CVE-2026-20294 Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability

A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to view sensitive information in clear text on an affected system. This vulnerability is due to insufficient access control enforcement for specific template types...

EUVD-2026-52924

An Improper Authorization vulnerability exists in ERPNext version v16.25.0 and 15.115.0 due to insufficient access control in the whitelisted API method erpnext.crm.doctype.prospect.prospect.getopportunities. This issue affects ERPNext: before 15.115.0, before 16.26.0...

ASUS AURA SYNC driver local privilege escalation

RISK EVALUATION Exposed IOCTL with Insufficient Access Control in the ASUS AURA SYNC driver allows a local user to bypass the driver's verification and invoke arbitrary IOCTLs, resulting in privilege escalation. 2. RECOMMENDED PRACTICES ASUS recommends that users check whether a newer version of...

ROS-20260717-73-0030

The vulnerability of Google Chrome’s application programming interface extensions is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to bypass security restrictions by downloading specially created extensions...

EUVD-2026-43825

Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally...

PYSEC-2026-2934 praisonai-platform: Any workspace member can delete the entire workspace via DELETE /workspaces/{id}

Summary Type: Authorization bypass enabling destructive action. The DELETE /workspaces/workspaceid endpoint is gated only by requireworkspacememberworkspaceid default minrole="member". Any member of the workspace can issue a single DELETE to wipe the entire workspace, including every project,...

CVE-2026-59523

Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through = 1.6.11.11...

ROS-20260707-73-0056

The vulnerability of the Annotations API interface of the Grafana monitoring and observation platform is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to gain read, modify, or delete access to data...

The vulnerability of the Supply to Order Workbench component, a tool set for creating and assembling orders within the Oracle Configure to Order system—a business automation solution from Oracle E-Business Suite—allows unauthorized access by attackers to read, create, modify, and delete protected information.

The vulnerability of the Supply to Order Workbench component, a tool for creating and assembling orders within the Oracle Configure to Order system—a business automation solution from Oracle E-Business Suite—is related to deficiencies in access control. Exploiting this vulnerability could allow a...

Improper Authorization

Apache DolphinScheduler is vulnerable to Improper Authorization. The vulnerability is due to incorrect authorization checks in the experimental /v2 interface, where insufficient access control allows attackers to perform unauthorized actions or access protected resources...

Vulnerability of the Core component of the Oracle WebCenter Content application: The Oracle WebCenter Content imaging platform for user interaction allows a perpetrator to gain unauthorized access to read, create, delete, and modify data.

Vulnerability of the Core component of the Oracle WebCenter Content application: The Imaging platform of Oracle WebCenter Content is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of...

The vulnerabilities of JADM components, the JVM diagnostics software for monitoring Oracle Application Performance Management, part of the Oracle Enterprise Manager software platform, allow attackers to gain unauthorized access to information or cause service failures.

The vulnerability of JADM components, a software for JVM diagnostics and monitoring within Oracle Application Performance Management, is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to gain unauthorized access to information or cause service...

The vulnerability of the Enterprise Infrastructure Security component of the JD Edwards EnterpriseOne Tools system allows a hacker to gain full access to the system.

The vulnerability of the Enterprise Infrastructure Security component of the JD Edwards EnterpriseOne Tools management system is related to lack of access control. Exploiting this vulnerability could allow a malicious actor to gain full access to the system...

The vulnerability of the Content Server component of the Oracle WebCenter Content user interaction platform allows a perpetrator to gain access to read, modify, or delete data.

The vulnerability of the Content Server component of the Oracle WebCenter Content user interaction platform is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to gain read, modify, or delete access to data...

The vulnerability in the virtual graphics adapter VMSVGA of the Oracle VM VirtualBox software allows a attacker to trigger a service failure.

The vulnerability of the Virtual Graphics Adapter VMSVGA in the Oracle VM VirtualBox virtualization software is related to deficiencies in access control. This vulnerability allows a malicious actor to trigger a service failure...

CVE-2026-11532 imvks786 student_management_system Student Record add.php access control

A weakness has been identified in imvks786 studentmanagementsystem up to 9599b560ad3c3b83e75d328b76bedcd489ef1f46. Affected is an unknown function of the file /add.php of the component Student Record Handler. Executing a manipulation can lead to improper access controls. The attack may be perform...

ROS-20260605-73-0081

The vulnerability in Firefox is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to enhance their privileges...

The vulnerability of the Framework component in Android operating systems, which allows a hacker to increase their privileges

The vulnerability of the Framework component in Android operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

The vulnerability of the setother_config() function in the RBAC access control subsystem of the XCP-ng supervisor and the XenServer server virtualization platform allows a malicious individual to gain unauthorized access to the file system.

The vulnerability of the setotherconfig function in the RBAC access control subsystem of the XCP-ng supervisor and the XenServer server virtualization platform is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain...

PT-2026-41181

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.8.9 Description When a non-administrative user logs into the application, a web request to the '/api/models?' endpoint is initiated. The response from this request reveals the system prompts of available models...