CWE-284 · Improper Access Control (page 8)
Page 8 of 82 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-51717 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setOpModeCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change the device operating mode… |
CVE-2026-51716 | High | 7.5 | 2026-08-31 | Incorrect access control in the delPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to delete port-forwarding ru… |
CVE-2026-51715 | Critical | 9.8 | 2026-08-31 | Incorrect access control in the delMacFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove MAC filter rules via… |
CVE-2026-51714 | Medium | 5.9 | 2026-08-31 | Incorrect access control in the setRoamingCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter roaming behavior via send… |
CVE-2026-51713 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setManualDialCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to manipulate WAN dial state vi… |
CVE-2026-51712 | Medium | 5.9 | 2026-08-31 | Incorrect access control in the setApWiFiSchCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter wireless availability w… |
CVE-2026-51711 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setWiFiWpsStart function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to open a wireless pairing windo… |
CVE-2026-51710 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter parental-control behav… |
CVE-2026-51709 | Critical | 9.8 | 2026-08-31 | Incorrect access control in the setWiFiBasicCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reconfigure primary Wi-Fi set… |
CVE-2026-51708 | Critical | 9.8 | 2026-08-31 | Incorrect access control in the setWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change WPS availability via sen… |
CVE-2026-51706 | Medium | 4.3 | 2026-08-31 | Incorrect access control in the setSmartQosCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to degrade traffic handling via s… |
CVE-2026-51705 | Critical | 9.8 | 2026-08-31 | Incorrect access control in the setWiFiMeshName function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to rename mesh entries via sendi… |
CVE-2026-51704 | Medium | 4.3 | 2026-08-31 | Incorrect access control in the setWiFiMeshConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter mesh configurations v… |
CVE-2026-51703 | Medium | 5.4 | 2026-08-31 | Incorrect access control in the setWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter when Wi-Fi is availa… |
CVE-2026-51702 | Medium | 4.3 | 2026-08-31 | Incorrect access control in the setIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter firewall policies… |
CVE-2026-51701 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setMacFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change device access contro… |
CVE-2026-51700 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setWiFiAdvancedCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to degrade wireless behavior… |
CVE-2026-51699 | Critical | 9.8 | 2026-08-31 | Incorrect access control in the setDmzCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to expose an internal host via sending… |
CVE-2026-51698 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setUrlFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter browsing policies via… |
CVE-2026-51697 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setIptvCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter IPTV service configuration v… |
CVE-2026-51696 | Critical | 9.8 | 2026-08-31 | Incorrect access control in the setPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to expose internal services… |
CVE-2026-51695 | High | 7.5 | 2026-08-31 | Incorrect access control in the setDdnsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter dynamic DNS state via sendin… |
CVE-2026-51694 | High | 7.5 | 2026-08-31 | Incorrect access control in the setStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to add or change static DHCP… |
CVE-2026-51693 | Critical | 9.8 | 2026-08-31 | Incorrect access control in the setVpnPassCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to weaken edge filtering via sendi… |
CVE-2026-51692 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setWiFiGuestCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to establish or weaken guest wir… |
CVE-2026-51691 | Critical | 9.8 | 2026-08-31 | Incorrect access control in the setUploadSetting function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to manipulate the upload or fla… |
CVE-2026-51690 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setWanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter upstream provisioning and con… |
CVE-2026-51689 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setUpgradeFW function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger firmware-upgrade workflo… |
CVE-2026-51688 | High | 7.5 | 2026-08-31 | Incorrect access control in the setWiFiSignalCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reduce wireless power or cau… |
CVE-2026-51687 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setWiFiEasyGuestCf function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to create or weaken guest wir… |
CVE-2026-51686 | Critical | 9.8 | 2026-08-31 | Incorrect access control in the setWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reconfigure or disable wireles… |
CVE-2026-51684 | Critical | 9.8 | 2026-08-31 | Incorrect access control in the setStorageCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter the storage-related servi… |
CVE-2026-51683 | Medium | 4.3 | 2026-08-31 | Incorrect access control in the setLanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter LAN network configuration via… |
CVE-2026-78076 | | 2026-08-31 | Joomla Extension - joomshaper.com - Broken Access Control & Missing Authorization in MegaMenu Settings in Helix Ultimate < 2.2.10 - The AJAX endpoint save-mega… | |
CVE-2026-78074 | | 2026-08-31 | Joomla Extension - miniorgange.com - Unauthenticated arbitrary extension deinstallation via various miniOrange extensions - a missing authentication check allo… | |
CVE-2026-51681 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setRemoteCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to expose WAN-side administration v… |
CVE-2026-51680 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setLedCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to modify LED behavior via sending a c… |
CVE-2026-51679 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setPasswordCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change the administrator accou… |
CVE-2026-51678 | Medium | 4.3 | 2026-08-31 | Incorrect access control in the setSyslogCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter logging behavior via sendi… |
CVE-2026-51677 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setUPnPCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change UPnP service state via send… |
CVE-2026-51676 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setAccessDeviceCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter access-device polici… |
CVE-2026-51675 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setWanIeCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reconfigure uplink settings via s… |
CVE-2026-51674 | Critical | 9.8 | 2026-08-31 | Incorrect access control in the setScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to configure forced reboot tasks… |
CVE-2026-51673 | High | 7.5 | 2026-08-31 | Incorrect access control in the setNtpCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter time synchronization settings… |
CVE-2026-51672 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the getRoamingCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain the roaming enablement f… |
CVE-2026-51671 | High | 7.5 | 2026-08-31 | Incorrect access control in the getCloudDownloadStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain cloud firmware… |
CVE-2026-51670 | Critical | 9.8 | 2026-08-31 | Incorrect access control in the getSlaveUpdate function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to query slave upgrade status and… |
CVE-2026-51669 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the getPairCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain pairing and mesh-slave conf… |
CVE-2026-51668 | High | 7.5 | 2026-08-31 | Incorrect access control in the setLanguageCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to modify language configuration… |
CVE-2026-51667 | Medium | 4.3 | 2026-08-31 | Incorrect access control in the getWiFiIpMacTable function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain Wi-Fi client MAC-to-… |
CVE-2026-51666 | Medium | 4.3 | 2026-08-31 | Incorrect access control in the setWizardCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reconfigure WAN, Wi-Fi, and devi… |
CVE-2026-82679 | Medium | 6.3 | 2026-08-31 | A security flaw has been discovered in diem-project diem up to 5.1.3. The impacted element is an unknown function of the file dmFrontPlugin/lib/dmWidget/media/… |
CVE-2026-82861 | High | 7.5 | 2026-08-31 | @hulumi/policies versions before 1.3.2 contain a parent spoof bypass vulnerability that allows attackers to submit spoofed SecureBucket parent evidence during… |
CVE-2026-82859 | Critical | 9.8 | 2026-08-31 | hulumi versions before v1.3.2 contain a deployment SCP template that allows tag-on-create bypasses for hulumi:iac-role protections. Attackers can bypass intend… |
CVE-2026-82856 | Critical | 9.8 | 2026-08-31 | @hulumi/policies versions before 1.3.2 fail to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies. Attackers can use For… |
CVE-2026-82629 | Medium | 4.7 | 2026-08-31 | A vulnerability was determined in jeecgboot jeewx-boot up to 641ab52c3e1845fec39996d7794c33fb40dad1dd. This issue affects the function MyJwWebJwid3Controller.d… |
CVE-2026-82624 | Medium | 5.3 | 2026-08-31 | A flaw has been found in code-projects Simple Inventory System 1.0. Affected by this issue is some unknown functionality of the file inventorymanagement.sql of… |
CVE-2026-40463 | High | 7.6 | 2026-08-31 | WaveSuite is affected by an insufficient role-based access control vulnerability in the CPB Log Files feature. Successful exploitation allows an authenticated… |
CVE-2026-82607 | High | 7.3 | 2026-08-31 | A vulnerability was found in Cozmoslabs Profile Builder Plugin up to 3.16.1 on WordPress. The impacted element is the function wppb_ajax_simple_avatar of the f… |
CVE-2026-82548 | Medium | 5.3 | 2026-08-30 | A vulnerability was determined in Linux Foundation Magma 1.9.0. The impacted element is an unknown function of the component InitialUEMessage Handler. This man… |
CVE-2026-82486 | Medium | 5.0 | 2026-08-30 | A vulnerability was found in SiteServer SSCMS 7.4.0. Affected by this issue is some unknown functionality of the component Agent Installation Workflow. Perform… |
CVE-2026-81026 | Medium | 4.8 | 2026-08-29 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.40 does not verify the amount, receiver, currency or status of a payment notification before… |
CVE-2026-77010 | Medium | 6.5 | 2026-08-29 | The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform authorisation checks on its REST API routes and does not… |
CVE-2026-77008 | Medium | 6.5 | 2026-08-29 | The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not have any authorisation or authentication check when saving its s… |
CVE-2026-76586 | High | 7.5 | 2026-08-29 | The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.6.3 does not verify the amount actually paid against the server-side p… |
CVE-2026-55678 | | 2026-08-28 | Arc is an open, SQL-native time-series database for telemetry. From 26.02.1 until 26.06.2, Arc Enterprise clustering accepts cluster join requests without auth… | |
CVE-2026-51665 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getTracerouteCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain traceroute diagnostic… |
CVE-2026-51664 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getTelnetCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain Telnet service enablement… |
CVE-2026-51663 | Critical | 9.8 | 2026-08-28 | Incorrect access control in the getWiFiApcliScan function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger wireless scans and r… |
CVE-2026-51662 | High | 7.5 | 2026-08-28 | Incorrect access control in the getCloudSrvCheckStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain cloud firmware… |
CVE-2026-51661 | Critical | 9.1 | 2026-08-28 | Incorrect access control in the getPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain port-forwarding ru… |
CVE-2026-54745 | Critical | 10.0 | 2026-08-28 | Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the Kubeflow Pipelines frontend exposes an… |
CVE-2026-51660 | Critical | 9.1 | 2026-08-28 | Incorrect access control in the getIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain IP and port filte… |
CVE-2026-51659 | High | 7.5 | 2026-08-28 | Incorrect access control in the getUrlFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain DMZ configuration in… |
CVE-2026-51658 | High | 7.5 | 2026-08-28 | Incorrect access control in the getDmzCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain DMZ configuration informatio… |
CVE-2026-51657 | Critical | 9.1 | 2026-08-28 | Incorrect access control in the getSyslogCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain syslog-related configurat… |
CVE-2026-51656 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getVpnPassCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain VPN pass-through and WAN… |
CVE-2026-51655 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getMacFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain MAC filter rules via… |
CVE-2026-51654 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain schedule or scheduled-r… |
CVE-2026-51653 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getStorageCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain storage feature state in… |
CVE-2026-51652 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getUPnPCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain UPnP enablement and parsed… |
CVE-2026-51651 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getSmartQosCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain Smart QoS configuration… |
CVE-2026-51650 | High | 7.5 | 2026-08-28 | Incorrect access control in the getRemoteCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain remote-management enablem… |
CVE-2026-51649 | Critical | 9.1 | 2026-08-28 | Incorrect access control in the getDiagnosisCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain diagnostic configurati… |
CVE-2026-51648 | High | 7.5 | 2026-08-28 | Incorrect access control in the getWanInfo function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain WAN information returned by… |
CVE-2026-51647 | High | 7.5 | 2026-08-28 | Incorrect access control in the getCrpcCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain cloud remote-control status… |
CVE-2026-51646 | Critical | 9.1 | 2026-08-28 | Incorrect access control in the getParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain parental-control rule… |
CVE-2026-51645 | Critical | 9.8 | 2026-08-28 | Incorrect access control in the getPasswordCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain the administrative user… |
CVE-2026-51644 | High | 7.5 | 2026-08-28 | Incorrect access control in the getCrpcConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain cloud remote-control sta… |
CVE-2026-51643 | Critical | 9.1 | 2026-08-28 | Incorrect access control in the getNtpCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain NTP configuration and curren… |
CVE-2026-51642 | High | 7.5 | 2026-08-28 | Incorrect access control in the getMeshRoutingTable function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain mesh routing infor… |
CVE-2026-51641 | High | 7.5 | 2026-08-28 | Incorrect access control in the getWiFiMeshConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain mesh configuration a… |
CVE-2026-51640 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getMeshNeighborTable function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain mesh neighbor inf… |
CVE-2026-51639 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getApWiFiSchCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain AP-specific Wi-Fi sche… |
CVE-2026-51638 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getWiFiGuestCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain guest Wi-Fi configurat… |
CVE-2026-51637 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getMeshPortalTable function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain mesh portal table i… |
CVE-2026-51636 | Critical | 9.1 | 2026-08-28 | Incorrect access control in the getWiFiAclRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain Wi-Fi ACL rules via se… |
CVE-2026-51635 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain Wi-Fi scheduling ru… |
CVE-2026-51634 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getWiFiBasicCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain core wireless settings… |
CVE-2026-51633 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getWiFiEasyGuestCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain simplified guest W… |