CVE-2026-87710

Improper access control in Microsoft Local Security Authority Server lsasrv allows an authorized attacker to elevate privileges locally...

CVE-2026-87709

Improper access control in Windows Host Guardian Service allows an authorized attacker to perform tampering locally...

CVE-2026-85938

Improper access control in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally...

CVE-2026-83864

Improper access control in Windows NTFS allows an authorized attacker to disclose information locally...

CVE-2026-83854

Improper access control in Windows Notification allows an authorized attacker to disclose information locally...

CVE-2026-83658

Improper access control in Windows Error Reporting allows an authorized attacker to disclose information locally...

CVE-2026-83568

Improper access control in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally...

CVE-2026-70217

Improper access control in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network...

CVE-2026-70137

Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to disclose information locally...

CVE-2026-70084

Improper access control in Windows Projected File System allows an authorized attacker to disclose information locally...

CVE-2026-110229

QloApps through 1.7.0 contains an improper access control vulnerability in AdminSlipController that allows hotel-restricted back-office employees to access credit slips of all hotels. Attackers can list, export as PDF, mark as redeemed, and generate store-credit vouchers from other hotels' refund...

CVE-2026-105733

Improper access control in Windows Hyper-V allows an authorized attacker to execute code locally...

CVE-2026-110111

Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods. Attackers can point xo-server at a malicious ESXi host serving a craft...

UBUNTU-CVE-2026-110111

Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods. Attackers can point xo-server at a malicious ESXi host serving a craft...

CVE-2026-102860

Improper access control in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network...

CVE-2026-70217

A vulnerability in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network due to improper access control (CWE-284). The impact is classified as access to sensitive data with a CVSSv3.1 base score of 4.9 . Microsoft has released updates to address this vul...

CVE-2026-88135

A vulnerability in WebDAV involving improper access control allows an authorized attacker to achieve local privilege elevation . The vulnerability is associated with CWE-862 (Missing Authorization) . The CVSS 3.1 score is 7.8 (High) , indicating high impact on confidentiality, integrity, and avai...

CVE-2026-87709

A vulnerability exists in the Windows Host Guardian Service due to improper access control . This flaw allows an authorized attacker to perform tampering locally . The vulnerability is associated with CWE-250 (Execution with Unnecessary Privileges) . While the technical root cause is not detailed...

CVE-2026-96855

Improper access control in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally . The vulnerability is associated with CWE-862 (Missing Authorization) . No specific exploit details or in-the-wild exploitation records are provided in the documents. Reme...

CVE-2026-96316

The Windows Routing and Remote Access Service (RRAS) is affected by an improper access control vulnerability (CWE-862). This flaw allows an authorized attacker to perform tampering locally on the system. The vulnerability is categorized with a Medium severity, specifically impacting integrity. Wh...