CWE-862
CVEs classified under CWE-862, newest first.
3503 CVEsRSS
CVE-2026-28582Low· 3.3In onCreate of ConfirmDeviceCredentialActivity.java, there is a possible unauthorized access to and modification of device credentials due to a missing permission check
In onCreate of ConfirmDeviceCredentialActivity.java, there is a possible unauthorized access to and modification of device credentials due to a missing permission check. This could lead to local information disclosure with no additional …
CVE-2026-28652Low· 3.1In multiple functions of RangingServiceImpl.java, there is a possible MITM due to a missing permission check
In multiple functions of RangingServiceImpl.java, there is a possible MITM due to a missing permission check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed…
CVE-2026-28623Low· 3.3In writeToParcel of BleRssiRangingCapabilities.java, there is a possible way to obtain the Bluetooth MAC address due to a missing permission check
In writeToParcel of BleRssiRangingCapabilities.java, there is a possible way to obtain the Bluetooth MAC address due to a missing permission check. This could lead to local information disclosure with no additional execution privileges n…
CVE-2026-28622Low· 3.3In getQueryBuilderInternal of MediaProvider.java, there is a possible way to retrieve location metadata due to a permissions bypass
In getQueryBuilderInternal of MediaProvider.java, there is a possible way to retrieve location metadata due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User int…
GHSA-57v5-wqx3-cgj4Medium· 5.8SiYuan: Database view structure (all view names, layout types and per-field visibility) is returned to anonymous readers by /api/av/getAt…
SiYuan: Database view structure (all view names, layout types and per-field visibility) is returned to anonymous readers by /api/av/getAttributeViewFieldViews
CVE-2026-72790Medium· 5.8SiYuan: Notebook name, document count, size and timestamps are returned for any notebook, including notebooks hidden from readers, by /ap…
SiYuan: Notebook name, document count, size and timestamps are returned for any notebook, including notebooks hidden from readers, by /api/notebook/getNotebookInfo
CVE-2026-83942High· 7.8Missing authorization in Windows Kernel allows an authorized attacker to elevate privileges locally.
Missing authorization in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-83941Critical· 9.9Missing authorization in Entra ID allows an authorized attacker to elevate privileges over a network.
Missing authorization in Entra ID allows an authorized attacker to elevate privileges over a network.
CVE-2026-81823Medium· 5.3The vulnerability, if exploited, could allow an unauthenticated miscreant to perform read operations intended only for PIMBoards users, resulting in information disclosure
The vulnerability, if exploited, could allow an unauthenticated miscreant to perform read operations intended only for PIMBoards users, resulting in information disclosure. Write operations are not impacted.
CVE-2026-73014High· 7.8Missing authorization in Data Sharing Service Client allows an authorized attacker to elevate privileges locally.
Missing authorization in Data Sharing Service Client allows an authorized attacker to elevate privileges locally.
CVE-2026-72966Medium· 5.5Missing authorization in Windows Remote Access Connection Manager allows an authorized attacker to perform tampering locally.
Missing authorization in Windows Remote Access Connection Manager allows an authorized attacker to perform tampering locally.
CVE-2026-69724High· 8.8Missing authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2026-69641Critical· 9.1Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-69553High· 7.1Missing authorization in Windows Hyper-V allows an authorized attacker to elevate privileges over a network.
Missing authorization in Windows Hyper-V allows an authorized attacker to elevate privileges over a network.
CVE-2026-69465High· 8.8Missing authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2026-69453Medium· 5.5Missing authorization in Microsoft Windows Search Component allows an authorized attacker to perform tampering locally.
Missing authorization in Microsoft Windows Search Component allows an authorized attacker to perform tampering locally.
CVE-2026-69403Medium· 5.5Missing authorization in Windows SMB Server allows an authorized attacker to disclose information locally.
Missing authorization in Windows SMB Server allows an authorized attacker to disclose information locally.
CVE-2026-69380High· 8.1Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-69377High· 7.8Missing authorization in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.
Missing authorization in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.
CVE-2026-47625High· 7.5NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could abuse missing authorization
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could abuse missing authorization. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and denial of service.
CVE-2026-86840Critical· 9.1PoCThe `vtoken-minting` and `slpx` pallets in Bifrost contain an improper authorization vulnerability in channel commission attribution
The `vtoken-minting` and `slpx` pallets in Bifrost contain an improper authorization vulnerability in channel commission attribution. A signed account can supply an arbitrary registered `channel_id` when minting tokens without verifying …
CVE-2026-86737Medium· 4.3snipe-it versions before 8.7.0 fail to enforce asset view authorization in the GET /hardware/{asset}/barcode endpoint
snipe-it versions before 8.7.0 fail to enforce asset view authorization in the GET /hardware/{asset}/barcode endpoint. Authenticated attackers can iterate asset IDs to retrieve barcodes and enumerate asset tags across tenants, including …
CVE-2026-86731Medium· 6.5Craft CMS versions 5.0.0-RC1 through 5.10.11 are missing an admin-target guard in UsersController::actionActivateUser (the users/activate-user action)
Craft CMS versions 5.0.0-RC1 through 5.10.11 are missing an admin-target guard in UsersController::actionActivateUser (the users/activate-user action). While the action requires the administrateUsers permission, it does not call requireA…
CVE-2026-86665High· 7.3PoCA vulnerability was identified in aircheng-org iWebShop-5 up to 5.15
A vulnerability was identified in aircheng-org iWebShop-5 up to 5.15. This issue affects the function Update::index of the file controllers/update.php. The manipulation leads to missing authorization. Remote exploitation of the attack is…
CVE-2026-18851High· 8.8Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacker to escalate their privileges to admin.
Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacker to escalate their privileges to admin.
CVE-2026-12647Critical· 9.9A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.
A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.
CVE-2026-12646Critical· 9.9A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.
A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.
CVE-2026-12645Critical· 9.9A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.
A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.
CVE-2026-77106High· 8.8Cvlaunchd contained a missing authorization issue affecting command execution authorization
Cvlaunchd contained a missing authorization issue affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, …
CVE-2026-9331High· 7.1The EDD Product Catalog Feed by PixelYourSite plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the wpeddpcf_delete_feed function in all vers…
The EDD Product Catalog Feed by PixelYourSite plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the wpeddpcf_delete_feed function in all vers…