62027 matches found
PT-2026-40240
Improper access control in Microsoft Office Word allows an authorized attacker to perform spoofing locally...
PT-2026-40239
Name of the Vulnerable Software and Affected Versions Microsoft 365 Copilot for Android affected versions not specified Description Improper access control in the intelligent virtual assistant allows an authorized attacker to perform spoofing attacks locally. Spoofing is a technique where a perso...
PT-2026-40250
Improper access control in M365 Copilot for Desktop allows an unauthorized attacker to perform spoofing locally...
Siemens Ruggedcom Rox
SUMMARY Ruggedcom Rox contains an improper access control vulnerability that could allow an authenticated remote attacker to read arbitrary files with root privileges from the underlying operating system's filesystem. Siemens has released new versions for the affected products and recommends to...
PT-2026-40136
Name of the Vulnerable Software and Affected Versions Windows Filtering Platform affected versions not specified Description Improper access control in the Windows Filtering Platform WFP allows an authorized attacker to bypass a security feature locally. Recommendations At the moment, there is no...
PT-2026-40265
Name of the Vulnerable Software and Affected Versions FortiAuthenticator versions 8.0.0 through 8.0.2 FortiAuthenticator versions 6.6.0 through 6.6.8 FortiAuthenticator versions 6.5.0 through 6.5.6 Description An improper access control issue in API endpoints allows an unauthenticated remote...
PT-2026-40210
Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally...
PT-2026-40241
Improper access control in Microsoft Office PowerPoint allows an authorized attacker to perform spoofing locally...
PT-2026-40257
Name of the Vulnerable Software and Affected Versions Microsoft Office affected versions not specified Description Improper access control allows an unauthorized attacker to perform spoofing locally...
EUVD-2026-29116
HireFlow v1.2 is vulnerable to Incorrect Access Control. The application does not enforce object-level authorization on the /candidate/ and /interview/ endpoints. The route handlers retrieve records by the user-supplied ID without verifying that the requesting user is the owner or has an authoriz...
CVE-2026-45006 OpenClaw < 2026.4.23 - Unsafe Config Mutation via Gateway Tool Denylist Bypass
OpenClaw before 2026.4.23 contains an improper access control vulnerability in the gateway tool's config.apply and config.patch operations that allows compromised models to write unsafe configuration changes by bypassing an incomplete denylist protection. Attackers can persist malicious config...
CVE-2026-8233
A vulnerability was determined in Dotouch XproUPF 2.0.0-release-088aa7c4. Affected is an unknown function of the component UPF. This manipulation causes improper access controls. A high degree of complexity is needed for the attack. The exploitability is told to be difficult. The vendor was...
CVE-2026-8233 Dotouch XproUPF access control
A vulnerability was determined in Dotouch XproUPF 2.0.0-release-088aa7c4. Affected is an unknown function of the component UPF. This manipulation causes improper access controls. A high degree of complexity is needed for the attack. The exploitability is told to be difficult. The vendor was...
CVE-2026-33109
Improper access control in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code over a network...
Improper Access Control
Apollo Federation is vulnerable to improper access control. The vulnerability is due to improper enforcement of user-defined access control directives on interface types and fields, which allows an attacker to bypass access restrictions by querying implementing object types and fields through...
CVE-2026-8127
The CVE covers eladmin up to version 2.7, where the checkLevel function in /rest/UserController.java (Users API Endpoint) is susceptible. The issue allows remote manipulation that leads to improper access controls. Exploitation is possible remotely and has been disclosed publicly; the CVSS metric...
EUVD-2026-28454
Improper access control in Azure AI Foundry M365 published agents allows an unauthorized attacker to elevate privileges over a network...
EUVD-2026-28448
Improper access control in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code over a network...
ELADMIN 安全漏洞
ELADMIN is a backend management system developed by elunez himself. Versions of ELADMIN 2.7 and earlier had security vulnerabilities. These vulnerabilities stemmed from an improper access control caused by the checkLevel operation in the Users API Endpoint component’s /file/rest/UserController.ja...
