Topic
8 articles
CyberSecureToday covers CWE-284 across 8 articles published between 19 Sep 2026 and 18 Oct 2026.
The coverage includes 8 vulnerability advisories. 8 advisories are rated critical or high severity, and 1 involves a flaw listed in CISA's Known Exploited Vulnerabilities catalog.
Stories on CWE-284 most often intersect with Access Control, HackerOne and Privilege Escalation, with Technology, Cloud & SaaS the most affected sector. The most recent story, “MariaDB DROP PACKAGE Defect Leaves Orphaned Grants in mysql.procs_priv Enabling Privilege Escalation”, was published 18 Oct 2026. Every article is listed below, newest first, with the affected products, severity and remediation guidance in each piece.
Threat IntelA catalog cleanup omission in MariaDB's PL/SQL package engine left orphaned grants in mysql.procs_priv, allowing low-privilege users to hijack administrative packages.
CMS SecurityA broken object authorization flaw in the WordPress core REST API enabled unauthenticated attackers to read private and hidden bbPress forum posts.
Threat IntelA missing authorization boundary in RubyGems.org's gem transfer workflow enabled organization admins to invite attacker-controlled owners and evict founders.
Threat IntelProFTPD resolves a critical access control flaw in mod_copy (CVE-2015-3306) where unauthenticated attackers copy arbitrary server files and execute remote code.
AWS CloudAWS resolves an access control flaw in IAM Identity Center and AWS CLI session handling (CVE-2026-82856) where revoked STS tokens remained temporarily active.
Threat IntelA critical security flaw in yii2-starter-kit exposes the Gii code generator and debug modules to all remote IP addresses by default, allowing unauthenticated RCE.
FortinetFortinet resolves a high-severity improper access control flaw in FortiSandbox (CVE-2026-26084) allowing unauthenticated attackers to expose forensic analysis data.
OT / SCADACISA, NSA, and the FBI issue joint advisory AA26-231A warning of active campaigns targeting Siemens S7 series PLCs using automated S7comm protocol exploitation.