CVE-2026-105733

A vulnerability exists in Windows Hyper-V due to improper access control . This flaw allows an authorized attacker to achieve local code execution . The vulnerability is associated with CWE-1419 (Incorrect Initialization of Resource) and carries a HIGH severity rating. No specific exploit details...

CVE-2026-102860

A privilege escalation vulnerability exists in Microsoft Office SharePoint due to improper access control . An authorized attacker can exploit this flaw over a network to gain elevated privileges. Microsoft has released updates to address this vulnerability; users are recommended to install the l...

EUVD-2026-99043

Improper access control in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network...

CVE-2026-110229 QloApps through 1.7.0 Missing Hotel Access Restriction in Credit Slips

QloApps through 1.7.0 contains an improper access control vulnerability in AdminSlipController that allows hotel-restricted back-office employees to access credit slips of all hotels. Attackers can list, export as PDF, mark as redeemed, and generate store-credit vouchers from other hotels' refund...

CVE-2026-110229 QloApps through 1.7.0 Missing Hotel Access Restriction in Credit Slips

QloApps through 1.7.0 contains an improper access control vulnerability in AdminSlipController that allows hotel-restricted back-office employees to access credit slips of all hotels. Attackers can list, export as PDF, mark as redeemed, and generate store-credit vouchers from other hotels' refund...

CVE-2026-110229

Versions of QloApps through 1.7.0 are vulnerable to an improper access control flaw in the AdminSlipController component. This vulnerability allows hotel-restricted back-office employees to bypass restrictions and access credit slips from other hotels. An attacker can list, export as PDF, mark as...

CVE-2026-109958

EspoCRM 4.0.0 before 10.0.7 contains an improper access control vulnerability that allows authenticated users to read restricted emailAddress values via the address-book search API. Users with record access can query address-book search to obtain email addresses even when Roles restrict the...

Windows Error Reporting Information Disclosure Vulnerability

Improper access control in Windows Error Reporting allows an authorized attacker to disclose information locally...

Windows NTFS Information Disclosure Vulnerability

Improper access control in Windows NTFS allows an authorized attacker to disclose information locally...

Windows Hyper-V Remote Code Execution Vulnerability

Improper access control in Windows Hyper-V allows an authorized attacker to execute code locally...

Windows Notification Information Disclosure Vulnerability

Improper access control in Windows Notification allows an authorized attacker to disclose information locally...

Windows Routing and Remote Access Service (RRAS) Tampering Vulnerability

Improper access control in Windows Routing and Remote Access Service RRAS allows an authorized attacker to perform tampering locally...

Windows Broadcast DVR User Service Information Disclosure Vulnerability

Improper access control in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally...

Windows Remote Access Connection Manager Information Disclosure Vulnerability

Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to disclose information locally...

Windows Modern Device Management (MDM) Tampering Vulnerability

Improper access control in Windows Modern Device Management MDM allows an authorized attacker to perform tampering locally...

Windows Update Stack Tampering Vulnerability

Improper access control in Windows Update Stack allows an authorized attacker to perform tampering locally...

Windows Host Guardian Service Tampering Vulnerability

Improper access control in Windows Host Guardian Service allows an authorized attacker to perform tampering locally...

Windows Projected File System Information Disclosure Vulnerability

Improper access control in Windows Projected File System allows an authorized attacker to disclose information locally...

CVE-2025-33073

CVE-2025-33073 — Windows SMB Client NTLM Reflection EoP Research writeup by Sentinel AI Defense. Defensive analysis only — no working exploit or PoC is published here. An improper access control flaw in the Windows SMB Client that revives NTLM reflection techniques thought to be mitigated — letti...

CVE-2026-109958 EspoCRM 4.0.0 before 10.0.7 Field-Level Access Bypass via Address-Book Search

EspoCRM 4.0.0 before 10.0.7 contains an improper access control vulnerability that allows authenticated users to read restricted emailAddress values via the address-book search API. Users with record access can query address-book search to obtain email addresses even when Roles restrict the...