cve.bz

OWASP A01:2025 Broken Access Control vulnerabilities, newest first, page 138

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A01:2025 at MITRE.

Its weaknesses: 40

CWE-22, CWE-23, CWE-36, CWE-59, CWE-61, CWE-65, CWE-200, CWE-201, CWE-219, CWE-276, CWE-281, CWE-282, CWE-283, CWE-284, CWE-285, CWE-352, CWE-359, CWE-377, CWE-379, CWE-402, CWE-424, CWE-425, CWE-441, CWE-497, CWE-538, CWE-540, CWE-548, CWE-552, CWE-566, CWE-601, CWE-615, CWE-639, CWE-668, CWE-732, CWE-749, CWE-862, CWE-863, CWE-918, CWE-922, CWE-1275

  1. 5.8CVE-2026-54587EPSS 0.1%

    mport is the MidnightBSD Package Manager. Prior to 2.7.8, directory assets handled as ASSET_DIR or ASSET_DIR_OWNER_MODE in libmport/bundle_read_install_pkg.c used path-based mport_mkdirp(), ownership, and permission operations. A local att…

  2. 6.0CVE-2026-54585EPSS 0.5%

    mport is the MidnightBSD Package Manager. Prior to 2.7.8, create_sample_file() in libmport/bundle_read_install_pkg.c did not constrain absolute source and destination paths from the sample-file manifest directive to mport->root. A maliciou…

  3. 8.3CVE-2026-54583EPSS 0.5%

    mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/fetch.c did not consistently reject empty, dot, dot-dot, or slash-containing bundle filenames before composing package download and write paths. Malicious package index dat…

  4. 6.0CVE-2026-54582EPSS 0.6%

    mport is the MidnightBSD Package Manager. Prior to 2.7.8, package installation lacked a preflight check for incoming non-directory assets that already existed on disk. The affected logic across libmport/check_preconditions.c, libmport/inst…

  5. 5.8CVE-2026-54576EPSS 0.1%

    mport is the MidnightBSD Package Manager. Prior to 2.7.8, do_actual_install() in libmport/bundle_read_install_pkg.c used path-based lstat(), chown(), stat(), and chmod() operations while installing package files. A local attacker with writ…

  6. 7.1CVE-2026-93014EPSS 0.5%

    RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users to unlink allow-listed files via path traversal. Attackers can use parent-directory sequences to es…

  7. 5.3CVE-2026-93013EPSS 0.5%

    RAGFlow through 0.27.2 contains a path traversal vulnerability in the dev_insert_chunks_from_file and dev_insert_metadata_from_file endpoints that allows authenticated attackers to read arbitrary files by supplying absolute file paths in t…

  8. 8.7CVE-2026-86864EPSS 0.6%

    pgAdmin 4's Backup tool appended the client-supplied 'database' field from the /backup/job/<sid>/object request to the pg_dump argument vector as a bare trailing positional argument, without validation. Because pg_dump parses its options w…

  9. 7.1CVE-2026-86862EPSS 0.4%

    pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database' field directly as the value of the --dbname option given to pg_restore and psql. libpq expands a database name containing an equals sign into a full connection…

  10. 6.0CVE-2026-86861EPSS 0.3%

    pgAdmin 4's File Manager save_file endpoint, which backs saving from the Query Tool and ERD, validated the requested path with Filemanager.check_access_permission() and then opened the file for writing with a plain open() call. CVE-2026-78…

  11. 6.8CVE-2026-85717EPSS 0.5%

    The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and from 3.0.9 to 3.0.11, a client configured with a client-wide Realm and redirect…

  12. 5.9CVE-2026-75523EPSS 0.4%

    Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, the Steeltoe.Management.Endpoint /actuator/httpexchanges endpoint passes recorded request URIs thr…

  13. 8.7CVE-2026-69197EPSS 0.7%

    Umbraco is an ASP.NET CMS. Prior to 13.15.1, 17.5.3, and 18.0.2, the Content Delivery API applies member and Public Access checks to the directly requested node but not to referenced nodes serialized through Content Picker or Multi-Node Tr…

  14. 3.7CVE-2026-61700EPSS 0.4%

    MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, ClientMessage.readPacket processes a server-initiated LOCAL INFILE protocol packet 0xfb without…

  15. 7.4CVE-2026-81446EPSS 0.4%

    Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Server-Side Request Forgery (SSRF) vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Server-s…

  16. 7.3CVE-2026-80356EPSS 0.1%

    Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Exposure of Sensitive Information to an Unauthorized Actor vulnerability. A low privileged attacker with local access could potentially exploit this vulnerabilit…

  17. 5.3CVE-2026-63461EPSS 0.4%

    Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop API products, collections, and facets queries combine mandatory visibility guards with caller-supplied filters using the caller-controlled filterOperator…

  18. 6.9CVE-2026-61793EPSS 0.5%

    Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.0.2 until 6.7.0, nuxt-og-image exposes the unauthenticated /_og/d/** route when the documented defaults security.strict = false and security.secret = "" are used, and bas…

  19. 8.7CVE-2026-92970EPSS 0.8%

    HUBzero CMS through 2.2.32 contains a path traversal vulnerability in project file upload handlers that allows authenticated project members to write arbitrary files outside the project repository. Attackers can supply traversal sequences …

  20. 10.0CVE-2026-92960EPSS 0.5%

    vm2 before 3.11.6 fails to restrict access to os and dns builtins under the builtin: ['*'] configuration, allowing sandbox code to read host process identity and network topology. Attackers can invoke dns.setServers() to hijack the host pr…

  21. 10.0CVE-2026-92947EPSS 0.5%

    vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related allocations. Sandboxed code can read and write to host-realm buffers by acquiring Arr…

  22. 2.3CVE-2026-92945EPSS 0.3%

    vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string prefix matching instead of boundary-anchored comparison. Attackers can reach non-allowlisted packages sharing a prefix with a…

  23. 10.0CVE-2026-92941EPSS 0.3%

    vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call tls.setDefaultCACertificates() and replace process-wide certificate authorities. Attackers with access to allowed tls and …

  24. 10.0CVE-2026-92940EPSS 0.4%

    vm2 versions 3.11.3 through 3.11.6 expose the host process's real https.globalAgent to sandboxed code when a NodeVM is explicitly configured to allow require('https'). The builtin loader wraps host modules in a read-only proxy, but method …

  25. 6.9CVE-2026-92933EPSS 0.4%

    vm2 is a sandbox for running untrusted Node.js code. In versions <= 3.11.7, NodeVM exposes the host `util` module to the sandbox as an unfiltered shallow copy (`Object.assign({}, util)` in `defaultBuiltinLoaderUtil`), and the deprecated `s…

  26. 7.6CVE-2026-82685EPSS 0.7%

    Authorization Bypass Through User-Controlled Key vulnerability in team-alembic AshAuthentication allows an authenticated attacker to overwrite and confirm another user's email address, and so take over that account. A confirmation token is…

  27. 5.3CVE-2026-81829EPSS 0.6%

    A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWS_ALB key provider is configured, the resolver constructs the key-fetch URL …

  28. 6.5CVE-2026-81453EPSS 0.5%

    Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A low privileged attacker with remote access could potentially expl…

  29. 6.4CVE-2026-81443EPSS 0.2%

    Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Server-Side Request Forgery (SSRF) vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Server-sid…

  30. 5.4CVE-2026-80355EPSS 0.2%

    Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Cross-Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote ex…

  31. 5.3CVE-2026-78528EPSS 0.3%

    Unauthenticated Broken Access Control in BerqWP <= 4.1.15 versions.

  32. 8.8CVE-2026-78295EPSS 0.2%

    Unauthenticated Cross Site Request Forgery (CSRF) in Xagio SEO <= 7.1.0.43 versions.

  33. 5.3CVE-2026-74017EPSS 0.3%

    Unauthenticated Broken Access Control in User Registration <= 5.2.7 versions.

  34. 5.4CVE-2026-74005EPSS 0.1%

    Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Series <= 3.1.3 versions.

  35. 5.3CVE-2026-74002EPSS 0.3%

    Unauthenticated Broken Access Control in Booking Calendar <= 11.7 versions.

  36. 5.3CVE-2026-74000EPSS 0.3%

    Contributor Broken Access Control in Simple Membership <= 4.8.2 versions.

  37. 5.4CVE-2026-73999EPSS 0.3%

    Contributor Insecure Direct Object References (IDOR) in Cooked <= 1.16.0 versions.

  38. 5.3CVE-2026-66676EPSS 0.3%

    Unauthenticated Broken Access Control in Easy Invoice <= 2.3.8 versions.

  39. 6.4CVE-2026-66608EPSS 0.2%

    Contributor Server Side Request Forgery (SSRF) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.19 versions.

  40. 5.3CVE-2026-66575EPSS 0.3%

    Unauthenticated Insecure Direct Object References (IDOR) in King Addons for Elementor <= 51.1.81 versions.

  41. 7.1CVE-2026-66571EPSS 0.1%

    Unauthenticated Cross Site Request Forgery (CSRF) in Asset CleanUp: Page Speed Booster <= 1.4.0.5 versions.

  42. 5.1CVE-2026-92932EPSS 0.4%

    In the MISP sachertortephp library, the Xml::build() static method in lib/Cake/Utility/Xml.php contains a logic error in the conditional that gates network-based XML fetching. The original condition was written as: $options['readFile'] && …

  43. 7.2CVE-2026-92919EPSS 0.6%

    admin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to write files outside the storage root on Windows deployments. Attackers can use dot-dot path segments in filenames to es…

  44. 4.3CVE-2026-92904EPSS 0.3%

    A flaw was found in the foreman_remote_execution plugin's template invocations controller. The show_template_invocation_by_host action resolves the job invocation by ID without evaluating the caller's view_job_invocations permission filter…

  45. 7.5CVE-2026-81481EPSS 0.5%

    Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. An unauthenticated attacker with remote access could potentially ex…

  46. 8.7CVE-2026-92917EPSS 0.5%

    Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters (print_r, vardump, json_encode, yaml_encode, string): GravExtension::assertSandboxDumpSafe() determin…

  47. 8.7CVE-2026-92916EPSS 0.5%

    Grav is a flat-file CMS. In Grav 1.7.0 through 1.7.53.2 and 2.0.0 through 2.0.21, when the debugger is enabled (system.debugger.enabled: true, which is not the default), the Clockwork profiler endpoint is exposed without authentication: In…

  48. 4.3CVE-2026-92893EPSS 0.3%

    A flaw was found in the foreman_ansible plugin's Ansible inventory API. The controller builds its host query using an unscoped Host.where call that does not enforce the search filter associated with the caller's view_hosts permission. An a…

  49. 4.8CVE-2026-92611EPSS 0.3%

    In Eclipse Ankaios versions 0.6.0 to before 1.0.4, `LogRule::matches` in the agent control-interface authorizer stops at the first wildcard pattern in a single rule instead of evaluating later entries, which can cause deny `LogRule` entrie…

  50. 6.5CVE-2026-81439EPSS 0.2%

    Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism…