CWE-284 · Improper Access Control (page 7)
Page 7 of 82 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-86302 | Medium | 5.3 | 2026-09-07 | A vulnerability was found in code-projects Hospital Information System 1.0. Affected by this vulnerability is an unknown functionality of the file /HIS/his.sql… |
CVE-2026-86285 | Medium | 4.3 | 2026-09-07 | A vulnerability was detected in BookStack up to 26.05.2. Affected by this issue is the function AttachmentController::getUpdateForm of the file app/Uploads/Con… |
CVE-2026-86284 | Medium | 5.3 | 2026-09-07 | A security vulnerability has been detected in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132. Affected by this vulnera… |
CVE-2026-86272 | High | 7.3 | 2026-09-07 | A vulnerability was determined in Beijing Meite Software Technology U+Smart Enjoyment WebSite 18.6001.1096.1000. This impacts an unknown function of the file /… |
CVE-2026-86239 | Medium | 5.3 | 2026-09-07 | A vulnerability was identified in liufee FeehiCMS up to 2.1.1. The impacted element is the function UeditorAction::init of the file backend/widgets/ueditor/Ued… |
CVE-2026-86228 | Medium | 4.3 | 2026-09-06 | A security vulnerability has been detected in JeecgBoot up to 3.9.3. This vulnerability affects the function exportXls of the file jeecg-boot/jeecg-boot-module… |
CVE-2026-86217 | Medium | 5.3 | 2026-09-06 | A vulnerability was detected in code-projects Hotel and Tourism Reservation in PHP 1.0. Affected is an unknown function of the file /ht/hotel_db%20(1).sql of t… |
CVE-2026-86242 | High | 8.1 | 2026-09-06 | Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated POST /api/plugins when management authen… |
CVE-2026-86179 | Medium | 5.3 | 2026-09-06 | A flaw has been found in code-projects Daily Expense Manager 1.0. Affected is an unknown function of the file /Daily-Expense-Manager/exp_ak.sql of the componen… |
CVE-2026-75793 | Medium | 6.5 | 2026-09-06 | The SureCart WordPress plugin before 4.7.0 does not consult the site's user registration setting before creating WordPress accounts, allowing unauthenticated… |
CVE-2026-84936 | Medium | 5.3 | 2026-09-05 | The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-loading action, allowing unauthenticated users to force the… |
CVE-2026-79390 | High | 7.5 | 2026-09-04 | Trueview TI8161 6.0.23.4 is vulnerable to information disclosure due to the transmission of MQTT communications in plaintext over TCP port 1883. An unauthentic… |
CVE-2026-78745 | Critical | 9.8 | 2026-09-04 | An issue in HiDPT/ Weyon HiDPTAndroid Hi3751V350 Hi3751V352E_DMO allows a remote attacker to execute arbitrary code via the Android Debug Bridge (ADB) daemon (… |
CVE-2026-75168 | Medium | 6.3 | 2026-09-04 | An issue in the ugw-editfile method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenticated user with the low-p… |
CVE-2026-75167 | Medium | 4.3 | 2026-09-04 | A broken access control vulnerability in the ugw-usr-edit method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote auth… |
CVE-2026-19274 | Critical | 9.6 | 2026-09-04 | IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated Kubernetes tenant to hijack or per… |
CVE-2026-9186 | Medium | 6.5 | 2026-09-04 | IBM Langflow OSS 1.0.0 through 1.11.2 allows remote authenticated attackers to bypass localhost-only MCP configuration installation by spoofing X-Forwarded-For… |
CVE-2026-85517 | Medium | 5.3 | 2026-09-04 | A flaw has been found in code-projects Vehicle Management System 1.0. The impacted element is an unknown function of the file /vehicle_management.sql of the co… |
CVE-2026-80438 | Medium | 5.9 | 2026-09-04 | The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a Ninja Forms WordPress plugin before 3.15.2… |
CVE-2026-85401 | Medium | 6.3 | 2026-09-04 | A weakness has been identified in Dolibarr up to 21.0.4/22.0.5/23.0.3. Affected by this issue is some unknown functionality of the file htdocs/core/filemanager… |
CVE-2026-85147 | High | 7.5 | 2026-09-04 | SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain a specific passwo… |
CVE-2026-85208 | High | 7.3 | 2026-09-03 | A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. The affected element is the function doInsert of the file /rider/order… |
CVE-2026-85186 | Medium | 6.3 | 2026-09-03 | A weakness has been identified in itsourcecode Online Medicine Delivery System 1.0. Affected by this vulnerability is the function doupdateimage of the file /c… |
CVE-2026-53924 | | 2026-09-03 | Gardens v2 is a modular governance framework that enables communities to create and manage multiple governance pools with customizable parameters and voting me… | |
CVE-2026-85135 | Medium | 6.3 | 2026-09-03 | A security flaw has been discovered in ILIAS up to 9.21/10.9/11.2. This affects the function ilObjMediaObjectGUI::uploadMultipleSubtitleFileObject of the file… |
CVE-2026-20279 | Critical | 9.8 | 2026-09-02 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive inter… |
CVE-2026-84668 | High | 8.8 | 2026-09-02 | Jenkins SAML Plugin 4.618.v441a_27fa_46d2 and earlier allows overwriting the SAML identity provider metadata file through Stapler data binding, allowing attack… |
CVE-2026-84651 | Medium | 6.3 | 2026-09-02 | In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a submitted configuration… |
CVE-2026-84804 | Medium | 5.4 | 2026-09-02 | Kimai before 2.65.0 fails to properly validate permissions when removing team access to activities, projects, and customers via API endpoints. Authenticated us… |
CVE-2026-73762 | Medium | 6.6 | 2026-09-01 | A vulnerability has been identified in the API endpoint of AOS-CX that could allow a remote actor to circumvent existing access controls. In some cases this co… |
CVE-2026-73750 | High | 8.8 | 2026-09-01 | Vulnerabilities exist in the authentication module that may improperly process malformed or truncated input. An authenticated remote attacker could exploit the… |
CVE-2026-73749 | Critical | 9.8 | 2026-09-01 | Multiple vulnerabilities exist in a daemon of AOS-CX that may allow for improper processing of malformed input. An unauthenticated remote attacker could exploi… |
CVE-2026-73741 | Medium | 4.3 | 2026-09-01 | A vulnerability in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to view some system files. Successful exp… |
CVE-2026-73727 | Medium | 6.5 | 2026-09-01 | Vulnerabilities in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to access sensitive information. A succes… |
CVE-2026-52111 | Critical | 9.8 | 2026-09-01 | An issue in fast-note-sync-service <=2.13.7 allows a remote attacker to escalate privileges via the admin configuration endpoint exposes authTokenKey |
CVE-2024-7953 | | 2026-09-01 | A vulnerability exists in the affected products that allows a threat actor to create a project and become the administrator for it. If exploited, a threat acto… | |
CVE-2026-51956 | High | 8.1 | 2026-09-01 | A Broken Object Level Authorization vulnerability exists in Grashjs Atlas CMMS prior to v1.6.0. An authenticated user from one tenant can read and modify anoth… |
CVE-2026-51770 | Critical | 9.8 | 2026-09-01 | Incorrect access control in the sendToMasterQosConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to forward attacker-contro… |
CVE-2026-51769 | Critical | 9.8 | 2026-09-01 | Incorrect access control in the remoteCloudUpdateCheck function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to restart the cloud upda… |
CVE-2026-51768 | High | 7.5 | 2026-09-01 | Incorrect access control in the setElinkQosConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to modify privileged QoS polic… |
CVE-2026-51767 | Critical | 9.8 | 2026-09-01 | Incorrect access control in the recvClearPairCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reset pairing state and rebo… |
CVE-2026-51766 | High | 7.5 | 2026-09-01 | Incorrect access control in the setDevReboot function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reboot the local device and, on… |
CVE-2026-51765 | Critical | 9.8 | 2026-09-01 | Incorrect access control in the recvIndirectMeshInfo function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to insert or replace mesh n… |
CVE-2026-51764 | Critical | 9.8 | 2026-09-01 | Incorrect access control in the recvSlaveCloudCheckStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to overwrite cloud-res… |
CVE-2026-51763 | Critical | 9.8 | 2026-09-01 | Incorrect access control in the freeStaClient function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to forcibly disconnect wireless cl… |
CVE-2026-51762 | Critical | 9.8 | 2026-09-01 | Incorrect access control in the meshInfoKick function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to kick or clean stale mesh informa… |
CVE-2026-51761 | Medium | 5.3 | 2026-09-01 | Incorrect access control in the updateLanIp function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to refresh the LAN address state via… |
CVE-2026-51760 | Critical | 9.8 | 2026-09-01 | Incorrect access control in the informSyncUpgfw function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to mass-trigger firmware update… |
CVE-2026-51757 | Critical | 9.8 | 2026-09-01 | Incorrect access control in the meshSlaveUpdate function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to start a firmware download or… |
CVE-2026-51756 | Medium | 5.9 | 2026-09-01 | Incorrect access control in the meshSlaveUpgfw function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to start firmware flashing using… |
CVE-2026-51754 | Critical | 9.8 | 2026-09-01 | Incorrect access control in the updateSlaveIpList function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to overwrite the slave IP inve… |
CVE-2026-51752 | Medium | 5.3 | 2026-09-01 | Incorrect access control in the staticInfoSend function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger static information rep… |
CVE-2026-51751 | Critical | 9.8 | 2026-09-01 | Incorrect access control in the delSlaveDevice function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove a specified slave devic… |
CVE-2026-51750 | Critical | 9.8 | 2026-09-01 | Incorrect access control in the updatePriChannel function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to rescan and switch the primar… |
CVE-2026-51748 | Medium | 5.9 | 2026-09-01 | Incorrect access control in the sendStaticInfoToMaster function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to update stored slave in… |
CVE-2026-84128 | High | 8.8 | 2026-09-01 | Privilege escalation in the WebDriver BiDi component. This vulnerability was fixed in Firefox 155 and Thunderbird 155. |
CVE-2026-84117 | High | 8.8 | 2026-09-01 | Privilege escalation in Firefox for Android. This vulnerability was fixed in Firefox 155. |
CVE-2026-53682 | Medium | 5.3 | 2026-09-01 | An unauthenticated client can query the Security Domain hosts inventory via GET /ca/rest/securityDomain/hosts and receive a structured response enumerating int… |
CVE-2026-51747 | Critical | 9.8 | 2026-09-01 | Incorrect access control in the keepAlive function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to emit indirect mesh heartbeat inform… |
CVE-2026-51745 | Medium | 5.3 | 2026-09-01 | Incorrect access control in the updatePriStaList function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to refresh the primary station… |
CVE-2026-51744 | Critical | 9.8 | 2026-09-01 | Incorrect access control in the recv_mesh_info_sync function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to force mesh configuration… |
CVE-2026-51743 | Critical | 9.1 | 2026-09-01 | Incorrect access control in the guest_wifi_sync function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to disable guest virtual AP inte… |
CVE-2026-51742 | Medium | 5.9 | 2026-09-01 | Incorrect access control in the discoverWan function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger WAN discovery logic via s… |
CVE-2026-51741 | Critical | 9.8 | 2026-09-01 | Incorrect access control in the clearDiagnosisLog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase diagnosis logs via se… |
CVE-2026-84200 | Critical | 9.0 | 2026-09-01 | Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw. When a policy in enforce mode is combined with two PolicyExceptions, the less… |
CVE-2026-84187 | High | 8.2 | 2026-09-01 | AVideo contains a missing authentication vulnerability in plugin/Live/on_publish.php that allows unauthenticated attackers to mark arbitrary scheduled broadcas… |
CVE-2026-84165 | | 2026-09-01 | A vulnerability relating to incorrect access control in OpenNebula by OpenNebula Systems, affecting all versions prior to 7.4. This vulnerability could allow a… | |
CVE-2026-82745 | | 2026-09-01 | Improper Access Control vulnerability in ash-project ash lets a create action overwrite an existing record when the ETS or Mnesia data layer is used, because n… | |
CVE-2026-82921 | High | 7.3 | 2026-08-31 | A weakness has been identified in ShopEx ECShop up to 2.5.1. This affects the function check_img_type of the file admin/pack.php. Executing a manipulation of t… |
CVE-2026-82835 | Medium | 5.4 | 2026-08-31 | A weakness has been identified in caoqianming django-vue-admin 1.0. This vulnerability affects unknown code of the file /api/file/. Executing a manipulation of… |
CVE-2026-82834 | Medium | 5.4 | 2026-08-31 | A security flaw has been discovered in Doccano Open Source Annotation Tools for Machine Learning Practitioners and Auto Labeling Pipeline Module to Annotate a… |
CVE-2026-82833 | Medium | 6.3 | 2026-08-31 | A vulnerability was identified in Doccano Open Source Annotation Tools for Machine Learning Practitioners and Auto Labeling Pipeline Module to Annotate a Docum… |
CVE-2026-51740 | Critical | 9.8 | 2026-08-31 | Incorrect access control in the killProcess function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to terminate critical services via s… |
CVE-2026-51739 | Medium | 5.9 | 2026-08-31 | Incorrect access control in the CloudSrvVersionCheck function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger cloud update che… |
CVE-2026-51738 | Critical | 9.8 | 2026-08-31 | Incorrect access control in the LoadDefSettings function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reset the device configuratio… |
CVE-2026-51737 | Medium | 5.3 | 2026-08-31 | Incorrect access control in the clearTracerouteLog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase traceroute logs via… |
CVE-2026-51736 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the clearSyslog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase system logs via sending a c… |
CVE-2026-51735 | High | 7.5 | 2026-08-31 | Incorrect access control in the showSyslog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to retrieve recent system logs via se… |
CVE-2026-51734 | Critical | 9.8 | 2026-08-31 | Incorrect access control in the informSlaveUpdate function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger mesh slave update c… |
CVE-2026-51733 | Critical | 9.8 | 2026-08-31 | Incorrect access control in the FirmwareUpgrade function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove Wi-Fi schedule entries… |
CVE-2026-51732 | Medium | 5.3 | 2026-08-31 | Incorrect access control in the delWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove Wi-Fi schedule entr… |
CVE-2026-51731 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the delVlanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove VLAN entries via sending a… |
CVE-2026-82818 | Medium | 6.3 | 2026-08-31 | A vulnerability was determined in dibo-software diboot 3.8.0. This affects an unknown part of the file /api/iam/tenant/resource of the component Tenant Resourc… |
CVE-2026-82817 | Medium | 6.3 | 2026-08-31 | A vulnerability was found in dibo-software diboot 3.8.0. Affected by this issue is some unknown functionality of the file /admin/ of the component Tenant Admin… |
CVE-2026-82815 | High | 7.3 | 2026-08-31 | A flaw has been found in MegaEase EaseProbe up to 2.3.0. Affected is the function realIP of the file web/server.go of the component Middleware. This manipulati… |
CVE-2026-51730 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the delWiFiAclRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove Wi-Fi ACL rules via se… |
CVE-2026-51729 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the delDevice function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to request deletion of a managed slave… |
CVE-2026-51728 | Critical | 9.8 | 2026-08-31 | Incorrect access control in the UploadFirmwareFile function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to upload a crafted firmware… |
CVE-2026-51727 | Medium | 5.3 | 2026-08-31 | Incorrect access control in the SystemSettings function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to retrieve administrative import… |
CVE-2026-51726 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the delParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove parental-control rule… |
CVE-2026-51725 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the NTPSyncWithHost function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change the device clock via s… |
CVE-2026-82810 | Low | 3.3 | 2026-08-31 | A weakness has been identified in extension.vn 2FA Authenticator Extension 1.0.0.2 on Chrome. The impacted element is the function chrome.runtime.onMessageExte… |
CVE-2026-82809 | Medium | 4.3 | 2026-08-31 | A security flaw has been discovered in vidIQ Vision for YouTube Extension 3.199.0 on Chrome. The affected element is the function window.addEventListener of th… |
CVE-2026-51724 | Critical | 9.8 | 2026-08-31 | Incorrect access control in the delSmartQosCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove Smart QoS rules via sen… |
CVE-2026-51723 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the UploadCustomModule function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to install a custom CGI modul… |
CVE-2026-51722 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setWiFiRepeaterCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to repoint the device to an a… |
CVE-2026-51721 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setPairCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter the mesh pairing state via s… |
CVE-2026-51720 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the delIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove firewall filter r… |
CVE-2026-51719 | High | 7.5 | 2026-08-31 | Incorrect access control in the delUrlFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove URL filtering rules… |
CVE-2026-51718 | Critical | 9.8 | 2026-08-31 | Incorrect access control in the delStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove static DHCP reserva… |