Configuration Manager Elevation of Privilege Vulnerability

Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network...

DNS Client Tampering Vulnerability

Improper access control in Microsoft Windows DNS allows an authorized attacker to perform tampering locally...

Windows Operating Systems Elevation of Privilege Vulnerability

Improper access control in Windows Operating Systems allows an authorized attacker to elevate privileges locally...

Extensible Storage Engine (ESENT) Elevation of Privilege Vulnerability

Improper access control in Extensible Storage Engine ESENT allows an authorized attacker to elevate privileges locally...

Windows Filtering Platform Elevation of Privilege Vulnerability

Insufficient granularity of access control in Windows Filtering Platform WFP allows an authorized attacker to elevate privileges locally...

Windows Search Service Elevation of Privilege Vulnerability

Improper access control in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally...

Win32k Elevation of Privilege Vulnerability

Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally...

Active Directory Federation Services Elevation of Privilege Vulnerability

Insufficient granularity of access control in Active Directory Federation Services AD FS allows an authorized attacker to elevate privileges locally...

Windows Event Logging Service Remote Code Execution Vulnerability

Insufficient granularity of access control in Windows Event Logging Service allows an authorized attacker to execute code over a network...

Windows Kernel Elevation of Privilege Vulnerability

Improper access control in Windows Kernel allows an authorized attacker to elevate privileges locally...

Surface Broker SDMA Elevation of Privilege Vulnerability

Insufficient granularity of access control in Microsoft Surface allows an authorized attacker to elevate privileges locally...

Microsoft Exchange Server Elevation of Privilege Vulnerability

Insufficient granularity of access control in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally...

CVE-2026-15389

A vulnerability relating to insufficient access control has been identified in the session management of the Sesame Time web application and its REST v3 API. The flaw lies in the fact that the system uses the session identifier USID as the sole validation mechanism, without verifying whether that...

CVE-2026-15389

Sesame Time web app and its REST v3 API expose an access-control weakness in session management: USID is used as the sole validator without verifying ownership, enabling session impersonation when a valid USID is obtained. The flaw is worsened by poor session lifecycle management, as new logins g...

CVE-2026-15389 Inadequate access control in Sesame Time session management

A vulnerability relating to insufficient access control has been identified in the session management of the Sesame Time web application and its REST v3 API. The flaw lies in the fact that the system uses the session identifier USID as the sole validation mechanism, without verifying whether that...

Cisco Small Business WAN VPN Routers - Sensitive Information Disclosure

Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated remote attacker to retrieve sensitive information due to improper access controls for URLs. An attacker could exploit this vulnerability by connecting to an affected device via HTTP or HTTPS and...

EUVD-2026-43604

EIPStackGroup OpENer 2.3.0 commit 76b95cf suffers from an Incorrect Access Control vulnerability in its handling of encapsulation sessions. When the server processes critical encapsulation commands, it verifies whether the provided sessionhandle exists in the global session list, but it fails to...

GHSA-3Q6Q-26VG-V97X Kimai: Improper Authorization Through Activity Creation with Preset Project Allows Creation Under Unauthorized Projects

Summary Kimai 2.56.0 contains an authenticated improper authorization vulnerability in the preset-project activity creation flow. A user with the generic createactivity permission, but without access to a target project, can still create a new Activity under that unauthorized project by visiting...

PT-2026-58624

Name of the Vulnerable Software and Affected Versions Microsoft Extensible Storage Engine affected versions not specified Description Improper access control in the Extensible Storage Engine ESENT allows an authorized attacker to elevate privileges locally, which can lead to full system compromis...

PT-2026-58198

Name of the Vulnerable Software and Affected Versions Windows MIDI Service Module affected versions not specified Description Improper access control in the Windows MIDI Service Module allows an authorized attacker to elevate privileges locally, which can lead to full system compromise...