Dapr Dashboard 0.1.0-0.10.0 - Improper Access Control

Dapr Dashboard 0.1.0 through 0.10.0 is susceptible to improper access control. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2022-38817 info: name: Dapr Dashboard 0.1.0-0.10.0 - Improper Access Control author: For3stCo1d...

WAVLINK WN530HG4 - Improper Access Control

WAVLINK WN530HG4 M30HG4.V5030.191116 is susceptible to improper access control. It contains a hardcoded encryption/decryption key for its configuration files at /etcro/lighttpd/www/cgi-bin/ExportAllSettings.sh. An attacker can possibly obtain sensitive information, modify data, and/or execute...

WordPress WPQA <5.5 - Improper Access Control

WordPress WPQA plugin before 5.5 is susceptible to improper access control. The plugin lacks authentication in a REST API endpoint. An attacker can potentially discover private questions sent between users on the site. id: CVE-2022-1598 info: name: WordPress WPQA 5.5 - Improper Access Control...

Adobe ColdFusion - Arbitrary File Read

ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could lead to arbitrary file system read. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access to sensitive files and perform arbitrary...

WAVLINK WN535 G3 - Improper Access Control

WAVLINK WN535 G3 M35G3R.V5030.180927 is susceptible to improper access control. A vulnerability in /cgi-bin/ExportAllSettings.sh allows an attacker to execute arbitrary code via a crafted POST request and thereby possibly obtain sensitive information, modify data, and/or execute unauthorized...

vCenter Server - Improper Access Control

Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to bypass proxy leading to internal endpoints being accessed. id: CVE-2021-22017 info: name:...

Adobe Connect < 12.1.5 - Local File Disclosure

Adobe Connect versions 11.4.5 and earlier, 12.1.5 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the integrity of a minor feature. Exploitation of this issue does not...

VMware vRealize Log Insight - Improper Access Control to RCE

The vRealize Log Insight contains a broken access control vulnerability. An unauthenticated malicious actor can remotely inject code into sensitive files of an impacted appliance which can result in remote code execution. id: CVE-2022-31704 info: name: VMware vRealize Log Insight - Improper Acces...

CVE-2026-19918

A vulnerability has been found in SpaceX Starlink Router Gen 3 2025.11.14.mr64708.3. This affects the function getstatus of the component gRPC Management Interface. The manipulation leads to improper access controls. The attack can only be initiated within the local network. The exploit has been...

PT-2026-73074

A vulnerability was determined in OpenBoxes up to 0.9.7. This affects the function needManager of the file grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy of the component Role Interceptor. Executing a manipulation can lead to improper privilege management. The attack may be...

CVE-2026-19918

SpaceX Starlink Router Gen 3 (version 2025.11.14.mr64708.3) contains a vulnerability in the gRPC Management Interface get_status function. The issue is improper access controls, allowing an adjacent-network attacker to exploit it with no user interaction. Exploit maturity is listed as Proof-of-Co...

CVE-2026-19918

A vulnerability has been found in SpaceX Starlink Router Gen 3 2025.11.14.mr64708.3. This affects the function getstatus of the component gRPC Management Interface. The manipulation leads to improper access controls. The attack can only be initiated within the local network. The exploit has been...

Security Bulletin: Improper Access Control Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-7362)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway could allow an authenticated user to obtain sensitive information that should only be available to a privileged user. Vulnerability Details CVEID:CVE-2026-7362 DESCRIPTION: IBM Sterling B2B Integrator 6.2.1.0 through 6.2.1.12, and...

CVE-2026-19639

An improper access control vulnerability exists where an authenticated non-administrative application user could potentially view settings outside of their assigned scope...

CVE-2026-19639

CVE-2026-19639 is an Improper Access Control vulnerability affecting Tenable Security Center. The issue allows an authenticated non-administrative application user to view settings outside their assigned scope. Tenable’s advisory (TENABLE:20EF43...) indicates the fix is delivered with Security Ce...

EUVD-2026-58738

An improper access control vulnerability exists where an authenticated non-administrative application user could potentially view settings outside of their assigned scope...

CVE-2026-19639

An improper access control vulnerability exists where an authenticated non-administrative application user could potentially view settings outside of their assigned scope...

CVE-2026-19639 Improper Access Control

An improper access control vulnerability exists where an authenticated non-administrative application user could potentially view settings outside of their assigned scope...

CVE-2026-19835

A vulnerability was identified in Webkul Bagisto up to 2.4.4. Affected by this vulnerability is an unknown functionality of the component Customer Item Deletion Endpoint. Such manipulation leads to improper access controls. The attack can be launched remotely. The exploit is publicly available an...

EUVD-2026-58679

A vulnerability was identified in Webkul Bagisto up to 2.4.4. Affected by this vulnerability is an unknown functionality of the component Customer Item Deletion Endpoint. Such manipulation leads to improper access controls. The attack can be launched remotely. The exploit is publicly available an...