CWE-285 · Improper Authorization (page 2)
Page 2 of 17 — CVEs classified under CWE-285, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-90566 | High | 7.3 | 2026-09-13 | A weakness has been identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this vulnerability is the fu… |
CVE-2026-90521 | Medium | 6.3 | 2026-09-13 | A vulnerability was found in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132. This issue affects some unknown processin… |
CVE-2026-90520 | Medium | 6.3 | 2026-09-13 | A vulnerability has been found in jaychouchannel Tourism-Management-System up to 84d8ec384f669df3985293dab293bb7b477efa64. This vulnerability affects unknown c… |
CVE-2026-90517 | Medium | 5.3 | 2026-09-13 | A vulnerability was identified in PHPGurukul Bank Locker Management System 1.0. This affects an unknown function of the file /blms/view-assign-locker.php. The… |
CVE-2026-90499 | Medium | 5.4 | 2026-09-13 | A security flaw has been discovered in lenve vhr 1.0-SNAPSHOT. This affects the function HrInfoController.updatePass of the file /hr/pass of the component Pass… |
CVE-2026-44715 | | 2026-09-11 | OpenMRS is an open source electronic medical record system platform. Prior to versions 1.23.0 and 2.10.0, an authenticated user can trigger administrative DWR… | |
CVE-2026-53952 | Critical | 9.8 | 2026-09-11 | GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. A logic flaw in GetSimple CMS (v3.4.0a and below… |
CVE-2026-49463 | Medium | 6.5 | 2026-09-11 | NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizatio… |
CVE-2026-80436 | High | 8.5 | 2026-09-10 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service by deleting arbitrary RabbitMQ queues or e… |
CVE-2026-80378 | High | 8.5 | 2026-09-10 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to improper authorization. |
CVE-2026-85543 | Medium | 4.3 | 2026-09-10 | Some Wi-Fi series camera products have insufficient permission validation on certain interfaces, allowing authenticated low-privileged users to obtain device W… |
CVE-2026-21097 | Medium | 6.7 | 2026-09-09 | Improper authentication in ActivityTaskManagerService prior to SMR Sep-2026 Release 1 allows local privileged attackers to launch arbitrary activity. |
CVE-2026-86804 | Medium | 5.3 | 2026-09-08 | A vulnerability was identified in seakee CPA-Manager-Plus up to 1.11.10. This vulnerability affects the function CPAResource of the file apps/manager-server/in… |
CVE-2026-58611 | High | 7.8 | 2026-09-08 | Improper authorization in XBox Gaming Services allows an authorized attacker to elevate privileges locally. |
CVE-2026-86277 | High | 7.3 | 2026-09-07 | A vulnerability has been found in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. Impacted is an unknown function of the file del… |
CVE-2026-86263 | High | 7.3 | 2026-09-07 | A vulnerability was detected in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This impacts the function orderRecordsService.cancelOrder o… |
CVE-2026-86262 | High | 7.3 | 2026-09-07 | A security vulnerability has been detected in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This affects the function updateOrderSta1/upd… |
CVE-2026-86261 | High | 7.3 | 2026-09-07 | A weakness has been identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. The impacted element is an unknown function of the file s… |
CVE-2026-86283 | | 2026-09-06 | MISP's UiBeta theme collection view (app/View/Themed/UiBeta/Collections/view.ctp) performed a secondary query of member events by UUID without applying the cal… | |
CVE-2026-86212 | Medium | 4.3 | 2026-09-06 | A vulnerability has been found in Open5GS 2.7.7/2.8.0. This vulnerability affects unknown code of the component AMF/MME. The manipulation leads to improper aut… |
CVE-2026-86183 | Medium | 5.3 | 2026-09-06 | A vulnerability was identified in diem-project diem up to 5.1.3. This vulnerability affects unknown code of the file dmFrontPlugin/modules/dmWidget/lib/BasedmW… |
CVE-2026-53602 | | 2026-09-04 | nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.7, two related authorization gaps let a host that should no longer b… | |
CVE-2026-85638 | High | 7.3 | 2026-09-04 | A weakness has been identified in jofpin trape 2.0. This affects an unknown part of the file core/user.py. This manipulation of the argument vId/id causes auth… |
CVE-2026-18175 | High | 8.1 | 2026-09-04 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to manipulate database transactions due to improper authorization in the DDM target dispatcher. |
CVE-2026-17483 | Medium | 4.3 | 2026-09-04 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 IBM i could allow a local attacker to delete historical flight-recorder archives due to improper access control in an SQ… |
CVE-2026-75165 | Medium | 6.5 | 2026-09-04 | An issue in /cgi-bin/wwwugw.cgi of MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenticated user with the low-privileged Standard role to… |
CVE-2026-85381 | Medium | 5.3 | 2026-09-04 | A security vulnerability has been detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This issue affec… |
CVE-2026-85378 | High | 7.3 | 2026-09-03 | A vulnerability was identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is th… |
CVE-2026-85241 | Medium | 6.3 | 2026-09-03 | A weakness has been identified in SpecterOps BloodHound up to 9.5.1. The affected element is the function NewV2API of the file cmd/api/src/api/registration/v2… |
CVE-2026-50554 | Medium | 5.3 | 2026-09-03 | Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/{bookID}/notes is an unauthenticated endpoint that accepts a "dele… |
CVE-2026-85105 | High | 7.3 | 2026-09-03 | A flaw has been found in NousResearch hermes-agent 0.18.0. Affected by this issue is the function _sess_nowait of the file s71.py of the component Session Mana… |
CVE-2026-79989 | | 2026-09-02 | The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It al… | |
CVE-2026-84799 | Medium | 4.3 | 2026-09-02 | Craft CMS before 5.11.0 fails to enforce user-group scope filters on native GraphQL user relations including author, authors, uploader, draftCreator, and revis… |
CVE-2026-83743 | Medium | 6.3 | 2026-09-01 | A weakness has been identified in invoiceninja Invoice Ninja up to 5.13.26. This affects an unknown part of the file /vedor/profile/ of the component Vendor Po… |
CVE-2026-82816 | Medium | 6.3 | 2026-08-31 | A vulnerability has been found in dibo-software diboot 3.8.0. Affected by this vulnerability is an unknown functionality of the file /api/ai-session/ of the co… |
CVE-2026-82621 | High | 7.3 | 2026-08-31 | A weakness has been identified in Soarkey StudentManagement and 学生信息管理系统 up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. This impacts the function AdminDao.doG… |
CVE-2026-82602 | Medium | 5.3 | 2026-08-31 | A security vulnerability has been detected in SeaCMS up to 13.6. This vulnerability affects unknown code of the file /ass.php. The manipulation leads to author… |
CVE-2026-82594 | Medium | 5.0 | 2026-08-31 | A vulnerability has been found in LogNet grpc-spring-boot-starter up to 5.2.0. Affected is an unknown function of the component Annotation Processing. Such man… |
CVE-2026-82553 | Medium | 6.3 | 2026-08-30 | A vulnerability was detected in sambitraj Student Management System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. Affected by this issue is the function mysq… |
CVE-2026-82658 | Medium | 4.3 | 2026-08-30 | Admidio versions before 5.0.12 contain a broken access control vulnerability in profile_function.php that allows authenticated low-privilege users to read anot… |
CVE-2026-55547 | Medium | 4.3 | 2026-08-28 | Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits SystemPrivilege.ControlAccess checks from IamApi.listRoles, IamApi.getRole, and I… |
CVE-2026-55065 | High | 8.1 | 2026-08-28 | Vikunja is an open-source self-hosted task management platform. From 0.24.6 until 2.4.0, DELETE /api/v1/projects/:project/views/:view permits an authenticated… |
CVE-2026-54766 | | 2026-08-28 | Vikunja is an open-source self-hosted task management platform. From 0.21.0 until 2.4.0, the project duplication operation in pkg/models/project_duplicate.go a… | |
CVE-2026-50152 | Critical | 9.1 | 2026-08-28 | Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Monitor subscription… |
CVE-2026-16279 | Critical | 9.3 | 2026-08-27 | An Improper Authorization vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x could allow an at… |
CVE-2026-62249 | Medium | 4.3 | 2026-08-26 | Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, an authenticated user with access to… |
CVE-2026-35445 | | 2026-08-26 | Winter CMS is a content management system built on the Laravel PHP framework. In versions prior to 1.2.13, the backend did not validate the handler name submit… | |
CVE-2026-78236 | High | 8.8 | 2026-08-26 | An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to administrator by communicating over Cross-Process Communicat… |
CVE-2026-70665 | Medium | 4.2 | 2026-08-25 | Doorkeeper OpenID Connect implements an OpenID Connect authentication provider for Rails applications on top of Doorkeeper. Prior to 1.10.4, the Dynamic Client… |
CVE-2026-18985 | High | 8.1 | 2026-08-25 | Incorrect Authorization vulnerability in Drupal Edit in-place field allows Forceful Browsing. This issue affects Edit in-place field versions: from 0.0.0 to 2… |
CVE-2026-66422 | High | 8.1 | 2026-08-25 | Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additio… |
CVE-2026-55571 | High | 8.2 | 2026-08-25 | djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to 1.0.4, LiveViewConsumer.handle_mount se… |
CVE-2026-78887 | Low | 3.7 | 2026-08-25 | A weakness has been identified in liketrek TREK up to 3.0.22. This impacts the function validateShareTokenForAsset of the component Journey Photo Proxy. Execut… |
CVE-2026-79667 | High | 7.6 | 2026-08-25 | Ech0 version 4.3.4 and earlier fails to reliably enforce scoped access token (least-privilege) restrictions on several privileged admin routes. Multiple privil… |
CVE-2026-78160 | Medium | 6.3 | 2026-08-24 | A vulnerability has been found in Dolibarr ERP up to 18.0.10/22.0.5/23.0.3. This issue affects some unknown processing of the file /user/note.php of the compon… |
CVE-2026-78158 | Medium | 6.3 | 2026-08-24 | A flaw has been found in Open5GS 2.8.0. This vulnerability affects unknown code of the component AMF UEContextReleaseRequest Path Handler. Executing a manipula… |
CVE-2026-78144 | Medium | 6.3 | 2026-08-23 | A vulnerability was identified in code-projects Barangay Resident Profiling Management System 1.0. Affected by this vulnerability is an unknown functionality o… |
CVE-2026-78142 | Medium | 6.3 | 2026-08-23 | A vulnerability was found in code-projects Barangay Resident Profiling Management System 1.0. This impacts an unknown function of the file /archived_records.ph… |
CVE-2026-78115 | Medium | 5.4 | 2026-08-23 | A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /admin/edit_user_account.ph… |
CVE-2026-77795 | Medium | 6.3 | 2026-08-21 | A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.6.2. This issue affects the function FlwInstanceController/FlwDefinitionController/FlwCategory… |
CVE-2026-77686 | Medium | 5.4 | 2026-08-21 | A weakness has been identified in Dolibarr up to 23.0.4. This affects an unknown part of the file htdocs/user/card.php of the component Account Handler. This m… |
CVE-2026-66722 | High | 7.2 | 2026-08-21 | Improper authorization for CRUD operations on Project Roles and Project Role permissions for domain admins in CloudStack. A Domain Admin can create, update… |
CVE-2026-54624 | Medium | 6.5 | 2026-08-20 | django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, render_object_structure in cms/view… |
CVE-2026-77036 | Medium | 6.3 | 2026-08-20 | A vulnerability was found in elunez eladmin up to 2.7. The impacted element is the function EmailController/AliPayController/GeneratorController/GenConfigContr… |
CVE-2026-18283 | Low | 2.4 | 2026-08-20 | Sony XAV-9500ES udev USB Rules Authorization Bypass Vulnerability. This vulnerability allows physically present attackers to bypass authorization on affected i… |
CVE-2026-76999 | Medium | 6.3 | 2026-08-20 | A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This affects the function add_grade of the file /… |
CVE-2026-16925 | High | 7.1 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to achieve privilege escalation due to improper authorization. |
CVE-2026-76352 | High | 8.8 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could create or modify a s… |
CVE-2026-53548 | Critical | 9.6 | 2026-08-19 | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.6.1, the GET /host/db/host/:id/passwor… |
CVE-2026-55519 | Medium | 5.4 | 2026-08-19 | Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an authenticated user with generic asset edit permission can delete files attached to assets… |
CVE-2026-76243 | | 2026-08-19 | stigmem versions before 0.9.0a2 allow unauthenticated access when authentication is disabled on non-loopback deployments. Attackers can perform read, write, an… | |
CVE-2025-11729 | Medium | 4.3 | 2026-08-19 | The PPWP: Password Protect Pages, Posts & Full or Partial Content plugin for WordPress is vulnerable to unauthorized access of data due to a improper capabilit… |
CVE-2026-21584 | High | 8.1 | 2026-08-18 | This High severity Improper Authorization vulnerability was introduced in versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center. … |
CVE-2026-70923 | Medium | 6.1 | 2026-08-18 | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 3.0.0-3.2.18. Ea… |
CVE-2026-55166 | Critical | 9.9 | 2026-08-18 | Lemur manages TLS certificate creation. Prior to 1.9.2, authenticated users could influence an ACME authority acme_url without an effective server-side destina… |
CVE-2026-48744 | Medium | 6.5 | 2026-08-18 | Saleor is an e-commerce platform. From 3.14.67 until 3.21.67, 3.22.63, and 3.23.22, a broken authorization check in saleor/permission/utils.py can incorrectly… |
CVE-2026-19608 | Medium | 5.3 | 2026-08-18 | A flaw was found in the group policy provider of Keycloak authorization services, which is used to manage fine-grained access control to resources. The issue o… |
CVE-2024-14045 | Medium | 6.3 | 2026-08-18 | A weakness has been identified in OpenBoxes up to 0.9.2. This vulnerability affects unknown code of the file grails-app/controllers/org/pih/warehouse/RoleInter… |
CVE-2026-19997 | Medium | 4.7 | 2026-08-17 | A security flaw has been discovered in Webkul Bagisto up to 2.4.4. This issue affects some unknown processing of the file /admin/sales/rma/requests of the comp… |
CVE-2026-19994 | Medium | 6.3 | 2026-08-17 | A vulnerability was found in Webkul Bagisto up to 2.4.4. Affected by this issue is some unknown functionality of the file /admin/configuration/cache-management… |
CVE-2026-19986 | Medium | 5.4 | 2026-08-17 | A weakness has been identified in Adblock for Youtube Extension up to 7.2.1 on Chrome. The impacted element is the function updateDynamicRules of the file cont… |
CVE-2026-19979 | High | 8.3 | 2026-08-17 | A vulnerability was identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X20… |
CVE-2026-19966 | Medium | 5.4 | 2026-08-17 | A vulnerability was identified in CodeCanyon TimeCamp Integration for CRM up to 2.8. This issue affects some unknown processing of the file /clients/save_conta… |
CVE-2026-16879 | High | 8.8 | 2026-08-14 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to improper authorization using user-sup… |
CVE-2026-19838 | Medium | 4.3 | 2026-08-14 | A security vulnerability has been detected in Webkul Bagisto up to 2.4.4. This vulnerability affects unknown code of the file /admin/reporting/sales/ of the co… |
CVE-2026-19836 | Medium | 4.3 | 2026-08-14 | A security flaw has been discovered in Webkul Bagisto up to 2.4.4. Affected by this issue is some unknown functionality of the file /admin/customers/view of th… |
CVE-2026-19834 | Medium | 4.7 | 2026-08-14 | A vulnerability was determined in Webkul Bagisto up to 2.4.4. Affected is an unknown function of the file /admin/customers/login-as-customer/ of the component… |
CVE-2026-19784 | Medium | 4.3 | 2026-08-14 | A flaw has been found in francoisjacquet RosarioSIS up to 12.8. This affects the function DBUpdate of the file Discipline/Referrals.php. This manipulation caus… |
CVE-2026-73421 | | 2026-08-13 | NextAuth.js provides authentication for Next.js. From next-auth 5.0.0-beta.0 until 5.0.0-beta.32, applications that gate access by checking only for the existe… | |
CVE-2026-18509 | High | 8.2 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to gain privilege escalation via the Navigator for i debugger. This could allow the att… |
CVE-2026-73644 | Critical | 9.6 | 2026-08-13 | OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.2, the SASL PLAIN authorization identity path in opendj-server-legacy/src/main/java/org/opends/se… |
CVE-2026-3835 | Medium | 5.3 | 2026-08-13 | The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token vali… |
CVE-2026-10543 | High | 8.2 | 2026-08-12 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation with a specially crafted query. |
CVE-2026-72786 | Medium | 6.5 | 2026-08-12 | Craft CMS versions before 5.10.8 contain an authentication bypass vulnerability in the elements/save action that allows authenticated users to change passwords… |
CVE-2026-18499 | High | 8.1 | 2026-08-12 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to a privilege escalation when using Liberty collectives. |
CVE-2026-18144 | Medium | 4.3 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper authorization. |
CVE-2026-72907 | Medium | 6.5 | 2026-08-10 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the add_ac function in erpnext/accounts/utils.py accepts th… |
CVE-2026-47663 | | 2026-08-07 | Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pa… | |
CVE-2026-59118 | Critical | 9.3 | 2026-08-07 | Improper authorization in Copilot Cowork allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-19066 | Medium | 4.3 | 2026-08-06 | A vulnerability was identified in SourceCodester Online Examination & Learning Management System 1.0. Impacted is an unknown function of the file view_students… |