Base de CVEs

CVE-2026-50495 Média · 5.5 CWE-284 14/07/2026

DNS Client Tampering Vulnerability

Improper access control in Microsoft Windows DNS allows an authorized attacker to perform tampering locally.

CVE-2026-50465 Alta · 7.1 CWE-284 14/07/2026

Windows DNS Client Tampering Vulnerability

Improper access control in Microsoft Windows DNS allows an authorized attacker to perform tampering locally.

CVE-2026-50423 Alta · 7.8 CWE-284 14/07/2026

Windows Kernel Elevation of Privilege Vulnerability

Improper access control in Windows Kernel allows an authorized attacker to elevate privileges locally.

CVE-2026-50418 Média · 6.1 CWE-284 14/07/2026

Windows System Secure Feature Bypass Vulnerability

Improper access control in Windows System allows an unauthorized attacker to bypass a security feature locally.

CVE-2026-50373 Alta · 7.8 CWE-284 14/07/2026

Windows Search Service Elevation of Privilege Vulnerability

Improper access control in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

CVE-2026-50335 Alta · 7.8 CWE-284 14/07/2026

Windows Operating Systems Elevation of Privilege Vulnerability

Improper access control in Windows Operating Systems allows an authorized attacker to elevate privileges locally.

CVE-2026-55014 Alta · 7.8 CWE-284 14/07/2026

Windows Remote Help Defense Elevation of Privilege Vulnerability

Improper access control in Windows Remote Help Defense allows an authorized attacker to elevate privileges locally.

CVE-2026-50351 Alta · 7.8 CWE-284 14/07/2026

Windows Audio Compression Manager (ACM) Elevation of Privilege Vulnerability

Improper access control in Windows Audio Compression Manager (ACM) allows an authorized attacker to elevate privileges locally.

CVE-2026-50342 Alta · 8.8 CWE-284 14/07/2026

Windows MIDI Service Module Elevation of Privileges Vulnerability

Improper access control in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.

CVE-2026-50325 Alta · 7.0 CWE-284 14/07/2026

Win32k Elevation of Privilege Vulnerability

Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally.

CVE-2026-50311 Alta · 7.8 CWE-284 14/07/2026

Windows Server Elevation of Privilege Vulnerability

Improper access control in Windows Server allows an authorized attacker to elevate privileges locally.

CVE-2026-50297 Alta · 7.0 CWE-284 14/07/2026

Win32k Elevation of Privilege Vulnerability

Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally.

CVE-2026-49805 Alta · 7.0 CWE-284 14/07/2026

Win32k Elevation of Privilege Vulnerability

Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally.

CVE-2026-15677 Alta · 7.3 CWE-284 14/07/2026

code-projects Online Job Portal JobSeekerInsert.php unrestricted upload

A weakness has been identified in code-projects Online Job Portal 1.0. This affects an unknown function of the file /JobSeekerInsert.php. Executing a manipulation of the argument txtFile can lead to unrestricted upload. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.

CVE-2026-57855 Alta · 8.8 CWE-284 13/07/2026

Cockpit CMS Missing Authorization in Bucket File Storage API

Cockpit CMS contains a missing authorization vulnerability in the Bucket file storage API (/system/buckets/api). The api() method in modules/System/Controller/Buckets.php executes bucket commands (ls, upload, removefiles, rename, createfolder) without performing any ACL or role check. Any authenticated user, regardless of role, can perform all bucket operations on any named bucket, including buckets intended for admin use only.

CVE-2026-51538 Crítica · 9.1 CWE-284 13/07/2026

Improper Access Control em Opener Project Opener

EIPStackGroup OpENer 2.3.0 (commit 76b95cf) suffers from an Incorrect Access Control vulnerability in its handling of encapsulation sessions. When the server processes critical encapsulation commands, it verifies whether the provided session_handle exists in the global session list, but it fails to verify whether that handle belongs to the specific TCP connection issuing the request. Because there is no strong binding between a session handle and its originating socket, any attacker on the network can use a valid session handle created by another legitimate client to bypass access controls.

CVE-2026-15539 Média · 4.7 CWE-284 13/07/2026

SourceCodester Online Book Store System Book Image Upload Feature index.php books unrestricted upload

A security vulnerability has been detected in SourceCodester Online Book Store System 1.0. Impacted is an unknown function of the file /admin/index.php?page=books of the component Book Image Upload Feature. Such manipulation leads to unrestricted upload. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.

CVE-2026-15518 Média · 4.7 CWE-284 12/07/2026

AREA 17 Twill CMS Media Library Insert FileLibraryController.php storeFile unrestricted upload

A vulnerability has been found in AREA 17 Twill CMS up to 3.6.0. The impacted element is the function FileLibraryController::storeFile of the file src/Http/Controllers/Admin/FileLibraryController.php of the component Media Library Insert Page. Such manipulation of the argument qqfilename leads to unrestricted upload. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-15488 Alta · 7.3 CWE-284 12/07/2026

hcr707305003 shiroiAdmin FileController.php upload unrestricted upload

A vulnerability was determined in hcr707305003 shiroiAdmin 1.1/1.3. Affected is the function FileController::upload of the file app/common/controller/FileController.php. Executing a manipulation of the argument File can lead to unrestricted upload. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.4 is able to address this issue. This patch is called 3ecde28ea8a20a3840dbfefd6d6863ee79a83e70. It is suggested to upgrade the affected component. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-20744 Crítica · 9.8 CWE-284 10/07/2026

Hydro-Québec Le Circuit Electrique charging station backend Improper Access Control

The charging station websocket endpoint accepts connections without proper authentication, which could lead to privilege escalation.

CVE-2026-55670 Baixa · 2.3 CWE-284 10/07/2026

ZITADEL: Cross-Tenant User Leakage via Recycled Identifiers

ZITADEL is an open source identity management platform. Prior to 4.15.1, ZITADEL's event store validation can retain the original resource owner for a deleted user identifier, causing a later user recreated with the same identifier in another organization to be provisioned under the original organization and exposed to that organization's administrator. This issue is fixed in version 4.15.2.

CVE-2026-56335 Média · 6.5 CWE-284 10/07/2026

Capgo - Channel Configuration Mutation via Write-Scoped API Keys

Capgo before 12.128.2 contains an authorization bypass vulnerability where write-scoped API keys can directly mutate protected channel configuration fields through PostgREST by exploiting a null authentication check in the immutability trigger. Attackers with write API keys can modify sensitive channel attributes such as public, allow_emulator, and security-related flags outside intended application routes.

CVE-2026-40452 Alta · 7.5 CWE-284 10/07/2026

Apache IoTDB: Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to unauthorized authenticated users

Incorrect Authorization, Improper Access Control vulnerability in Apache IoTDB. Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to unauthorized authenticated users. This issue affects Apache IoTDB: from 1.3.5 before 1.3.8, from 2.0.5 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue.

CVE-2025-45422 Alta · 8.1 CWE-284 09/07/2026

Incorrect access control in Proximus b-box v8c.725A allows authenticated attackers to…

Incorrect access control in Proximus b-box v8c.725A allows authenticated attackers to bypass normal restrictions and make arbitrary changes to port forwarding rules.

CVE-2026-58525 Alta · 8.2 CWE-284 08/07/2026

Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability

Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.