Advisories · Weakness

Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2026-71385 CVE record

CVSS 8.4 High

ColdFusion | Incorrect Authorization (CWE-863)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-106623 CVE record

CVSS 7.5 High

ColdFusion | Incorrect Authorization (CWE-863)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-106617 CVE record

CVSS 8.8 High

ColdFusion | Incorrect Authorization (CWE-863)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-93895 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

IBM WebSphere Application Server Liberty Improper Access Control
- IBM WebSphere Application Server - Liberty
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-95695 CVE record

CVSS 7.4 High

IBM WebSphere Application Server Liberty Incorrect Authorization
- IBM WebSphere Application Server - Liberty
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-105443 CVE record

CVSS 8.2 High

IBM WebSphere Application Server Liberty is affected by an improper access control
- IBM WebSphere Application Server - Liberty
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-11713 CVE record

CVSS 5.4 Medium

IBM WebSphere Application Server Liberty Incorrect Authorization
- IBM WebSphere Application Server - Liberty
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-78632 CVE record

CVSS 5.3 Medium

Insecure Default File Permissions in Okta RADIUS Agent Windows Installer
- Okta RADIUS Agent
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-63172 CVE record

CVSS 7.1 High

Omnispace Agora Project < 26.10.0 Broken Function-Level Authorization via User-Edit
- Omnispace Agora Project
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-63174 CVE record

CVSS 8.6 High

Omnispace Agora Project < 26.10.0 Broken Access Control via spaceAffectList
- Omnispace Agora Project
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-63153 CVE record

CVSS 8.6 High

Omnispace Agora Project < 26.10.0 Broken Access Control via setAffectations()
- Omnispace Agora Project
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-63163 CVE record

CVSS 8.7 High

Omnispace Agora Project < 26.10.0 Broken Access Control via MobileFileDownload
- Omnispace Agora Project
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-90532 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Adobe Experience Manager | Incorrect Authorization (CWE-863)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-75732 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

Adobe Experience Manager | Incorrect Authorization (CWE-863)
- Adobe Experience Manager 6.5 LTS
- Adobe Experience Manager 6.5
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-48383 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Adobe Experience Manager | Incorrect Authorization (CWE-863)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-48382 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Adobe Experience Manager | Incorrect Authorization (CWE-863)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-16753 CVE record

CVSS 8.8 High

CVE-2026-16753
- Lowcoder
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-104875 CVE record

CVSS 7.1 High

Ente: Accepted emergency contact can bypass the recovery notice period
- ente
- ghcr.io/ente/server
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-110112 CVE record

CVSS 9.2 CriticalCritical · CVSS 9+

Dockhand before 1.0.50 OIDC Privilege Escalation via Missing Token Claim Validation
- Finsys dockhand
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-105009 CVE record

CVSS 7.5 High

Windows Server Update Service Elevation of Privilege Vulnerability
- Microsoft Windows Server 2012
- Microsoft Windows Server 2012 (Server Core installation)
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-103560 CVE record

CVSS 5.5 Medium

Role: DNS Server Tampering Vulnerability
- Microsoft Windows Server 2012
- Microsoft Windows Server 2012 (Server Core installation)
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-100217 CVE record

CVSS 7.8 High

Windows Group Policy Elevation of Privilege Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-97792 CVE record

CVSS 7.8 High

Windows Container Isolation FS Filter Driver (unionfs.sys) Elevation of Privilege Vulnerability
- Microsoft Windows 11 version 23H2
- Microsoft Windows 11 Version 24H2
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-96926 CVE record

CVSS 5.5 Medium

Role: DNS Server Tampering Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-96918 CVE record

CVSS 7.8 High

Windows NTFS Elevation of Privilege Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-70246 CVE record

CVSS 8.8 High

Microsoft Office SharePoint Elevation of Privilege Vulnerability
- Microsoft SharePoint Server Subscription Edition
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-70217 CVE record

CVSS 4.9 Medium

Microsoft Office SharePoint Information Disclosure Vulnerability
- Microsoft SharePoint Server Subscription Edition
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-85873 CVE record

CVSS 6.5 Medium

Skype for Business Elevation of Privilege Vulnerability
- Microsoft Skype for Business Server 2015 CU13
- Microsoft Skype for Business Server 2019 CU8
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-77910 CVE record

CVSS 8.8 High

Microsoft Exchange Server Elevation of Privilege Vulnerability
- Microsoft Exchange Server 2016 Cumulative Update 23
- Microsoft Exchange Server 2019 Cumulative Update 14
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-70229 CVE record

CVSS 8.1 High

Windows Active Directory Domain Services Remote Code Execution Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-88135 CVE record

CVSS 7.8 High

WebDAV Elevation of Privilege Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-83792 CVE record

CVSS 7.8 High

Windows Device Install Service Elevation of Privilege Vulnerability
- Microsoft Windows 10 Version 21H2
- Microsoft Windows 10 Version 22H2
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-83766 CVE record

CVSS 4.2 Medium

Windows Hyper-V Security Feature Bypass Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-83764 CVE record

CVSS 5.5 Medium

Windows Clipboard User Service Information Disclosure Vulnerability
- Microsoft Windows 10 Version 1809
- Microsoft Windows 10 Version 21H2
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-83568 CVE record

CVSS 7.8 High

Windows Kernel-Mode Drivers Elevation of Privilege Vulnerability
- Microsoft Windows 11 Version 24H2
- Microsoft Windows 11 Version 25H2
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-69640 CVE record

CVSS 5.3 Medium

Windows Key Distribution Center Security Feature Bypass Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-96855 CVE record

CVSS 5.5 Medium

Windows Modern Device Management (MDM) Tampering Vulnerability
- Microsoft Windows 10 Version 1809
- Microsoft Windows 10 Version 21H2
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-96316 CVE record

CVSS 5.5 Medium

Windows Routing and Remote Access Service (RRAS) Tampering Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-96315 CVE record

CVSS 5.5 Medium

Windows Overlay Filter Tampering Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-96311 CVE record

CVSS 5.5 Medium

Windows Network List Service Tampering Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-88198 CVE record

CVSS 8.8 High

Microsoft Office SharePoint Elevation of Privilege Vulnerability
- Microsoft SharePoint Server Subscription Edition
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-87714 CVE record

CVSS 6.5 Medium

WebDAV Security Feature Bypass Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-85938 CVE record

CVSS 5.5 Medium

Windows Broadcast DVR User Service Information Disclosure Vulnerability
- Microsoft Windows 10 Version 1809
- Microsoft Windows 10 Version 21H2
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-70185 CVE record

CVSS 8.8 High

Microsoft PowerShell Security Feature Bypass Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-88162 CVE record

CVSS 5.5 Medium

Windows Encrypting File System (EFS) Tampering Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-84011 CVE record

CVSS 5.5 Medium

Windows SMB Client Security Feature Bypass Vulnerability
- Microsoft Windows 11 version 23H2
- Microsoft Windows 11 Version 24H2
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-70299 CVE record

CVSS 8.8 High

Windows Bind Filter Driver Elevation of Privilege Vulnerability
- Microsoft Windows 11 version 23H2
- Microsoft Windows Server 2025
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-83658 CVE record

CVSS 5.5 Medium

Windows Error Reporting Information Disclosure Vulnerability
- Microsoft Windows 10 Version 1809
- Microsoft Windows 10 Version 21H2
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-83583 CVE record

CVSS 7.8 High

Windows Geotag Broker Elevation of Privilege Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-70280 CVE record

CVSS 4.4 Medium

Windows Hello Security Feature Bypass Vulnerability
- Microsoft Windows 10 Version 21H2
- Microsoft Windows 10 Version 22H2
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-70218 CVE record

CVSS 7.8 High

Windows StateRepository API Elevation of Privilege Vulnerability
- Microsoft Windows 11 Version 24H2
- Microsoft Windows 11 Version 25H2
- Broken access control
- CWE-1220
Not analysed yet 13 Oct 2026
CVE-2026-70087 CVE record

CVSS 5.5 Medium

Role: DNS Server Security Feature Bypass Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-70083 CVE record

CVSS 5.5 Medium

Role: DNS Server Tampering Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-70085 CVE record

CVSS 5.5 Medium

Role: DNS Server Tampering Vulnerability
- Microsoft Windows Server 2012
- Microsoft Windows Server 2012 (Server Core installation)
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-70057 CVE record

CVSS 5.5 Medium

Windows Routing and Remote Access Service (RRAS) Security Feature Bypass Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-69971 CVE record

CVSS 5.5 Medium

Windows Kernel-Mode Drivers Information Disclosure Vulnerability
- Microsoft Windows 11 Version 24H2
- Microsoft Windows 11 Version 25H2
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-69945 CVE record

CVSS 8.8 High

Windows AppX Deployment Extensions Elevation of Privilege Vulnerability
- Microsoft Windows 10 Version 21H2
- Microsoft Windows 10 Version 22H2
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-69905 CVE record

CVSS 5.5 Medium

Windows AppX Deployment Service Tampering Vulnerability
- Microsoft Windows 10 Version 1809
- Microsoft Windows 10 Version 21H2
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-70235 CVE record

CVSS 5.5 Medium

Windows Event Tracing Spoofing Vulnerability
- Microsoft Windows 11 Version 24H2
- Microsoft Windows 11 Version 25H2
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-97800 CVE record

CVSS 7.8 High

Windows Mobile Broadband Elevation of Privilege Vulnerability
- Microsoft Windows 11 Version 24H2
- Microsoft Windows 11 Version 25H2
- Broken access control
Not analysed yet 13 Oct 2026