Windows Audio Compression Manager (ACM) Elevation of Privilege Vulnerability

Improper access control in Windows Audio Compression Manager ACM allows an authorized attacker to elevate privileges locally...

Win32k Elevation of Privilege Vulnerability

Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally...

CVE-2026-15389

A vulnerability relating to insufficient access control has been identified in the session management of the Sesame Time web application and its REST v3 API. The flaw lies in the fact that the system uses the session identifier USID as the sole validation mechanism, without verifying whether that...

CVE-2026-15389 Inadequate access control in Sesame Time session management

A vulnerability relating to insufficient access control has been identified in the session management of the Sesame Time web application and its REST v3 API. The flaw lies in the fact that the system uses the session identifier USID as the sole validation mechanism, without verifying whether that...

CVE-2026-15389

Sesame Time web app and its REST v3 API expose an access-control weakness in session management: USID is used as the sole validator without verifying ownership, enabling session impersonation when a valid USID is obtained. The flaw is worsened by poor session lifecycle management, as new logins g...

Cisco Small Business WAN VPN Routers - Sensitive Information Disclosure

Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated remote attacker to retrieve sensitive information due to improper access controls for URLs. An attacker could exploit this vulnerability by connecting to an affected device via HTTP or HTTPS and...

EUVD-2026-43604

EIPStackGroup OpENer 2.3.0 commit 76b95cf suffers from an Incorrect Access Control vulnerability in its handling of encapsulation sessions. When the server processes critical encapsulation commands, it verifies whether the provided sessionhandle exists in the global session list, but it fails to...

PT-2026-58325

Name of the Vulnerable Software and Affected Versions Windows Operating Systems affected versions not specified Description Improper access control allows an authorized attacker to elevate privileges locally, potentially enabling a full system takeover. Recommendations At the moment, there is no...

PT-2026-58476

Name of the Vulnerable Software and Affected Versions Windows Event Logging Service affected versions not specified Description Insufficient granularity of access control in the Windows Event Logging Service allows an authorized attacker to execute arbitrary code over a network. Recommendations A...

PT-2026-58191

Name of the Vulnerable Software and Affected Versions Windows Server affected versions not specified Description Improper access control allows an authorized attacker to elevate privileges locally, effectively turning a basic login into a mechanism for privilege escalation. Recommendations Deploy...

PT-2026-58195

Name of the Vulnerable Software and Affected Versions Windows Win32K affected versions not specified Description Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally, which can lead to full system compromise. Recommendations At the moment, there is...

PT-2026-58695

Name of the Vulnerable Software and Affected Versions Microsoft Configuration Manager version 2509 Description Improper access control allows an authorized attacker to elevate privileges over a network. Recommendations Update Microsoft Configuration Manager version 2509 to the latest patched...

PT-2026-58592

Name of the Vulnerable Software and Affected Versions Microsoft Office SharePoint affected versions not specified Description Improper access control allows an authorized attacker to perform spoofing over a network, which enables them to affect the system. Recommendations At the moment, there is ...

PT-2026-58200

Name of the Vulnerable Software and Affected Versions Windows Audio Compression Manager affected versions not specified Description Improper access control in the Windows Audio Compression Manager ACM allows an authorized attacker to elevate privileges locally. Recommendations Install update...

PT-2026-58384

Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description Insufficient granularity of access control in the Windows Filtering Platform WFP, which acts as a traffic management system for the Windows Firewall, allows an authorized attacker to elevate...

PT-2026-58469

Name of the Vulnerable Software and Affected Versions Microsoft Windows DNS affected versions not specified Description Improper access control in the Windows DNS Client allows an authorized, logged-in attacker to perform local tampering. Recommendations At the moment, there is no information abo...

Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability

Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally...

CVE-2026-51538

EIPStackGroup OpENer 2.3.0 commit 76b95cf suffers from an Incorrect Access Control vulnerability in its handling of encapsulation sessions. When the server processes critical encapsulation commands, it verifies whether the provided sessionhandle exists in the global session list, but it fails to...

CVE-2026-58408

ChurchCRM is an open-source church management system. Prior to version 7.4.0, a low-privileged user can bypass the /admin/export UI and exfiltrate the entire member directory. The POST /CSVCreateFile.php endpoint generates and streams a CSV containing the full Personally Identifiable Information...

CVE-2026-58408 ChurchCRM : Broken Access Control in `CSVCreateFile.php` Allows Low-Privileged Users to Export All Members' PII

ChurchCRM is an open-source church management system. Prior to version 7.4.0, a low-privileged user can bypass the /admin/export UI and exfiltrate the entire member directory. The POST /CSVCreateFile.php endpoint generates and streams a CSV containing the full Personally Identifiable Information...