cve.bz

OWASP A01:2025 Broken Access Control vulnerabilities, newest first, page 74

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A01:2025 at MITRE.

Its weaknesses: 40

CWE-22, CWE-23, CWE-36, CWE-59, CWE-61, CWE-65, CWE-200, CWE-201, CWE-219, CWE-276, CWE-281, CWE-282, CWE-283, CWE-284, CWE-285, CWE-352, CWE-359, CWE-377, CWE-379, CWE-402, CWE-424, CWE-425, CWE-441, CWE-497, CWE-538, CWE-540, CWE-548, CWE-552, CWE-566, CWE-601, CWE-615, CWE-639, CWE-668, CWE-732, CWE-749, CWE-862, CWE-863, CWE-918, CWE-922, CWE-1275

  1. 5.5CVE-2026-84011EPSS 0.3%

    Incorrect authorization in Windows SMB Client allows an authorized attacker to bypass a security feature locally.

  2. 5.5CVE-2026-83933EPSS 0.5%

    Improper link resolution before file access ('link following') in Windows Update Orchestrator Service allows an authorized attacker to disclose information locally.

  3. 7.8CVE-2026-83927EPSS 0.4%

    Improper link resolution before file access ('link following') in Windows Registry allows an authorized attacker to elevate privileges locally.

  4. 4.7CVE-2026-83925EPSS 0.7%

    Use of uninitialized resource in Windows Kernel allows an authorized attacker to disclose information locally.

  5. 8.8CVE-2026-83923EPSS 1.0%

    Relative path traversal in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.

  6. 4.7CVE-2026-83909EPSS 0.4%

    Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.

  7. 5.5CVE-2026-83907EPSS 0.9%

    Exposure of sensitive system information to an unauthorized control sphere in Windows Hello allows an authorized attacker to disclose information locally.

  8. 4.7CVE-2026-83905EPSS 0.7%

    Exposure of sensitive system information to an unauthorized control sphere in Windows Shell allows an authorized attacker to disclose information locally.

  9. 4.7CVE-2026-83897EPSS 0.7%

    Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.

  10. 5.5CVE-2026-83893EPSS 0.5%

    Exposure of sensitive system information to an unauthorized control sphere in Windows Clipboard User Service allows an authorized attacker to disclose information locally.

  11. 7.8CVE-2026-83873EPSS 0.4%

    Relative path traversal in Windows Shell allows an authorized attacker to elevate privileges locally.

  12. 4.7CVE-2026-83865EPSS 0.3%

    Relative path traversal in Windows Internet (wininet.dll) allows an authorized attacker to perform tampering locally.

  13. 7.8CVE-2026-83837EPSS 0.3%

    Improper access control in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.

  14. 5.5CVE-2026-83835EPSS 0.9%

    Buffer over-read in Windows Common Log File System Driver allows an authorized attacker to disclose information locally.

  15. 7.0CVE-2026-83793EPSS 0.3%

    Improper link resolution before file access ('link following') in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.

  16. 7.8CVE-2026-83792EPSS 0.3%

    Incorrect authorization in Windows Device Install Service allows an authorized attacker to elevate privileges locally.

  17. 7.8CVE-2026-83791EPSS 0.3%

    Improper authorization in Windows Virtual Input allows an authorized attacker to elevate privileges locally.

  18. 8.8CVE-2026-83784EPSS 1.1%

    Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges over a network.

  19. 4.7CVE-2026-83774EPSS 0.7%

    Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.

  20. 5.5CVE-2026-83773EPSS 0.9%

    Exposure of sensitive system information to an unauthorized control sphere in Windows MIDI Service Module allows an authorized attacker to disclose information locally.

  21. 4.2CVE-2026-83766EPSS 0.4%

    Incorrect authorization in Windows Hyper-V allows an authorized attacker to bypass a security feature over an adjacent network.

  22. 5.5CVE-2026-83764EPSS 0.3%

    Incorrect authorization in Windows Clipboard User Service allows an authorized attacker to disclose information locally.

  23. 8.1CVE-2026-83746EPSS 1.1%

    Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.

  24. 5.5CVE-2026-83713EPSS 0.9%

    Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to disclose information locally.

  25. 5.5CVE-2026-83705EPSS 0.9%

    Exposure of sensitive system information to an unauthorized control sphere in Windows HTTP.sys allows an authorized attacker to disclose information locally.

  26. 7.8CVE-2026-83704EPSS 0.5%

    Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

  27. 6.5CVE-2026-83683EPSS 1.3%

    Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to disclose information over a network.

  28. 4.7CVE-2026-83672EPSS 0.7%

    Exposure of sensitive system information to an unauthorized control sphere in Windows Installer allows an authorized attacker to disclose information locally.

  29. 7.8CVE-2026-83659EPSS 0.3%

    Improper link resolution before file access ('link following') in Windows User Profile Service allows an authorized attacker to elevate privileges locally.

  30. 5.5CVE-2026-83658EPSS 0.3%

    Improper access control in Windows Error Reporting allows an authorized attacker to disclose information locally.

  31. 5.4CVE-2026-83646EPSS 0.4%

    Url redirection to untrusted site ('open redirect') in Active Directory Federation Services (AD FS) allows an authorized attacker to perform spoofing over a network.

  32. 7.8CVE-2026-83583EPSS 0.3%

    Improper access control in Windows Geotag Broker allows an authorized attacker to elevate privileges locally.

  33. 7.8CVE-2026-83568EPSS 0.3%

    Improper access control in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.

  34. 5.5CVE-2026-83507EPSS 0.5%

    Improper link resolution before file access ('link following') in Windows Update Orchestrator Service allows an authorized attacker to disclose information locally.

  35. 6.1CVE-2026-83500EPSS 0.4%

    Url redirection to untrusted site ('open redirect') in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.

  36. 8.8CVE-2026-77910EPSS 0.9%

    Incorrect authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

  37. 8.8CVE-2026-70299EPSS 0.3%

    Improper access control in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.

  38. 6.5CVE-2026-70298EPSS 1.2%

    Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.

  39. 8.8CVE-2026-70297EPSS 1.2%

    Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to execute code over a network.

  40. 5.5CVE-2026-70280EPSS 0.4%

    Incorrect authorization in Windows Hello allows an authorized attacker to bypass a security feature locally.

  41. 5.5CVE-2026-70264EPSS 0.5%

    Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to disclose information locally.

  42. 5.5CVE-2026-70261EPSS 0.9%

    Exposure of sensitive system information to an unauthorized control sphere in Microsoft Trace Data Helper allows an authorized attacker to disclose information locally.

  43. 5.5CVE-2026-70260EPSS 0.9%

    Exposure of sensitive system information to an unauthorized control sphere in Microsoft Trace Data Helper allows an authorized attacker to disclose information locally.

  44. 6.5CVE-2026-70259EPSS 0.9%

    Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.

  45. 7.5CVE-2026-70251EPSS 0.6%

    Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

  46. 8.8CVE-2026-70246EPSS 0.9%

    Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

  47. 5.5CVE-2026-70235EPSS 0.3%

    Improper authentication in Windows Event Tracing allows an authorized attacker to perform spoofing locally.

  48. 5.5CVE-2026-70232EPSS 0.9%

    Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information locally.

  49. 8.1CVE-2026-70229EPSS 1.0%

    Incorrect authorization in Active Directory Domain Services allows an unauthorized attacker to execute code over a network.

  50. 7.8CVE-2026-70222EPSS 0.4%

    Relative path traversal in Windows Shell allows an authorized attacker to elevate privileges locally.