cve.bz

OWASP A01:2025 Broken Access Control vulnerabilities, newest first, page 73

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A01:2025 at MITRE.

Its weaknesses: 40

CWE-22, CWE-23, CWE-36, CWE-59, CWE-61, CWE-65, CWE-200, CWE-201, CWE-219, CWE-276, CWE-281, CWE-282, CWE-283, CWE-284, CWE-285, CWE-352, CWE-359, CWE-377, CWE-379, CWE-402, CWE-424, CWE-425, CWE-441, CWE-497, CWE-538, CWE-540, CWE-548, CWE-552, CWE-566, CWE-601, CWE-615, CWE-639, CWE-668, CWE-732, CWE-749, CWE-862, CWE-863, CWE-918, CWE-922, CWE-1275

  1. 8.6CVE-2026-63153EPSS 0.3%

    Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in setAffectations() that allows authenticated attackers to insert access-right records for a caller-supplied target space without verifying the caller h…

  2. 5.4CVE-2026-56826EPSS 0.3%

    Shopper is a Headless e-commerce Admin Panel. From 2.0.0 until 2.9.2, authenticated users who could reach the Settings pages with only access_setting could directly invoke destructive actions through the Livewire endpoint because packages/…

  3. 10.0CVE-2026-48383EPSS 1.0%

    Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or …

  4. 10.0CVE-2026-48382EPSS 1.0%

    Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or …

  5. 8.8CVE-2026-16753EPSS 0.5%

    Incorrect authorization in the library-query execution endpoint in Lowcoder version, up to and including 2.4.10, allows an authenticated administrator or developer in one organization to execute a library query belonging to another organiz…

  6. 7.7CVE-2026-106634EPSS 0.5%

    Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary file system write. A low-privileged attacker could leverage this vulnera…

  7. 9.6CVE-2026-102238EPSS 0.8%

    Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to execute code over a network.

  8. 7.8CVE-2026-97800EPSS 0.3%

    Incorrect permission assignment for critical resource in Windows Mobile Broadband allows an authorized attacker to elevate privileges locally.

  9. 7.8CVE-2026-97792EPSS 0.3%

    Improper access control in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.

  10. 5.5CVE-2026-97790EPSS 0.4%

    Improper link resolution before file access ('link following') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to perform tampering locally.

  11. 6.5CVE-2026-97740EPSS 0.9%

    Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.

  12. 5.5CVE-2026-96948EPSS 0.5%

    Exposure of sensitive information to an unauthorized actor in Windows Client Side Caching driver (csc.sys) allows an authorized attacker to disclose information locally.

  13. 5.5CVE-2026-96944EPSS 0.5%

    Insertion of sensitive information into externally-accessible file or directory in Windows Storage allows an authorized attacker to disclose information locally.

  14. 5.5CVE-2026-96935EPSS 0.4%

    Exposure of sensitive system information to an unauthorized control sphere in Windows NTFS allows an authorized attacker to disclose information locally.

  15. 5.5CVE-2026-96926EPSS 0.3%

    Missing authorization in DNS Server allows an authorized attacker to perform tampering locally.

  16. 7.8CVE-2026-96918EPSS 0.3%

    Improper access control in Windows NTFS allows an authorized attacker to elevate privileges locally.

  17. 7.8CVE-2026-96911EPSS 0.5%

    Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

  18. 5.6CVE-2026-96865EPSS 0.4%

    Exposure of sensitive system information to an unauthorized control sphere in Windows Secure Kernel Mode allows an authorized attacker to disclose information locally.

  19. 5.5CVE-2026-96857EPSS 0.4%

    Files or directories accessible to external parties in Windows Projected File System allows an authorized attacker to disclose information locally.

  20. 5.5CVE-2026-96855EPSS 0.3%

    Improper access control in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally.

  21. 5.5CVE-2026-96316EPSS 0.3%

    Improper access control in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to perform tampering locally.

  22. 5.5CVE-2026-96315EPSS 0.3%

    Missing authorization in Windows Overlay Filter allows an authorized attacker to perform tampering locally.

  23. 5.5CVE-2026-96311EPSS 0.3%

    Improper authorization in Windows Network List Service allows an authorized attacker to perform tampering locally.

  24. 7.8CVE-2026-96243EPSS 0.3%

    Improper link resolution before file access ('link following') in Windows WalletService allows an authorized attacker to elevate privileges locally.

  25. 7.8CVE-2026-96231EPSS 0.4%

    Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.

  26. 7.8CVE-2026-96225EPSS 0.4%

    Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.

  27. 6.5CVE-2026-96204EPSS 0.8%

    Server-side request forgery (ssrf) in Azure Arc allows an authorized attacker to elevate privileges over a network.

  28. 7.2CVE-2026-92910EPSS 0.4%

    Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write a…

  29. 9.8CVE-2026-92909EPSS 0.8%

    Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation o…

  30. 8.3CVE-2026-92908EPSS 0.6%

    Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and w…

  31. 7.5CVE-2026-88206EPSS 0.6%

    Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

  32. 8.8CVE-2026-88198EPSS 0.7%

    Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

  33. 7.8CVE-2026-88191EPSS 0.4%

    Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

  34. 5.5CVE-2026-88162EPSS 0.3%

    Improper authorization in Windows Encrypting File System (EFS) allows an authorized attacker to perform tampering locally.

  35. 6.5CVE-2026-88137EPSS 1.0%

    Files or directories accessible to external parties in WebDAV allows an authorized attacker to disclose information over a network.

  36. 7.8CVE-2026-88135EPSS 0.3%

    Improper access control in WebDAV allows an authorized attacker to elevate privileges locally.

  37. 7.8CVE-2026-88133EPSS 0.5%

    Improper authorization in Windows Portable Device Enumerator Service allows an authorized attacker to elevate privileges locally.

  38. 7.8CVE-2026-88072EPSS 0.4%

    Improper access control in Windows Host Guardian Service allows an authorized attacker to elevate privileges locally.

  39. 6.5CVE-2026-87714EPSS 0.4%

    Missing authorization in WebDAV allows an authorized attacker to bypass a security feature over a network.

  40. 5.5CVE-2026-85938EPSS 0.3%

    Improper access control in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally.

  41. 6.5CVE-2026-85932EPSS 1.2%

    Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.

  42. 5.5CVE-2026-85916EPSS 0.4%

    Exposure of private personal information to an unauthorized actor in Azure Active Directory allows an unauthorized attacker to disclose information locally.

  43. 7.5CVE-2026-85891EPSS 0.9%

    Exposure of sensitive information to an unauthorized actor in Azure HDInsight allows an unauthorized attacker to disclose information over a network.

  44. 6.5CVE-2026-85873EPSS 1.0%

    Improper authorization in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.

  45. 4.7CVE-2026-85866EPSS 0.4%

    Exposure of sensitive system information to an unauthorized control sphere in Windows ALPC allows an authorized attacker to disclose information locally.

  46. 7.8CVE-2026-85849EPSS 0.5%

    Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.

  47. 6.5CVE-2026-85840EPSS 1.0%

    Files or directories accessible to external parties in Windows Event Viewer allows an authorized attacker to disclose information over a network.

  48. 5.5CVE-2026-85812EPSS 0.5%

    Files or directories accessible to external parties in Windows Bind Filter Driver allows an authorized attacker to disclose information locally.

  49. 5.5CVE-2026-85793EPSS 0.5%

    Exposure of sensitive system information to an unauthorized control sphere in Windows Sysmain Service allows an authorized attacker to disclose information locally.

  50. 7.8CVE-2026-85343EPSS 0.3%

    Improper link resolution before file access ('link following') in Windows Hyper-V allows an authorized attacker to elevate privileges locally.