Filtered by CWE-285
Filtered by vendor Subscriptions
Total 1165 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-1106 1 Chamilo 2 Chamilo, Chamilo Lms 2026-02-27 5.4 Medium
A security flaw has been discovered in Chamilo LMS up to 2.0.0 Beta 1. This issue affects the function deleteLegal of the file src/CoreBundle/Controller/SocialController.php of the component Legal Consent Handler. Performing a manipulation of the argument userId results in improper authorization. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-25999 2 Aiven, Aiven-open 2 Klaw, Klaw 2026-02-27 7.1 High
Klaw is a self-service Apache Kafka Topic Management/Governance tool/portal. Prior to 2.10.2, there is an improper access control vulnerability that allows unauthorized users to trigger a reset or deletion of metadata for any tenant. By sending a crafted request to the /resetMemoryCache endpoint, an attacker can clear cached configurations, environments, and cluster data. This vulnerability is fixed in 2.10.2.
CVE-2025-21348 1 Microsoft 3 Sharepoint Server, Sharepoint Server 2016, Sharepoint Server 2019 2026-02-26 7.2 High
Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2025-24418 1 Adobe 1 Adobe Commerce 2026-02-26 8.1 High
Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Authorization vulnerability that could result in Privilege escalation. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction.
CVE-2025-26683 1 Microsoft 1 Azure Playwright 2026-02-26 8.1 High
Improper authorization in Azure Playwright allows an unauthorized attacker to elevate privileges over a network.
CVE-2025-30389 1 Microsoft 1 Azure Ai Bot Service 2026-02-26 8.7 High
Improper authorization in Azure Bot Framework SDK allows an unauthorized attacker to elevate privileges over a network.
CVE-2025-30390 1 Microsoft 1 Azure Machine Learning 2026-02-26 9.9 Critical
Improper authorization in Azure allows an authorized attacker to elevate privileges over a network.
CVE-2025-30392 1 Microsoft 1 Azure Ai Bot Service 2026-02-26 9.8 Critical
Improper authorization in Azure Bot Framework SDK allows an unauthorized attacker to elevate privileges over a network.
CVE-2025-46840 1 Adobe 1 Experience Manager 2026-02-26 8.7 High
Adobe Experience Manager versions 6.5.22 and earlier are affected by an Improper Authorization vulnerability that could result in Privilege escalation. A low privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue requires user interaction. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.
CVE-2025-49746 1 Microsoft 1 Azure Machine Learning 2026-02-26 9.9 Critical
Improper authorization in Azure Machine Learning allows an authorized attacker to elevate privileges over a network.
CVE-2025-53792 1 Microsoft 2 Azure, Azure Portal 2026-02-26 9.1 Critical
Azure Portal Elevation of Privilege Vulnerability
CVE-2025-26430 1 Google 1 Android 2026-02-26 7.8 High
In getDestinationForApp of SpaAppBridgeActivity, there is a possible cross-user file reveal due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2025-53795 1 Microsoft 1 Pc Manager 2026-02-26 9.1 Critical
Improper authorization in Microsoft PC Manager allows an unauthorized attacker to elevate privileges over a network.
CVE-2025-59271 1 Microsoft 3 Azure Cache For Redis, Azure Cache For Redis Enterprise, Azure Managed Redis 2026-02-26 8.7 High
Redis Enterprise Elevation of Privilege Vulnerability
CVE-2025-15087 1 Youlai 1 Youlai-mall 2026-02-26 4.3 Medium
A security vulnerability has been detected in youlaitech youlai-mall 1.0.0/2.0.0. Affected is the function submitOrderPayment of the file mall-oms/oms-boot/src/main/java/com/youlai/mall/oms/controller/app/OrderController.java. Such manipulation of the argument orderSn leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-64655 1 Microsoft 1 Dynamics Omnichannel Sdk Storage Containers 2026-02-26 8.8 High
Improper authorization in Dynamics OmniChannel SDK Storage Containers allows an unauthorized attacker to elevate privileges over a network.
CVE-2025-65041 1 Microsoft 1 Partner Center 2026-02-26 10 Critical
Improper authorization in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-3185 2 Feiyuchuixue, Szadmin 2 Sz-boot-parent, Sz-boot-parent 2026-02-26 5.3 Medium
A vulnerability was found in feiyuchuixue sz-boot-parent up to 1.3.2-beta. Affected is an unknown function of the file /api/admin/sys-message/ of the component API Endpoint. The manipulation of the argument messageId results in authorization bypass. The attack can be launched remotely. The exploit has been made public and could be used. Upgrading to version 1.3.3-beta is able to address this issue. The patch is identified as aefaabfd7527188bfba3c8c9eee17c316d094802. The affected component should be upgraded. The project was informed beforehand and acted very professional: "We have implemented message ownership verification, so that users can only query messages related to themselves."
CVE-2026-24305 1 Microsoft 2 Entra Id, Microsoft Entra Id 2026-02-26 9.3 Critical
Azure Entra ID Elevation of Privilege Vulnerability
CVE-2025-15582 1 Detronetdip 1 E-commerce 2026-02-26 5.4 Medium
A security flaw has been discovered in detronetdip E-commerce 1.0.0. The impacted element is the function Delete/Update of the component Product Management Module. Performing a manipulation of the argument ID results in authorization bypass. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.