CVE-2026-35425
Improper access control in Azure API Management (APIM) allows an authorized attacker to execute code over a network.
CVSS
8.0
High
EPSS
—
KEV
—
Exploit Today
0
0-100
Published: Jul 24, 2026 · Last modified: Jul 24, 2026 · CWE-284
Not enough EPSS history yet.
Improper access control in Azure API Management (APIM) allows an authorized attacker to execute code over a network.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-65760——
——0Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1 - Improper access checks allow logged in users to retreive order and customer information of any order in the system.1dCVE-2026-65759——
——0Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store extension 1.0.0-2.0.1 - Critical order and payment information, including states, are processed from client side input, enabling unauthenticated attackers to manipulate payment and order states of arbritrary orders.1dCVE-2026-65758——
——0Joomla Extension - tassos.gr - Sensitive data exposure in Convert Forms extension 2.5.0-5.2.2 - The front-end Submissions view did not enforce access control. An unauthenticated visitor could therefore list a form's submissions.1dCVE-2026-65757—2.8%
——1Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Modules Anywhere extension - The editor popup could expose restricted module data to authenticated users without the required module permissions or valid request tokens.2dCVE-2026-64876—2.8%
——1Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in GeoIP extension - Database-update requests lacked consistent token and Super User checks, this could cause unauthorized updates.2dCVE-2026-64871—2.8%
——1Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Cache Cleaner extension - Administrator URL purges did not consistently require a valid token and cache-management permission.2d