CVE-2026-109958

EspoCRM version 4.0.0 before 10.0.7 is vulnerable to an improper access control vulnerability. Authenticated users with record access can bypass field-level restrictions to read restricted emailAddress values via the address-book search API . This occurs even when specific Roles are configured to...

CVE-2026-48907

CVE-2026-48907 CVE-2026-48907 is a critical improper access control vulnerability in the JCE editor extension for Joomla. It allows unauthenticated attackers to create new editor profiles, which can ultimately lead to arbitrary PHP file upload and remote code execution on affected systems Also if...

CVE-2022-26629

Lock Screen Bypass CVE-2022-26629 Affected Products SoroushPlus+ Messenger 1.0.30 Vulnerability Type Improper Access Control Impact Lock Screen Bypass Summary Improper handling of insufficient permissions and privileges allows an attacker to modify and overwrite the lock screen functionality...

CVE-2022-1442

CVE-2022-1442 WordPress Plugin Metform = 2.1.3 - Improper Access Control Allowing Unauthenticated Sensitive Information Disclosure Description The is vulnerable to sensitive information disclosure due to improper access control in the /core/forms/action.php file which can be exploited by an...

CVE-2025-24076

CVE-2025-24076 Microsoft Windows Cross Device Service Elevation of Privilege Vulnerability Exploit Overview This script exploits a vulnerability in the Windows Cross Device Service that allows privilege escalation on Windows 11 , Windows Server 2025 , and Windows Server 2022 23H2 Server Core...

CVE-2026-48907

🚨 CVE-2026-48907 - JCE Joomla Content Editor Unauthenticated Remote Code Execution ⚠️ Critical Unauthenticated RCE in JCE Joomla Content Editor A critical access control vulnerability allowing unauthenticated attackers to compromise vulnerable Joomla installations running JCE. 📖 Overview...

EUVD-2026-98168

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to cause a denial of service due to improper access control...

EUVD-2023-60718

Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permissions that allows any authenticated non-guest user to create and edit any Email Template. Attackers with low-privileged accounts, including self-registered users when signup is...

CVE-2026-17484

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to cause a denial of service due to improper access control...

Microsoft SharePoint: CVE-2026-70217: Microsoft Office SharePoint Information Disclosure Vulnerability

Improper access control in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network...

Microsoft Windows: CVE-2026-96855: Windows Modern Device Management (MDM) Tampering Vulnerability

Improper access control in Windows Modern Device Management MDM allows an authorized attacker to perform tampering locally...

Microsoft Windows: CVE-2026-87709: Windows Host Guardian Service Tampering Vulnerability

Improper access control in Windows Host Guardian Service allows an authorized attacker to perform tampering locally...

PT-2026-112468

Name of the Vulnerable Software and Affected Versions Windows Error Reporting affected versions not specified Description Improper access control allows an authorized attacker to disclose sensitive information locally and affect the system. Recommendations At the moment, there is no information...

PT-2026-113507

Name of the Vulnerable Software and Affected Versions CAI Content Credentials affected versions not specified Description An Improper Access Control issue exists that could lead to a security feature bypass. This allows an attacker to circumvent security measures and obtain unauthorized write...

Microsoft Windows: CVE-2026-85938: Windows Broadcast DVR User Service Information Disclosure Vulnerability

Improper access control in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally...

CVE-2026-105443: Improper Access Control

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insufficient isolation between servers sharing an install...

Microsoft Windows: CVE-2026-88072: Windows Host Guardian Service Elevation of Privilege Vulnerability

Improper access control in Windows Host Guardian Service allows an authorized attacker to elevate privileges locally...

CVE-2026-110111: Improperly Controlled Modification of Object Prototype Attributes

Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods. Attackers can point xo-server at a malicious ESXi host serving a craft...

Microsoft Windows: CVE-2026-70137: Windows Remote Access Connection Manager Information Disclosure Vulnerability

Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to disclose information locally...

PT-2026-112246

Name of the Vulnerable Software and Affected Versions Windows Remote Access Connection Manager affected versions not specified Description Improper access control allows an authorized attacker to locally disclose sensitive information, which can affect the system. Recommendations At the moment,...