CVE-2026-110111: Improperly Controlled Modification of Object Prototype Attributes

Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods. Attackers can point xo-server at a malicious ESXi host serving a craft...

CVE-2026-88135: Missing Authorization

Improper access control in WebDAV allows an authorized attacker to elevate privileges locally...

CVE-2026-87709: Execution with Unnecessary Privileges

Improper access control in Windows Host Guardian Service allows an authorized attacker to perform tampering locally...

CVE-2026-105733: Incorrect Initialization of Resource

Improper access control in Windows Hyper-V allows an authorized attacker to execute code locally...

CVE-2026-83658: Missing Authorization

Improper access control in Windows Error Reporting allows an authorized attacker to disclose information locally...

CVE-2026-83864: Authentication Bypass by Spoofing

Improper access control in Windows NTFS allows an authorized attacker to disclose information locally...

Microsoft Windows: CVE-2026-70137: Windows Remote Access Connection Manager Information Disclosure Vulnerability

Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to disclose information locally...

PT-2026-112246

Name of the Vulnerable Software and Affected Versions Windows Remote Access Connection Manager affected versions not specified Description Improper access control allows an authorized attacker to locally disclose sensitive information, which can affect the system. Recommendations At the moment,...

CVE-2026-109958: Exposure of Sensitive Information to an Unauthorized Actor

EspoCRM 4.0.0 before 10.0.7 contains an improper access control vulnerability that allows authenticated users to read restricted emailAddress values via the address-book search API. Users with record access can query address-book search to obtain email addresses even when Roles restrict the...

PT-2026-113036

Name of the Vulnerable Software and Affected Versions Windows Update Stack affected versions not specified Description Improper access control allows an authorized attacker to perform local tampering, which can affect the system. Recommendations At the moment, there is no information about a newe...

PT-2026-112868

Name of the Vulnerable Software and Affected Versions Windows Broadcast DVR User Service affected versions not specified Description Improper access control in the Windows Broadcast DVR User Service allows an authorized attacker to disclose sensitive information locally, which can affect the...

Microsoft Windows: CVE-2026-83837: Windows Kernel-Mode Drivers Elevation of Privilege Vulnerability

Improper access control in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-87710: Microsoft Local Security Authority (LSA) Server Elevation of Privilege Vulnerability

Improper access control in Microsoft Local Security Authority Server lsasrv allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-96218: Windows Update Stack Tampering Vulnerability

Improper access control in Windows Update Stack allows an authorized attacker to perform tampering locally...

PT-2026-113508

CAI Content Credentials is affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interactio...

CVE-2026-17484: Exposure of Sensitive Information to an Unauthorized Actor

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to cause a denial of service due to improper access control...

CVE-2026-110229: Missing Authorization

QloApps through 1.7.0 contains an improper access control vulnerability in AdminSlipController that allows hotel-restricted back-office employees to access credit slips of all hotels. Attackers can list, export as PDF, mark as redeemed, and generate store-credit vouchers from other hotels' refund...

PT-2026-112629

Name of the Vulnerable Software and Affected Versions Windows NTFS affected versions not specified Description Improper access control in Windows NTFS allows an authorized attacker to disclose information locally. Recommendations At the moment, there is no information about a newer version that...

CVE-2026-85938: Missing Authorization

Improper access control in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally...

Microsoft Windows: CVE-2026-85938: Windows Broadcast DVR User Service Information Disclosure Vulnerability

Improper access control in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally...