Windows Modern Device Management (MDM) Tampering Vulnerability

Improper access control in Windows Modern Device Management MDM allows an authorized attacker to perform tampering locally...

Windows Broadcast DVR User Service Information Disclosure Vulnerability

Improper access control in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally...

Windows Remote Access Connection Manager Information Disclosure Vulnerability

Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to disclose information locally...

Windows NTFS Information Disclosure Vulnerability

Improper access control in Windows NTFS allows an authorized attacker to disclose information locally...

Windows Error Reporting Information Disclosure Vulnerability

Improper access control in Windows Error Reporting allows an authorized attacker to disclose information locally...

Windows Hyper-V Remote Code Execution Vulnerability

Improper access control in Windows Hyper-V allows an authorized attacker to execute code locally...

CVE-2026-109958 EspoCRM 4.0.0 before 10.0.7 Field-Level Access Bypass via Address-Book Search

EspoCRM 4.0.0 before 10.0.7 contains an improper access control vulnerability that allows authenticated users to read restricted emailAddress values via the address-book search API. Users with record access can query address-book search to obtain email addresses even when Roles restrict the...

CVE-2026-109958

EspoCRM version 4.0.0 before 10.0.7 is vulnerable to an improper access control vulnerability. Authenticated users with record access can bypass field-level restrictions to read restricted emailAddress values via the address-book search API . This occurs even when specific Roles are configured to...

CVE-2026-109958 EspoCRM 4.0.0 before 10.0.7 Field-Level Access Bypass via Address-Book Search

EspoCRM 4.0.0 before 10.0.7 contains an improper access control vulnerability that allows authenticated users to read restricted emailAddress values via the address-book search API. Users with record access can query address-book search to obtain email addresses even when Roles restrict the...

EUVD-2026-98168

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to cause a denial of service due to improper access control...

EUVD-2023-60718

Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permissions that allows any authenticated non-guest user to create and edit any Email Template. Attackers with low-privileged accounts, including self-registered users when signup is...

CVE-2026-17484

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to cause a denial of service due to improper access control...

CVE-2026-109958: Exposure of Sensitive Information to an Unauthorized Actor

EspoCRM 4.0.0 before 10.0.7 contains an improper access control vulnerability that allows authenticated users to read restricted emailAddress values via the address-book search API. Users with record access can query address-book search to obtain email addresses even when Roles restrict the...

Microsoft Windows: CVE-2026-87709: Windows Host Guardian Service Tampering Vulnerability

Improper access control in Windows Host Guardian Service allows an authorized attacker to perform tampering locally...

CVE-2026-110111: Improperly Controlled Modification of Object Prototype Attributes

Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods. Attackers can point xo-server at a malicious ESXi host serving a craft...

CVE-2026-70217: Improper Access Control

Improper access control in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network...

Microsoft SharePoint: CVE-2026-70217: Microsoft Office SharePoint Information Disclosure Vulnerability

Improper access control in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network...

PT-2026-112311

Name of the Vulnerable Software and Affected Versions Microsoft Office SharePoint affected versions not specified Description Improper access control allows an authorized attacker to disclose information over a network. Recommendations At the moment, there is no information about a newer version...

CVE-2026-87710: Concurrent Execution using Shared Resource with Improper Synchronization

Improper access control in Microsoft Local Security Authority Server lsasrv allows an authorized attacker to elevate privileges locally...

CVE-2026-110229: Missing Authorization

QloApps through 1.7.0 contains an improper access control vulnerability in AdminSlipController that allows hotel-restricted back-office employees to access credit slips of all hotels. Attackers can list, export as PDF, mark as redeemed, and generate store-credit vouchers from other hotels' refund...