CVE-2026-70217

Improper access control in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network...

CVE-2026-70137

Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to disclose information locally...

CVE-2026-70084

Improper access control in Windows Projected File System allows an authorized attacker to disclose information locally...

CVE-2026-110229

QloApps through 1.7.0 contains an improper access control vulnerability in AdminSlipController that allows hotel-restricted back-office employees to access credit slips of all hotels. Attackers can list, export as PDF, mark as redeemed, and generate store-credit vouchers from other hotels' refund...

CVE-2026-105733

Improper access control in Windows Hyper-V allows an authorized attacker to execute code locally...

CVE-2026-110111

Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods. Attackers can point xo-server at a malicious ESXi host serving a craft...

UBUNTU-CVE-2026-110111

Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods. Attackers can point xo-server at a malicious ESXi host serving a craft...

CVE-2026-102860

Improper access control in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network...

CVE-2026-70217

A vulnerability in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network due to improper access control (CWE-284). The impact is classified as access to sensitive data with a CVSSv3.1 base score of 4.9 . Microsoft has released updates to address this vul...

CVE-2026-88135

A vulnerability in WebDAV involving improper access control allows an authorized attacker to achieve local privilege elevation . The vulnerability is associated with CWE-862 (Missing Authorization) . The CVSS 3.1 score is 7.8 (High) , indicating high impact on confidentiality, integrity, and avai...

CVE-2026-87709

A vulnerability exists in the Windows Host Guardian Service due to improper access control . This flaw allows an authorized attacker to perform tampering locally . The vulnerability is associated with CWE-250 (Execution with Unnecessary Privileges) . While the technical root cause is not detailed...

CVE-2026-96855

Improper access control in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally . The vulnerability is associated with CWE-862 (Missing Authorization) . No specific exploit details or in-the-wild exploitation records are provided in the documents. Reme...

CVE-2026-96316

The Windows Routing and Remote Access Service (RRAS) is affected by an improper access control vulnerability (CWE-862). This flaw allows an authorized attacker to perform tampering locally on the system. The vulnerability is categorized with a Medium severity, specifically impacting integrity. Wh...

CVE-2026-96218

A vulnerability exists in the Windows Update Stack due to improper access control . This flaw allows an authorized attacker to perform tampering locally . The vulnerability is associated with CWE-15 (External Control of System or Configuration Setting) and carries a MEDIUM base severity (CVSS 3.1...

CVE-2026-70137

A vulnerability in Windows Remote Access Connection Manager involves improper access control , which allows an authorized attacker to perform a local information disclosure . The CVSS 3.1 score is 5.5 (Medium) , with a high impact on confidentiality. No specific exploit details or versions are pr...

CVE-2026-87710

A vulnerability exists in the Microsoft Local Security Authority Server (lsasrv) due to improper access control . This flaw allows an authorized attacker to achieve local privilege escalation . The vulnerability is associated with CWE-362 (Race Condition). No specific exploit details or mitigatio...

CVE-2026-85938

The Windows Broadcast DVR User Service is impacted by an improper access control vulnerability (CWE-862). This flaw allows an authorized attacker to perform a local information disclosure attack. The vulnerability has been assigned a CVSS 3.1 base score of 5.5 (Medium) , with a high impact on con...

CVE-2026-83854

A vulnerability exists in Windows Notification due to improper access control , which allows an authorized attacker to disclose information locally . The vulnerability is associated with CWE-306 (Missing Authentication for Critical Function). A MEDIUM severity rating of 5.5 (CVSS 3.1) is assigned...

CVE-2026-83864

The Windows NTFS file system contains an improper access control vulnerability. This flaw allows an authorized attacker to perform a local information disclosure , potentially exposing sensitive data. While the vulnerability is confirmed, the provided documents do not specify the exact component,...

CVE-2026-83658

A vulnerability exists in Windows Error Reporting due to improper access control . This flaw allows an authorized attacker to perform a local information disclosure . The impact is classified as high regarding confidentiality, with a CVSS 3.1 base score of 5.5. Remediation is available via an off...