ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Adobe ColdFusion 2025 contains an Incorrect Authorization vulnerability (CWE-863) that allows a low-privileged attacker to bypass security controls and gain unauthorized write access without user interaction. This vulnerability affects versions up to and including 2025.0.13 and 2023.0.25. The vulnerability changes the security scope and has a critical severity with a CVSS score of 9.6.
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Adobe ColdFusion 2025 contains an Incorrect Authorization vulnerability (CWE-863) that allows an attacker with high privileges to execute arbitrary code without user interaction. The vulnerable component is by default restricted to an administrative network zone. This vulnerability changes the security scope and can lead to full compromise of the affected system.
Adobe ColdFusion 2025 contains an Incorrect Authorization vulnerability (CWE-863) that may allow an attacker to disclose sensitive memory information without requiring user interaction. This vulnerability affects versions up to 2025.0.13 and 2023.0.25. The issue has a high severity with a CVSS score of 7.5, indicating a significant confidentiality impact but no integrity or availability impact.
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-95695 is a high-severity vulnerability in IBM WebSphere Application Server - Liberty versions 20.0.0.12 through 26.0.0.10. It involves incorrect authorization that could allow a remote attacker to bypass security restrictions without authentication. The vulnerability impacts confidentiality and integrity but does not affect availability. No known exploits are reported in the wild. No patch or remediation details are provided in the available data.
IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.9 are affected by a privilege escalation vulnerability when the restConnector-2.0 feature is enabled. This vulnerability involves incorrect authorization, potentially allowing users with limited privileges to escalate their access rights. The CVSS v3.1 base score is 5.4, indicating a medium severity issue.
CVE-2026-90532 is an Incorrect Authorization vulnerability in Adobe Experience Manager as a Cloud Service. It allows an attacker to execute arbitrary code with the privileges of the current user without requiring user interaction. The vulnerability impacts confidentiality, integrity, and availability, with a critical severity rating and a CVSS score of 10.0. Affected versions include those up to 2026.9.28187 and version 6.5.25. No explicit patch or remediation information is provided. The vulnerability changes the security scope, potentially allowing elevated access or control over victim accounts or sessions.
Adobe Experience Manager 6.5 LTS suffers from an Incorrect Authorization vulnerability (CWE-863) that allows arbitrary code execution with elevated privileges in the context of the current user. Exploitation does not require user interaction and changes the security scope, potentially compromising the victim's account or session.
CVE-2026-48383 is a critical Incorrect Authorization vulnerability in Adobe Experience Manager as a Cloud Service. It allows an attacker to execute arbitrary code in the context of the current user without requiring user interaction. The vulnerability can lead to elevated access or control over the victim's account or session, with a changed scope indicating potential broader impact.
CVE-2026-48382 is an incorrect authorization vulnerability in Adobe Experience Manager as a Cloud Service. This flaw allows an attacker to execute arbitrary code with the privileges of the current user without requiring any user interaction. The vulnerability has a critical severity with a CVSS score of 10. Exploitation can lead to full compromise of the victim's account or session. No patch or official remediation information is provided in the available data.
CVE-2026-16753 is an incorrect authorization vulnerability in Lowcoder versions 2.1.0 through 2.4.10. It allows an authenticated administrator or developer from one organization to execute library queries belonging to another organization by crafting a request with the victim's library-query identifier. This flaw affects the library-query execution endpoint and can lead to unauthorized access and execution of queries across organizational boundaries.
CVE-2026-96918 is a high-severity vulnerability in Microsoft Windows 10 Version 1607 involving improper access control in the NTFS file system. It allows an authorized local attacker to elevate privileges. The flaw affects multiple Windows 10 builds prior to specific fixed versions. An official fix is available from Microsoft.
CVE-2026-70246 is a high-severity vulnerability in Microsoft SharePoint Server Subscription Edition that involves incorrect authorization. This flaw allows an authorized attacker to elevate their privileges over a network. The issue affects versions from 16.0.0 up to but not including 16.0.20326.20190. Microsoft has released an official fix in version 16.0.20326.20190 to address this vulnerability.
CVE-2026-77910 is an incorrect authorization vulnerability in Microsoft Exchange Server 2016 Cumulative Update 23 that allows an authorized attacker to elevate privileges over a network. The vulnerability affects multiple versions prior to specific fixed releases. A high-severity CVSS 3.1 score of 8.8 reflects the potential for complete confidentiality, integrity, and availability impact. An official fix is available from Microsoft.
CVE-2026-70229 is a high-severity vulnerability in Microsoft Windows 10 Version 1607 involving incorrect authorization in Active Directory Domain Services. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability affects multiple Windows 10 builds prior to specific fixed versions. An official fix is available from Microsoft.
CVE-2026-83792 is a high-severity vulnerability in Microsoft Windows 10 Version 21H2 involving incorrect authorization in the Windows Device Install Service. This flaw allows an authorized local attacker to elevate privileges, potentially gaining higher system rights. The issue affects multiple Windows 10 builds prior to specific fixed versions. Microsoft has released official patches to address this vulnerability.