CWE-285 · Improper Authorization (page 5)
Page 5 of 17 — CVEs classified under CWE-285, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-10282 | Medium | 4.3 | 2026-06-01 | A security vulnerability has been detected in Bottelet DaybydayCRM up to 2.2.1. This impacts the function view of the file app/Http/Controllers/DocumentsContro… |
CVE-2026-0072 | High | 7.8 | 2026-06-01 | In addInputMethodListener of com.android.server.inputmethod.InputMethodManagerService, there is a missing permission check. This could lead to local escalation… |
CVE-2026-10272 | Medium | 6.5 | 2026-06-01 | A vulnerability has been found in a4m4 Student-Management-System up to f0c5f6842c5e8c431ff02b5260a565ca844df3a0. The impacted element is an unknown function of… |
CVE-2026-10269 | Medium | 6.3 | 2026-06-01 | A security vulnerability has been detected in decolua 9router up to 0.4.0. This issue affects the function isAuthenticated of the file src/dashboardGuard.js of… |
CVE-2026-46605 | Medium | 4.3 | 2026-06-01 | Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with pro… |
CVE-2026-40963 | Low | 3.1 | 2026-06-01 | The structure_data endpoint in the Airflow UI returned external dependency graph nodes for linked Dags without checking whether the caller had read permission… |
CVE-2026-10236 | High | 7.3 | 2026-06-01 | A vulnerability has been found in SourceCodester Water Billing Management System 1.0. This issue affects some unknown processing of the file /classes/Users.php… |
CVE-2026-10218 | Medium | 5.4 | 2026-06-01 | A vulnerability has been found in nextlevelbuilder GoClaw up to 3.11.3. This affects the function auth of the file internal/http/evolution_handlers.go. Such ma… |
CVE-2026-10215 | Medium | 4.3 | 2026-06-01 | A security vulnerability has been detected in Dolibarr ERP CRM up to 23.0.1. Impacted is the function checkUserAccessToObject of the file htdocs/holiday/class/… |
CVE-2026-10212 | Medium | 6.3 | 2026-06-01 | A vulnerability was identified in AstrBotDevs AstrBot 4.24.2. This affects the function astr_main_agent of the file astrbot/core/astr_main_agent.py. Such manip… |
CVE-2026-10211 | Medium | 6.3 | 2026-06-01 | A vulnerability was determined in AstrBotDevs AstrBot 4.23.6. Affected by this issue is the function _normalize_rw_path of the file astrbot/core/tools/computer… |
CVE-2026-10154 | Medium | 4.3 | 2026-05-31 | A vulnerability has been found in Dolibarr ERP CRM 23.0.0/23.0.1/23.0.2. The affected element is an unknown function of the file htdocs/user/messaging.php. Suc… |
CVE-2026-48810 | Medium | 4.3 | 2026-05-29 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.221, while investigating the ThreadPolicy::delete issue reporte… |
CVE-2026-47744 | Critical | 9.9 | 2026-05-29 | Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, two distinct authorization defects in the team settings allowed any authenticated panel user to t… |
CVE-2026-47740 | High | 8.1 | 2026-05-29 | Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, Multiple Filament actions on the admin Order detail and Order shipments table were callable by an… |
CVE-2026-10070 | Medium | 4.7 | 2026-05-29 | A vulnerability was found in macrozheng mall up to 1.0.3. This affects an unknown function of the file /admin/update/ of the component Super Admin Password Han… |
CVE-2026-45620 | Medium | 5.3 | 2026-05-29 | WWBN AVideo is an open source video platform. In 29.0 and earlier, objects/mention.json.php has no User::loginCheck() or admin gate. It only has an entry guard… |
CVE-2026-47713 | Low | 2.0 | 2026-05-28 | AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to 1.13.0, an approved mobile… |
CVE-2026-45297 | | 2026-05-28 | OpenReplay is a self-hosted session replay suite. Prior to 1.26.0, there is a cross-tenant IDOR on feature-flag and assist-stats routes via {project_id} case m… | |
CVE-2026-47673 | Medium | 4.8 | 2026-05-28 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the jwt and jwk middlewares do not verify that the Auth… |
CVE-2025-68712 | Medium | 5.5 | 2026-05-27 | SpSoft AppLock (com.sp.protector.free) 7.9.40 for Android allows a local attacker with physical access to bypass fingerprint or PIN authentication. Although th… |
CVE-2026-6938 | Medium | 6.5 | 2026-05-27 | IBM Db2 12.1.0 through 12.1.4 is vulnerable to authorization bypass when uploading to a remote object storage path with a special query. |
CVE-2025-43289 | Medium | 5.5 | 2026-05-26 | A logic issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. A malicious app may be able… |
CVE-2026-46620 | Medium | 6.5 | 2026-05-26 | e107 is a content management system (CMS). Prior to 2.3.5, e107 CMS does not properly enforce CSRF token validation on comment moderation actions. The problem… |
CVE-2026-9484 | Medium | 6.3 | 2026-05-25 | A vulnerability was determined in SourceCodester Student Grades Management System 1.0. Affected by this vulnerability is the function getClassroomStudents/remo… |
CVE-2026-9483 | Medium | 6.3 | 2026-05-25 | A vulnerability was found in SourceCodester Student Grades Management System 1.0. Affected is an unknown function of the file grades.php. Performing a manipula… |
CVE-2026-9410 | Medium | 4.3 | 2026-05-25 | A vulnerability has been found in Sushmi-pal Invoice-System up to a0a3faa16dee2621b231ae227333f5761607283b. This vulnerability affects unknown code of the file… |
CVE-2026-9409 | Medium | 4.3 | 2026-05-25 | A flaw has been found in Sushmi-pal Invoice-System up to a0a3faa16dee2621b231ae227333f5761607283b. This affects an unknown part of the file /user of the compon… |
CVE-2026-9397 | High | 8.1 | 2026-05-24 | A weakness has been identified in Besen BS20 EV Charging Station up to 20260426. Affected by this issue is some unknown functionality of the component OTA Upda… |
CVE-2026-9376 | Medium | 6.3 | 2026-05-24 | A vulnerability was determined in JPress up to 1.0.3. The affected element is an unknown function of the file /ucenter/article/doWriteSave of the component UCe… |
CVE-2026-9306 | Low | 3.7 | 2026-05-23 | A security vulnerability has been detected in QuantumNous new-api up to 0.12.1. This affects the function RelayMidjourneyImage/GetByOnlyMJId of the file router… |
CVE-2022-34363 | Medium | 6.5 | 2026-05-22 | Dell Unisphere for PowerMax vApp version prior to 10.0.0.2, contains an authorization bypass vulnerability in the Unisphere for VMAX application running in vA… |
CVE-2026-45187 | Medium | 6.5 | 2026-05-19 | Improper Authorization vulnerability in Apache OFBiz Webtools. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version… |
CVE-2026-8786 | Medium | 6.3 | 2026-05-18 | A vulnerability has been found in Tencent WeKnora up to 0.3.6. Affected by this issue is the function getKnowledgeBaseForInitialization of the file internal/ha… |
CVE-2026-8747 | Medium | 6.3 | 2026-05-17 | A weakness has been identified in Z-BlogPHP 1.7.4.3430. This affects the function CheckComment of the file zb_system/function/c_system_event.php of the compone… |
CVE-2026-8743 | Medium | 6.3 | 2026-05-17 | A vulnerability was found in Open5GS up to 2.7.6. This impacts the function ran_ue_find_by_amf_ue_ngap_id of the file src/amf/context.c of the component AMF/MM… |
CVE-2026-45365 | Medium | 5.4 | 2026-05-15 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.11, an internal-only bypass_filter parameter is… |
CVE-2026-45345 | Medium | 6.5 | 2026-05-15 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.5.7, a user can modify another user's model even… |
CVE-2026-45371 | | 2026-05-14 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan publish-mode Reader can mutate Conf and SQL index via 8 ungated APIs. POS… | |
CVE-2026-45147 | Medium | 4.3 | 2026-05-14 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, POST /api/tag/getTag is registered with model.CheckAuth only, omitting both mode… |
CVE-2026-44504 | | 2026-05-14 | Aegra is a drop-in replacement for LangSmith Deployments. Prior to 0.9.7, with multiple authenticated users on a shared instance are vulnerable to a cross-tena… | |
CVE-2025-9988 | Medium | 4.3 | 2026-05-13 | The Broadstreet plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the create_advertiser AJAX action in all version… |
CVE-2026-34656 | Medium | 4.3 | 2026-05-12 | Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Improper Authorization vulnerability th… |
CVE-2026-43515 | Critical | 9.1 | 2026-05-12 | Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This issue affects Apache… |
CVE-2026-43983 | High | 8.1 | 2026-05-12 | Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. Prior to 2.6.0, The createTokenFromRefreshToken function… |
CVE-2026-43912 | High | 8.7 | 2026-05-11 | Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, Vaultwarden does not enforce that a groups_users.users_organizations_uuid entry… |
CVE-2026-42876 | Medium | 4.9 | 2026-05-11 | External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Prior to 2.4.1, a user who o… |
CVE-2026-42875 | | 2026-05-11 | External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Prior to 2.4.0, Namespaced S… | |
CVE-2026-42609 | High | 8.1 | 2026-05-11 | Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a business logic vulnerability in the Grav Admin Panel allows a low-privileged user (with only user c… |
CVE-2026-8241 | Medium | 5.3 | 2026-05-10 | A vulnerability has been found in Industrial Application Software IAS Canias ERP 8.03. The affected element is the function iasGetServerInfoEvent of the compon… |
CVE-2026-8196 | Low | 3.7 | 2026-05-09 | A flaw has been found in JeecgBoot 3.9.1. The impacted element is an unknown function of the file jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/… |
CVE-2026-42202 | Medium | 6.5 | 2026-05-08 | nova-toggle-5 enables fliping booleans in the index. Prior to version 1.3.0, the toggle endpoint (POST/nova-vendor/nova-toggle/toggle/{resource}/{resourceId})… |
CVE-2026-33823 | Critical | 9.6 | 2026-05-07 | Improper authorization in Microsoft Teams allows an authorized attacker to disclose information over a network. |
CVE-2026-30496 | Critical | 9.8 | 2026-05-07 | The Optoma CinemaX P2 projector (firmware TVOS-04.24.010.04.01, Android 8.0.0) exposes an HTTP API on TCP port 2345 that allows full unauthenticated remote con… |
CVE-2026-30495 | High | 8.8 | 2026-05-07 | The Optoma CinemaX P2 projector (firmware TVOS-04.24.010.04.01, Android 8.0.0) exposes Android Debug Bridge (ADB) on TCP port 5555 over the network without req… |
CVE-2026-8027 | Medium | 4.3 | 2026-05-06 | A weakness has been identified in FlowiseAI Flowise up to 3.0.12. Affected by this vulnerability is an unknown functionality of the component User Controller H… |
CVE-2026-7782 | Medium | 6.3 | 2026-05-04 | A vulnerability was detected in CodeCanyon Perfex CRM up to 3.4.1. This affects the function Clients::project of the file application/controllers/Clients.php o… |
CVE-2026-41572 | Medium | 5.3 | 2026-05-04 | Note Mark is an open-source note-taking application. Prior to version 0.19.3, after a note-mark owner soft-deletes a public book, its notes and uploaded assets… |
CVE-2026-7713 | Medium | 6.3 | 2026-05-04 | A vulnerability was detected in crocodilestick Calibre-Web-Automated up to 4.0.6. Affected by this vulnerability is the function generate_auth_token of the fil… |
CVE-2026-7709 | Medium | 6.3 | 2026-05-03 | A vulnerability was identified in janeczku Calibre-Web up to 0.6.26. The impacted element is the function generate_auth_token of the file cps/kobo_auth.py of t… |
CVE-2026-7702 | Medium | 5.3 | 2026-05-03 | A vulnerability was detected in toeverything AFFiNE up to 0.26.3. This issue affects the function allowDocPreview of the file /workspace/:workspaceId/:docId of… |
CVE-2026-7681 | Medium | 6.5 | 2026-05-03 | A security vulnerability has been detected in jsbroks COCO Annotator up to 0.11.1. Affected by this vulnerability is an unknown functionality of the file backe… |
CVE-2026-7644 | High | 7.3 | 2026-05-02 | A vulnerability has been found in ChatGPTNextWeb NextChat up to 2.16.1. Affected is the function addMcpServer of the file app/mcp/actions.ts. The manipulation… |
CVE-2026-7631 | Medium | 5.4 | 2026-05-02 | A vulnerability was found in code-projects Online Hospital Management System 1.0. The impacted element is an unknown function of the component Registration Han… |
CVE-2026-6449 | Medium | 5.3 | 2026-05-02 | The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Improper Authorization in all versions up to, and including, 2… |
CVE-2026-7602 | Medium | 6.3 | 2026-05-02 | A vulnerability was found in JeecgBoot up to 3.9.1. Affected by this vulnerability is an unknown functionality of the file /sys/fillRule/edit of the component… |
CVE-2026-7510 | Medium | 6.3 | 2026-04-30 | A vulnerability was determined in OWAP DefectDojo up to 2.55.4. Affected by this vulnerability is an unknown functionality of the component Benchmark/Engagemen… |
CVE-2026-7505 | High | 7.3 | 2026-04-30 | A flaw has been found in nextlevelbuilder GoClaw and GoClaw Lite up to 3.8.5. This affects an unknown function of the component RPC Handler. This manipulation… |
CVE-2026-7502 | Medium | 5.4 | 2026-04-30 | A security vulnerability has been detected in LinkStackOrg LinkStack up to 4.8.6. The affected element is the function saveLink of the file app/Http/Controller… |
CVE-2026-2892 | High | 7.5 | 2026-04-30 | The Otter Blocks plugin for WordPress is vulnerable to Purchase Verification Bypass in all versions up to, and including, 3.1.4. This is due to the 'get_custom… |
CVE-2026-7292 | Medium | 5.6 | 2026-04-28 | A security vulnerability has been detected in o2oa up to 10.0. This impacts the function syncFile of the file NodeAgent.java of the component NodeAgent. The ma… |
CVE-2026-5781 | High | 8.8 | 2026-04-28 | An authorization vulnerability in MphRx's Minerva V3.6.0, specifically in the '/minerva/moUser/update' endpoint, could allow an authenticated user with user mo… |
CVE-2026-7145 | Medium | 5.4 | 2026-04-27 | A weakness has been identified in mettle sendportal up to 3.0.1. Affected is the function destroy of the file app/Http/Controllers/Workspaces/WorkspaceInvitati… |
CVE-2026-7144 | Medium | 4.3 | 2026-04-27 | A security flaw has been discovered in 1000 Projects Portfolio Management System MCA 1.0. This impacts an unknown function of the file update_passwd_process.ph… |
CVE-2026-7142 | Medium | 6.3 | 2026-04-27 | A vulnerability was determined in Wooey up to 0.13.2. The impacted element is the function add_or_update_script of the file wooey/api/scripts.py of the compone… |
CVE-2026-7109 | Medium | 5.3 | 2026-04-27 | A vulnerability was detected in code-projects Invoice System in Laravel 1.0. This impacts an unknown function of the file /item of the component API Endpoint… |
CVE-2026-7093 | Medium | 6.3 | 2026-04-27 | A vulnerability was found in code-projects Invoice System in Laravel 1.0. Affected by this vulnerability is an unknown functionality of the file /invoice/ of t… |
CVE-2026-7092 | Medium | 6.3 | 2026-04-27 | A vulnerability has been found in code-projects Invoice System in Laravel 1.0. Affected is an unknown function of the file /profile/ of the component Profile H… |
CVE-2026-7091 | Medium | 6.3 | 2026-04-27 | A flaw has been found in code-projects Invoice System in Laravel 1.0. This impacts an unknown function of the file /user of the component User Management Handl… |
CVE-2026-6977 | High | 7.3 | 2026-04-25 | A security vulnerability has been detected in vanna-ai vanna up to 2.0.2. The affected element is an unknown function of the component Legacy Flask API. The ma… |
CVE-2025-67259 | Medium | 6.5 | 2026-04-24 | A Broken Access Control vulnerability exists in ClassroomIO v0.1.13 where an authenticated low-privileged "student" user can access unauthorized course-level i… |
CVE-2026-34321 | Medium | 4.8 | 2026-04-21 | Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: User Interf… |
CVE-2026-34320 | High | 7.5 | 2026-04-21 | Vulnerability in the Oracle Financial Services Customer Screening product of Oracle Financial Services Applications (component: User Interface). The supporte… |
CVE-2026-34315 | Medium | 6.5 | 2026-04-21 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 12.2.1.4.0… |
CVE-2026-6634 | Medium | 6.3 | 2026-04-20 | A weakness has been identified in usememos memos up to 0.22.1. This affects the function memos_access_token of the file src/App.tsx of the component UpdateInst… |
CVE-2026-6614 | Medium | 6.3 | 2026-04-20 | A security flaw has been discovered in TransformerOptimus SuperAGI up to 0.0.14. Affected by this vulnerability is the function get_project/update_project/get_… |
CVE-2026-6613 | Medium | 6.3 | 2026-04-20 | A vulnerability was identified in TransformerOptimus SuperAGI up to 0.0.14. Affected is the function delete_agent/stop_schedule/get_schedule_data of the file s… |
CVE-2026-6612 | Medium | 6.3 | 2026-04-20 | A vulnerability was determined in TransformerOptimus SuperAGI up to 0.0.14. This impacts the function get_agent_execution/update_agent_execution of the file su… |
CVE-2026-6609 | Medium | 6.3 | 2026-04-20 | A flaw has been found in liangliangyy DjangoBlog up to 2.1.0.0. The affected element is the function form_valid of the file oauth/views.py. This manipulation o… |
CVE-2026-6586 | Medium | 6.3 | 2026-04-20 | A vulnerability was identified in TransformerOptimus SuperAGI up to 0.0.14. Impacted is the function get_budget/update_budget of the file superagi/controllers/… |
CVE-2026-6585 | Medium | 5.4 | 2026-04-20 | A vulnerability was determined in TransformerOptimus SuperAGI up to 0.0.14. This issue affects the function update_organisation of the file superagi/controller… |
CVE-2026-6584 | Medium | 5.4 | 2026-04-20 | A vulnerability was found in TransformerOptimus SuperAGI up to 0.0.14. This vulnerability affects the function update_user of the file superagi/controllers/use… |
CVE-2026-6583 | Medium | 5.4 | 2026-04-19 | A vulnerability has been found in TransformerOptimus SuperAGI up to 0.0.14. This affects the function delete_api_key/edit_api_key of the file superagi/controll… |
CVE-2026-6572 | Medium | 5.6 | 2026-04-19 | A security vulnerability has been detected in Collabora KodExplorer up to 4.52. Affected by this issue is some unknown functionality of the file /app/controlle… |
CVE-2026-6571 | Medium | 6.3 | 2026-04-19 | A weakness has been identified in kodcloud KodExplorer up to 4.52. Affected by this vulnerability is the function roleGroupAction of the file /app/controller/s… |
CVE-2026-6570 | Low | 2.7 | 2026-04-19 | A security flaw has been discovered in kodcloud KodExplorer up to 4.52. Affected is the function initInstall of the file /app/controller/systemMember.class.php… |
CVE-2026-6564 | Medium | 4.3 | 2026-04-19 | A vulnerability was found in EMQ EMQX Enterprise up to 6.1.0. The impacted element is an unknown function of the component Session Handling. The manipulation r… |
CVE-2026-40305 | Medium | 4.3 | 2026-04-17 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 6.0.0 and prior to version 10… |
CVE-2026-40259 | High | 8.1 | 2026-04-16 | SiYuan is an open-source personal knowledge management system. In versions 3.6.3 and below, the /api/av/removeUnusedAttributeView endpoint is protected only by… |
CVE-2026-40248 | High | 7.5 | 2026-04-16 | free5GC is an open-source implementation of the 5G core network. In versions 4.2.1 and below of the UDR service, the handler for creating or updating Traffic I… |