EUVD-2026-97904

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper access control due to a schema-less Custom Resource Definition...

CVE-2026-18517 IBM Maximo Application Suite - Location Service for Esri Component Improper Access Control

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 IBM Maximo Application Suite — Location Service for Esri Component is vulnerable to unintended network egress due to a misconfigured Kubernetes NetworkPolicy...

CVE-2026-18517

The IBM Maximo Application Suite - Location Service for Esri Component is vulnerable to unintended network egress in versions 9.2 , 9.1 , and 9.0 . This issue is caused by a misconfigured Kubernetes NetworkPolicy , which leads to Improper Access Control (CWE-284). The vulnerability allows for pot...

CVE-2026-106495 Backstage: Improper access control in backend action invocation

Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper access control in backend action invocation. An authenticated user could invoke actions that an operator had excluded through action configuration...

CVE-2026-106495 Backstage: Improper access control in backend action invocation

Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper access control in backend action invocation. An authenticated user could invoke actions that an operator had excluded through action configuration...

CVE-2026-106495

The Backstage framework is affected by an improper access control vulnerability in the @backstage/backend-defaults package. Prior to version 0.17.8 , an authenticated user could successfully invoke backend actions that an operator had specifically excluded through action configuration. While exis...

CVE-2026-108923

The 1024-lab smart-admin software (up to version 3.30.0 ) contains an improper access control vulnerability in the Support Config Query component. Specifically, a manipulation of the configKey argument within the /support/config/queryByKey file allows for unauthorized actions. This vulnerability ...

CVE-2026-109285

Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in hasaccesstofile that lets former knowledge base collaborators keep file access via stale cached knowledge base references. Attackers with read or write grants can download removed files through the file conte...

CVE-2026-109285 Open WebUI 0.6.0 before 0.11.4 Improper Access Control via Stale File Metadata

Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in hasaccesstofile that lets former knowledge base collaborators keep file access via stale cached knowledge base references. Attackers with read or write grants can download removed files through the file conte...

CVE-2026-109285

Open WebUI versions 0.6.0 before 0.11.4 are vulnerable to an improper access control flaw within the has_access_to_file function. The root cause is the retention of stale cached knowledge base references , which allows former collaborators to maintain unauthorized access to files. An attacker wit...

CVE-2026-109285 Open WebUI 0.6.0 before 0.11.4 Improper Access Control via Stale File Metadata

Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in hasaccesstofile that lets former knowledge base collaborators keep file access via stale cached knowledge base references. Attackers with read or write grants can download removed files through the file conte...

EUVD-2026-97587

Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in hasaccesstofile that lets former knowledge base collaborators keep file access via stale cached knowledge base references. Attackers with read or write grants can download removed files through the file conte...

CVE-2026-21135

Improper access control in Samsung Internet prior to version 30.0.5.6 allows local attackers to access sensitive information...

CVE-2026-21139

Improper access control in Samsung Continuity Service for windows prior to version 4.6.1217.0 allows adjacent attackers to manipulate the connected mobile device...

CVE-2026-21118

Improper access control in DownloadProvider prior to SMR Oct-2026 Release 1 allows local attackers to access files in scoped storage...

CVE-2026-21139

Improper access control in Samsung Continuity Service for windows prior to version 4.6.1217.0 allows adjacent attackers to manipulate the connected mobile device...

EUVD-2026-97203

Improper access control in Samsung Continuity Service for windows prior to version 4.6.1217.0 allows adjacent attackers to manipulate the connected mobile device...

CVE-2026-21135

Improper access control in Samsung Internet prior to version 30.0.5.6 allows local attackers to access sensitive information...

EUVD-2026-97199

Improper access control in Samsung Internet prior to version 30.0.5.6 allows local attackers to access sensitive information...

CVE-2026-21118

An improper access control vulnerability exists in the DownloadProvider component on devices prior to the SMR Oct-2026 Release 1 . This flaw allows local attackers to gain unauthorized access to files located within scoped storage . Exploitation details and specific exploit paths are not provided...