Advisories · Weakness
CWE-286.
Every Advisory and CVE whose sources give the weakness CWE-286, newest first.
- CVSS 8.1 High
Bosch BSH ELP (Electronic Platform) Modules: The SSH service on BSH ELP (Electronic Platform) modules contains a platform-specific…
- Bosch BSH ELP (Electronic Platform) Modules
- CWE-286
- CVSS 7.1 High
Weintek cMT3092X Incorrect User Management
- Weintek cMT3092X firmware
- Weintek EasyWeb
- CWE-286
- CVSS 8.7 High
OpenClaw's Trusted-proxy Control UI sessions retain privileged scopes without device identity on device-less allow paths
- CWE-286
<2026.3.22 · fixed in 2026.3.22
GHSA-48vw-m3qc-wr99 · CVE-2026-35638 - CVSS 1.0 Low
Weblate has improper validation upon invitation acceptance
- CWE-286
<5.15 · fixed in 5.15
GHSA-m6hq-f4w9-qrjj · CVE-2025-64725 - CVSS 6.5 Medium
Summer Pearl Group Vacation Rental Management Platform prior to v1.0.2 does not properly invalidate active user sessions after a password change.
- CWE-286
- CVSS 8.1 High
phpMyFAQ duplicate email registration allows multiple accounts with the same email
- Broken access control
- CWE-286
>=4.0.7, <4.0.13 · fixed in 4.0.13
GHSA-9wj2-4hcm-r74j · CVE-2025-59943 - CVSS 8.4 High
Rockwell Automation FactoryTalk® Linx Network Browser Security Bypass Vulnerability
- Rockwell Automation FactoryTalk® Linx
- CWE-286
- CVSS 9.5 CriticalCritical · CVSS 9+
Authenticated Escalation to guest to root
- ABB ASPECT-Enterprise
- ABB NEXUS Series
- CWE-286
- CVSS 5.6 Medium
Fortinet FortiWeb: An Incorrect User Management vulnerability [CWE-286] in FortiWeb version 7.6.2 and below…
- Fortinet FortiWeb
- CWE-286
- CVSS 7.3 High
Trend Micro, Inc. Trend Micro Apex One: A vulnerability in the Trend Micro Apex One Security Agent Plug-in User Interface Manager…
- Trend Micro, Inc. Trend Micro Apex One
- Trend Micro, Inc. Trend Micro Apex One as a Service
- CWE-286
- CVSS 4.9 Medium
Zoom Workplace Apps - Incorrect User Management
- Zoom Communications, Inc Zoom Workplace Apps
- CWE-286
- CVSS 4.4 Medium
Incorrect User Management in GitLab
- GitLab
- CWE-286
- CVSS 4.2 Medium
Incorrect User Management in GitLab
- GitLab
- CWE-286
- CVSS 4.3 Medium
IBM Concert Software improper access controls
- IBM Concert Software
- CWE-286
- CVSS 7.5 High
Authd allows attacker-controlled usernames to yield controllable UIDs in github.com/ubuntu/authd
- CWE-286
<0.3.6 · fixed in 0.3.6
GHSA-4gfw-wf7c-w6g2 · CVE-2024-9312 - CVSS 9.8 CriticalCritical · CVSS 9+
An issue discovered in CS-Cart MultiVendor 4.16.1 allows attackers to alter arbitrary user account profiles via crafted post request.
- CWE-286
- CVSS 8.0 High
A user/password reuse vulnerability exists in the FOXMAN-UN/UNEM application and server management.
- Hitachi Energy FOXMAN-UN
- Hitachi Energy UNEM
- CWE-286
- CVSS 6.8 Medium
IBM QRadar SIEM information disclosure
- IBM QRadar SIEM
- CWE-286
- CVSS 7.5 High
Improper verification of a user input in Open Source MANO v7-v12 allows an authenticated attacker to execute arbitrary code within the LCM module container via a Virtual Network Function (VNF) descri…
- Command injection
- CWE-286
- CVSS 5.3 Medium
Portainer CE allows username enumeration through authentication response timing
- CWE-286
<0.6.1-0.20240417040827-48bc7d0d92f0 · fixed in 0.6.1-0.20240417040827-48bc7d0d92f0
GHSA-87x6-8m9v-g8c2 · CVE-2024-29296 -
ScaleFusion 10.5.2 does not properly limit users to the Edge application because file downloads can occur.
- CWE-286
- CVSS 4.9 Medium
Improper User Management in GitLab
- GitLab
- CWE-286
- CVSS 5.4 Medium
Incorrect User Management in GitLab
- GitLab
- CWE-286
- CVSS 5.4 Medium
Incorrect User Management in GitLab
- GitLab
- CWE-286
- CVSS 7.1 High
Cisco SD-WAN vManage: A vulnerability in the command line interface (cli) management interface of Cisco SD-WAN…
- Cisco SD-WAN vManage
- CWE-286
- CVSS 7.8 High
NVIDIA ConnectX Host Firmware for the BlueField Data Processing Unit contains a vulnerability where a restricted host may cause an incorrect user management error.
- NVIDIA BlueField 1
- NVIDIA BlueField 2 LTS
- CWE-286
- CVSS 8.2 High
Incorrect User Management in GitLab
- GitLab
- CWE-286
- CVSS 5.9 Medium
Unintentional change of settings during initial registration of system administrators which uses control protocols.
- Canon Inc. Canon Office/Small Office Multifunction Printers and Laser Printers
- CWE-286
- CVSS 6.0 Medium
Fortinet FortiManager: An incorrect user management vulnerability [CWE-286] in the FortiManager version 6.4.6…
- Fortinet FortiManager
- CWE-286
- CVSS 6.5 Medium
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1).
- Siemens SINEMA Remote Connect Server
- CWE-286
- CVSS 5.9 Medium
Philips MRI 1.5T and 3T Improper Access Control
- Philips MRI 1.5T
- Philips MRI 3T
- CWE-286
- CVSS 7.3 High
Dell PowerScale OneFS: Dell PowerScale OneFS versions 8.1.0-9.1.0 contain an Incorrect User Management…
- Dell PowerScale OneFS
- CWE-286