CWE-284 Improper Access Control
pillarThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
01
child weaknesses
More specific entries beneath this one.
02
vulnerabilities (10751)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-76407US | — | — | ||
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software ha… | ||||
| CVE-2026-76299US | — | — | ||
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software ha… | ||||
| CVE-2026-76291US | high8.8 | — | ||
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the schedule_search capability could bypass the expected safeguards in the sc… | ||||
| CVE-2026-114262US | high7.3 | — | ||
A vulnerability was determined in file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df. Impacted is the function store of the file app/Http/Controllers/FileController.ph… | ||||
| CVE-2026-76478US | high8.8 | — | ||
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unifie… | ||||
| CVE-2026-114259US | high7.3 | — | ||
A flaw has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the function save_files of the file admin_class.php. Exec… | ||||
| CVE-2026-101138US | — | — | ||
The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.21 does not correctly apply maintenance mode to pages added to its page whitelist by manually entered URL pattern, a… | ||||
| CVE-2026-15261US | — | — | ||
The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not enforce the same owner-only access control on its REST API that it applies on the front-end, allowing unauthenti… | ||||
| CVE-2026-114054US | medium6.5 | — | ||
vLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shared cache keys by supplying caller-controlled values such as EXIF Image… | ||||
| CVE-2026-113706US | low3.5 | — | ||
A vulnerability was identified in a2aproject a2a-rs up to 0.4.3. Impacted is an unknown function of the file a2a-server/src/task_store/inmemory.rs. The manipulation of the argument… | ||||
| CVE-2026-91390US | medium5.4 | — | ||
Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability al… | ||||
| CVE-2026-91389US | medium5.4 | — | ||
Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability al… | ||||
| CVE-2026-91388US | medium4.7 | — | ||
Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability… | ||||
| CVE-2026-91387US | medium5.4 | — | ||
Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability al… | ||||
| CVE-2026-91386US | medium6.8 | — | ||
Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security). Supported versions that are affected are 9.2.0.0… | ||||
| CVE-2026-91383US | medium6.6 | — | ||
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC). Supported versions that are affected are 9.2.0.0-9.2.… | ||||
| CVE-2026-91382US | medium6.5 | — | ||
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are… | ||||
| CVE-2026-91381US | low3.7 | — | ||
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u503 an… | ||||
| CVE-2026-91380US | medium4.0 | — | ||
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Utility). Supported versions that are affected… | ||||
| CVE-2026-91378US | medium6.1 | — | ||
Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open Integration). Supported versions that are affected are 25.12-26.9. Easily exploitable vul… | ||||
03
attack patterns (17)
CAPEC attack patterns that exploit this.
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan