CWE-863
CVEs classified under CWE-863, newest first.
1764 CVEsRSS
CVE-2026-16753High· 8.8Incorrect authorization in the library-query execution endpoint in Lowcoder version, up to and including 2.4.10, allows an authenticated administrator or developer in one organization to execute a library query belonging to another organ…
Incorrect authorization in the library-query execution endpoint in Lowcoder version, up to and including 2.4.10, allows an authenticated administrator or developer in one organization to execute a library query belonging to another organ…
CVE-2026-96918High· 7.8Improper access control in Windows NTFS allows an authorized attacker to elevate privileges locally.
Improper access control in Windows NTFS allows an authorized attacker to elevate privileges locally.
CVE-2026-92910High· 7.2Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write…
CVE-2026-92909Critical· 9.8Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation…
CVE-2026-92908High· 8.3Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and…
CVE-2026-88162Medium· 5.5Improper authorization in Windows Encrypting File System (EFS) allows an authorized attacker to perform tampering locally.
Improper authorization in Windows Encrypting File System (EFS) allows an authorized attacker to perform tampering locally.
CVE-2026-84011Medium· 5.5Incorrect authorization in Windows SMB Client allows an authorized attacker to bypass a security feature locally.
Incorrect authorization in Windows SMB Client allows an authorized attacker to bypass a security feature locally.
CVE-2026-83792High· 7.8Incorrect authorization in Windows Device Install Service allows an authorized attacker to elevate privileges locally.
Incorrect authorization in Windows Device Install Service allows an authorized attacker to elevate privileges locally.
CVE-2026-83766Medium· 4.2Incorrect authorization in Windows Hyper-V allows an authorized attacker to bypass a security feature over an adjacent network.
Incorrect authorization in Windows Hyper-V allows an authorized attacker to bypass a security feature over an adjacent network.
CVE-2026-83764Medium· 5.5Incorrect authorization in Windows Clipboard User Service allows an authorized attacker to disclose information locally.
Incorrect authorization in Windows Clipboard User Service allows an authorized attacker to disclose information locally.
CVE-2026-77910High· 8.8Incorrect authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
Incorrect authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-70299High· 8.8Improper access control in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.
Improper access control in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.
CVE-2026-70280Medium· 4.4Incorrect authorization in Windows Hello allows an authorized attacker to bypass a security feature locally.
Incorrect authorization in Windows Hello allows an authorized attacker to bypass a security feature locally.
CVE-2026-70246High· 8.8Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
CVE-2026-70229High· 8.1Incorrect authorization in Active Directory Domain Services allows an unauthorized attacker to execute code over a network.
Incorrect authorization in Active Directory Domain Services allows an unauthorized attacker to execute code over a network.
CVE-2026-70183High· 7.5Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
CVE-2026-70087Medium· 5.5Incorrect authorization in DNS Server allows an authorized attacker to bypass a security feature locally.
Incorrect authorization in DNS Server allows an authorized attacker to bypass a security feature locally.
CVE-2026-70083Medium· 5.5Incorrect authorization in DNS Server allows an authorized attacker to perform tampering locally.
Incorrect authorization in DNS Server allows an authorized attacker to perform tampering locally.
CVE-2026-70057Medium· 5.5Incorrect authorization in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to bypass a security feature locally.
Incorrect authorization in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to bypass a security feature locally.
CVE-2026-69971Medium· 5.5Incorrect authorization in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally.
Incorrect authorization in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally.
CVE-2026-69640Medium· 5.3Incorrect authorization in Windows Key Distribution Center allows an authorized attacker to bypass a security feature over a network.
Incorrect authorization in Windows Key Distribution Center allows an authorized attacker to bypass a security feature over a network.
CVE-2026-110112High· 8.1Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain admin access because OIDC iss, aud, nonce and exp claims are not validated
Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain admin access because OIDC iss, aud, nonce and exp claims are not validated. Attackers with admin rights in another tenant …
CVE-2026-105720Medium· 4.3Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
CVE-2026-102865Medium· 6.5Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
CVE-2026-102862High· 8.8Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
CVE-2026-102232High· 7.0Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-93294Medium· 6.3⚖ disputedA user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy)
A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Az…
CVE-2026-15577Medium· 6.5A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization)
A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization). On Grafana 12.4 the affected API is only available w…
CVE-2026-77459Critical· 9.9Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.10.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Argo CD creates PostDelete resource hooks without applying the AppProject destination and resource authoriz…
CVE-2026-69226Medium· 6.5A flaw in Portal for ArcGIS allows unauthenticated users to create new accounts through the sharing endpoint even when self-service account registration is disabled (disableSignup=true)
A flaw in Portal for ArcGIS allows unauthenticated users to create new accounts through the sharing endpoint even when self-service account registration is disabled (disableSignup=true). An attacker can bypass the intended restriction by…