EUVD-2026-80227

QND contains an improper access control vulnerability in a named pipe, which may allow a local attacker who is logged in to a Windows PC where the affected product's client is installed to execute arbitrary commands with SYSTEM privileges...

PT-2026-93695

Name of the Vulnerable Software and Affected Versions WNC T-Mobile 5G Box IDU versions prior to 1.1.0.651412 Description Improper access control allows a remote attacker to access the 'wnc maccheck.cgi' endpoint without authentication. This enables the retrieval of sensitive configuration data,...

CVE-2026-20332: Improper Access Control

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management Center Software engineering team has conducted a comprehensive internal securi...

CVE-2026-20121: Improper Access Control

A vulnerability in the access control list ACL Object Group Search OGS implementation of Cisco Secure Firewall Adaptive Security Appliance ASA Software and Cisco Secure Firewall Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass configured access controls. This...

PT-2026-93334

QND contains an improper access control vulnerability in a named pipe, which may allow a local attacker who is logged in to a Windows PC where the affected product's client is installed to execute arbitrary commands with SYSTEM privileges...

PT-2026-93957

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine affected versions not specified Cisco ISE Passive Identity Connector affected versions not specified Description Improper access control issues exist within the software, categorized under CWE-284. Approximately...

CVE-2026-40856: Missing Authentication for Critical Function

WNC T-Mobile 5G Box IDU router is vulnerable to improper access control. The vulnerability exists in the wncmaccheck.cgi endpoint, which is accessible without authentication. It allows a remote attacker to retrieve sensitive configuration data, including the administrator web password, WiFi...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38415)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability in access control. This vulnerability stems from an improper access control in the getCloudDownloadStatus function. Attackers can exploit this vulnerability by sending a specially crafted POS...

CVE-2026-87959: Improper Access Control

The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with subscriber-level access to overwrite those settings, including the API key used for the WPBot WordPress plugin before 8.7.6's outgoing AI...

CVE-2026-92754: Missing Authorization

PatrowlManager through 1.8.4 contains an improper access control vulnerability in the user listing API endpoint where the authorization decorator is commented out. Authenticated attackers with low-privilege accounts can enumerate all users and their privilege flags including superuser and staff...

CVE-2026-20322: Improper Access Control

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. T...

CVE-2026-20192: Improper Access Control

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release...

CVE-2026-89328: Improper Access Control

The FluentBoards WordPress plugin before 2.0.15 does not properly verify that a user holds board-manager privileges before performing several board-management operations, checking only board membership. This allows any member of a board to carry out manager-only actions on it, including adding or...

CVE-2026-92601: Missing Authorization

Guns through 8.3.5 contains an improper access control vulnerability in SysNoticeController where requiredPermission defaults to false and is not overridden by any action methods. Authenticated users without assigned roles can exploit this to create, edit, delete, publish and retract system-wide...

PT-2026-93978

Name of the Vulnerable Software and Affected Versions Cisco Nexus Dashboard affected versions not specified Description Improper access control issues exist within the software, categorized under CWE-284, which refers to the failure to properly restrict access to a component or function...

CVE-2026-82126: Improper Access Control

The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check that a user is allowed to edit the specific post they request schema generation for, allowing users with the contributor role and above to obtain the content of other users' draft, pending, private and password...

PT-2026-93983

Name of the Vulnerable Software and Affected Versions Cisco Secure Adaptive Security Appliance Software affected versions not specified Cisco Secure Firewall Threat Defense Software affected versions not specified Cisco Secure Firewall Management Center Software affected versions not specified...

TOTOLINK T6: Vulnerability due to improper access control (CNVD-2026-38425)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from improper access control in the setApWiFiSchCfg function. Attackers can exploit this vulnerability by sending a specially crafted POST...

PT-2026-93361

Name of the Vulnerable Software and Affected Versions GitLab EE versions 17.1 through 19.1.7 GitLab EE versions 19.2 through 19.2.5 GitLab EE versions 19.3 through 19.3.1 Description An issue exists where an authenticated user with Owner or Maintainer permissions can silently disable protected...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38588)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to improper access control. This vulnerability stems from improper access control in the keepAlive function. Attackers can exploit this vulnerability by sending specially crafted MQTT...