cve.bz

OWASP A01:2025 Broken Access Control vulnerabilities, newest first, page 171

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A01:2025 at MITRE.

Its weaknesses: 40

CWE-22, CWE-23, CWE-36, CWE-59, CWE-61, CWE-65, CWE-200, CWE-201, CWE-219, CWE-276, CWE-281, CWE-282, CWE-283, CWE-284, CWE-285, CWE-352, CWE-359, CWE-377, CWE-379, CWE-402, CWE-424, CWE-425, CWE-441, CWE-497, CWE-538, CWE-540, CWE-548, CWE-552, CWE-566, CWE-601, CWE-615, CWE-639, CWE-668, CWE-732, CWE-749, CWE-862, CWE-863, CWE-918, CWE-922, CWE-1275

  1. 7.8CVE-2026-28602EPSS 0.09%

    In setClipboardAccessNotificationsEnabledForUser of ClipboardService.java, there is a possible mult-iuser isolation due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges …

  2. 7.8CVE-2026-28600EPSS 0.09%

    In onCreate of PaymentDefaultDialog.java, there is a possible way to change default payment app due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is …

  3. 3.3CVE-2026-28582EPSS 0.08%

    In onCreate of ConfirmDeviceCredentialActivity.java, there is a possible unauthorized access to and modification of device credentials due to a missing permission check. This could lead to local information disclosure with no additional ex…

  4. 7.8CVE-2026-28572EPSS 0.09%

    In onCreate of InstallLaunch.kt, there is a possible misleading UI due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for expl…

  5. 3.3CVE-2026-0054EPSS 0.08%

    In isCallerAllowed of WalletContextualLocationsService.kt, there is a possible way to get wallet information due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.…

  6. 1.8CVE-2026-9215EPSS 0.2%

    A cross site request forgery (CSRF) vulnerability in the listed NETGEAR models allows an attacker who can leverage social engineering techniques on a router administrator to tamper with router configuration and disrupt router operations wi…

  7. 5.5CVE-2026-86672EPSS 0.5%

    A vulnerability has been found in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected is an unknown function of the file example.7z of the component Backup Handler. The manipulation leads to inform…

  8. 5.9CVE-2026-86074EPSS 0.4%

    n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the Instance AI credential setup flow accepted a credential test or verification URL without checking that it matched the workflow node's origin. Attacker-cont…

  9. 7.0CVE-2026-83999EPSS 0.3%

    Improper link resolution before file access ('link following') in Windows Resilient File System (ReFS) Deduplication Service allows an authorized attacker to elevate privileges locally.

  10. 7.8CVE-2026-83942EPSS 0.3%

    Missing authorization in Windows Kernel allows an authorized attacker to elevate privileges locally.

  11. 8.8CVE-2026-83941EPSS 0.8%

    Missing authorization in Entra ID allows an authorized attacker to elevate privileges over a network.

  12. 7.8CVE-2026-81963KEVEPSS 0.4%

    Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.

  13. 6.9CVE-2026-81823EPSS 0.4%

    The vulnerability, if exploited, could allow an unauthenticated miscreant to perform read operations intended only for PIMBoards users, resulting in information disclosure. Write operations are not impacted.

  14. 5.5CVE-2026-81394EPSS 0.6%

    Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

  15. 5.5CVE-2026-81387EPSS 0.6%

    Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

  16. 6.5CVE-2026-81377EPSS 0.8%

    Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to perform tampering over a network.

  17. 8.2CVE-2026-81357EPSS 0.5%

    Server-side request forgery (ssrf) in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

  18. 5.0CVE-2026-79904EPSS 0.2%

    Photoshop Mobile is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to …

  19. 8.8CVE-2026-78462EPSS 0.8%

    Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

  20. 7.4CVE-2026-78461EPSS 1.0%

    Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

  21. 7.0CVE-2026-77897EPSS 0.3%

    Relative path traversal in Power Automate allows an authorized attacker to elevate privileges locally.

  22. 8.8CVE-2026-77487EPSS 0.8%

    Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.

  23. 8.8CVE-2026-73028EPSS 0.8%

    Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.

  24. 7.8CVE-2026-73014EPSS 0.3%

    Missing authorization in Data Sharing Service Client allows an authorized attacker to elevate privileges locally.

  25. 5.5CVE-2026-73008EPSS 0.5%

    Exposure of private personal information to an unauthorized actor in Windows Biometric Service allows an authorized attacker to disclose information locally.

  26. 5.5CVE-2026-72966EPSS 0.3%

    Missing authorization in Windows Remote Access Connection Manager allows an authorized attacker to perform tampering locally.

  27. 7.8CVE-2026-72948EPSS 0.4%

    Relative path traversal in Windows DNS allows an authorized attacker to elevate privileges locally.

  28. 7.5CVE-2026-71330EPSS 1.0%

    Exposure of sensitive system information to an unauthorized control sphere in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to disclose information over a network.

  29. 8.1CVE-2026-70563EPSS 0.8%

    Improper link resolution before file access ('link following') in Windows Shell allows an unauthorized attacker to perform spoofing over a network.

  30. 7.0CVE-2026-70283EPSS 0.2%

    Incorrect authorization in Windows Win32K allows an authorized attacker to elevate privileges locally.

  31. 6.5CVE-2026-70019EPSS 1.0%

    Windows hard link in Windows Compressed Folder allows an unauthorized attacker to disclose information over a network.

  32. 3.5CVE-2026-69904EPSS 0.6%

    Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.

  33. 5.5CVE-2026-69862EPSS 0.5%

    Out-of-bounds read in Windows Wireless Wide Area Network Service allows an authorized attacker to disclose information locally.

  34. 4.7CVE-2026-69832EPSS 0.4%

    Exposure of sensitive system information to an unauthorized control sphere in Windows Win32K allows an authorized attacker to disclose information locally.

  35. 8.0CVE-2026-69807EPSS 0.9%

    Improper limitation of a pathname to a restricted directory ('path traversal') in Windows PowerShell allows an authorized attacker to elevate privileges over a network.

  36. 7.0CVE-2026-69806EPSS 0.8%

    Exposure of sensitive information to an unauthorized actor in .NET allows an authorized attacker to elevate privileges locally.

  37. 8.1CVE-2026-69805EPSS 0.5%

    External control of file name or path in .NET allows an unauthorized attacker to elevate privileges over a network.

  38. 4.7CVE-2026-69771EPSS 0.3%

    Improper link resolution before file access ('link following') in Windows Container Manager Service allows an authorized attacker to bypass a security feature locally.

  39. 8.8CVE-2026-69724EPSS 0.8%

    Missing authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

  40. 5.7CVE-2026-69723EPSS 0.9%

    Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information over a network.

  41. 7.7CVE-2026-69683EPSS 0.8%

    Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.

  42. 9.1CVE-2026-69641EPSS 0.9%

    Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

  43. 7.8CVE-2026-69612EPSS 0.4%

    Absolute path traversal in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

  44. 7.5CVE-2026-69553EPSS 0.5%

    Missing authorization in Windows Hyper-V allows an authorized attacker to elevate privileges over a network.

  45. 7.0CVE-2026-69549EPSS 0.3%

    Out-of-bounds read in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.

  46. 5.5CVE-2026-69531EPSS 0.3%

    Unintended proxy or intermediary ('confused deputy') in Microsoft Windows Speech allows an authorized attacker to perform tampering locally.

  47. 5.7CVE-2026-69507EPSS 0.9%

    Insertion of sensitive information into externally-accessible file or directory in Microsoft Windows Search Component allows an authorized attacker to disclose information over a network.

  48. 7.1CVE-2026-69482EPSS 0.5%

    Creation of temporary file in directory with insecure permissions in Windows Error Reporting allows an authorized attacker to perform tampering locally.

  49. 8.8CVE-2026-69465EPSS 0.8%

    Missing authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

  50. 5.5CVE-2026-69453EPSS 0.3%

    Missing authorization in Microsoft Windows Search Component allows an authorized attacker to perform tampering locally.