CWE-863

In JetBrains IntelliJ IDEA before 2025.2 improper access control allowed Code With Me guest to discover hidden files

The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection plugin for WordPress is vulnerable to

Incorrect authorization in Kibana can lead to privilege escalation via the built-in reporting_user role which incorrectl

Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an Incorrect Authorization vulnerability that cou

Improper Access Control vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024

In Internet2 Grouper 5.17.1 before 5.20.5, group admins who are not Grouper sysadmins can configure loader jobs.

A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have

Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an

The Restaurant Brands International (RBI) assistant platform through 2025-09-06 does not implement access control for th

GitLab has remediated an issue in GitLab EE affecting all versions from 10.6 before 18.3.5, 18.4 before 18.4.3, and 18.5

Nagios Log Server versions prior to 2024R2.0.3 contain an incorrect authorization vulnerability that allows non-administ

An issue was discovered in rymcu forest thru commit f782e85 (2025-09-04) in function doBefore in file src/main/java/com/

Windu CMS is vulnerable to Broken Access Control in user editing functionality. Malicious attacker can send a GET reques

Tryton trytond 6.0 before 7.6.11 does not enforce access rights for data export. This is fixed in 7.6.11, 7.4.21, 7.0.40

Kalmia CMS version 0.2.0 contains an Incorrect Access Control vulnerability in the /kal-api/auth/users API endpoint. Due

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to 2.41.0,

On-Premises Data Gateway Information Disclosure Vulnerability

An issue in System.Linq.Dynamic.Core before 1.6.0 allows remote access to properties on reflection types and static prop

In GRAU DATA Blocky before 3.1, Blocky-Gui has a Client-Side Enforcement of Server-Side Security vulnerability. An attac

In Sherpa Orchestrator 141851, a low-privileged user can elevate their privileges by creating new users and roles.

The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows remote attackers to adjust Drive

A vulnerability classified as critical has been found in pihome-shc PiHome 2.0. This affects an unknown part of the file

IBM Sterling Connect:Direct Web Services 6.1.0, 6.2.0, and 6.3.0 could allow an authenticated user to spoof the identity

A vulnerability was found in xujeff tianti 天梯 up to 2.3. It has been declared as critical. This vulnerability affects un

A vulnerability was found in Xinhu RockOA up to 2.6.9. Impacted is the function publicsaveAjax of the file /index.php. P

NVIDIA ConnectX contains a vulnerability in the management interface, where an attacker with local access could cause in

A vulnerability has been found in JhumanJ OpnForm up to 1.9.3. This vulnerability affects unknown code of the file /cust

A security flaw has been discovered in PHPGurukul Small CRM 4.0. This impacts an unknown function of the file /admin/edi

Vulnerability in the Oracle Life Sciences Argus Safety product of Oracle Health Sciences Applications (component: Login)

An authorization issue was addressed with improved state management. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4

In lunary-ai/lunary before version 1.4.30, a privilege escalation vulnerability exists where admins can invite new membe

Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences). Suppo

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology). S

Device commissioning parameters in ASPECT may be modified by an external source if administrative credentials become com

Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an

Pexip Infinity 38.0 and 38.1 before 39.0 has insufficient access control in the RTMP implementation, allowing an attacke

A flaw was found in the live query subscription mechanism of the database engine. This vulnerability allows record or gu

An improper access control vulnerability exists in WSO2 Enterprise Integrator product due to insufficient permission res

A vulnerability was found in Shiprocket Module 3 on OpenCart. It has been rated as critical. Affected by this issue is s

An incorrect authorization vulnerability exists in multiple WSO2 products, allowing protected APIs to be accessed direct

A vulnerability was identified in moxi159753 Mogu Blog v2 up to 5.2. This issue affects some unknown processing of the f

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that a

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Vent

The macOS Rocket.Chat application is affected by a vulnerability that allows bypassing Transparency, Consent, and Contr

Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences). Suppo

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are

An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.6. A local

In onCreate of NotificationAccessConfirmationActivity.java, there is a possible incorrect verification of proper intent