168634 matches found
PT-2026-68848
Name of the Vulnerable Software and Affected Versions Jiangmin Antivirus 21 Description A flaw in the Minifilter Port component within the kvcore.sys library allows for improper access controls. This issue occurs in the MessageNotifyCallback function and requires local access to be exploited...
The vulnerability of Cisco IOS XE operating systems, related to deficiencies in access control, allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.
The vulnerability of Cisco IOS XE operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information...
The vulnerability of the programmatically defined Cisco Catalyst SD-WAN (formerly Cisco SD-WAN) relates to deficiencies in access control, allowing attackers to compromise the confidentiality, integrity, and accessibility of protected information.
The vulnerability of the programmatically defined Cisco Catalyst SD-WAN formerly Cisco SD-WAN is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information...
CVE-2026-56161
Improper access control in Azure Logic Apps allows an authorized attacker to disclose information over a network...
CVE-2026-65668
Improper access control in Microsoft Purview eDiscovery allows an authorized attacker to elevate privileges over a network...
CVE-2026-5336
The DataPress Dataverse Integration WordPress plugin before 2.91 does not properly restrict access to its template rendering feature and exposes the viewing user's data to it, allowing users with a role as low as Contributor to disclose sensitive information, such as the session cookies of higher...
CVE-2026-48086 OpenReception: Tenant admin self-promotes to GLOBAL_ADMIN
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, a TENANTADMIN promotes themselves to platform-wide GLOBALADMIN through a single PUT request. The role-update handler accepts the GLOBALADMIN enum value from any tena...
CVE-2026-47185 Frappe Has Broken Access Control in its Workspace Save API
Frappe is a full-stack web application framework. Prior to 16.18.0, the Workspace Save API accepts a controlled workspace identifier from any authenticated user without enforcing workspace ownership, allowing modification of another user's private workspace and persistent script injection. This...
CVE-2026-47185
CVE-2026-47185 — Frappe Workspace Save API : In Frappe, prior to version 16.18.0, the Workspace Save API accepted a controlled workspace identifier from any authenticated user without enforcing workspace ownership, enabling modification of another user’s private workspace and risking persistent s...
CVE-2025-14561
The CVE-2025-14561 entry concerns WSO2 products with multi-tenant deployments. The issue is an access control bypass in the Publisher REST APIs where tenant isolation is not correctly enforced, allowing a privileged user in one tenant to perform publisher operations (e.g., exposing or modifying A...
CVE-2026-66712
Unauthenticated Broken Access Control in Simple Membership = 4.7.8 versions...
CVE-2026-66708
Unauthenticated Broken Access Control in Total Upkeep = 1.17.2 versions...
CVE-2026-66699
Custom role Broken Access Control in Dokan = 5.0.10 versions...
CVE-2026-66701
Unauthenticated Broken Access Control in Profile Builder = 3.16.5 versions...
CVE-2026-66678
Contributor Broken Access Control in Advanced Custom Fields: Font Awesome Field = 6.1.1 versions...
CVE-2026-65554
Subscriber Broken Access Control in AnsPress – Question and answer 4.4.4 versions...
CVE-2026-65541
Unauthenticated Broken Access Control in Staff Training = 1.0.7 versions...
CVE-2026-65504
Unauthenticated Broken Access Control in BOX NOW Delivery Croatia = 3.3.0 versions...