CWE-284
CVEs classified under CWE-284, newest first.
1612 CVEsRSS
CVE-2025-46288Medium· 5.5A permissions issue was addressed with additional restrictions
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2, watchOS 26.2. An app may be able to access sensitive payment tokens.
CVE-2025-14095Medium· 6.8A "Privilege boundary violation" vulnerability is identified affecting multiple Radiometer Products
A "Privilege boundary violation" vulnerability is identified affecting multiple Radiometer Products. Exploitation of this vulnerability gives a user with physical access to the analyzer, the possibility to gain unauthorized access to fun…
CVE-2025-11901NoneAn uncontrolled resource consumption vulnerability affects certain ASUS motherboards using Intel B460, B560, B660, B760, H410, H510, H610, H470, Z590, Z690, Z790, W480, W680 series chipsets
An uncontrolled resource consumption vulnerability affects certain ASUS motherboards using Intel B460, B560, B660, B760, H410, H510, H610, H470, Z590, Z690, Z790, W480, W680 series chipsets. Exploitation requires physical access to inte…
CVE-2025-14749Medium· 6.3A vulnerability was identified in Ningyuanda TC155 57.0.2.0
A vulnerability was identified in Ningyuanda TC155 57.0.2.0. This impacts an unknown function of the file /onvif/device_service of the component ONVIF PTZ Control Interface. The manipulation leads to improper access controls. The attack …
CVE-2025-14748Medium· 5.4A vulnerability was determined in Ningyuanda TC155 57.0.2.0
A vulnerability was determined in Ningyuanda TC155 57.0.2.0. This affects an unknown function of the file /onvif/device_service of the component ONVIF Device Management Service. Executing manipulation of the argument FactoryDefault with …
CVE-2025-67715Medium· 4.3Weblate is a web based localization tool
Weblate is a web based localization tool. In versions prior to 5.15, it was possible to retrieve user notification settings or list all users via API. Version 5.15 fixes the issue.
CVE-2025-55895Critical· 9.1TOTOLINK A3300R V17.0.0cu.557_B20221024 and N200RE V9.3.5u.6448_B20240521 and V9.3.5u.6437_B20230519 are vulnerable to Incorrect Access Control
TOTOLINK A3300R V17.0.0cu.557_B20221024 and N200RE V9.3.5u.6448_B20240521 and V9.3.5u.6437_B20230519 are vulnerable to Incorrect Access Control. Attackers can send payloads to the interface without logging in (remote).
CVE-2025-65176High· 7.5An issue was discovered in Dynatrace OneAgent before 1.325.47
An issue was discovered in Dynatrace OneAgent before 1.325.47. When attempting to access a remote network share from a machine where OneAgent is installed and receiving a "STATUS_LOGON_FAILURE" error, the agent will retrieve every user t…
CVE-2025-65780High· 8.8An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16
An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Authenticated users can update their entire user document (beyond profile fields), including orgs/teams and loginDisabled, due to m…
CVE-2025-65779High· 7.5An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16
An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Unauthenticated attackers can update a board's "sort" value (Boards.allow returns true without verifying userId), allowing arbitrar…
CVE-2025-14642Medium· 4.7A vulnerability has been found in code-projects Computer Laboratory System 1.0
A vulnerability has been found in code-projects Computer Laboratory System 1.0. Impacted is an unknown function of the file technical_staff_pic.php. Such manipulation of the argument image leads to unrestricted upload. The attack may be …
CVE-2025-14641Medium· 4.7A flaw has been found in code-projects Computer Laboratory System 1.0
A flaw has been found in code-projects Computer Laboratory System 1.0. This issue affects some unknown processing of the file admin/admin_pic.php. This manipulation of the argument image causes unrestricted upload. The attack may be init…
CVE-2025-14660Medium· 5.6A flaw has been found in DecoCMS Mesh up to 1.0.0-alpha.31
A flaw has been found in DecoCMS Mesh up to 1.0.0-alpha.31. Affected by this vulnerability is the function createTool of the file packages/sdk/src/mcp/teams/api.ts of the component Workspace Domain Handler. This manipulation of the argum…
CVE-2025-66430Critical· 9.1Plesk 18.0 has Incorrect Access Control.
Plesk 18.0 has Incorrect Access Control.
CVE-2025-14583High· 7.3A flaw has been found in campcodes Online Student Enrollment System 1.0
A flaw has been found in campcodes Online Student Enrollment System 1.0. This impacts an unknown function of the file /admin/register.php. Executing a manipulation of the argument photo can lead to unrestricted upload. The attack can be …
CVE-2025-14582Medium· 4.7A vulnerability was detected in campcodes Online Student Enrollment System 1.0
A vulnerability was detected in campcodes Online Student Enrollment System 1.0. This affects an unknown function of the file /admin/index.php?page=user-profile. Performing a manipulation of the argument userphoto results in unrestricted …
CVE-2025-43518Low· 3.3A logic issue was addressed with improved checks
A logic issue was addressed with improved checks. This issue is fixed in iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2, watchOS 26.2. An app may be able to inappropriately access files through the …
CVE-2025-43513Medium· 5.5A permissions issue was addressed by removing the vulnerable code
A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2. An app may be able to read sensitive location information.
CVE-2025-43416Medium· 5.5A logic issue was addressed with improved restrictions
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2. An app may be able to access protected user data.
CVE-2025-43404Low· 3.3A permissions issue was addressed with additional sandbox restrictions
A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Tahoe 26.1. An app may be able to access sensitive user data.
CVE-2025-43393Medium· 5.2A permissions issue was addressed with additional sandbox restrictions
A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Tahoe 26.1. An app may be able to break out of its sandbox.
CVE-2025-43351Medium· 5.5A permissions issue was addressed with additional restrictions
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.1. An app may be able to access protected user data.
CVE-2025-64669High· 7.8Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges locally.
Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges locally.
CVE-2025-14530Medium· 4.7A vulnerability has been found in SourceCodester Real Estate Property Listing App 1.0
A vulnerability has been found in SourceCodester Real Estate Property Listing App 1.0. The impacted element is an unknown function of the file /admin/property.php. Such manipulation of the argument image leads to unrestricted upload. It …
CVE-2025-14528Medium· 5.3PoCA vulnerability was detected in D-Link DIR-803 up to 1.04
A vulnerability was detected in D-Link DIR-803 up to 1.04. Impacted is an unknown function of the file /getcfg.php of the component Configuration Handler. The manipulation of the argument AUTHORIZED_GROUP results in information disclosur…
CVE-2025-14522Medium· 6.3A vulnerability was detected in baowzh hfly up to 638ff9abe9078bc977c132b37acbe1900b63491c
A vulnerability was detected in baowzh hfly up to 638ff9abe9078bc977c132b37acbe1900b63491c. The impacted element is an unknown function of the file /Public/Kindeditor/php/upload_json.php. Performing manipulation of the argument imgFile r…
CVE-2025-14082Low· 2.7A flaw was found in Keycloak Admin REST (Representational State Transfer) API
A flaw was found in Keycloak Admin REST (Representational State Transfer) API. This vulnerability allows information disclosure of sensitive role metadata via insufficient authorization checks on the /admin/realms/{realm}/roles endpoint.
CVE-2025-67510Critical· 9.4Neuron is a PHP framework for creating and orchestrating AI Agents
Neuron is a PHP framework for creating and orchestrating AI Agents. In versions 2.8.11 and below, the MySQLWriteTool executes arbitrary SQL provided by the caller using PDO::prepare() + execute() without semantic restrictions. This is co…
CVE-2025-64897Medium· 5.6ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Access Control vulnerability
ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Access Control vulnerability. A low privileged attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized writ…
CVE-2025-62570High· 7.1Improper access control in Windows Camera Frame Server Monitor allows an authorized attacker to disclose information locally.
Improper access control in Windows Camera Frame Server Monitor allows an authorized attacker to disclose information locally.