CVE-2026-109675 Frappe Suite before commit 2697564 Broken Access Control in Mail Mailbox and Quota APIs

Frappe Suite before commit 2697564a9c46da6acc614743eaf9915fe5238f4f contains a broken access control vulnerability in the getmailboxes and getquota APIs that allows authenticated mail users to access other users' data. Attackers can supply another user's JMAP account ID to read mailbox names,...

CVE-2026-109667 Frappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation

Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type from the request and inserts the record with permission checks disabled. Any authenticated user, including one holding no operational role,...

CVE-2026-109667 Frappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation

Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type from the request and inserts the record with permission checks disabled. Any authenticated user, including one holding no operational role,...

CVE-2026-109600

The Frappe Framework is affected by an improper access control vulnerability in its Document Follow email notifications system. Specifically, versions before 15.118.0 and 16.x before 16.31.0 fail to verify if a user account is disabled before sending automated email updates. As a result, a disabl...

CVE-2026-109600 Frappe before 16.31.0 Improper Access Control in Document Follow Notifications

Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether a user account is disabled before sending Document Follow email notifications. A disabled user who previously followed documents continues to receive email updates about activity on those documents after their access...

CVE-2023-54412 Frappe before 13.46.3 Improper Access Control for Email Templates

Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permissions that allows any authenticated non-guest user to create and edit any Email Template. Attackers with low-privileged accounts, including self-registered users when signup is...

CVE-2023-54412 Frappe before 13.46.3 Improper Access Control for Email Templates

Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permissions that allows any authenticated non-guest user to create and edit any Email Template. Attackers with low-privileged accounts, including self-registered users when signup is...

CVE-2023-54412

The Frappe application (versions before 13.46.3 and 14.x before 14.21.1 ) contains an improper access control vulnerability within the Email Template permissions. This flaw allows any authenticated non-guest user , including low-privileged self-registered users, to create and edit any Email Templ...

cloudpanel-2.4.2-CVE-2024-44765-recovery

CVE-2024-44765 is an Improper Authorization Access Control Misconfiguration vulnerability in MGT-COMMERCE GmbH CloudPanel versions 2.0.0 to 2.4.2 1. Follow instructions in every folder this should be done locally 2. Reset Passwords and Access for root $ sudo passwd root while for users $ getent...

CVE-2026-90920

IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to execute arbitrary code due to improper control of code generation...

CVE-2026-11991-Exploit

CVE-2026-11991 — FlowForms Unauthorized Form Publication Authenticated Contributor+ Authorization Bypass to Publish Any Draft Form in FlowForms ≤ 1.1.1 Vulnerability Overview Property| Value ---|--- CVE ID| CVE-2026-11991 CVSS Score| 6.2 — Medium CVSS Vector|...

CVE-2026-72585-PoC

CVE-2026-72585 — Grafana: Incomplete Fix for CVE-2026-21724 Allows Editor Role to Delete Protected Contact Points Product: Grafana Grafana Labs — through 13.2.0 File: pkg/services/ngalert/provisioning/contactpoints.go CWE: CWE-284 — Improper Access Control CVSS 3.1:...

CVE-2023-31704

CVE-2023-31704 description Sourcecodester Online Computer and Laptop Store 1.0 is vulnerable to Incorrect Access Control, which allows remote attackers to elevate privileges to the administrator's role. Vulnerability Type Incorrect Access Control Vendor of Product Sourcecodster Affected Product...

CVE-2022-47529

CVE-2022-47529 RSA NetWitness Platform EDR Agent / Incorrect Access Control - Code Execution During a security audit of the EDR agent I discovered a novel vector to tamper with the service with only standard user rights by targeting an insecure Win32 memory event object. Hijacking the service...

CVE-2023-41508

CVE-2023-41508 CVE-2023-41508 - A hard-coded password in Super Store Finder v3.6 allows attackers to access the administration panel. Vulnerability Type Incorrect Access Control Vendor of Product Super Store Finder Affected Product Code Base Super Store Finder - Affected version 3.6 or below. Fix...

CVE-2023-31594

CVE-2023-31594 IC Realtime ICIP-P2012T is vulnerable to Incorrect Access Control Unauthenticated Streaming Channel in IC Realtime IP PTZ Dome Camera ICIP-P2012 software version: 2.420 The live feed MJPEG can be streamed via an exposed HTTP channel using VLC network stream. This vulnerability...

Stuxnet

Stuxnet This repository contains a strictly educational and research-oriented reconstruction of the infamous Stuxnet worm. It is the product of countless hours of reverse engineering work conducted by the global security research community on the original binary samples discovered in 2010. Warnin...

CVE-2024-32371

CVE-2024-32371 Description Description A vulnerability identified as CVE-2024-32371 allows an attacker to elevate privileges by changing the type parameter from 1 to 0. This vulnerability enables an attacker with a regular user account to escalate their privileges and gain administrative access t...

CVE-2026-18513

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper access control due to a schema-less Custom Resource Definition...

CVE-2026-106495

Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper access control in backend action invocation. An authenticated user could invoke actions that an operator had excluded through action configuration...