EUVD-2026-98168

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to cause a denial of service due to improper access control...

EUVD-2026-98081

IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to delete folders and applications belonging to other users due to improper functional level access control...

EUVD-2026-98066

Frappe Suite before commit 2697564a9c46da6acc614743eaf9915fe5238f4f contains a broken access control vulnerability in the getmailboxes and getquota APIs that allows authenticated mail users to access other users' data. Attackers can supply another user's JMAP account ID to read mailbox names,...

EUVD-2026-98058

Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type from the request and inserts the record with permission checks disabled. Any authenticated user, including one holding no operational role,...

EUVD-2023-60718

Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permissions that allows any authenticated non-guest user to create and edit any Email Template. Attackers with low-privileged accounts, including self-registered users when signup is...

CVE-2026-89112 Broken Access Control in CLA-Assistant � CLA Signature PII Disclosure

The admin API endpoint used to retrieve CLA signature records does not consistently enforce the required authorization checks when the target organisation is specified using an organisation ID.An authenticated user with limited privileges could potentially access CLA signature records containing...

CVE-2026-89112 Broken Access Control in CLA-Assistant � CLA Signature PII Disclosure

The admin API endpoint used to retrieve CLA signature records does not consistently enforce the required authorization checks when the target organisation is specified using an organisation ID.An authenticated user with limited privileges could potentially access CLA signature records containing...

CVE-2026-89112

The CLA-Assistant service is impacted by a broken access control vulnerability where the admin API endpoint for retrieving CLA signature records fails to consistently enforce authorization checks. When a target organization is specified using an organisation ID , an authenticated user with limite...

CVE-2026-89110

The SAP NetWeaver Visual Composer software is vulnerable to broken access control due to insufficient authorization checks within certain portal functionalities. An attacker with low privileges can exploit this flaw to invoke internal operations on a preconfigured remote system. Depending on the ...

CVE-2026-89110 Broken Access Control in SAP NetWeaver Visual Composer

SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations on a preconfigured remote system. Depending on the remote connection configuration, this could lead to a full compromise...

CVE-2023-1430

Update 2023-06-12: You no longer need the snippet. WPManageNinja patched the vulnerability two hours after public disclosure 93 days after reporting. Update 2024-01-27: The related issue with with everlasting hash values is now fully addressed. Responsible disclosure of unpatched vulnerability...

EUVD-2026-98191

SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An attacker with MII administrator privileges could submit a specially crafted request to provision an account with elevated privileges on the...

CVE-2026-89108

SAP Manufacturing Integration and Intelligence (Configuration Service) contains a missing authorization check (CWE-862) within certain administrative functionalities. An attacker possessing MII administrator privileges can submit a specially crafted request to provision an account with elevated p...

CVE-2026-17484

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to cause a denial of service due to improper access control...

CVE-2020-23586

CVE-2020-23586 OPTILINK E-PON "MODEL NO: OP-XT71000N" with "HARDWARE VERSION: V2.2"; & "FIRMWARE VERSION: OPV3.3.1-191028" vulnerability found in the "OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OPV3.3.1-191028"which allows an unauthenticated, remote attacker to conduct a...

CVE-2026-52394

The DeepSeek V4 model is vulnerable to Incorrect Access Control when processing a crafted input. While specific internal component details or root cause files are not provided in the documents, the vulnerability allows for unauthorized access. Based on the SSVC metrics, the issue is considered au...

PT-2026-112629

Name of the Vulnerable Software and Affected Versions Windows NTFS affected versions not specified Description Improper access control in Windows NTFS allows an authorized attacker to disclose information locally. Recommendations At the moment, there is no information about a newer version that...

PT-2026-113348

Name of the Vulnerable Software and Affected Versions Adobe Experience Manager affected versions not specified Description An Incorrect Authorization issue allows for arbitrary code execution within the context of the current user. This could enable an attacker to gain elevated access or control...

PT-2026-113507

CAI Content Credentials is affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interactio...

PT-2026-113391

IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods...