CWE-284 · Improper Access Control (page 37)
Page 37 of 82 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-29060 | Medium | 5.0 | 2026-03-06 | Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, a registered user without privileges to c… |
CVE-2026-28682 | Medium | 6.4 | 2026-03-06 | Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, the upload status SSE implementation on /… |
CVE-2026-25877 | Medium | 6.5 | 2026-03-06 | Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.1, the appl… |
CVE-2026-29188 | Critical | 9.1 | 2026-03-05 | File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to ver… |
CVE-2026-29077 | High | 7.1 | 2026-03-05 | Frappe is a full-stack web application framework. Prior to versions 15.98.0 and 14.100.0, due to a lack of validation when sharing documents, a user could shar… |
CVE-2026-28410 | High | 8.1 | 2026-03-05 | The Graph is an indexing protocol for querying networks like Ethereum, IPFS, Polygon, and other blockchains. Prior to version 3.0.0, a flaw in the token vestin… |
CVE-2025-70614 | High | 8.1 | 2026-03-05 | OpenCode Systems OC Messaging / USSD Gateway OC Release 6.32.2 contains a broken access control vulnerability in the web-based control panel allowing authentic… |
CVE-2026-28790 | High | 7.5 | 2026-03-05 | OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.0, OliveTin allows an unauthenticated guest to terminate runn… |
CVE-2026-27723 | Medium | 4.3 | 2026-03-05 | OpenProject is an open-source, web-based project management software. Prior to versions 17.0.5 and 17.1.2, an attacker can create wiki pages belonging to unper… |
CVE-2026-26418 | High | 7.5 | 2026-03-05 | Missing authentication and authorization in the web API of Tata Consultancy Services Cognix Recon Client v3.0 allows remote attackers to access application fun… |
CVE-2026-26417 | High | 8.1 | 2026-03-05 | A broken access control vulnerability in the password reset functionality of Tata Consultancy Services Cognix Recon Client v3.0 allows authenticated users to r… |
CVE-2026-25702 | High | 7.3 | 2026-03-05 | A Improper Access Control vulnerability in the kernel of SUSE SUSE Linux Enterprise Server 12 SP5 breaks nftables, causing firewall rules applied via nftables… |
CVE-2026-3543 | High | 8.8 | 2026-03-04 | Inappropriate implementation in V8 in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds memory access via a… |
CVE-2026-3542 | High | 8.8 | 2026-03-04 | Inappropriate implementation in WebAssembly in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform out of bounds memory access via a cra… |
CVE-2026-3541 | High | 8.8 | 2026-03-04 | Inappropriate implementation in CSS in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform an out of bounds memory read via a crafted HT… |
CVE-2026-20073 | Medium | 5.8 | 2026-03-04 | A vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unau… |
CVE-2026-20007 | Medium | 5.8 | 2026-03-04 | A vulnerability in the Snort 2 and Snort 3 deep packet inspection of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote… |
CVE-2024-55025 | Medium | 6.5 | 2026-03-03 | Incorrect access control in the VNC component of Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 allows unauthorized attackers to access the HMI system. |
CVE-2024-55019 | High | 7.5 | 2026-03-03 | Incorrect access control in the component download_wb.cgi of Weintek cMT-3072XH2 easyweb Web Version v2.1.53, OS v20231011 allows unauthenticated attack to dow… |
CVE-2026-0012 | Medium | 6.2 | 2026-03-02 | In setHideSensitive of ExpandableNotificationRow.java, there is a possible contact name leak due due to a logic error in the code. This could lead to local inf… |
CVE-2025-48619 | High | 8.4 | 2026-03-02 | In multiple functions of ContentProvider.java, there is a possible way for an app with read-only access to truncate files due to a logic error in the code. Thi… |
CVE-2025-15597 | Medium | 6.3 | 2026-03-02 | A vulnerability has been found in Dataease SQLBot up to 1.4.0. This affects an unknown function of the file backend/apps/system/api/assistant.py of the compone… |
CVE-2026-28415 | Medium | 4.3 | 2026-02-27 | Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, the _redirect_to_target() function in Gradio's OAuth flow accep… |
CVE-2026-3268 | Medium | 5.4 | 2026-02-26 | A vulnerability was detected in psi-probe PSI Probe up to 5.3.0. The affected element is an unknown function of the file psi-probe-core/src/main/java/psiprobe/… |
CVE-2026-28276 | High | 7.5 | 2026-02-26 | Initiative is a self-hosted project management platform. An access control vulnerability exists in Initiative versions prior to 0.32.2 where uploaded documents… |
CVE-2026-28230 | Medium | 6.3 | 2026-02-26 | SteVe is an open-source EV charging station management system. In versions up to and including 3.11.0, when a charger sends a StopTransaction message, SteVe lo… |
CVE-2026-28215 | Critical | 9.1 | 2026-02-26 | hoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, an unauthenticated attacker can overwrite the entire infrastructure configur… |
CVE-2026-28218 | Medium | 5.4 | 2026-02-26 | Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, fail-open access control in Data Explorer plugin allows a… |
CVE-2026-27449 | High | 7.5 | 2026-02-26 | Umbraco Engage is a business intelligence platform. A vulnerability has been identified in Umbraco Engage prior to versions 16.2.1 and 17.1.1 where certain API… |
CVE-2026-27152 | Low | 3.8 | 2026-02-26 | Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, DM communication-preference bypass when adding members vi… |
CVE-2026-2356 | Medium | 5.3 | 2026-02-26 | The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Refere… |
CVE-2026-27975 | Critical | 9.8 | 2026-02-26 | Ajenti is a Linux and BSD modular server admin panel. Prior to version 2.2.13, an unauthenticated user could gain access to a server to execute arbitrary code… |
CVE-2026-22728 | Medium | 4.9 | 2026-02-26 | Bitnami Sealed Secrets is vulnerable to a scope-widening attack during the secret rotation (/v1/rotate) flow. The rotation handler derives the sealing scope fo… |
CVE-2026-3209 | Medium | 6.3 | 2026-02-25 | A vulnerability has been found in fosrl Pangolin up to 1.15.4-s.3. This affects the function verifyRoleAccess/verifyApiKeyRoleAccess of the component Role Hand… |
CVE-2026-3187 | Medium | 6.3 | 2026-02-25 | A vulnerability was identified in feiyuchuixue sz-boot-parent up to 1.3.2-beta. Affected by this issue is some unknown functionality of the file /api/admin/sys… |
CVE-2026-27624 | High | 7.2 | 2026-02-25 | Coturn is a free open source implementation of TURN and STUN Server. Coturn is commonly configured to block loopback and internal ranges using "denied-peer-ip"… |
CVE-2026-24896 | Medium | 6.5 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, a Broken Access Control vulner… |
CVE-2025-63409 | High | 8.8 | 2026-02-24 | Privilege escalation and improper access control in GCOM EPON 1GE C00R371V00B01 allows remote authenticated users to modify administrator only settings and ext… |
CVE-2026-2768 | Critical | 10.0 | 2026-02-24 | Sandbox escape in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. |
CVE-2026-25966 | Medium | 5.9 | 2026-02-24 | ImageMagick is free and open-source software used for editing and manipulating digital images. The shipped "secure" security policy includes a rule intended to… |
CVE-2026-3025 | High | 7.3 | 2026-02-23 | A flaw has been found in ShuoRen Smart Heating Integrated Management Platform 1.0.0. Affected by this vulnerability is an unknown functionality of the file /MP… |
CVE-2026-2983 | High | 7.3 | 2026-02-23 | A vulnerability was determined in SourceCodester Student Result Management System 1.0. The impacted element is an unknown function of the file /admin/core/impo… |
CVE-2026-2979 | Medium | 6.3 | 2026-02-23 | A flaw has been found in FastApiAdmin up to 2.2.0. This issue affects the function user_avatar_upload_controller of the file /backend/app/api/v1/module_system/… |
CVE-2026-2978 | Medium | 6.3 | 2026-02-23 | A vulnerability was detected in FastApiAdmin up to 2.2.0. This vulnerability affects the function upload_file_controller of the file /backend/app/api/v1/module… |
CVE-2026-2977 | Medium | 6.3 | 2026-02-23 | A security vulnerability has been detected in FastApiAdmin up to 2.2.0. This affects the function upload_controller of the file /backend/app/api/v1/module_comm… |
CVE-2026-2976 | Medium | 4.3 | 2026-02-23 | A weakness has been identified in FastApiAdmin up to 2.2.0. Affected by this issue is the function download_controller of the file /backend/app/api/v1/module_c… |
CVE-2026-2975 | Medium | 5.3 | 2026-02-23 | A security flaw has been discovered in FastApiAdmin up to 2.2.0. Affected by this vulnerability is the function reset_api_docs of the file /backend/app/plugin/… |
CVE-2026-2938 | High | 7.3 | 2026-02-22 | A vulnerability has been found in SourceCodester Student Result Management System 1.0. The affected element is an unknown function of the file /srms/script/adm… |
CVE-2026-2894 | Medium | 5.3 | 2026-02-21 | A vulnerability was identified in funadmin up to 7.1.0-rc4. Affected by this vulnerability is the function getMember of the file app/frontend/view/login/forget… |
CVE-2026-27471 | Critical | 9.1 | 2026-02-21 | ERP is a free and open source Enterprise Resource Planning tool. In versions up to 15.98.0 and 16.0.0-rc.1 and through 16.6.0, certain endpoints lacked access… |
CVE-2026-2861 | Medium | 5.3 | 2026-02-21 | A vulnerability was detected in Foswiki up to 2.1.10. The affected element is an unknown function of the component Changes/Viewfile/Oops. The manipulation resu… |
CVE-2026-2852 | Medium | 6.3 | 2026-02-20 | A vulnerability was identified in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This issue affects the function addSales/updateSales/deleteS… |
CVE-2026-2851 | Medium | 6.3 | 2026-02-20 | A vulnerability was determined in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This vulnerability affects the function addInport/updateInpo… |
CVE-2026-2850 | Medium | 6.3 | 2026-02-20 | A vulnerability was found in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This affects the function addCustomer/updateCustomer/deleteCustom… |
CVE-2026-2849 | Medium | 5.4 | 2026-02-20 | A vulnerability has been found in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. Affected by this issue is the function deleteCache/removeAll… |
CVE-2026-21627 | | 2026-02-20 | The vulnerability was rooted in how the Tassos Framework plugin handled specific AJAX requests through Joomla’s com_ajax entry point. Under certain conditions… | |
CVE-2026-26977 | Medium | 5.3 | 2026-02-20 | Frappe Learning Management System (LMS) is a learning system that helps users structure their content. In versions 2.44.0 and below, unauthorized users are abl… |
CVE-2026-26328 | Medium | 6.5 | 2026-02-20 | OpenClaw is a personal AI assistant. Prior to version 2026.2.14, under iMessage `groupPolicy=allowlist`, group authorization could be satisfied by sender ident… |
CVE-2026-26325 | High | 7.2 | 2026-02-19 | OpenClaw is a personal AI assistant. Prior to version 2026.2.14, a mismatch between `rawCommand` and `command[]` in the node host `system.run` handler could ca… |
CVE-2026-21535 | High | 8.2 | 2026-02-19 | Improper access control in Microsoft Teams allows an unauthorized attacker to disclose information over a network. |
CVE-2026-25229 | Medium | 6.5 | 2026-02-19 | Gogs is an open source self-hosted Git service. Versions 0.13.4 and below have a broken access control vulnerability which allows authenticated users with writ… |
CVE-2025-12884 | Medium | 4.3 | 2026-02-19 | The Advanced Ads – Ad Manager & AdSense plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 2.0.14. This is due to the… |
CVE-2026-2684 | High | 7.3 | 2026-02-19 | A vulnerability was determined in Tsinghua Unigroup Electronic Archives System up to 3.2.210802(62532). The impacted element is an unknown function of the file… |
CVE-2026-2669 | Medium | 6.5 | 2026-02-18 | A vulnerability was determined in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260206. This impacts an unknown function of the file /dm/… |
CVE-2026-2668 | High | 7.3 | 2026-02-18 | A vulnerability was found in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260206. This affects an unknown function of the file /dm/dispa… |
CVE-2026-2667 | Medium | 5.3 | 2026-02-18 | A vulnerability has been found in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260206. The impacted element is an unknown function of th… |
CVE-2026-2666 | Medium | 4.7 | 2026-02-18 | A flaw has been found in mingSoft MCMS 6.1.1. The affected element is an unknown function of the file /ms/file/uploadTemplate.do of the component Template Arch… |
CVE-2026-2665 | Medium | 6.3 | 2026-02-18 | A vulnerability was detected in huanzi-qch base-admin up to 57a8126bb3353a004f3c7722089e3b926ea83596. Impacted is the function Upload of the file SysFileContro… |
CVE-2025-70064 | High | 8.8 | 2026-02-18 | PHPGurukul Hospital Management System v4.0 contains a Privilege Escalation vulnerability. A low-privileged user (Patient) can directly access the Administrator… |
CVE-2023-38005 | Medium | 4.3 | 2026-02-17 | IBM Cloud Pak System 2.3.3.6, 2.3.3.7, 2.3.4.0, 2.3.4.1, and 2.3.5.0 could allow an authenticated user to perform unauthorized tasks due to improper access con… |
CVE-2026-23595 | High | 8.8 | 2026-02-17 | An authentication bypass in the application API allows an unauthorized administrative account to be created. A remote attacker could exploit this vulnerability… |
CVE-2026-2592 | High | 7.7 | 2026-02-17 | The Zarinpal Gateway for WooCommerce plugin for WordPress is vulnerable to Improper Access Control to Payment Status Update in all versions up to and including… |
CVE-2026-2550 | Critical | 9.8 | 2026-02-16 | A vulnerability was found in EFM iptime A6004MX 14.18.2. Affected is the function commit_vpncli_file_upload of the file /cgi/timepro.cgi. The manipulation resu… |
CVE-2026-2549 | High | 7.3 | 2026-02-16 | A vulnerability has been found in zhanghuanhao LibrarySystem 图书馆管理系统 up to 1.1.1. This impacts an unknown function of the file BookController.java. The manipul… |
CVE-2025-70866 | High | 8.8 | 2026-02-13 | LavaLite CMS 10.1.0 is vulnerable to Incorrect Access Control. An authenticated user with low-level privileges (User role) can directly access the admin backen… |
CVE-2025-61879 | High | 7.7 | 2026-02-12 | In Infoblox NIOS through 9.0.7, a High-Privileged User Can Trigger an Arbitrary File Write via the Account Creation Mechanism. |
CVE-2025-69634 | Critical | 9.0 | 2026-02-12 | Cross Site Request Forgery vulnerability in Dolibarr ERP & CRM v.22.0.9 allows a remote attacker to escalate privileges via the notes field in perms.php NOTE… |
CVE-2026-23856 | High | 7.8 | 2026-02-12 | Dell iDRAC Service Module (iSM) for Windows, versions prior to 6.0.3.1, and Dell iDRAC Service Module (iSM) for Linux, versions prior to 5.4.1.1, contain an Im… |
CVE-2026-20642 | Low | 2.4 | 2026-02-11 | An input validation issue was addressed. This issue is fixed in iOS 26.3 and iPadOS 26.3. A person with physical access to an iOS device may be able to access… |
CVE-2026-20638 | Medium | 5.5 | 2026-02-11 | A logic issue was addressed with improved checks. This issue is fixed in iOS 26.3 and iPadOS 26.3. A user with Live Caller ID app extensions turned off could h… |
CVE-2026-20628 | High | 7.1 | 2026-02-11 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15… |
CVE-2026-20603 | Medium | 4.4 | 2026-02-11 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Tahoe 26.3. An app with root privileges may be able to… |
CVE-2026-20601 | Low | 3.3 | 2026-02-11 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.3. An app may be able to monitor keystrokes without user… |
CVE-2026-2250 | High | 7.5 | 2026-02-11 | The /dbviewer/ web endpoint in METIS WIC devices is exposed without authentication. A remote attacker can access and export the internal telemetry SQLite datab… |
CVE-2025-8025 | Critical | 9.8 | 2026-02-11 | Missing Authentication for Critical Function, Improper Access Control vulnerability in Dinosoft Business Solutions Dinosoft ERP allows Accessing Functionality… |
CVE-2025-29939 | | 2026-02-10 | Improper access control in secure encrypted virtualization (SEV) could allow a privileged attacker to write to the reverse map page (RMP) during secure nested… | |
CVE-2026-21255 | High | 8.8 | 2026-02-10 | Improper access control in Windows Hyper-V allows an authorized attacker to bypass a security feature locally. |
CVE-2026-21238 | High | 7.8 | 2026-02-10 | Improper access control in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2026-0653 | Medium | 6.5 | 2026-02-10 | On TP-Link Tapo C260 v1 and D235 v1, a guest‑level authenticated user can bypass intended access restrictions by sending crafted requests to a synchronization… |
CVE-2026-25231 | High | 7.5 | 2026-02-09 | FileRise is a self-hosted web file manager / WebDAV server. Versions prior to 3.3.0, the application contains an unauthenticated file read vulnerability due to… |
CVE-2026-2226 | Medium | 4.7 | 2026-02-09 | A vulnerability has been found in DouPHP up to 1.9. This issue affects some unknown processing of the file /admin/file.php of the component ZIP File Handler. S… |
CVE-2026-2213 | Medium | 4.7 | 2026-02-09 | A security flaw has been discovered in code-projects Online Music Site 1.0. Affected by this issue is some unknown functionality of the file /Administrator/PHP… |
CVE-2026-2183 | Medium | 6.3 | 2026-02-08 | A security vulnerability has been detected in Great Developers Certificate Generation System up to 97171bb0e5e22e52eacf4e4fa81773e5f3cffb73. This affects an un… |
CVE-2026-2164 | High | 7.3 | 2026-02-08 | A security flaw has been discovered in detronetdip E-commerce 1.0.0. This issue affects some unknown processing of the file /seller/assets/backend/profile/adda… |
CVE-2026-2148 | Medium | 5.3 | 2026-02-08 | A security vulnerability has been detected in Tenda AC21 16.03.08.16. Affected is an unknown function of the file /cgi-bin/DownloadFlash of the component Web M… |
CVE-2026-2147 | Medium | 5.3 | 2026-02-08 | A weakness has been identified in Tenda AC21 16.03.08.16. This impacts an unknown function of the file /cgi-bin/DownloadLog of the component Web Management Int… |
CVE-2026-2146 | Medium | 6.3 | 2026-02-08 | A security flaw has been discovered in guchengwuyue yshopmall up to 1.9.1. This affects the function updateAvatar of the file /api/users/updateAvatar of the co… |
CVE-2026-2133 | High | 7.3 | 2026-02-08 | A weakness has been identified in code-projects Online Music Site 1.0. Impacted is an unknown function of the file /Administrator/PHP/AdminUpdateCategory.php… |
CVE-2026-2207 | Medium | 5.3 | 2026-02-08 | A weakness has been identified in WeKan up to 8.20. This issue affects some unknown processing of the file server/publications/activities.js of the component A… |
CVE-2026-2206 | Medium | 6.3 | 2026-02-08 | A security flaw has been discovered in WeKan up to 8.20. This vulnerability affects unknown code of the file server/methods/fixDuplicateLists.js of the compone… |