CVE-2026-20192

CVE-2026-20192 affects Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) , stemming from improper access control issues (CWE-284) identified during an internal security review. The CVSS 3.1 base score is 10.0 (Critical) , with a network attack vector, low com...

CVE-2026-20322 Cisco Nexus Dashboard Software Security Hardening Release September 2026 - Improper Access Control

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. T...

CVE-2026-20322

Cisco Nexus Dashboard is affected by improper access control vulnerabilities (CWE-284) discovered during an internal security review by Cisco's engineering team. The issues are addressed in a software hardening release (specific fixed version not provided in the available documents). The assigned...

EUVD-2026-81096

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. T...

CVE-2026-35616-detector.py

CVE-2026-35616 - FortiClient EMS Vulnerability Detector Description This tool detects if a FortiClient EMS server is vulnerable to CVE-2026-35616 , a critical improper access control vulnerability affecting versions 7.4.5 through 7.4.6. CVSS Score: 9.1 Critical CWE: CWE-284 Improper Access Contro...

CVE-2026-92601

Guns through version 8.3.5 , a Java-based enterprise admin framework, contains an improper access control flaw in SysNoticeController . The underlying cause is that the requiredPermission flag defaults to false and is never overridden by any action method, effectively bypassing permission checks....

EUVD-2026-80859

Guns through 8.3.5 contains an improper access control vulnerability in SysNoticeController where requiredPermission defaults to false and is not overridden by any action methods. Authenticated users without assigned roles can exploit this to create, edit, delete, publish and retract system-wide...

CVE-2026-40856

WNC T-Mobile 5G Box IDU router is vulnerable to improper access control. The vulnerability exists in the wncmaccheck.cgi endpoint, which is accessible without authentication. It allows a remote attacker to retrieve sensitive configuration data, including the administrator web password, WiFi...

CVE-2023-51119

CVE-2023-51119 Improper Access Control on D-Link DIR-605L router Exploitation explanation: Due to an incorrect access control, a takeover can be done over the admin account without any kind of authentication sending a request under special circumstances only needs a legitimate admin to be logged ...

AZL-101223 CVE-2026-89839 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: f2fs: use the mount idmap for the owner check in f2fsxattradviseset f2fsxattradviseset calls inodeownerorcapable with &nopmntidmap before allowing the "system.advise" xattr to be set, instead of the idmap that the VFS passes to t...

CVE-2026-84408

QND contains an improper access control vulnerability in a named pipe, which may allow a local attacker who is logged in to a Windows PC where the affected product's client is installed to execute arbitrary commands with SYSTEM privileges...

EUVD-2026-80249

GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user with Owner or Maintainer permissions could have silently disabled protected environment deployment approval...

CVE-2026-84408

QND contains an improper access control vulnerability in a named pipe, which may allow a local attacker who is logged in to a Windows PC where the affected product's client is installed to execute arbitrary commands with SYSTEM privileges...

CVE-2026-84408

QND (a client by QualitySoft ) contains an improper access control vulnerability in a named pipe . A local attacker with an existing logon session on an affected Windows PC can exploit this to execute arbitrary commands with SYSTEM privileges , leading to high impact on confidentiality, integrity...

EUVD-2026-80227

QND contains an improper access control vulnerability in a named pipe, which may allow a local attacker who is logged in to a Windows PC where the affected product's client is installed to execute arbitrary commands with SYSTEM privileges...

CVE-2024-20767-Adobe-ColdFusion

CVE-2024-20767-Adobe-ColdFusion Adobe ColdFusion is a rapid development platform for building and deploying web and mobile applications. CVE-2024-20767 - ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could lead to arbitrary file syst...

GitLab 17.1 < 19.1.8 / 19.2 < 19.2.6 / 19.3 < 19.3.2 (CVE-2026-86341)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user with Owner ...

CiscoSpill

CiscoSpill Solo una herramienta PoC para extraer contraseñas usando CVE-2019-1653. CVE-2019-1653 Una vulnerabilidad en la interfaz de administración basada en web de los routers VPN Cisco Small Business RV320 y RV325 Dual Gigabit WAN podría permitir que un atacante remoto no autenticado recupere...

CVE-2020-10551

CVEID : CVE-2020-10551 Nombre del productos afectados y versiónes : QQBrowser todas las versiones anteriores a 10.5.3870.400 Tipo de problema : CWE-284: Control de Acceso Inadecuado Resumen QQBrowser es un navegador web desarrollado por Tencent. Es uno de los navegadores web más populares...

CVE-2026-90969

Improper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authenticated user lacking the view-password permission to obtain cleartext passwords via a request to the entry listing endpoint with password disclosure parameters...