73519 matches found
CVE-2026-122116
Certain Yealink terminal devices before 2026-04-21 contain an improper access control vulnerability in the Wi-Fi 802.1X PEAP network configuration function. This flaw exposes deployed 802.1X network access authentication credentials to unauthorized users. The latest Yealink firmware has addressed...
EUVD-2026-87206
@payloadcms/storage-vercel-blob has access control bypass of uploads in Vercel Storage adapter...
CVE-2026-77779
ManageEngine Key Manager Plus versions before 7151 were vulnerable to an Improper Access Control vulnerability that allowed authenticated low-privilege users to export keys outside their authorized scope...
EUVD-2026-116756
ManageEngine Key Manager Plus versions before 7151 were vulnerable to an Improper Access Control vulnerability that allowed authenticated low-privilege users to export keys outside their authorized scope...
CVE-2026-77779 Improper access control vulnerability
ManageEngine Key Manager Plus versions before 7151 were vulnerable to an Improper Access Control vulnerability that allowed authenticated low-privilege users to export keys outside their authorized scope...
CVE-2026-77779
ManageEngine Key Manager Plus versions prior to 7151 are affected by an Improper Access Control vulnerability (CWE-1220). This flaw allows authenticated low-privilege users to export cryptographic keys outside of their authorized scope, potentially leading to unauthorized data access. Exploitatio...
CVE-2026-48907
🚨 CVE-2026-48907 - JCE Joomla Content Editor Unauthenticated Remote Code Execution ⚠️ Critical Unauthenticated RCE in JCE Joomla Content Editor A critical access control vulnerability allowing unauthenticated attackers to compromise vulnerable Joomla installations running JCE. 📖 Overview...
ClickHouse Server - Brotli v1.2.0 Decoder DoS/OOB-Write
ClickHouse Server contains a remote code execution vulnerability caused by improper access control, letting unauthenticated users with network access execute arbitrary code remotely, exploit requires network access. id: CVE-2026-116366 info: name: ClickHouse Server - Brotli v1.2.0 Decoder...
Hermes WebUI < 0.51.788 - Remote Code Execution
Hermes WebUI 0.51.788 contains an unauthenticated remote code execution caused by improper access control in embedded terminal API endpoints, letting remote attackers execute arbitrary shell commands without credentials. id: CVE-2026-58123 info: name: Hermes WebUI 0.51.788 - Remote Code Execution...
WordPress WPQA <5.5 - Improper Access Control
WordPress WPQA plugin before 5.5 is susceptible to improper access control. The plugin lacks authentication in a REST API endpoint. An attacker can potentially discover private questions sent between users on the site. id: CVE-2022-1598 info: name: WordPress WPQA 5.5 - Improper Access Control...
WAVLINK WN530HG4 - Improper Access Control
WAVLINK WN530HG4 M30HG4.V5030.191116 is susceptible to improper access control. It contains a hardcoded encryption/decryption key for its configuration files at /etcro/lighttpd/www/cgi-bin/ExportAllSettings.sh. An attacker can possibly obtain sensitive information, modify data, and/or execute...
vCenter Server - Improper Access Control
Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to bypass proxy leading to internal endpoints being accessed. id: CVE-2021-22017 info: name:...
Dapr Dashboard 0.1.0-0.10.0 - Improper Access Control
Dapr Dashboard 0.1.0 through 0.10.0 is susceptible to improper access control. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2022-38817 info: name: Dapr Dashboard 0.1.0-0.10.0 - Improper Access Control author: For3stCo1d...
RegistrationMagic <= 6.0.7.1 - Privilege Escalation
RegistrationMagic WordPress plugin = 6.0.7.1 contains a privilege escalation caused by improper access control in 'addmenu' via 'rmuserexists' AJAX action, letting unauthenticated attackers manipulate admin menu capabilities, exploit requires subscriber user for further escalation. id:...
WAVLINK WN535 G3 - Improper Access Control
WAVLINK WN535 G3 M35G3R.V5030.180927 is susceptible to improper access control. A vulnerability in /cgi-bin/ExportAllSettings.sh allows an attacker to execute arbitrary code via a crafted POST request and thereby possibly obtain sensitive information, modify data, and/or execute unauthorized...
EUVD-2026-116579
A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87/2.1.38. Affected by this issue is the function CheckPassword of the file app/src/server.js of the component Socket IO Handler. Performing a manipulation of the argument peerid results in improper access controls. It is possibl...
EUVD-2026-116541
Tanium addressed an improper access controls vulnerability in Discover...
EUVD-2026-116553
Tanium addressed an improper access controls vulnerability in Discover...