Windows Filtering Platform Elevation of Privilege Vulnerability

Insufficient granularity of access control in Windows Filtering Platform WFP allows an authorized attacker to elevate privileges locally...

Windows Kernel Elevation of Privilege Vulnerability

Improper access control in Windows Kernel allows an authorized attacker to elevate privileges locally...

Windows Search Service Elevation of Privilege Vulnerability

Improper access control in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally...

Surface Broker SDMA Elevation of Privilege Vulnerability

Insufficient granularity of access control in Microsoft Surface allows an authorized attacker to elevate privileges locally...

Active Directory Federation Services Elevation of Privilege Vulnerability

Insufficient granularity of access control in Active Directory Federation Services AD FS allows an authorized attacker to elevate privileges locally...

Microsoft Exchange Server Elevation of Privilege Vulnerability

Insufficient granularity of access control in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally...

Win32k Elevation of Privilege Vulnerability

Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally...

CVE-2026-15389

A vulnerability relating to insufficient access control has been identified in the session management of the Sesame Time web application and its REST v3 API. The flaw lies in the fact that the system uses the session identifier USID as the sole validation mechanism, without verifying whether that...

CVE-2026-15389

Sesame Time web app and its REST v3 API expose an access-control weakness in session management: USID is used as the sole validator without verifying ownership, enabling session impersonation when a valid USID is obtained. The flaw is worsened by poor session lifecycle management, as new logins g...

CVE-2026-15389 Inadequate access control in Sesame Time session management

A vulnerability relating to insufficient access control has been identified in the session management of the Sesame Time web application and its REST v3 API. The flaw lies in the fact that the system uses the session identifier USID as the sole validation mechanism, without verifying whether that...

Cisco Small Business WAN VPN Routers - Sensitive Information Disclosure

Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated remote attacker to retrieve sensitive information due to improper access controls for URLs. An attacker could exploit this vulnerability by connecting to an affected device via HTTP or HTTPS and...

EUVD-2026-43604

EIPStackGroup OpENer 2.3.0 commit 76b95cf suffers from an Incorrect Access Control vulnerability in its handling of encapsulation sessions. When the server processes critical encapsulation commands, it verifies whether the provided sessionhandle exists in the global session list, but it fails to...

GHSA-3Q6Q-26VG-V97X Kimai: Improper Authorization Through Activity Creation with Preset Project Allows Creation Under Unauthorized Projects

Summary Kimai 2.56.0 contains an authenticated improper authorization vulnerability in the preset-project activity creation flow. A user with the generic createactivity permission, but without access to a target project, can still create a new Activity under that unauthorized project by visiting...

PT-2026-58624

Name of the Vulnerable Software and Affected Versions Microsoft Extensible Storage Engine affected versions not specified Description Improper access control in the Extensible Storage Engine ESENT allows an authorized attacker to elevate privileges locally, which can lead to full system compromis...

PT-2026-58592

Name of the Vulnerable Software and Affected Versions Microsoft Office SharePoint affected versions not specified Description Improper access control allows an authorized attacker to perform spoofing over a network, which enables them to affect the system. Recommendations At the moment, there is ...

PT-2026-58145

Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description Insufficient granularity of access control in the Windows StateRepository API allows an authorized attacker to elevate privileges locally. Recommendations Apply the July patch to resolve this...

PT-2026-58195

Name of the Vulnerable Software and Affected Versions Windows Win32K affected versions not specified Description Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally, which can lead to full system compromise. Recommendations At the moment, there is...

PT-2026-58200

Name of the Vulnerable Software and Affected Versions Windows Audio Compression Manager affected versions not specified Description Improper access control in the Windows Audio Compression Manager ACM allows an authorized attacker to elevate privileges locally. Recommendations Install update...

Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability

Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally...

PT-2026-58198

Name of the Vulnerable Software and Affected Versions Windows MIDI Service Module affected versions not specified Description Improper access control in the Windows MIDI Service Module allows an authorized attacker to elevate privileges locally, which can lead to full system compromise...