CVE-2026-89110

The SAP NetWeaver Visual Composer software is vulnerable to broken access control due to insufficient authorization checks within certain portal functionalities. An attacker with low privileges can exploit this flaw to invoke internal operations on a preconfigured remote system. Depending on the ...

CVE-2026-89110 Broken Access Control in SAP NetWeaver Visual Composer

SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations on a preconfigured remote system. Depending on the remote connection configuration, this could lead to a full compromise...

EUVD-2026-98191

SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An attacker with MII administrator privileges could submit a specially crafted request to provision an account with elevated privileges on the...

CVE-2026-89108

SAP Manufacturing Integration and Intelligence (Configuration Service) contains a missing authorization check (CWE-862) within certain administrative functionalities. An attacker possessing MII administrator privileges can submit a specially crafted request to provision an account with elevated p...

CVE-2026-17484

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to cause a denial of service due to improper access control...

CVE-2026-52394

DeepSeek V4 is vulnerable to Incorrect Access Control via a crafted input...

CVE-2026-52394

DeepSeek V4 is vulnerable to Incorrect Access Control via a crafted input...

Microsoft Windows: CVE-2026-87709: Windows Host Guardian Service Tampering Vulnerability

Improper access control in Windows Host Guardian Service allows an authorized attacker to perform tampering locally...

CVE-2026-109959: Exposure of Sensitive Information to an Unauthorized Actor

EspoCRM 4.0.0 before 10.0.7 contains an access control vulnerability that allows authenticated users to read audited field values restricted by field-level security by fetching individual stream notes. Users with stream access to a parent record can request GET /Note/id, which skips the...

CVE-2026-109696: Missing Authorization

Missing Authorization vulnerability in WP ManageNinja LLC FluentBoards fluent-boards allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentBoards: from n/a through 2.1.0...

CVE-2026-87710: Concurrent Execution using Shared Resource with Improper Synchronization

Improper access control in Microsoft Local Security Authority Server lsasrv allows an authorized attacker to elevate privileges locally...

CVE-2026-83854: Missing Authentication for Critical Function

Improper access control in Windows Notification allows an authorized attacker to disclose information locally...

CVE-2026-52394

The DeepSeek V4 model is vulnerable to Incorrect Access Control when processing a crafted input. While specific internal component details or root cause files are not provided in the documents, the vulnerability allows for unauthorized access. Based on the SSVC metrics, the issue is considered au...

Microsoft Windows: CVE-2026-96855: Windows Modern Device Management (MDM) Tampering Vulnerability

Improper access control in Windows Modern Device Management MDM allows an authorized attacker to perform tampering locally...

ROS-20261013-73-0092

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

Microsoft Windows: CVE-2026-73027: Windows Setup Files Cleanup Elevation of Privilege Vulnerability

External control of system or configuration setting in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally...

ROS-20261013-73-0280

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261013-73-0444

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-96237: Inclusion of Functionality from Untrusted Control Sphere

Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network...

PT-2026-113332

Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in setAffectations that allows authenticated attackers to insert access-right records for a caller-supplied target space without verifying the caller has rights to that space. Attackers can assign access...