CWE-285

1,461 vulnerabilities with CWE-285

CVE-2026-5246 MEDIUM

Cesanta Mongoose P-384 Public Key mongoose.c mg_tls_verify_cert_signature authorization

CVSS 5.6

CVE-2026-34222 HIGH

Open WebUI has Broken Access Control in Tool Valves

CVSS 7.7

CVE-2026-5283 MEDIUM

Google Chrome <146.0.7680.178 - Info Disclosure

CVSS 6.5

CVE-2026-34738 MEDIUM

AVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus Request Parameter

CVSS 4.3

CVE-2026-34784 HIGH

Parse Server: Streaming file download bypasses afterFind file trigger authorization

CVSS 7.5

CVE-2026-33074 MEDIUM

Discourse Subscriptions Plugin - Higher-Tier Subscription Privilege Escalation

CVSS 5.3

CVE-2026-32619 MEDIUM

Discourse: Insufficient topic visibility check allows unauthorized poll manipulation in private categories

CVSS 4.3

CVE-2026-32615 MEDIUM

Discourse: Category group moderators can perform actions on topics in restricted categories without read access

CVSS 5.4

CVE-2026-4818 MEDIUM

Search Guard FLX 3.0.0-4.0.1 - Unauthorized Data Stream Management

CVSS 6.8

CVE-2026-1710 MEDIUM

WooPayments <= 10.5.1 - Missing Authorization to Unauthenticated Plugin Settings Update via save_upe_appearance_ajax

CVSS 6.5

CVE-2026-32716 HIGH

SciTokens: Authorization Bypass via Incorrect Scope Path Prefix Checking

CVSS 8.1

CVE-2026-30878 MEDIUM

baserCMS: Mail Form Acceptance Bypass via Public API

CVSS 5.3

CVE-2026-4248 HIGH

Ultimate Member <= 2.11.2 - Authenticated (Contributor+) Sensitive Information Exposure to Account Takeover via Shortcode Template Tag

CVSS 8.0

CVE-2026-4990 HIGH

chatwoot Signup Endpoint login improper authorization

CVSS 7.3

CVE-2026-33954 MEDIUM

LinkAce discloses private notesto unauthorized authenticated users via the web link detail page

CVSS 6.5

CVE-2026-4958 LOW

OpenBMB XAgent WebSocket Endpoint replayer.py ReplayServer.send_data authorization

CVSS 3.1

CVE-2026-33735 HIGH

MyTube <1.8.69 Database Import - Application Takeover

CVSS 8.8

CVE-2026-21724 MEDIUM

Missing Protected-field Authorization in Provisioning Contact Points API

CVSS 5.4

CVE-2026-34056 HIGH

OpenEMR <=8.0.0.3 Ensora eRx Logs - Privilege Escalation

CVSS 7.7

CVE-2026-34051 MEDIUM

OpenEMR has Improper ACL On Import/Export Popup

CVSS 5.4

CVE-2026-33222 MEDIUM

NATS JetStream Management API - Authorization Bypass

CVSS 4.9

CVE-2026-28881 MEDIUM

Apple macOS <26.4 - Info Disclosure

CVSS 5.5

CVE-2026-28865 HIGH

iOS and iPadOS < 18.7.7 - Authentication Bypass via Improved State Management

CVSS 7.5

CVE-2026-28845 MEDIUM

macOS < 26.4 - Unprotected User Data Exposure via Authorization Issue

CVSS 5.5

CVE-2026-28839 MEDIUM

macOS < 14.8.5, < 15.7.5, < 26.4 - Unprotected User Data Exposure via Improper Authorization

CVSS 5.3