxy module does not validate externalIPs or loadBalancer I… |
CVE-2026-21994 | Critical | 9.8 | 2026-03-17 | Vulnerability in the Oracle Edge Cloud Infrastructure Designer and Visualisation Toolkit product of Oracle Open Source Projects (component: Desktop). The sup… |
CVE-2026-30707 | High | 8.1 | 2026-03-17 | An issue was discovered in SpeedExam Online Examination System (SaaS) after v.FEV2026. It allows Broken Access Control via the ReviewAnswerDetails ASP.NET Page… |
CVE-2025-69727 | Medium | 5.3 | 2026-03-16 | An Incorrect Access Control vulnerability exists in INDEX-EDUCATION PRONOTE prior to 2025.2.8. The affected components (index.js and composeUrlImgPhotoIndividu… |
CVE-2026-4221 | High | 7.3 | 2026-03-16 | A vulnerability was found in Tiandy Easy7 Integrated Management Platform 7.17.0. This affects an unknown part of the file /rest/file/uploadLedImage of the comp… |
CVE-2026-4220 | High | 7.3 | 2026-03-16 | A vulnerability has been found in Technologies Integrated Management Platform 7.17.0. Affected by this issue is some unknown functionality of the file /SetWebp… |
CVE-2026-4218 | Low | 2.5 | 2026-03-16 | A vulnerability was detected in myAEDES App up to 1.18.4 on Android. Affected is an unknown function of the file aedes/me/beta/utils/EngageBayUtils.java of the… |
CVE-2026-4201 | High | 7.3 | 2026-03-16 | A weakness has been identified in glowxq glowxq-oj up to 6f7c723090472057252040fd2bbbdaa1b5ed2393. This vulnerability affects the function Upload of the file b… |
CVE-2026-4194 | High | 7.3 | 2026-03-16 | A vulnerability was detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-3… |
CVE-2026-4193 | High | 7.3 | 2026-03-16 | A security vulnerability has been detected in D-Link DIR-823G 1.0.2B05. The affected element is the function GetDDNSSettings/GetDeviceDomainName/GetDeviceSetti… |
CVE-2026-4191 | High | 7.3 | 2026-03-16 | A flaw has been found in JawherKl node-api-postgres up to 2.5. Affected is the function path.extname of the file index.js of the component Profile Picture Hand… |
CVE-2026-4180 | High | 7.3 | 2026-03-16 | A vulnerability was identified in D-Link DIR-816 1.10CNB05. The impacted element is an unknown function of the file redirect.asp of the component goahead. The… |
CVE-2026-3111 | | 2026-03-16 | Insecure Direct Object Reference (IDOR) vulnerability in Campus Educativa specifically at the endpoint '/archivos/usuarios/[ID]/[username]/thumb_AAxAA.jpg' (tr… | |
CVE-2026-3110 | | 2026-03-16 | Insecure Direct Object Reference (IDOR) vulnerability in Campus Educativa specifically at the endpoint '/administracion/admin_usuarios.cgi?filtro_estado=T&wAcc… | |
CVE-2026-32720 | | 2026-03-16 | The CTFer.io Monitoring component is in charge of the collection, process and storage of various signals (i.e. logs, metrics and distributed traces). Prior to… | |
CVE-2026-0977 | Medium | 5.1 | 2026-03-16 | IBM CICS Transaction Gateway for Multiplatforms 9.3 and 10.1 could allow a user to transfer or view files due to improper access controls. |
CVE-2026-4105 | Medium | 6.7 | 2026-03-13 | A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class paramet… |
CVE-2026-32138 | High | 8.2 | 2026-03-12 | NEXULEAN is a cybersecurity portfolio & service platform for an Ethical Hacker, AI Enthusiast, and Penetration Tester. Prior to 2.0.0, a security vulnerability… |
CVE-2026-21667 | Critical | 9.9 | 2026-03-12 | A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server. |
CVE-2026-21666 | Critical | 9.9 | 2026-03-12 | A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server. |
CVE-2026-3940 | Medium | 5.3 | 2026-03-11 | Insufficient policy enforcement in DevTools in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions via a crafted H… |
CVE-2026-3939 | Medium | 5.3 | 2026-03-11 | Insufficient policy enforcement in PDF in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions via a crafted PDF fi… |
CVE-2026-3938 | Medium | 4.3 | 2026-03-11 | Insufficient policy enforcement in Clipboard in Google Chrome prior to 146.0.7680.71 allowed a remote attacker who had compromised the renderer process to leak… |
CVE-2026-3934 | Medium | 6.5 | 2026-03-11 | Insufficient policy enforcement in ChromeDriver in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass same origin policy via a crafted HT… |
CVE-2026-3932 | High | 7.5 | 2026-03-11 | Insufficient policy enforcement in PDF in Google Chrome on Android prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions via a cra… |
CVE-2026-27591 | Critical | 9.9 | 2026-03-11 | Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Prior to 1.0.477, 1.1.12, and 1.2.12, Winter CMS allowed auth… |
CVE-2026-32102 | Medium | 6.5 | 2026-03-11 | OliveTin gives access to predefined shell commands from a web interface. In 3000.10.2 and earlier, OliveTin’s live EventStream broadcasts execution events and… |
CVE-2025-66956 | Critical | 9.9 | 2026-03-11 | Insecure Access Control in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote attackers to access and execute attachments via a… |
CVE-2026-31874 | Critical | 9.8 | 2026-03-11 | Taskosaur is an open source project management platform with conversational AI for task execution in-app. In 1.0.0, the application does not properly validate… |
CVE-2026-24509 | Low | 3.6 | 2026-03-11 | Dell Alienware Command Center (AWCC), versions prior to 6.12.24.0, contain an Improper Access Control vulnerability. A low privileged attacker with local acces… |
CVE-2026-31872 | High | 7.5 | 2026-03-11 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.6 and 8.6.32, the protectedFields… |
CVE-2026-3429 | Medium | 4.2 | 2026-03-11 | A flaw was identified in the Account REST API of Keycloak that allows a user authenticated at a lower security level to perform sensitive actions intended only… |
CVE-2025-68623 | High | 8.8 | 2026-03-11 | In Microsoft DirectX End-User Runtime Web Installer 9.29.1974.0, a low-privilege user can replace an executable file during the installation process, which may… |
CVE-2026-28803 | Medium | 6.5 | 2026-03-11 | Open Forms allows users create and publish smart forms. Prior to 3.3.13 and 3.4.5, to be able to cosign, the cosigner receives an e-mail with instructions or a… |
CVE-2026-31834 | High | 7.2 | 2026-03-10 | Umbraco is an ASP.NET CMS. From 15.3.1 to before 16.5.1 and 17.2.2, A privilege escalation vulnerability has been identified in Umbraco CMS. Under certain cond… |
CVE-2026-31815 | Medium | 5.3 | 2026-03-10 | Unicorn adds modern reactive component functionality to your Django templates. Prior to 0.67.0, component state manipulation is possible in django-unicorn due… |
CVE-2026-30966 | Critical | 10.0 | 2026-03-10 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.7 and 8.6.20, Parse Server's inter… |
CVE-2026-30962 | Medium | 6.5 | 2026-03-10 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.6 and 8.6.19, the validation for p… |
CVE-2026-0108 | Medium | 4.0 | 2026-03-10 | The register protection of the PowerVR GPU is incorrectly configured. This could lead to local information disclosure with no additional execution privileges n… |
CVE-2026-2742 | Medium | 5.3 | 2026-03-10 | An authentication bypass vulnerability exists in Vaadin 14.0.0 through 14.14.0, 23.0.0 through 23.6.6, 24.0.0 through 24.9.7 and 25.0.0 through 25.0.1, applica… |
CVE-2026-25176 | High | 7.8 | 2026-03-10 | Improper access control in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2026-24290 | High | 7.8 | 2026-03-10 | Improper access control in Windows Projected File System allows an authorized attacker to elevate privileges locally. |
CVE-2026-23660 | High | 7.8 | 2026-03-10 | Improper access control in Azure Portal Windows Admin Center allows an authorized attacker to elevate privileges locally. |
CVE-2026-22628 | Medium | 5.3 | 2026-03-10 | An improper access control vulnerability in Fortinet FortiSwitchAXFixed 1.0.0 through 1.0.1 may allow an authenticated admin to execute system commands via a s… |
CVE-2026-21262 | High | 8.8 | 2026-03-10 | Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network. |
CVE-2026-30926 | High | 7.1 | 2026-03-10 | SiYuan is a personal knowledge management system. Prior to 3.5.10, a privilege escalation vulnerability exists in the publish service of SiYuan Note that allow… |
CVE-2025-62166 | High | 7.5 | 2026-03-09 | FreshRSS is a free, self-hostable RSS aggregator. Prior 1.28.0, a bug in the auth logic related to master authentication tokens, this restriction is bypassed… |
CVE-2026-30140 | High | 7.5 | 2026-03-09 | An incorrect access control vulnerability exists in Tenda W15E V02.03.01.26_cn. An unauthenticated attacker can access the /cgi-bin/DownloadCfg/RouterCfm.jpg e… |
CVE-2026-3800 | Medium | 6.3 | 2026-03-09 | A vulnerability has been found in SourceCodester/janobe Resort Reservation System 1.0. Affected is the function doInsert of the file /controller.php?action=add… |
CVE-2026-3797 | Medium | 6.3 | 2026-03-09 | A security vulnerability has been detected in Tiandy Video Surveillance System 视频监控平台 7.17.0. The impacted element is the function uploadFile of the file /src/… |
CVE-2026-3796 | Medium | 5.3 | 2026-03-09 | A weakness has been identified in Qi-ANXIN QAX Virus Removal up to 2025-10-22. The affected element is the function ZwTerminateProcess in the library QKSecureI… |
CVE-2026-3749 | Medium | 6.3 | 2026-03-08 | A weakness has been identified in Bytedesk up to 1.3.9. This vulnerability affects the function handleFileUpload of the file source-code/src/main/java/com/byte… |
CVE-2026-3748 | Medium | 6.3 | 2026-03-08 | A security flaw has been discovered in Bytedesk up to 1.3.9. This affects the function uploadFile of the file source-code/src/main/java/com/bytedesk/core/uploa… |
CVE-2026-30859 | Medium | 5.3 | 2026-03-07 | WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.2.12, a broken access control vulnerabi… |
CVE-2026-30855 | High | 8.8 | 2026-03-07 | WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.3.2, an authorization bypass in tenant… |
CVE-2026-3668 | Low | 3.1 | 2026-03-07 | A weakness has been identified in Freedom Factory dGEN1 up to 20260221. This affects the function AndroidEthereum of the component org.ethosmobile.webpwaemul… |
CVE-2026-30244 | High | 7.5 | 2026-03-06 | Plane is an an open-source project management tool. Prior to version 1.2.2, unauthenticated attackers can enumerate workspace members and extract sensitive inf… |
CVE-2025-70363 | High | 7.5 | 2026-03-06 | Incorrect access control in the REST API of Ibexa & Ciril GROUP eZ Platform / Ciril Platform 2.x allows unauthenticated attackers to access sensitive data via… |
CVE-2026-29061 | Medium | 5.4 | 2026-03-06 | Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, a privilege escalation vulnerability in t… |