CVE-2026-107795

The TP-Link Omada Controller contains an improper authorization vulnerability in its MSP and OpenAPI certificate/private-key management APIs . Due to a failure to properly enforce administrative authorization, an authenticated user can perform privileged certificate management operations. Success...

CVE-2026-107795 Improper Authorization in TP-Link Omada Controller TLS Certificate and Private Key Management API

Omada Controller's MSP and OpenAPI certificate/private-key management APIs do not properly enforce administrative authorization, allowing an authenticated user to perform privileged certificate management operations. Successful exploitation may allow a low-privileged authenticated user to upload...

Security Bulletin: IBM i is Affected By Improper Authorization and Access Control Vulnerabilities in Network File System [CVE-2026-17068, CVE-2026-17073]

Summary IBM i is vulnerable to bypassing Network File System NFS version restrictions due to improper enforcement CVE-2026-17068 and obtaining sensitive information due to missing subtree checks CVE-2026-17073 in NFS as described in the vulnerability details section. Vulnerability Details...

Exploit for Improper Authorization in Microsoft

certighost – NXC module for CVE-2026-54121 NetExec NXC...

Web Authentication Passkeys Security Keys Access

The vulnerability of the Web Authentication components Passkeys & Security Keys in Google Chrome and Microsoft Edge is related to improper authorization. Exploiting this vulnerability can allow a malicious actor to gain access to protected information through a specially created HTML page...

Omnibox address bars compromise Data Compromise

The vulnerability of the Omnibox address bars in Google Chrome and Microsoft Edge is related to improper authorization. Exploiting this vulnerability allows a malicious actor to compromise the integrity of protected information through a specially created HTML page...

Component Access Information Disclosure

The vulnerability of the Browser component in Google Chrome and Microsoft Edge is related to improper authorization. Exploiting this vulnerability can allow a remote attacker to gain access to protected information through a specially created HTML page...

Paint Component Protected Information Access

The vulnerability of the Paint component in Google Chrome and Microsoft Edge is related to improper authorization. Exploiting this vulnerability can allow an attacker to gain access to protected information through a specially created HTML page...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: tomcat (UTSA-2026-130103)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130103 advisory. Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This issue affects Apache Tomcat...

CVE-2026-96311

Improper authorization in Windows Network List Service allows an authorized attacker to perform tampering locally...

CVE-2026-88162

Improper authorization in Windows Encrypting File System EFS allows an authorized attacker to perform tampering locally...

CVE-2026-70148

Improper authorization in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally...

CVE-2026-103560

Improper authorization in DNS Server allows an authorized attacker to perform tampering locally...

CVE-2026-103560

The DNS Server is subject to an improper authorization vulnerability (CWE-862) that allows an authorized attacker to perform local tampering . The vulnerability results in a high integrity impact and is rated as MEDIUM severity with a CVSS3.1 score of 5.5. No specific exploit information or remed...

CVE-2026-70148

The Windows Broadcast DVR User Service is susceptible to an improper authorization vulnerability (CWE-441). This flaw allows an authorized attacker to perform a local information disclosure . The vulnerability has a CVSS 3.1 base score of 6.5 and is categorized as a MEDIUM severity issue. No spec...

CVE-2026-96311

A vulnerability exists in the Windows Network List Service due to improper authorization . This flaw allows an authorized attacker to perform local tampering . The impact is categorized as a high integrity compromise with a base score of 5.5. No specific exploit details or in-the-wild exploitatio...

CVE-2026-88162

A vulnerability exists in the Windows Encrypting File System (EFS) due to improper authorization (CWE-863 ). This flaw allows an authorized attacker to perform local tampering . The vulnerability has been confirmed by Microsoft with a base score of 5.5 and an official fix is available. No specifi...

CVE-2026-15577

A flaw was found in Grafana. An improper authorization vulnerability allows an authenticated user or service account with read-only access to modify Git Sync connection configurations through the status subresource. Consequently, an attacker can make unauthorized configuration changes despite...

CVE-2026-109605

A security vulnerability has been detected in SourceCodester Simple Cafe Billing System 1.0. This affects the function Action::saveuser of the file adminclass.php of the component User Management. The manipulation of the argument Type leads to improper authorization. The attack is possible to be...

CVE-2026-109605 SourceCodester Simple Cafe Billing System User Management admin_class.php save_user improper authorization

A security vulnerability has been detected in SourceCodester Simple Cafe Billing System 1.0. This affects the function Action::saveuser of the file adminclass.php of the component User Management. The manipulation of the argument Type leads to improper authorization. The attack is possible to be...