CVE-2026-64723: Improper Access Control

A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to access sensitive user data...

PT-2026-65096

Name of the Vulnerable Software and Affected Versions Event-Driven Ansible EDA server affected versions not specified Description The Event-Driven Ansible EDA server contains a flaw in the ExternalEventStreamViewSet due to permissive access controls. The system relies exclusively on the Subject...

CVE-2026-12990: Improper Access Control

An access control vulnerability in the mobile app APK v5.5.0 for Ghost Robotics' Vision 60 robot allows multiple simultaneous sessions to run without proper client validation or session integrity checks. An attacker with a modified version of the app can connect to the robot during an active,...

CVE-2021-32084: Improper Access Control

An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. If a customer restricts access to the web console by IP address or subnets, the API endpoints are not restricted. If credentials/API keys are known to an attacker, the appliance can still be accessed via the API,...

CVE-2026-64732: Improper Access Control

This issue was addressed through improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.7. An attacker with physical access may be able to access sensitive user data during iPhone Mirroring...

CVE-2026-17432 NousResearch hermes-agent SimpleX Gateway Authorization adapter.py access control

A vulnerability was detected in NousResearch hermes-agent 2026.6.5. Affected by this vulnerability is an unknown functionality of the file hermes-agent/plugins/platforms/simplex/adapter.py of the component SimpleX Gateway Authorization. The manipulation of the argument contactId results in improp...

CVE-2026-17432 NousResearch hermes-agent SimpleX Gateway Authorization adapter.py access control

A vulnerability was detected in NousResearch hermes-agent 2026.6.5. Affected by this vulnerability is an unknown functionality of the file hermes-agent/plugins/platforms/simplex/adapter.py of the component SimpleX Gateway Authorization. The manipulation of the argument contactId results in improp...

CVE-2026-17432: Improper Access Control

A vulnerability was detected in NousResearch hermes-agent 2026.6.5. Affected by this vulnerability is an unknown functionality of the file hermes-agent/plugins/platforms/simplex/adapter.py of the component SimpleX Gateway Authorization. The manipulation of the argument contactId results in improp...

CVE-2026-58630

Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a network...

EUVD-2026-48606

Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with only the Reader role to execute automation tests and modify workflow properties via missing server-side authorization checks...

CVE-2026-58630

Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a network...

EUVD-2026-48602

Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-7484

CVE-2026-7484 affects AVESİS (ABIS Technology Ltd. Co.). Description: External control of an Assumed-Immutable web parameter vulnerability allowing access to functionality not properly constrained by ACLs. Affected versions: before 202606251646. Impact per provided metrics: CVSS 3.1 base score 5....

CVE-2026-7484 Improper Access Control in Abis Technology's AVESİS

External control of Assumed-Immutable web parameter vulnerability in ABIS Technology Ltd. Co. AVESİS allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects AVESİS: before 202606251646...

CVE-2026-35425

Improper access control in Azure API Management APIM allows an authorized attacker to execute code over a network...

PT-2026-64308

Name of the Vulnerable Software and Affected Versions Devolutions PowerShell Universal versions prior to 2026.2.3 Description Improper access control within the automation tests and workflows features allows an authenticated user assigned the Reader role to execute automation tests and modify...

CVE-2026-35425: Improper Access Control

Improper access control in Azure API Management APIM allows an authorized attacker to execute code over a network...

CVE-2026-12702: Improper Access Control

In affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows an unauthorized user to trigger a deployment...

CVE-2026-14603: Improper Access Control

The WowOptin: Next-Gen Popup Maker WordPress plugin before 1.4.38 does not have proper authorization on a REST endpoint, allowing unauthenticated users to disable all of the site's opt-in forms and insert new template-based opt-in rows into the database...

CVE-2026-12688: Improper Access Control

The ProfileGrid WordPress plugin before 5.9.9.7 does not verify PayPal IPN notifications before granting paid group membership, allowing unauthenticated attackers to forge a payment notification and mark any user as a paid member of any group without any payment being made...