CWE-284 · Improper Access Control (page 39)
Page 39 of 82 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-20825 | Medium | 4.4 | 2026-01-13 | Improper access control in Windows Hyper-V allows an authorized attacker to disclose information locally. |
CVE-2026-0386 | High | 7.5 | 2026-01-13 | Improper access control in Windows Deployment Services allows an unauthorized attacker to execute code over an adjacent network. |
CVE-2026-0881 | Critical | 10.0 | 2026-01-13 | Sandbox escape in the Messaging System component. This vulnerability was fixed in Firefox 147 and Thunderbird 147. |
CVE-2026-22033 | Medium | 5.4 | 2026-01-12 | Label Studio is a multi-type data labeling and annotation tool. In 1.22.0 and earlier, a persistent stored cross-site scripting (XSS) vulnerability exists in t… |
CVE-2025-15503 | High | 7.3 | 2026-01-10 | A security flaw has been discovered in Sangfor Operation and Maintenance Management System up to 3.0.8. The impacted element is an unknown function of the file… |
CVE-2026-22605 | Medium | 4.3 | 2026-01-10 | OpenProject is an open-source, web-based project management software. OpenProject versions prior to version 16.6.3, allowed users with the View Meetings permis… |
CVE-2025-46299 | Medium | 4.3 | 2026-01-09 | A memory initialization issue was addressed with improved memory handling. This issue is fixed in Safari 26.2, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS… |
CVE-2025-46297 | Medium | 5.5 | 2026-01-09 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.2. An app may be able to access protected files within an… |
CVE-2025-15495 | Medium | 4.7 | 2026-01-09 | A vulnerability was found in BiggiDroid Simple PHP CMS 1.0. This impacts an unknown function of the file /admin/editsite.php. The manipulation of the argument… |
CVE-2025-68716 | High | 8.4 | 2026-01-08 | KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 enable the SSH service enabled by default on the LAN interface. The root account is configured with no passwor… |
CVE-2026-22043 | Critical | 9.8 | 2026-01-08 | RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 through 1.0.0-alpha.78, a flawed `deny_only` short-circuit in RustFS IA… |
CVE-2026-21694 | Medium | 6.8 | 2026-01-08 | Titra is open source project time tracking software. Versions 0.99.49 and below have Improper Access Control, allowing users to view and edit other users' time… |
CVE-2025-69221 | Medium | 4.3 | 2026-01-07 | LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control when querying agent permissions. An authenticat… |
CVE-2025-69220 | High | 7.1 | 2026-01-07 | LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control for file uploads to an agents file context and… |
CVE-2026-0643 | High | 7.3 | 2026-01-07 | A flaw has been found in projectworlds House Rental and Property Listing 1.0. Impacted is an unknown function of the file /app/register.php?action=reg of the c… |
CVE-2025-0980 | Medium | 6.4 | 2026-01-07 | Nokia SR Linux is vulnerable to an authentication vulnerability allowing unauthorized access to the JSON-RPC service. When exploited, an invalid validation al… |
CVE-2026-21635 | Medium | 5.3 | 2026-01-05 | An Improper Access Control could allow a malicious actor in Wi-Fi range to the EV Station Lite (v1.5.2 and earlier) to use WiFi AutoLink feature on a device th… |
CVE-2025-15448 | Medium | 6.3 | 2026-01-05 | A vulnerability was found in cld378632668 JavaMall up to 994f1e2b019378ec9444cdf3fce2d5b5f72d28f0. This impacts the function Upload of the file src/main/java/c… |
CVE-2026-0577 | Medium | 6.3 | 2026-01-04 | A flaw has been found in code-projects Online Product Reservation System 1.0. Affected by this vulnerability is an unknown functionality of the file /handgunne… |
CVE-2026-21447 | High | 7.1 | 2026-01-02 | Bagisto is an open source laravel eCommerce platform. Prior to version 2.3.10, an Insecure Direct Object Reference vulnerability in the customer order reorder… |
CVE-2026-0566 | Medium | 4.7 | 2026-01-02 | A security vulnerability has been detected in code-projects Content Management System 1.0. Impacted is an unknown function of the file /admin/edit_posts.php. T… |
CVE-2025-69284 | Medium | 4.3 | 2026-01-02 | Plane is an an open-source project management tool. In plane.io, a guest user doesn't have a permission to access https[:]//app[.]plane[.]so/[:]slug/settings… |
CVE-2026-0547 | Medium | 6.3 | 2026-01-02 | A vulnerability was found in PHPGurukul Online Course Registration up to 3.1. This issue affects some unknown processing of the file /admin/edit-student-profil… |
CVE-2025-15426 | High | 7.3 | 2026-01-02 | A vulnerability was identified in jackying H-ui.admin up to 3.1. This affects an unknown function in the library /lib/webuploader/0.1.5/server/preview.php. The… |
CVE-2025-15423 | Medium | 6.3 | 2026-01-02 | A vulnerability has been found in EmpireSoft EmpireCMS up to 8.0. Impacted is the function CheckSaveTranFiletype of the file e/class/connect.php. Such manipula… |
CVE-2025-15415 | Medium | 4.7 | 2026-01-01 | A vulnerability has been found in xnx3 wangmarket up to 6.4. The impacted element is the function uploadImage of the file /sits/uploadImage.do of the component… |
CVE-2025-15404 | Medium | 6.3 | 2026-01-01 | A security vulnerability has been detected in campcodes School File Management System 1.0. The affected element is an unknown function of the file /save_file.p… |
CVE-2025-15360 | Medium | 4.7 | 2025-12-30 | A vulnerability was determined in newbee-mall-plus 2.0.0. This impacts the function Upload of the file src/main/java/ltd/newbee/mall/controller/common/UploadCo… |
CVE-2025-69257 | Medium | 6.7 | 2025-12-30 | theshit is a command-line utility that automatically detects and fixes common mistakes in shell commands. Prior to version 0.1.1, the application loads custom… |
CVE-2025-15262 | Medium | 4.7 | 2025-12-30 | A security flaw has been discovered in BiggiDroid Simple PHP CMS 1.0. This impacts an unknown function of the file /admin/edit.php of the component Site Logo H… |
CVE-2023-32238 | Medium | 5.4 | 2025-12-30 | Vulnerability in CodexThemes TheGem (Elementor), CodexThemes TheGem (WPBakery).This issue affects TheGem (Elementor): from n/a before 5.8.1.1; TheGem (WPBakery… |
CVE-2025-15199 | Medium | 6.3 | 2025-12-29 | A security vulnerability has been detected in code-projects College Notes Uploading System 1.0. Impacted is an unknown function of the file /dashboard/userprof… |
CVE-2025-15197 | Medium | 4.7 | 2025-12-29 | A security flaw has been discovered in code-projects/anirbandutta9 Content Management System and News-Buzz 1.0. This vulnerability affects unknown code of the… |
CVE-2025-15152 | Medium | 6.3 | 2025-12-28 | A vulnerability was identified in h-moses moga-mall up to 392d631a5ef15962a9bddeeb9f1269b9085473fa. This vulnerability affects the function addProduct of the f… |
CVE-2025-15141 | Low | 3.1 | 2025-12-28 | A vulnerability was determined in Halo up to 2.21.10. This issue affects some unknown processing of the file /actuator of the component Configuration Handler… |
CVE-2025-15121 | Low | 2.4 | 2025-12-28 | A vulnerability has been found in JeecgBoot up to 3.9.0. The affected element is the function getDeptRoleByUserId of the file /sys/sysDepartRole/getDeptRoleByU… |
CVE-2025-15110 | Medium | 4.7 | 2025-12-27 | A vulnerability has been found in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. Affected is the function Upload of the file Admin/Home/Controller/… |
CVE-2025-15109 | High | 7.3 | 2025-12-27 | A flaw has been found in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. This impacts an unknown function of the file Public/javascripts/admin/plupl… |
CVE-2025-67015 | High | 7.5 | 2025-12-26 | Incorrect access control in Comtech EF Data CDM-625 / CDM-625A Advanced Satellite Modem with firmware v2.5.1 allows attackers to change the Administrator passw… |
CVE-2025-67014 | High | 7.5 | 2025-12-26 | Incorrect access control in DEV Systemtechnik GmbH DEV 7113 RF over Fiber Distribution System 32-0078 H.01 allows unauthenticated attackers to access an admini… |
CVE-2025-15086 | Medium | 4.3 | 2025-12-25 | A weakness has been identified in youlaitech youlai-mall 1.0.0/2.0.0. This impacts the function getMemberByMobile of the file mall-ums/ums-boot/src/main/java/c… |
CVE-2025-15084 | Low | 3.1 | 2025-12-25 | A vulnerability was identified in youlaitech youlai-mall 1.0.0/2.0.0. The impacted element is the function orderService.payOrder of the file mall-oms/oms-boot/… |
CVE-2025-15082 | Medium | 5.3 | 2025-12-25 | A vulnerability was found in TOZED ZLT M30s up to 1.47. Impacted is an unknown function of the file /reqproc/proc_post of the component Web Management Interfac… |
CVE-2025-15050 | Medium | 6.3 | 2025-12-24 | A security vulnerability has been detected in code-projects Student File Management System 1.0. This affects an unknown part of the file /save_file.php. Such m… |
CVE-2025-66736 | High | 7.1 | 2025-12-22 | youlai-boot V2.21.1 is vulnerable to Incorrect Access Control. The importUsers function in SysUserController.java does not perform a permission check on the cu… |
CVE-2025-66735 | High | 7.5 | 2025-12-22 | youlai-boot V2.21.1 is vulnerable to Incorrect Access Control. The getRoleForm function in SysRoleController.java does not perform permission checks, which may… |
CVE-2025-63664 | High | 7.5 | 2025-12-22 | Incorrect access control in the /api/v1/conversations/*/messages API of GT Edge AI Platform before v2.0.10-dev allows unauthorized attackers to access other us… |
CVE-2025-63663 | High | 7.5 | 2025-12-22 | Incorrect access control in the /api/v1/conversations/*/files API of GT Edge AI Platform before v2.0.10 allows unauthorized attackers to access other users' up… |
CVE-2025-15009 | Medium | 6.3 | 2025-12-22 | A flaw has been found in liweiyi ChestnutCMS up to 1.5.8. This vulnerability affects the function FilenameUtils.getExtension of the file /dev-api/common/upload… |
CVE-2025-66911 | Medium | 6.5 | 2025-12-19 | Turms IM Server v0.10.0-SNAPSHOT and earlier contains a broken access control vulnerability in the user online status query functionality. The handleQueryUserO… |
CVE-2025-64400 | Medium | 4.1 | 2025-12-18 | Control Panel provides an API for pre-registering into an enrollment and organization prior to a user's first login. The API for creating users checks that th… |
CVE-2025-63387 | High | 7.5 | 2025-12-18 | Dify v1.9.1 is vulnerable to Insecure Permissions. An unauthenticated attacker can directly send HTTP GET requests to the /console/api/system-features endpoint… |
CVE-2025-14885 | Medium | 6.3 | 2025-12-18 | A flaw has been found in SourceCodester Client Database Management System 1.0. This affects an unknown part of the file /user_leads.php of the component Leads… |
CVE-2025-67789 | Medium | 5.3 | 2025-12-17 | An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5. Authenticated users can retrieve the computer count of oth… |
CVE-2025-46292 | Medium | 5.5 | 2025-12-17 | This issue was addressed with additional entitlement checks. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2. An app may be able… |
CVE-2025-46288 | Medium | 5.5 | 2025-12-17 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2, watchOS 26.2… |
CVE-2025-46282 | Medium | 5.5 | 2025-12-17 | The issue was addressed with additional permissions checks. This issue is fixed in Safari 26.2, macOS Tahoe 26.2. An app may be able to access sensitive user d… |
CVE-2025-66397 | High | 8.3 | 2025-12-17 | ChurchCRM is an open-source church management system. Prior to version 6.5.3, the allowRegistration, acceptKiosk, reloadKiosk, and identifyKiosk functions in t… |
CVE-2025-14095 | Medium | 6.8 | 2025-12-17 | A "Privilege boundary violation" vulnerability is identified affecting multiple Radiometer Products. Exploitation of this vulnerability gives a user with physi… |
CVE-2025-11901 | | 2025-12-17 | An uncontrolled resource consumption vulnerability affects certain ASUS motherboards using Intel B460, B560, B660, B760, H410, H510, H610, H470, Z590, Z690, Z… | |
CVE-2025-14749 | Medium | 6.3 | 2025-12-16 | A vulnerability was identified in Ningyuanda TC155 57.0.2.0. This impacts an unknown function of the file /onvif/device_service of the component ONVIF PTZ Cont… |
CVE-2025-14748 | Medium | 5.4 | 2025-12-16 | A vulnerability was determined in Ningyuanda TC155 57.0.2.0. This affects an unknown function of the file /onvif/device_service of the component ONVIF Device M… |
CVE-2025-67715 | Medium | 4.3 | 2025-12-16 | Weblate is a web based localization tool. In versions prior to 5.15, it was possible to retrieve user notification settings or list all users via API. Version… |
CVE-2025-55895 | Critical | 9.1 | 2025-12-15 | TOTOLINK A3300R V17.0.0cu.557_B20221024 and N200RE V9.3.5u.6448_B20240521 and V9.3.5u.6437_B20230519 are vulnerable to Incorrect Access Control. Attackers can… |
CVE-2025-65176 | High | 7.5 | 2025-12-15 | An issue was discovered in Dynatrace OneAgent before 1.325.47. When attempting to access a remote network share from a machine where OneAgent is installed and… |
CVE-2025-65780 | High | 8.8 | 2025-12-15 | An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Authenticated users can update their entire user docu… |
CVE-2025-65779 | High | 7.5 | 2025-12-15 | An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Unauthenticated attackers can update a board's "sort"… |
CVE-2025-14660 | Medium | 5.6 | 2025-12-14 | A flaw has been found in DecoCMS Mesh up to 1.0.0-alpha.31. Affected by this vulnerability is the function createTool of the file packages/sdk/src/mcp/teams/ap… |
CVE-2025-14642 | Medium | 4.7 | 2025-12-14 | A vulnerability has been found in code-projects Computer Laboratory System 1.0. Impacted is an unknown function of the file technical_staff_pic.php. Such manip… |
CVE-2025-14641 | Medium | 4.7 | 2025-12-14 | A flaw has been found in code-projects Computer Laboratory System 1.0. This issue affects some unknown processing of the file admin/admin_pic.php. This manipul… |
CVE-2025-14583 | High | 7.3 | 2025-12-12 | A flaw has been found in campcodes Online Student Enrollment System 1.0. This impacts an unknown function of the file /admin/register.php. Executing a manipula… |
CVE-2025-14582 | Medium | 4.7 | 2025-12-12 | A vulnerability was detected in campcodes Online Student Enrollment System 1.0. This affects an unknown function of the file /admin/index.php?page=user-profile… |
CVE-2025-43518 | Low | 3.3 | 2025-12-12 | A logic issue was addressed with improved checks. This issue is fixed in iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2… |
CVE-2025-43513 | Medium | 5.5 | 2025-12-12 | A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2. An app m… |
CVE-2025-43416 | Medium | 5.5 | 2025-12-12 | A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2. An app may be able… |
CVE-2025-43404 | Low | 3.3 | 2025-12-12 | A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Tahoe 26.1. An app may be able to access sensitive user da… |
CVE-2025-43393 | Medium | 5.2 | 2025-12-12 | A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Tahoe 26.1. An app may be able to break out of its sandbox. |
CVE-2025-43351 | Medium | 5.5 | 2025-12-12 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.1. An app may be able to access protected user data. |
CVE-2025-66430 | Critical | 9.1 | 2025-12-12 | Plesk 18.0 has Incorrect Access Control. |
CVE-2025-64669 | High | 7.8 | 2025-12-11 | Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges locally. |
CVE-2025-14530 | Medium | 4.7 | 2025-12-11 | A vulnerability has been found in SourceCodester Real Estate Property Listing App 1.0. The impacted element is an unknown function of the file /admin/property… |
CVE-2025-14528 | Medium | 5.3 | 2025-12-11 | A vulnerability was detected in D-Link DIR-803 up to 1.04. Impacted is an unknown function of the file /getcfg.php of the component Configuration Handler. The… |
CVE-2025-14522 | Medium | 6.3 | 2025-12-11 | A vulnerability was detected in baowzh hfly up to 638ff9abe9078bc977c132b37acbe1900b63491c. The impacted element is an unknown function of the file /Public/Kin… |
CVE-2025-67510 | Critical | 9.4 | 2025-12-10 | Neuron is a PHP framework for creating and orchestrating AI Agents. In versions 2.8.11 and below, the MySQLWriteTool executes arbitrary SQL provided by the cal… |
CVE-2025-24857 | High | 7.6 | 2025-12-10 | Improper access control for volatile memory containing boot code in Universal Boot Loader (U-Boot) before 2017.11 and Qualcomm chips IPQ4019, IPQ5018, IPQ5322… |
CVE-2025-14082 | Low | 2.7 | 2025-12-10 | A flaw was found in Keycloak Admin REST (Representational State Transfer) API. This vulnerability allows information disclosure of sensitive role metadata via… |
CVE-2025-64897 | Medium | 5.6 | 2025-12-10 | ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Access Control vulnerability. A low privileged attacker could leverage thi… |
CVE-2025-65594 | High | 8.1 | 2025-12-09 | OpenSIS 9.2 and below is vulnerable to Incorrect Access Control in Student.php, which allows an authenticated low-privilege user to perform unauthorized databa… |
CVE-2025-64673 | High | 7.8 | 2025-12-09 | Improper access control in Storvsp.sys Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-62570 | High | 7.1 | 2025-12-09 | Improper access control in Windows Camera Frame Server Monitor allows an authorized attacker to disclose information locally. |
CVE-2025-62474 | High | 7.8 | 2025-12-09 | Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally. |
CVE-2025-59923 | Low | 2.7 | 2025-12-09 | An improper access control vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all ve… |
CVE-2025-59810 | Medium | 6.5 | 2025-12-09 | An improper access control vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.2, FortiSOAR PaaS 7.5.0 through 7.5.1, FortiSOAR PaaS 7.4 all versions, F… |
CVE-2025-59517 | High | 7.8 | 2025-12-09 | Improper access control in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-63739 | Medium | 4.3 | 2025-12-09 | An issue was discovered in function phpinisaveAction in file webmain/system/cogini/coginiAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers to authen… |
CVE-2025-40939 | Medium | 4.6 | 2025-12-09 | A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected device contains a USB port which allows unauthenticated connection… |
CVE-2025-14286 | Medium | 5.3 | 2025-12-09 | A vulnerability was determined in Tenda AC9 15.03.05.14_multi. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/DownloadCfg.jpg… |
CVE-2025-65797 | Medium | 6.5 | 2025-12-08 | Incorrect access control in the Identity Provider service of usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily modify or delete… |
CVE-2025-65795 | High | 7.5 | 2025-12-08 | Incorrect access control in the /api/v1/user endpoint of usememos memos v0.25.2 allows unauthorized attackers to create arbitrary accounts via a crafted reques… |
CVE-2025-65798 | Medium | 5.4 | 2025-12-08 | Incorrect access control in usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily modify or delete attachments made by other users. |