CWE-1220
CWE-1220 · 7 records · 1 with a public proof-of-concept
Records the NVD classes under CWE-1220, highest CVSS first.
- HIGH 7.8CVE-2026-83499
Insufficient granularity of access control in Windows Server Update Service allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-81969
Insufficient granularity of access control in Windows Server Update Service allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-70218
Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate privileges locally.
- MEDIUM 6.3CVE-2026-93294
A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to tha…
- MEDIUM 5.5CVE-2026-70216
Insufficient granularity of access control in Windows Mobile Device Management allows an authorized attacker to perform tampering locally.
- MEDIUM 4.3CVE-2026-14210
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with a project-scoped fine-grained Personal Acce…
- UNSCOREDCVE-2026-86338public PoC
Ash field_policies are documented to protect against filter-based information disclosure: when a field the actor may not see is referenced in a filter, it is replaced with an expression that evaluates to nil, so a filter cannot be used as a yes/no oracle to re…