CVE-2026-77541: Improper Access Control

A malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerability found in UniFi Network Application to escalate privileges within the UniFi Network Application...

CVE-2026-79940: Improper Access Control

Dell iDRAC9, 14G versions prior to 7.00.00.182 and 15G/16G versions prior to 7.20.30.50, contains an Improper Access Control vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to gaining access to unauthorized data...

CVE-2026-15203: On-Chip Debug and Test Interface With Improper Access Control

Improper access control in debug and engineering interfaces in Danfoss iC7-Automation SP, iC7-Marine, and iC7-Hybrid GR3 allows attackers to gain read/write access to internal values, upload and execute unsigned applications, and upload unsigned EEPROM data and firmware via exposed service...

CVE-2026-18664: Improper Access Control

When ranges are used for access control i.e. of the form 1.2.3.4-1.2.3.25, because NSD wrongly compares the IP address with the range on little endian systems, IPs that were meant to be allowed may be denied, and, IPs that were meant to be denied access could be allowed. An IPv4 address is compar...

CVE-2026-77536: Improper Access Control

A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances...

PT-2026-82076

Name of the Vulnerable Software and Affected Versions UniFi Access Application affected versions not specified Description An Improper Access Control issue allows a malicious actor with network access and low privileges to escalate privileges on the host device. Improper Access Control occurs whe...

PT-2026-82053

Name of the Vulnerable Software and Affected Versions UniFi OS affected versions not specified Description An Improper Access Control issue exists where a malicious actor with network access and low privileges can escalate their privileges within the system. Recommendations At the moment, there i...

PT-2026-82074

Name of the Vulnerable Software and Affected Versions UniFi Connect Display Cast Pro affected versions not specified Description An improper access control issue allows a malicious actor with network access to escalate privileges on the device under certain conditions. Recommendations At the...

PT-2026-82365

Name of the Vulnerable Software and Affected Versions Content Moderation Notifications versions 0.0.0 through 3.9.0 Description An issue exists where a permission allowing users to configure email templates containing Twig a template engine for web pages was not marked as restricted. If a site...

CVE-2025-70340

A Broken Access Control vulnerability exists in ThingsBoard Professional Edition PE 4.21 and below, within the Alarms comments functionality. An authenticated customer user can manipulate the respective API request parameters to create or modify system-generated alarm comments. This allows...

CVE-2026-77695: Improper Access Control

The Return Refund and Exchange For WooCommerce WordPress plugin before 4.6.4 does not correctly verify the ownership of guest orders in some of the AJAX actions it exposes to unauthenticated users, allowing them to read private order messages, post messages and attachments in the customer's name,...

PT-2026-82242

A Broken Access Control vulnerability exists in ThingsBoard Professional Edition PE 4.21 and below, within the Alarms comments functionality. An authenticated customer user can manipulate the respective API request parameters to create or modify system-generated alarm comments. This allows...

Data field - Moderately critical - Information disclosure - SA-CONTRIB-2026-108

This module enables you to store structured data in configurable fields and expose Data Field values through JSON endpoints. The module doesn't sufficiently check access when returning Data Field values through its JSON endpoint. This may allow anonymous users to access field values belonging to...

PT-2026-82219

Name of the Vulnerable Software and Affected Versions IDURAR ERP CRM affected versions not specified Description An issue exists where the system changes the password of any account specified in a request instead of the account making the request. The update handler in...

PT-2026-81934

Improper access control in debug and engineering interfaces in Danfoss iC7-Automation SP, iC7-Marine, and iC7-Hybrid GR3 allows attackers to gain read/write access to internal values, upload and execute unsigned applications, and upload unsigned EEPROM data and firmware via exposed service...

PT-2026-82300

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, an authenticated user with access to a project can retrieve the change history of restricted components in that project through nested API change endpoints, even without...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: pcp (UTSA-2026-104832)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104832 advisory. An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite a...

CVE-2025-61162

Cohere North AI v1.1.5 is affected by an incorrect access control vulnerability. A remote attacker can send a specially crafted request to the /api/internal/v1/users/{{USER_ID}} endpoint to arbitrarily overwrite user information , leading to unauthorized modification of user data. To mitigate thi...

Dell Watchdog Timer < 2.0.0.1 Privilege Escalation (DSA-2026-248)

According to its self-reported version, the Dell Watchdog Timer kernel driver WDTKernel.sys on the remote Windows host is prior to 2.0.0.1. It is, therefore, affected by an exposed IOCTL with insufficient access control vulnerability. A low privileged local attacker could potentially exploit this...

PT-2026-82267

Dell iDRAC9, 14G versions prior to 7.00.00.182 and 15G/16G versions prior to 7.20.30.50, contains an Improper Access Control vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to gaining access to unauthorized data...