CWE-284
8,872 CVEs • Abstraction: Pillar
Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVEs (8,872)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
1Microsoft 16Windows 10 1507 Windows 10 1607Windows 10 1809+13 moreJun 17, 2026 Oct 14, 2025 N/A· v4 7.8 HIGH· v3 N/A· v2 Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally. |
1Microsoft 16Windows 10 1507 Windows 10 1607Windows 10 1809+13 moreJun 17, 2026 Oct 14, 2025 N/A· v4 7.8 HIGH· v3 N/A· v2 Improper access control in Network Connection Status Indicator (NCSI) allows an authorized attacker to elevate privileges locally. |
1Microsoft 11Windows 10 1809 Windows 10 21h2Windows 10 22h2+8 moreJun 17, 2026 Oct 14, 2025 N/A· v4 7.8 HIGH· v3 N/A· v2 Improper access control in Software Protection Platform (SPP) allows an authorized attacker to elevate privileges locally. |
1Microsoft 16Windows 10 1507 Windows 10 1607Windows 10 1809+13 moreJun 17, 2026 Oct 14, 2025 N/A· v4 7.5 HIGH· v3 N/A· v2 Improper access control in Windows SMB Server allows an authorized attacker to elevate privileges over a network. |
1Microsoft 1Azure Connected Machine Agent Oct 8, 2026 Oct 14, 2025 N/A· v4 7.8 HIGH· v3 N/A· v2 Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally. |
1Microsoft 16Windows 10 1507 Windows 10 1607Windows 10 1809+13 moreJun 17, 2026 Oct 14, 2025 N/A· v4 7.8 HIGH· v3 N/A· v2 Improper access control in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
1Microsoft 3Windows 11 24h2 Windows 11 25h2Windows Server 2025Oct 18, 2026 Oct 14, 2025 N/A· v4 7.8 HIGH· v3 N/A· v2 Improper access control in Windows Error Reporting allows an authorized attacker to elevate privileges locally. |
1Microsoft 3Visual Studio 2017 Visual Studio 2019Visual Studio 2022Jun 17, 2026 Oct 14, 2025 N/A· v4 7.3 HIGH· v3 N/A· v2 Improper access control in Visual Studio allows an authorized attacker to elevate privileges locally. |
An incorrect OIDC authentication flow in Claroty Secure Access 3.3.0 through 4.0.2 can result in unauthorized user creation or impersonation of existing OIDC users. |
1Microsoft 1Azure Connected Machine Agent Oct 8, 2026 Oct 14, 2025 N/A· v4 7.0 HIGH· v3 N/A· v2 Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally. |
An arbitrary file download vulnerability exists in the web-based management interface of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an Authenticated malicious...Show more |
Arbitrary file download vulnerabilities exist in the CLI binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to download arb...Show more |
Arbitrary file download vulnerabilities exist in the CLI binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to download arb...Show more |
Arbitrary file download vulnerabilities exist in the CLI binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to download arb...Show more |
Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility Conductor. Successful exploitation of these vulnerabilities could allow an authenticated remote m...Show more |
Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility Conductor. Successful exploitation of these vulnerabilities could allow an authenticated remote m...Show more |
Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility Conductor. Successful exploitation of these vulnerabilities could allow an authenticated remote m...Show more |
1Microsoft 17Powershell Windows 10 1507Windows 10 1607+14 moreJun 17, 2026 Oct 14, 2025 N/A· v4 7.3 HIGH· v3 N/A· v2 Improper access control in Microsoft PowerShell allows an authorized attacker to elevate privileges locally. |
Improper access control within AMD SEV-SNP could allow an admin privileged attacker to write to the RMP during SNP initialization, potentially resulting in a loss of SEV-SNP guest memory integrity. |
Links in a sandboxed iframe could open an external app on Android without the required "allow-" permission. This vulnerability was fixed in Firefox 144 and Thunderbird 144. |