CWE-284 · Improper Access Control (page 6)
Page 6 of 82 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-73951 | High | 8.1 | 2026-09-15 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). Supported versions that are affected are 12.2… |
CVE-2026-73949 | High | 8.8 | 2026-09-15 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). Supported versions that are affected are 12.2… |
CVE-2026-73948 | Critical | 9.9 | 2026-09-15 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). Supported versions that are affected are 12.2.1.4.0 an… |
CVE-2026-73946 | Critical | 9.1 | 2026-09-15 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12… |
CVE-2026-73945 | Critical | 9.9 | 2026-09-15 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12… |
CVE-2026-73943 | High | 7.6 | 2026-09-15 | Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4… |
CVE-2026-73942 | High | 8.8 | 2026-09-15 | Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4… |
CVE-2026-73941 | High | 8.6 | 2026-09-15 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12… |
CVE-2026-73926 | High | 8.7 | 2026-09-15 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12… |
CVE-2026-71163 | Critical | 9.9 | 2026-09-15 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12… |
CVE-2026-71047 | High | 8.8 | 2026-09-15 | Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 1… |
CVE-2026-70915 | High | 8.8 | 2026-09-15 | Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 1… |
CVE-2026-70755 | Medium | 6.5 | 2026-09-15 | Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: File download). Supported versions that are aff… |
CVE-2026-62597 | Medium | 6.5 | 2026-09-15 | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Event Management). Supported versions that are a… |
CVE-2026-90969 | Medium | 6.5 | 2026-09-15 | Improper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authenticated user lacking the view-password p… |
CVE-2026-84048 | | 2026-09-15 | Joomla Extension - joomgalleryfriends.net - Unauthenticated arbitrary file upload via the TUS endpoint in JoomGallery < 4.4.2 - The TUS endpoint allows arbitra… | |
CVE-2026-91849 | Medium | 6.3 | 2026-09-15 | A security flaw has been discovered in WuzhiCMS up to 4.1.0. This affects the function member::setAvatar of the file /index.php?m=member&f=user&v=setAvatar of… |
CVE-2026-63695 | Critical | 9.8 | 2026-09-15 | Dell SmartFabric OS10 Software, versions prior to 10.6.1.3, contains a Session Fixation vulnerability. An unauthenticated attacker with remote access could pot… |
CVE-2026-91005 | Medium | 6.3 | 2026-09-15 | A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0. This affects the function move_uploaded_file of the file production/edit_pictu… |
CVE-2026-90881 | Medium | 5.3 | 2026-09-15 | A weakness has been identified in D-Link DIR-882 up to 20260814. Impacted is the function main of the file /HNAP1/dllog.cgi of the component CGI Binary. Execut… |
CVE-2026-90857 | Medium | 6.3 | 2026-09-15 | A vulnerability was detected in SourceCodester College Notes Gallery Management System 1.0. Affected is an unknown function of the file /dashboard/userprofile… |
CVE-2026-90851 | Medium | 6.3 | 2026-09-15 | A flaw has been found in PHPGurukul Hostel Management System 3.0. This affects an unknown part of the file /admin/includes/checklogin.php. This manipulation of… |
CVE-2026-86905 | Medium | 5.5 | 2026-09-14 | This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. An app may be able to… |
CVE-2026-84585 | Medium | 5.5 | 2026-09-14 | A permissions issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. An app may be able to access local network devic… |
CVE-2026-84574 | Medium | 4.4 | 2026-09-14 | A permissions issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may… |
CVE-2026-84573 | Medium | 5.5 | 2026-09-14 | This issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access… |
CVE-2026-84555 | Medium | 5.5 | 2026-09-14 | An authorization issue was addressed with improved access control. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8. An app may be able to acces… |
CVE-2026-84535 | High | 8.2 | 2026-09-14 | An authorization issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app… |
CVE-2026-84491 | Medium | 5.5 | 2026-09-14 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, tv… |
CVE-2026-65403 | Medium | 5.5 | 2026-09-14 | This issue was addressed with improved checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8… |
CVE-2026-65383 | Medium | 4.4 | 2026-09-14 | This issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27. An app may bypass Gatekeeper checks. |
CVE-2026-65380 | Medium | 5.5 | 2026-09-14 | An issue existed in the handling of snapshots. The issue was resolved with improved permissions logic. This issue is fixed in macOS Golden Gate 27. An app may… |
CVE-2026-65362 | High | 7.8 | 2026-09-14 | This issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to gain ro… |
CVE-2026-65361 | Medium | 5.5 | 2026-09-14 | This issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access… |
CVE-2026-65345 | Medium | 5.5 | 2026-09-14 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, ma… |
CVE-2026-64712 | High | 7.8 | 2026-09-14 | This issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to gain ro… |
CVE-2026-43762 | Medium | 5.5 | 2026-09-14 | The issue was addressed with improved checks. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, visionOS 26.6. An app may be able to access us… |
CVE-2026-43741 | Medium | 5.5 | 2026-09-14 | A logic issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be ab… |
CVE-2026-28937 | Medium | 5.5 | 2026-09-14 | This issue was addressed through improved state management. This issue is fixed in macOS Golden Gate 27. An app may be able to access sensitive user data. |
CVE-2026-19290 | High | 7.5 | 2026-09-14 | IBM Sterling File Gateway 6.2.0.0 through 6.2.0.6_1, 6.2.1.0 - 6.2.1.2, 6.2.2.0 - 6.2.2.1 could allow a remote attacker to obtain sensitive information due to… |
CVE-2026-54629 | High | 7.5 | 2026-09-14 | Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes file-backed SQLite virtual table modules such as csv_reader and… |
CVE-2026-54628 | High | 8.6 | 2026-09-14 | Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes URL-capable SQLite virtual table modules such as json_reader an… |
CVE-2026-50006 | Critical | 9.1 | 2026-09-14 | Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL from its MySQL-compatible server port to S… |
CVE-2026-90811 | Low | 3.3 | 2026-09-14 | A weakness has been identified in cosmicstack-labs mercury-agent up to 1.2.0. This affects the function PermissionManager.checkShellCommand of the file mercury… |
CVE-2026-46696 | Low | 3.3 | 2026-09-14 | October System provides the system module for October Content Management System. Versions prior to 3.7.17 and 4.2.21 have a vulnerability in the Twig sandbox s… |
CVE-2026-76441 | Critical | 9.8 | 2026-09-14 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineer… |
CVE-2026-12258 | | 2026-09-14 | Inadequate access control in Hiperdino’s REST v1.0 API. The public endpoint ‘customer/check’ could allow an authenticated attacker to enter a telephone number… | |
CVE-2026-90898 | Critical | 9.8 | 2026-09-14 | Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the clie… |
CVE-2026-81566 | | 2026-09-14 | Joomla Extension - joomshaper.com - Missing Access Control in Menu Item Creation in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0 - The add-to-menu routine invo… | |
CVE-2026-90603 | High | 7.3 | 2026-09-13 | A vulnerability was identified in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this issue is some unknown functionality of the file /api/uplo… |
CVE-2026-90565 | Medium | 5.3 | 2026-09-13 | A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected is an unknown function of… |
CVE-2026-90519 | Medium | 6.3 | 2026-09-13 | A weakness has been identified in PHPGurukul Bank Locker Management System 1.0. Affected is an unknown function of the file /blms/banker/add-locker-form.php. T… |
CVE-2026-90518 | Medium | 6.3 | 2026-09-13 | A security flaw has been discovered in PHPGurukul Bank Locker Management System 1.0. This impacts an unknown function of the file sidebar.php. The manipulation… |
CVE-2026-90507 | Medium | 6.3 | 2026-09-13 | A vulnerability was identified in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. Affected is the function get_surge_subscription of th… |
CVE-2026-90503 | Low | 2.3 | 2026-09-13 | A flaw has been found in Chengdu Qilu Technology Ludashi 6.1026.4715.714. The affected element is the function sub_11008 in the library ComputerZ_x64.sys. Exec… |
CVE-2026-90500 | Medium | 6.3 | 2026-09-13 | A weakness has been identified in lenve vhr 1.0-SNAPSHOT. This vulnerability affects the function FastDFSUtils.upload of the file /hr/userface of the component… |
CVE-2026-90493 | High | 8.8 | 2026-09-13 | A vulnerability was detected in Tonec Internet Download Manager up to 6.42 Build 63 on Windows. The impacted element is an unknown function of the file idmwfp… |
CVE-2026-87918 | Medium | 5.3 | 2026-09-12 | The WPBot WordPress plugin before 8.5.7 does not perform any authorization or nonce check on several AJAX actions that relay prompts to its configured AI prov… |
CVE-2026-87892 | Medium | 5.3 | 2026-09-12 | The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing w… |
CVE-2026-87891 | Medium | 6.5 | 2026-09-12 | The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday schedule, allowing un… |
CVE-2026-77753 | Medium | 5.5 | 2026-09-12 | The Temporary Login Without Password WordPress plugin before 1.9.9 does not prevent a temporary user from creating an Application Password, and does not revoke… |
CVE-2026-77689 | Medium | 5.3 | 2026-09-12 | The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as… |
CVE-2026-47839 | | 2026-09-11 | A vulnerability allows users authenticating through a federated OIDC provider to obtain the uaa.admin scope despite operators restricting that provider through… | |
CVE-2026-86812 | Medium | 6.5 | 2026-09-11 | The WPCafe WordPress plugin before 3.0.18 does not correctly restrict access to a set of order-management REST endpoints because their permission callbacks re… |
CVE-2026-81941 | High | 8.8 | 2026-09-10 | IBM Langflow OSS 1.0.0 through 1.11.5 allows an authenticated non-administrative user could execute arbitrary operating system commands on the server at the pr… |
CVE-2026-79725 | Medium | 6.5 | 2026-09-10 | IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to read arbitrary files due to improper access control. |
CVE-2026-81046 | Critical | 9.4 | 2026-09-10 | Dell ThinOS 10, versions prior to 2605_10.2616, contain a Protection Mechanism Failure vulnerability. An unauthenticated attacker with remote access could pote… |
CVE-2026-88864 | Critical | 9.1 | 2026-09-10 | Capgo (capgo.app) fails to restrict direct write access to the public.sso_providers table exposed through Supabase PostgREST. A holder of an ordinary Capgo ful… |
CVE-2026-85545 | High | 7.1 | 2026-09-10 | There is an Vulnerability in some HikCentral Access Control versions. Authenticated low-privilege users can invoke API interfaces that their role is not author… |
CVE-2026-78084 | | 2026-09-10 | Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property < 4.1.4 - The gallery management controller tasks lacked… | |
CVE-2026-19436 | High | 7.5 | 2026-09-10 | The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not reconcile the value of the gift card coupon it issues against the amount actual… |
CVE-2026-71807 | Medium | 4.3 | 2026-09-09 | In RuoYi-Cloud-Plus <= 2.6.2 in the ruoyi-workflow module, multiple core task APIs in FlwTaskController lack permission annotations, and the Service layer does… |
CVE-2026-50165 | | 2026-09-09 | alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. An Improper Access Control issue in versions prior to… | |
CVE-2026-73789 | Medium | 5.3 | 2026-09-09 | A vulnerability in the web-based management interface of CPPM guest account management services could allow an unauthenticated remote attacker to manipulate ac… |
CVE-2026-86774 | Medium | 6.3 | 2026-09-09 | Snipe-IT versions before 8.7.0 contain a broken access control vulnerability in AssetModelPolicy where the files() method cascades from assets.files permission… |
CVE-2026-13144 | Low | 3.7 | 2026-09-09 | The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its ban… |
CVE-2026-21109 | | 2026-09-09 | Improper access control in Watch Plugin prior to Android Watch 17 allows local attackers to access sensitive information. | |
CVE-2026-21105 | Medium | 5.5 | 2026-09-09 | Improper access control in Collection prior to version 1.0.1.14 in Android 15 and 2.0.02.7 in Android 16 allows local attackers to access sensitive information. |
CVE-2026-21100 | High | 7.1 | 2026-09-09 | Improper access control in SystemUI prior to SMR Sep-2026 Release 1 allows local attackers to launch arbitrary activity. |
CVE-2026-21098 | Medium | 6.1 | 2026-09-09 | Improper access control in Link to Windows prior to SMR Sep-2026 Release 1 allows local attackers to establish a connection with the PC without proper user int… |
CVE-2026-19625 | Medium | 5.3 | 2026-09-08 | When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as "/oidc-provider1" that is secured by the OIDC Provider 1… |
CVE-2026-75998 | High | 7.5 | 2026-09-08 | ColdFusion is affected by an Improper Access Control vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability… |
CVE-2026-28602 | High | 7.8 | 2026-09-08 | In setClipboardAccessNotificationsEnabledForUser of ClipboardService.java, there is a possible mult-iuser isolation due to a logic error in the code. This coul… |
CVE-2026-86672 | Medium | 5.3 | 2026-09-08 | A vulnerability has been found in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected is an unknown function of the f… |
CVE-2026-81963 | High | 7.8 | 2026-09-08 | Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally. |
CVE-2026-77487 | High | 8.8 | 2026-09-08 | Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network. |
CVE-2026-73028 | High | 8.8 | 2026-09-08 | Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network. |
CVE-2026-69282 | High | 8.8 | 2026-09-08 | Improper access control in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2026-69273 | High | 8.8 | 2026-09-08 | Improper access control in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2026-69268 | High | 8.8 | 2026-09-08 | Improper access control in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2026-84385 | Medium | 5.4 | 2026-09-08 | A improper access control vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.6, FortiSOAR PaaS 7.5.0 through 7.5.3, FortiSOAR PaaS 7.4 all versions, Fo… |
CVE-2026-26084 | Critical | 9.9 | 2026-09-08 | A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.4 through 5.0.5… |
CVE-2026-22575 | Medium | 4.9 | 2026-09-08 | An improper access control vulnerability in Fortinet FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.10, FortiManager 7.2 all versions, FortiM… |
CVE-2026-86666 | High | 7.3 | 2026-09-08 | A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.15. Impacted is the function upload_json/uploadFile of the file controllers/pic.php. The… |
CVE-2026-79577 | Critical | 9.8 | 2026-09-08 | An issue in the /cas/login component of sso-master v1.0.0 allows attackers to authenticate into the application without a password via sending a crafted POST r… |
CVE-2026-79571 | Critical | 9.1 | 2026-09-08 | Incorrect access control in the SellerAuthorizeAspect component of springboot-project v1.0.0 allows unauthenticated attackers to access all seller management i… |
CVE-2026-86519 | Medium | 5.3 | 2026-09-08 | A vulnerability was found in code-projects Student Crud Operation 1.0. This impacts an unknown function of the file /card_activation.sql of the component Backu… |
CVE-2026-86512 | Medium | 6.3 | 2026-09-08 | A vulnerability was identified in java-json-tools json-patch up to 1.13. This affects the function CopyOperation.apply/MoveOperation.apply of the file src/main… |
CVE-2026-86308 | Medium | 5.3 | 2026-09-07 | A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This issue affects some unknow… |
CVE-2026-86305 | High | 7.3 | 2026-09-07 | A security flaw has been discovered in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue… |