CWE-284 · Improper Access Control (page 9)
Page 9 of 82 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-51632 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getWiFiAdvancedCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain advanced wireless s… |
CVE-2026-51631 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain WPS runtime status… |
CVE-2026-51630 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getDdnsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain DDNS configuration, includi… |
CVE-2026-51629 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain static DHCP reserva… |
CVE-2026-51628 | Critical | 9.1 | 2026-08-28 | Incorrect access control in the getGenerateWiFiWpsPin function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to generate and retrieve a… |
CVE-2026-51627 | High | 7.5 | 2026-08-28 | Incorrect access control in the getIptvCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain IPTV and IGMP configuration… |
CVE-2026-51626 | Critical | 9.1 | 2026-08-28 | Incorrect access control in the getWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain WPS configuration, inclu… |
CVE-2026-51625 | High | 7.5 | 2026-08-28 | Incorrect access control in the getWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain sensitive information s… |
CVE-2026-51624 | High | 7.5 | 2026-08-28 | Incorrect access control in the getStationMacByIp function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain a client MAC address… |
CVE-2026-51623 | High | 7.5 | 2026-08-28 | Incorrect access control in the getDdnsStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain DDNS runtime status and… |
CVE-2026-51622 | Critical | 9.1 | 2026-08-28 | Incorrect access control in the getWanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain WAN configuration data via s… |
CVE-2026-51621 | High | 7.5 | 2026-08-28 | Incorrect access control in the getInitCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain sensitive device configurat… |
CVE-2026-51620 | High | 7.5 | 2026-08-28 | Incorrect access control in the getNetInfoCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain network topology and int… |
CVE-2026-51619 | High | 7.5 | 2026-08-28 | Incorrect access control in the getOnlineClient function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain online client informat… |
CVE-2026-51618 | High | 7.5 | 2026-08-28 | Incorrect access control in the getWizardCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain setup wizard and onboardi… |
CVE-2026-51617 | High | 7.5 | 2026-08-28 | Incorrect access control in the getSysStatusCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain sensitive information… |
CVE-2026-51616 | High | 7.5 | 2026-08-28 | Incorrect access control in the getWanIeCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain LAN addressing and DHCP co… |
CVE-2026-51615 | High | 7.5 | 2026-08-28 | Incorrect access control in the getLanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain LAN addressing and DHCP conf… |
CVE-2026-51614 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getAccessDeviceCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain access-device polic… |
CVE-2026-51613 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getDeviceInfo function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain device identification de… |
CVE-2026-51611 | Critical | 9.8 | 2026-08-28 | Incorrect access control in the startSlaveReboot function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to arbitrarily force a reboot v… |
CVE-2026-51610 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the RebootSystem function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to arbitrarily force an immediate r… |
CVE-2026-40204 | Low | 3.1 | 2026-08-28 | None None None No publicly available exploits are known. |
CVE-2026-78618 | | 2026-08-28 | A business logic flaw in WatchGuard Dimension allows an authenticated administrator to trigger multiple backend operations within a single logical flow by send… | |
CVE-2026-37073 | Medium | 5.3 | 2026-08-27 | Incorrect access control in /vfm-admin/ajax/sendfiles.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to send emails from the configu… |
CVE-2026-37072 | Critical | 9.8 | 2026-08-27 | Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updates.php. |
CVE-2026-37070 | Medium | 6.5 | 2026-08-27 | Incorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project in 4.4.9 allows an authenticated attacker to read any uploaded files by… |
CVE-2026-37067 | Medium | 5.3 | 2026-08-27 | Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to extract all appli… |
CVE-2026-18886 | | 2026-08-27 | ServiceNow has remediated an improper access control vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauth… | |
CVE-2026-64896 | | 2026-08-27 | Debug and Test Interface With Improper Access Control vulnerability in Johnson Controls T2000 allows Accessing Functionality Not Properly Constrained by ACLs. … | |
CVE-2026-81573 | High | 8.6 | 2026-08-27 | If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not enforce network- origin restrictions. Commands… |
CVE-2026-77034 | | 2026-08-27 | Joomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish in Joomla Event Manager < 5.0.1 - Any visitor holding their own… | |
CVE-2026-16569 | Medium | 4.3 | 2026-08-27 | The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not check the user's capabilities bef… |
CVE-2026-75338 | Critical | 9.8 | 2026-08-26 | disconf (Distributed Configuration Management Platform) 2.6.36 is vulnerable to Incorrect Access Control. The config-fetching APIs /api/config/item, /api/confi… |
CVE-2026-61790 | Medium | 4.4 | 2026-08-26 | Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a team can require its members to co… |
CVE-2025-70340 | Medium | 6.5 | 2026-08-26 | A Broken Access Control vulnerability exists in ThingsBoard Professional Edition (PE) 4.21 and below, within the Alarms comments functionality. An authenticate… |
CVE-2026-79940 | Medium | 5.9 | 2026-08-26 | Dell iDRAC9, 14G versions prior to 7.00.00.182 and 15G/16G versions prior to 7.20.30.50, contains an Improper Access Control vulnerability. An unauthenticated… |
CVE-2025-61162 | High | 7.5 | 2026-08-26 | Incorrect access control in Cohere North AI v1.1.5 allows attackers to arbitrarily overwrite user info via a crafted request to the /api/internal/v1/users/{{US… |
CVE-2026-54256 | Medium | 5.4 | 2026-08-26 | Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the backend FileUpload form widget truste… |
CVE-2023-42179 | Critical | 9.8 | 2026-08-26 | Bird Home Automation GmbH D1101V-F 000140 is vulnerable to Incorrect Access Control via the Key derivation process, password validation process. |
CVE-2026-77557 | Critical | 9.8 | 2026-08-26 | A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to escalate privileges on the… |
CVE-2026-77553 | Critical | 9.9 | 2026-08-26 | A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Access Application to esc… |
CVE-2026-77551 | Critical | 9.0 | 2026-08-26 | A malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi Connect Display… |
CVE-2026-77541 | Critical | 9.1 | 2026-08-26 | A malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerability found in UniFi Network Application to e… |
CVE-2026-77538 | High | 8.2 | 2026-08-26 | A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Connect Application to escalate privileges w… |
CVE-2026-77536 | Critical | 9.9 | 2026-08-26 | A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain devices running UniFi O… |
CVE-2026-77534 | Critical | 9.9 | 2026-08-26 | A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain devices running UniFi O… |
CVE-2026-18664 | Critical | 9.1 | 2026-08-26 | When ranges are used for access control (i.e. of the form 1.2.3.4-1.2.3.25), because NSD wrongly compares the IP address with the range on little endian system… |
CVE-2026-78236 | High | 8.8 | 2026-08-26 | An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to administrator by communicating over Cross-Process Communicat… |
CVE-2026-58108 | | 2026-08-26 | The personal access token removal query selects from PersonalAccessTokenDB but filters on columns of Session, with no join between them. SQLAlchemy resolves th… | |
CVE-2026-77695 | Medium | 6.5 | 2026-08-26 | The Return Refund and Exchange For WooCommerce WordPress plugin before 4.6.4 does not correctly verify the ownership of guest orders in some of the AJAX action… |
CVE-2026-74929 | Medium | 5.4 | 2026-08-26 | The Project Manager WordPress plugin before 4.0.7 does not restrict several of its REST API routes to the projects a user belongs to, allowing any authenticat… |
CVE-2026-16986 | Medium | 5.3 | 2026-08-26 | The Booking Package WordPress plugin before 1.7.25 does not validate the payment amount server-side against the stored service price, deriving the expected cha… |
CVE-2026-16984 | Medium | 6.5 | 2026-08-26 | The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1 does not include an authoriza… |
CVE-2026-65182 | Critical | 9.1 | 2026-08-25 | Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specif… |
CVE-2026-38474 | Medium | 5.4 | 2026-08-25 | GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 suffers from a Broken access control vulnerability in the IP lock manager, which… |
CVE-2026-38470 | Medium | 4.3 | 2026-08-25 | A Broken access control vulnerability in the API user endpoint in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows unprivil… |
CVE-2026-79201 | Medium | 4.3 | 2026-08-25 | Improper access control in Workers in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chro… |
CVE-2026-75465 | High | 7.5 | 2026-08-25 | The /api.php/user/get_list endpoint in Maccms v10 v2026.1000.4055 is vulnerable to an Incorrect Access Control issue. The interface fails to perform any authen… |
CVE-2026-55536 | Critical | 9.1 | 2026-08-25 | PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, Browser Server _handle_connection() checks Chrome extension origins with re.match() and the… |
CVE-2026-77997 | | 2026-08-25 | Joomla Extension - yootheme.com - Authenticated, privileged information disclosure in YOOtheme Pro 1.0.0-5.0.41 - A missing access check allowed users with com… | |
CVE-2026-61419 | High | 7.8 | 2026-08-24 | Dell ThinOS 10, versions prior to 2605_10.2518, contain an Improper Access Control vulnerability. A low privileged attacker with local access could potentially… |
CVE-2026-78245 | High | 7.3 | 2026-08-24 | A flaw has been found in itsourcecode Online Pharmacy System 1.0. This affects the function move_uploaded_file of the file all_users/register.php of the compon… |
CVE-2026-78202 | High | 7.3 | 2026-08-24 | A vulnerability was found in itsourcecode Payroll System 1.0. This affects the function save_settings of the file admin_class.php. The manipulation of the argu… |
CVE-2026-76609 | | 2026-08-22 | Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik < 4.7.2 - The onUpdateComment endpoint did not perform any access check… | |
CVE-2026-76608 | | 2026-08-22 | Joomla Extension - fabrikar.com - Unauthenticated disclosure of any commenter's email address in Fabrik < 4.7.2 - The onGetEmail endpoint did not perform any a… | |
CVE-2026-76607 | | 2026-08-22 | Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik < 4.7.2. | |
CVE-2026-76603 | | 2026-08-22 | Joomla Extension - fabrikar.com - Unauthenticated row disclosure via form.inlineedit in Fabrik < 4.7.2 - The inineedit form controller does not perform any acc… | |
CVE-2026-76601 | | 2026-08-22 | Joomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik < 4.7.2 - The order plugin did not perform any access checks. | |
CVE-2026-76600 | | 2026-08-22 | Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik < 4.7.2 - The DeleteComment endpoint did not perform any access checks. | |
CVE-2026-76599 | | 2026-08-22 | Joomla Extension - fabrikar.com - Unauthenticated database table list and table-prefix disclosure in Fabrik < 4.7.2 - The ajax_tables method of the elements mo… | |
CVE-2026-76598 | | 2026-08-22 | Joomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing via onAjax_getFolders in Fabrik < 4.7.2 - The onAjax_getFolders method of the ele… | |
CVE-2026-76597 | | 2026-08-22 | Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik < 4.7.2 - The list email plugin controller… | |
CVE-2026-76596 | | 2026-08-22 | Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik < 4.7.2- The list controllers doemtpy endpoints lacks ACL gates… | |
CVE-2026-65915 | Medium | 6.5 | 2026-08-22 | NLTK versions before 3.10.0 contain a logic bug in FileSystemPathPointer.open() where the sandbox validation check compares a normalized path against itself, m… |
CVE-2026-66916 | | 2026-08-22 | Joomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in JoomGallery < 4.4.0- An unauthenticated access control bypass… | |
CVE-2026-16738 | Medium | 5.3 | 2026-08-22 | The Conekta Payment Gateway WordPress plugin before 6.2.2 does not verify the authenticity of incoming payment gateway webhook notifications, nor bind the conf… |
CVE-2026-55622 | High | 7.7 | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for instance copying where an attacker know… |
CVE-2026-55621 | High | 7.7 | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for custom volume copying where an attacker… |
CVE-2026-77681 | Medium | 6.3 | 2026-08-21 | A vulnerability was identified in CodeAstro Online Job Portal 1.0. Affected by this vulnerability is an unknown functionality of the file /users/update-profile… |
CVE-2026-66797 | Medium | 5.4 | 2026-08-21 | Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure. The addAnnotation and listAnnotation… |
CVE-2026-65613 | Medium | 4.3 | 2026-08-21 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Webhook module while listing and deleting deliveries. This iss… |
CVE-2026-62440 | Critical | 9.1 | 2026-08-21 | Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service (CKS) plugin, allowing cross-tenant manipulation of the Kubernetes cluster whil… |
CVE-2026-16576 | High | 7.2 | 2026-08-21 | The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not correctly check user capabilities on some of its ad… |
CVE-2026-13736 | Medium | 5.3 | 2026-08-21 | The NewPath WildApricotPress Add-on WordPress plugin through 1.0.0 does not enforce its members-only field privacy on an unauthenticated REST route, allowing… |
CVE-2026-43679 | Low | 2.4 | 2026-08-21 | This issue was addressed with improved permissions checking. This issue is fixed in watchOS 26.4. An attacker with physical access to a locked Apple Watch may… |
CVE-2026-66309 | Critical | 9.1 | 2026-08-20 | Improper access control in Azure SQL Database allows an authorized attacker to elevate privileges over a network. |
CVE-2026-76995 | Medium | 4.7 | 2026-08-20 | A vulnerability was identified in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the file /admin/ajax.php… |
CVE-2026-76610 | | 2026-08-20 | Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo < 4.1.65 - The comment controller endpoint lacked ACL checks, allowing unauthorized… | |
CVE-2026-76800 | Medium | 6.3 | 2026-08-20 | A flaw has been found in DeDeCMS 3. Affected by this vulnerability is an unknown functionality of the file /include/dialog/select_media_post.php. Executing a m… |
CVE-2026-76345 | Medium | 6.0 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, a user with a high-privilege Splunk role that can manage search head clustering could use the search head cluster m… |
CVE-2026-76313 | High | 8.8 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could perform Remote Code… |
CVE-2026-76312 | Critical | 9.4 | 2026-08-19 | In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who can read the Hypertext Markup Language (HTML) source of a p… |
CVE-2026-76311 | Critical | 9.4 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could download the dispatch ar… |
CVE-2026-76310 | Critical | 9.4 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could download the associated… |
CVE-2026-20315 | Critical | 10.0 | 2026-08-19 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive inter… |
CVE-2026-75950 | | 2026-08-19 | Joomla Extension - cmsjunkie.com - Unauthenticated listing ownership takeover in J-BusinessDirectory < 6.2.3 - Ownership could be changed using attacker-suppli… | |
CVE-2026-50719 | Medium | 6.8 | 2026-08-19 | The Ingenic T41, and probably also T32, T40, and A1 SoC boot ROMs parse and execute an attacker-controlled init table from the SPL header before checking the s… |
CVE-2026-18776 | Critical | 9.8 | 2026-08-19 | The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to change t… |
CVE-2026-18466 | Medium | 5.4 | 2026-08-19 | The WP Maps WordPress plugin before 4.9.8 does not perform a capability check, nor validate a nonce, in one of its AJAX actions, allowing users with a Subscri… |