OWASP A01:2025 Broken Access Control vulnerabilities, newest first, page 111
Filter
The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A01:2025 at MITRE.
Its weaknesses: 40
CWE-22, CWE-23, CWE-36, CWE-59, CWE-61, CWE-65, CWE-200, CWE-201, CWE-219, CWE-276, CWE-281, CWE-282, CWE-283, CWE-284, CWE-285, CWE-352, CWE-359, CWE-377, CWE-379, CWE-402, CWE-424, CWE-425, CWE-441, CWE-497, CWE-538, CWE-540, CWE-548, CWE-552, CWE-566, CWE-601, CWE-615, CWE-639, CWE-668, CWE-732, CWE-749, CWE-862, CWE-863, CWE-918, CWE-922, CWE-1275
- 7.8CVE-2026-47599EPSS 0.1%
NVIDIA GPU Display Driver for Linux contains a vulnerability in the open-source kernel module where an unprivileged local user could cause improper preservation of memory access permissions during DMA mapping. A successful exploit of this …
- 7.0CVE-2026-47596EPSS 0.1%
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user can write to read-only memory because the memory's permissions are not preserved. A successful exploit of this vulnerability m…
- 7.8CVE-2026-47595EPSS 0.1%
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user can write to read-only memory because the memory's permissions are not preserved. A successful exploit of this vulnerability m…
- 7.8CVE-2026-47591EPSS 0.1%
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could bypass read-only memory protection due to incorrect authorization, enabling write access to memory marked read-only. A s…
- 7.3CVE-2026-47580EPSS 0.1%
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker could cause a missing authorization issue. A successful exploit of this vulnerability might lead to information disclosure and data tampe…
- 7.8CVE-2026-47571EPSS 0.1%
NVIDIA GPU Display Driver for Windows contains a vulnerability in kernel-mode escape handling where an attacker with local access could bypass an authorization check that is intended to restrict certain operations based on client execution…
- 7.8CVE-2026-47559EPSS 0.1%
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could access memory belonging to another user's process. A successful exploit of this vulnerability might lead to code executio…
- 7.8CVE-2026-47552EPSS 0.1%
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could bypass an authorization check and modify privileged configuration. A successful exploit of this vulnerability might lead…
- 6.0CVE-2026-47518EPSS 0.1%
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in a secure microcontroller component, where incorrect permission assignment for a critical resource allows an attacker with privileged local access to modify protect…
- 7.8CVE-2026-47514EPSS 0.1%
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause exposure of kernel stack contents including return addresses and pointers. A successful exploit of this vulnerabili…
- 7.8CVE-2026-47493EPSS 0.1%
NVIDIA vGPU software for Windows and Linux contains a vulnerability in the GPU kernel driver where a guest may access privileged host GPU resources for which it is not authorized. A successful exploit of this vulnerability might lead to co…
- 5.5CVE-2026-47492EPSS 0.1%
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an attacker can cause improper access control. A successful exploit of this vulnerability might lead to denial of service.
- 7.8CVE-2026-47489EPSS 0.1%
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where permissions on read-only memory might not be preserved. A successful exploit of this vulnerability might lead to code execution, denial of service,…
- 4.3CVE-2026-100280EPSS 0.2%
In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible
- 6.5CVE-2026-100279EPSS 0.2%
In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials
- 4.9CVE-2026-100278EPSS 0.2%
In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments
- 9.8CVE-2026-100277EPSS 0.3%
In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature
- 7.5CVE-2026-100276EPSS 0.2%
In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action
- 9.8CVE-2026-100273EPSS 0.3%
In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution
- 4.9CVE-2026-100272EPSS 0.3%
In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues
- 2.7CVE-2026-100271EPSS 0.2%
In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects
- 2.7CVE-2026-100270EPSS 0.2%
In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials via import configurations
- 4.3CVE-2026-100269EPSS 0.2%
In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed
- 2.7CVE-2026-100268EPSS 0.2%
In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templates
- 6.5CVE-2026-100266EPSS 0.2%
In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address
- 7.1CVE-2026-100262EPSS 0.2%
In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification templates
- 4.3CVE-2026-100259EPSS 0.2%
In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access
- 4.3CVE-2026-100258EPSS 0.7%
In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings
- 4.3CVE-2026-100257EPSS 0.2%
In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export
- 5.3CVE-2026-97259EPSS 0.2%
Authorization Bypass Through User-Controlled Key vulnerability in WP Hosting AS Pay with Vipps for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pay with Vipps for WooCommerce: fro…
- 5.3CVE-2026-103396EPSS 0.3%
bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches the /api/admin/user/synccount endpoint before the intended dashboard…
- 6.9CVE-2026-103243EPSS 0.3%
LightLLM through 1.2.0 fails to validate image_url and audio_url parameters in multimodal endpoints, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply arbitrary URLs to fetch internal resources…
- 6.3CVE-2026-102983EPSS 0.3%
Astro is a web framework for content-driven websites. From 5.2.0 until 8.2.4, the @astrojs/netlify adapter generates regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Beca…
- 7.3CVE-2026-101295EPSS 0.1%
Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path (--v1) or the OCI feature path (--use-oci-feature), oc-mirror extracts tar entries fro…
- 5.3CVE-2026-93547EPSS 0.4%
A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are…
- 5.3CVE-2026-97302EPSS 0.2%
Unauthenticated Sensitive Data Exposure in MPG <= 4.2.3 versions.
- 5.4CVE-2026-97299EPSS 0.10%
Unauthenticated Cross Site Request Forgery (CSRF) in Razorpay Payment Links for WooCommerce <= 2.1.5 versions.
- 5.4CVE-2026-97285EPSS 0.2%
Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions.
- 5.3CVE-2026-97282EPSS 0.2%
Unauthenticated Insecure Direct Object References (IDOR) in Review Schema <= 3.1.0 versions.
- 4.3CVE-2026-97267EPSS 0.2%
Subscriber Broken Access Control in Prevent files / folders access <= 2.6.7 versions.
- 5.3CVE-2026-97261EPSS 0.2%
Unauthenticated Sensitive Data Exposure in Notivo <= 1.4.2 versions.
- 6.5CVE-2026-97247EPSS 0.2%
Unauthenticated Broken Access Control in Blocksy Companion <= 2.1.55 versions.
- 5.4CVE-2026-97243EPSS 0.2%
Subscriber Broken Access Control in AllAble Connector <= 0.13.4 versions.
- 6.8CVE-2026-97242EPSS 0.4%
Author Arbitrary File Deletion in WEBO MCP <= 3.0.18 versions.
- 7.5CVE-2026-97241EPSS 0.3%
Unauthenticated Sensitive Data Exposure in BackupEase <= 2.2.2 versions.
- 7.5CVE-2026-97240EPSS 0.3%
Unauthenticated Sensitive Data Exposure in StifLi Backup Tools <= 2.2.7 versions.
- 6.5CVE-2026-97239EPSS 0.3%
Subscriber Broken Access Control in MCP Content Manager Lite <= 1.1.0 versions.
- 7.5CVE-2026-97197EPSS 0.3%
Unauthenticated Broken Access Control in WordPress Backup & Migration <= 1.6.0 versions.
- 4.3CVE-2026-97079EPSS 0.3%
Subscriber Insecure Direct Object References (IDOR) in Webba Booking <= 6.5.0 versions.
- 5.3CVE-2026-97078EPSS 0.2%
Unauthenticated Insecure Direct Object References (IDOR) in Client Invoicing by Sprout Invoices <= 20.8.17 versions.