Access Control Archives • Daily CyberSecurity

Norwegian Cruise Line Vulnerability Permits Keycard Replay

Norwegian Cruise Line Vulnerability Permits Keycard Replay

Do Son September 25, 2026

A critical Norwegian Cruise Line vulnerability allows attackers to clone RFID keycards. Mitigate CVE-2026-75907 to protect vessel and guest security.

CVE-2026-58443: Gitea Flaw (CVSS 9.6) Details and PoC Exploit Code Publicly Disclosed Gitea vulnerability CVE-2026-58443 public-only token writing to private repository

Gitea vulnerability CVE-2026-58443 public-only token writing to private repository

CVE-2026-58443: Gitea Flaw (CVSS 9.6) Details and PoC Exploit Code Publicly Disclosed

Do Son July 20, 2026

Gitea vulnerability CVE-2026-58443 (CVSS 9.6) lets public-only tokens write to private repos. Details and PoC code are public. Update to v1.27.0.

CVE-2026-10577: CVSS 10 Access Control Vulnerability Hits Rockwell Automation 1715 Redundant I/O Modules Rockwell Automation vulnerability CVE-2026-10577 access control flaw in 1715 Redundant I/O

Rockwell Automation vulnerability CVE-2026-10577 access control flaw in 1715 Redundant I/O

CVE-2026-10577: CVSS 10 Access Control Vulnerability Hits Rockwell Automation 1715 Redundant I/O Modules

Do Son July 15, 2026

Rockwell Automation vulnerability CVE-2026-10577 (CVSS 10) exposes an unauthenticated debug port in 1715 Redundant I/O modules. Update to firmware 3.011.

Acer Router Security Flaws Earn Maximum 10.0 CVSS Scores Acer router flaw critical authentication bypass Acer router security flaws critical firmware bugs

Acer router flaw critical authentication bypass Acer router security flaws critical firmware bugs

Acer Router Security Flaws Earn Maximum 10.0 CVSS Scores

Do Son June 3, 2026

Acer router security flaws expose cleartext credentials. Learn how these critical firmware bugs threaten home networks and how to update.

Critical ZKTeco CCTV Flaw (CVE-2026-8598) Leaks Admin Credentials Without Authentication ZKTeco CCTV Vulnerability CVE-2026-8598 Patch

Critical ZKTeco CCTV Flaw (CVE-2026-8598) Leaks Admin Credentials Without Authentication

Do Son May 20, 2026

ZKTeco patches a critical 9.1 CVSS flaw (CVE-2026-8598) in CCTV cameras leaking admin credentials without authentication. Upgrade your firmware now!

Fortinet Critical Alert: 9.1 Severity Flaws in FortiSandbox and FortiAuthenticator Risk Remote Takeover CVE-2023-36553 Fortinet Critical Vulnerabilities FortiSandbox CVE-2026-26083

CVE-2023-36553 Fortinet Critical Vulnerabilities FortiSandbox CVE-2026-26083

Fortinet Critical Alert: 9.1 Severity Flaws in FortiSandbox and FortiAuthenticator Risk Remote Takeover

Do Son May 13, 2026

Urgent: Fortinet warns of 9.1 severity flaws in FortiSandbox (CVE-2026-26083) and FortiAuthenticator (CVE-2026-44277). Patch now to prevent unauthorized RCE.

Winter CMS Urgently Patches Critical 10.0 CVSS Privilege Escalation Flaw Winter CMS Vulnerability CVE-2026-27591

Winter CMS Urgently Patches Critical 10.0 CVSS Privilege Escalation Flaw

Do Son March 13, 2026

Winter CMS urgently patches a critical 10.0 CVSS privilege escalation flaw (CVE-2026-27591) allowing low-level backend users to gain full system control.

Public Yet Private? Critical Appsmith Flaw Exposes Unpublished Actions (CVSS 9.4) CVE-2026-24042 Appsmith Vulnerability CVE-2026-22794

Public Yet Private? Critical Appsmith Flaw Exposes Unpublished Actions (CVSS 9.4)

Do Son January 23, 2026

Critical Appsmith flaw CVE-2026-24042 (CVSS 9.4) allows public users to execute private, unpublished actions. Update to v1.95 now to secure your apps.

Hikvision Security Cameras and Access Controls Hit by Stack Overflow Flaws Hikvision Vulnerability CVE-2026-0709 Hikvision Vulnerability CVE-2025-66176 Hikvision, vulnerability Canada Hikvision Ban, National Security Hikvision firmware updates

Hikvision Vulnerability CVE-2026-0709 Hikvision Vulnerability CVE-2025-66176 Hikvision, vulnerability Canada Hikvision Ban, National Security Hikvision firmware updates

Hikvision Security Cameras and Access Controls Hit by Stack Overflow Flaws

Do Son January 13, 2026

High-severity Hikvision stack overflow flaws (CVE-2025-66176) allow attackers to crash cameras & NVRs via LAN. Update firmware now to prevent DoS.

WSO2 Fixes Two Critical Access Control Vulnerabilities (CVE-2025-9804, CVE-2025-10611) Affecting API Manager and Identity Server WSO2 Access Control, Critical API Flaws

WSO2 Fixes Two Critical Access Control Vulnerabilities (CVE-2025-9804, CVE-2025-10611) Affecting API Manager and Identity Server

Do Son October 22, 2025

WSO2 patched two Critical flaws: CVE-2025-10611 (CVSS 9.8) allows unauthenticated admin bypass of System REST APIs, and CVE-2025-9804 (CVSS 9.6) allows privilege escalation via SOAP services.

Critical Flaw (CVSS 9.8) in Ubiquiti UniFi Access Devices Allows RCE

shell-quote command injection AI-Driven Vulnerabilities Q1 2026 Cyber Threats vm2 Sandbox Escape Node.js RCE upKeeper Privilege Escalation CVE-2026-2449 Pharos Controls Vulnerability Root Access Exploit Cybersecurity Vulnerability Roundup CVSS 10.0 Flaws Shadow Archives CVE-2026-0866 MS-Agent Prompt Injection CVE-2026-2256 basic-ftp Path Traversal CVE-2026-27699 telnetd Root Vulnerability CVE-1999-0073 Regression USR-W610 Vulnerabilities End-of-Life IoT Security IceWarp Security Update IceWarp Vulnerabilities Airleader Master Vulnerability CVE-2026-1358 ZLAN5143D Vulnerability CISA ICS Advisory Acronis Cyber Protect Vulnerability CVE-2025-30411 WAGO 852 Vulnerability OT Network Security SandboxJS Vulnerability Sandbox Escape (CVSS 10.0) Kubernetes Local Path Provisioner CVE-2025-62878 CISA Unresponsive Vendors Avation & RISS Vulnerabilities KiloView Vulnerability CVE-2026-1453 OpenClaw RCE vulnerability Johnson Controls Vulnerability CVE-2025-26385 SandboxJS Vulnerability CVE-2026-23830 ibaPDA Vulnerability CVE-2025-14988 Protobuf Vulnerability CVE-2026-0994 AVEVA Process Optimization Vulnerability CVE-2025-61937 ConnectWise PSA Vulnerability CVE-2026-0695 Aruba VIA Vulnerability CVE-2025-37186 aiohttp v3.13.3, Denial of Service (DoS) SmarterMail RCE, CVE-2025-52691 Airoha RACE, Headphone Jacking HPE OneView RCE CVE-2025-37164 FreePBX Auth Bypass, PBX Takeover ScreenConnect Config Flaw, Untrusted Extensions Ruby SAML Auth Bypass, XML Parser Differential Devolutions SQL Injection, Password Manager Flaw Vivotek Unauthenticated RCE, EOL IP Camera Flaw Lynx+ Critical Flaw, Unauthenticated Reset Firebox Default Credentials, CVE-2025-59396 Veeder-Root RCE, Critical ATG Flaw ArcGIS Server SQLi Watchdoc RCE, CVE-2025-58384 Delta DIALink Daikin Security Gateway, authentication bypass Frostbyte10, industrial controller security SunPower, vulnerability Ubiquiti UniFi Connect, EV Station Vulnerabilities Adobe Experience Manager, RCE Vulnerability UniFi Access, Command Injection LDAPNightmare - CVE-2025-1316

Critical Flaw (CVSS 9.8) in Ubiquiti UniFi Access Devices Allows RCE

Do Son July 18, 2025

Ubiquiti warns of CVE-2025-27212, a critical (CVSS 9.8) command injection vulnerability in UniFi Access devices, enabling unauthenticated RCE on the management network.

Unauthenticated Attack: Siemens SiPass Vulnerability Risks DoS Siemens SiPass vulnerability, access control DoS

Unauthenticated Attack: Siemens SiPass Vulnerability Risks DoS

Do Son May 27, 2025

A high-severity Siemens SiPass flaw allows unauthenticated remote attackers to cause a denial-of-service condition. Update to V2.95.3.18.

Arista Fixes Critical CloudVision Portal Vulnerability with CVSS 10 Score Arista CloudVision, CVE-2024-11186

Arista Fixes Critical CloudVision Portal Vulnerability with CVSS 10 Score

Do Son May 9, 2025

Critical CVE-2024-11186 in Arista CloudVision Portal allows authenticated users broader network actions. Patch or mitigate now.

NATS Server Vulnerability: Missing Access Controls in JetStream API NATS security JetStream API vulnerability

NATS Server Vulnerability: Missing Access Controls in JetStream API

Do Son April 10, 2025

A security vulnerability (CVE-2025-30215) in NATS Server allows unauthorized actions on JetStream assets due to missing access controls.

Multi-Layered Security and Fine-Grained Access Control WordPress Hardening - Access Control

Multi-Layered Security and Fine-Grained Access Control

Mikhail Baranov July 21, 2023

Implement fine-grained access control and least privilege in microservice contexts. Learn about capability-based tokens and how to apply permissions to specific users.