CWE-284: Improper Access Control vulnerabilities

CVE-2026-56657 is a denial of service vulnerability in the SSH key parser component of Gitea Open Source Git Server. It allows an unauthenticated attacker with local access to cause a denial of service condition. The vulnerability affects Gitea versions up to and including 1.26.4. The issue is classified under CWE-284, indicating an authorization bypass or improper access control. The CVSS v3.1 base score is 6.2, reflecting a medium severity impact focused on availability disruption.

CVE-2026-56654 is a critical privilege escalation vulnerability in Gitea Open Source Git Server. It involves access token scope escalation via the API, allowing unauthorized privilege gain. The vulnerability affects all Gitea versions from 0 up to and including 1.26.4. The CVSS score is 9.8, indicating a severe impact on confidentiality, integrity, and availability.

CVE-2026-55986 is a medium severity vulnerability in the Gitea Open Source Git Server involving the Email Management API bypassing ManageCredentials feature restrictions. This could allow users with limited privileges to perform actions that should be restricted by the ManageCredentials feature. The vulnerability has a CVSS score of 5.4, indicating a moderate impact on confidentiality and integrity without affecting availability. No patch or official remediation guidance is currently available, and no known exploits are reported in the wild.

CVE-2026-55984 is a vulnerability in the Gitea Open Source Git Server affecting versions from 0 up to and including 1.26.4. It involves a null pointer dereference in the AddTime API that can cause an authenticated denial of service. The vulnerability has a low CVSS score of 2.7 and does not impact confidentiality or integrity, only availability.

: Improper Access Control vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions). This issue affects Portal Generator addon to Priority ERP (developed by Soft Solutions): All versions without Priwall v3.

: Improper Access Control vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions). This issue affects Portal Generator addon to Priority ERP (developed by Soft Solutions): All versions without Priwall v3.

The Food Menu WordPress plugin before 6.0.2 does not perform any capability or ownership check on its reservation-status update action, which is also exposed to unauthenticated users and gated only by a nonce that is publicly available to visitors, allowing unauthenticated attackers to change the status of arbitrary reservations.

IBM Informix Dynamic Server 14.10, and 15.0 contain a local privilege escalation vulnerability in the oninit setuid-root utility.

Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges and arbitrary code execution.

Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges and arbitrary code execution.

Joomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder < 6.8.0 - An unauthenticated attacker can create comments on instances with disabled guest commenting by overriding the setting in question with user supplied input.

Joomla Extension - tabaoca.org - Improper ACL implementation allows file operations in Cotton Cloud < 2.0.3 - Authenticated users could perform various file-related operations (read, delete, overwrite, re-assign permissions) on files owned by other users.

Joomla Extension - tabaoca.org - Improper ACL implementation allows file operations in Cotton Cloud < 2.0.2 - Unauthenticated users could perform various file-related operations (read, delete, overwrite, re-assign permissions) on every file managed within the extension.

The Wallet for WooCommerce WordPress plugin before 1.6.10 does not verify the amount actually collected for a wallet top-up before crediting the wallet, allowing customers to top up their wallet balance for less than its value.

The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX actions, allowing any authenticated users such as Subscribers to create crowdfunding campaign posts despite not being granted that permission.

The Eventin WordPress plugin before 4.1.20 does not perform an authorization check on its waiting-list registration handler, allowing unauthenticated users to create WordPress user accounts for arbitrary email addresses and inject order records.

Improper access control in Windows Kernel allows an authorized attacker to elevate privileges locally.

Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally.

No cwe for this issue in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to bypass a security feature over a network.

A broken access control vulnerability in Idurar IDURAR ERP CRM 4.1.0 allows unauthenticated remote attackers to download invoice PDF files containing customer PII via the /download router. The router is mounted without authentication middleware, making it publicly accessible. An attacker can enumerate MongoDB ObjectIds to download any invoice in the system without credentials.