CWE-266 · Incorrect Privilege Assignment (page 2)
Page 2 of 12 — CVEs classified under CWE-266, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-77036 | Medium | 6.3 | 2026-08-20 | A vulnerability was found in elunez eladmin up to 2.7. The impacted element is the function EmailController/AliPayController/GeneratorController/GenConfigContr… |
CVE-2026-76999 | Medium | 6.3 | 2026-08-20 | A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This affects the function add_grade of the file /… |
CVE-2026-66682 | Critical | 9.8 | 2026-08-20 | Unauthenticated Privilege Escalation in Abandoned Cart Pro for WooCommerce <= 10.4.0 versions. |
CVE-2025-15689 | Critical | 9.8 | 2026-08-20 | Unauthenticated Privilege Escalation in Capella <= 2.5.5 versions. |
CVE-2026-11861 | Critical | 9.6 | 2026-08-20 | A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for… |
CVE-2026-73390 | Critical | 9.8 | 2026-08-19 | Unauthenticated Privilege Escalation in Total Donations <= 2.0.5 versions. |
CVE-2026-73347 | Critical | 9.8 | 2026-08-19 | Unauthenticated Privilege Escalation in TrueBooker <= 1.2.6 versions. |
CVE-2026-75978 | Medium | 6.3 | 2026-08-19 | A security vulnerability has been detected in xianrendzw EasyReport up to 2.0.17.0522_Beta. The affected element is the function DataSourceController.add of th… |
CVE-2026-67846 | High | 7.8 | 2026-08-18 | Berkeley Out-of-Order Machine (BOOM) commit 5223e44cfeb26f41380057a2eb4d651197475f69 contains a potential incorrect privilege assignment issue in the v3 and v4… |
CVE-2026-73350 | High | 8.2 | 2026-08-18 | Unauthenticated Broken Authentication in SupportCandy <= 3.5.1 versions. |
CVE-2026-68568 | Medium | 6.3 | 2026-08-18 | Subscriber Privilege Escalation in MasterStudy LMS <= 3.7.41 versions. |
CVE-2026-28191 | High | 8.8 | 2026-08-18 | Incorrect Privilege Assignment vulnerability in ThemeOne The Grid allows Privilege Escalation. This issue affects The Grid: from n/a through 2.8.0. |
CVE-2024-14045 | Medium | 6.3 | 2026-08-18 | A weakness has been identified in OpenBoxes up to 0.9.2. This vulnerability affects unknown code of the file grails-app/controllers/org/pih/warehouse/RoleInter… |
CVE-2026-15218 | High | 7.9 | 2026-08-17 | A flaw was found in the maas-api and maas-controller ServiceAccounts within Red Hat OpenShift AI. These ServiceAccounts are granted cluster-wide permissions th… |
CVE-2026-19996 | Medium | 4.3 | 2026-08-17 | A vulnerability was identified in Webkul Bagisto up to 2.4.4. This vulnerability affects unknown code of the file /admin/customers of the component Backend Cus… |
CVE-2026-19986 | Medium | 5.4 | 2026-08-17 | A weakness has been identified in Adblock for Youtube Extension up to 7.2.1 on Chrome. The impacted element is the function updateDynamicRules of the file cont… |
CVE-2026-19928 | Medium | 6.3 | 2026-08-16 | A vulnerability was determined in OpenBoxes up to 0.9.7. This affects the function needManager of the file grails-app/controllers/org/pih/warehouse/RoleInterce… |
CVE-2026-19918 | Medium | 6.3 | 2026-08-16 | A vulnerability has been found in SpaceX Starlink Router Gen 3 2025.11.14.mr64708.3. This affects the function get_status of the component gRPC Management Inte… |
CVE-2026-19893 | Low | 3.1 | 2026-08-15 | A vulnerability was identified in D-Link DIR-842 2.01.B04. This impacts an unknown function of the file /etc/vsftpd.conf of the component vsftpd. Such manipula… |
CVE-2026-19841 | Low | 3.1 | 2026-08-14 | A flaw has been found in TRENDNET TEW-813DRU 1.01b01. Impacted is an unknown function of the file /etc/vsftpd.conf of the component vsftpd. This manipulation c… |
CVE-2026-19835 | Low | 3.8 | 2026-08-14 | A vulnerability was identified in Webkul Bagisto up to 2.4.4. Affected by this vulnerability is an unknown functionality of the component Customer Item Deletio… |
CVE-2026-72826 | High | 8.8 | 2026-08-14 | The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subset of the caller's scopes in createApiK… |
CVE-2026-72840 | High | 8.8 | 2026-08-13 | OpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts that grants write access to /etc/crontabs/root to users intended only for m… |
CVE-2026-72839 | Critical | 9.8 | 2026-08-13 | filebrowser through 2.63.16 fails to properly restrict scope and permissions when self-signup is enabled with default CreateUserDir setting. Unauthenticated at… |
CVE-2026-58435 | Medium | 5.4 | 2026-08-13 | Gitea LFS Deploy-Key Privilege Escalation |
CVE-2026-66661 | High | 7.7 | 2026-08-13 | Subscriber Privilege Escalation in Directories Pro <= 2.0.5 versions. |
CVE-2026-66424 | Critical | 9.8 | 2026-08-13 | Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.7 versions. |
CVE-2026-61979 | High | 8.1 | 2026-08-13 | Unauthenticated Privilege Escalation in SAML SP Single Sign On <= 5.4.3 versions. |
CVE-2026-28161 | High | 8.8 | 2026-08-13 | Subscriber Privilege Escalation in Service Finder Booking <= 6.2 versions. |
CVE-2026-27543 | High | 8.1 | 2026-08-13 | Unauthenticated Privilege Escalation in MStore API <= 4.20.0 versions. |
CVE-2025-9486 | Low | 3.3 | 2026-08-12 | GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain condi… |
CVE-2026-64639 | | 2026-08-12 | Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user (customer, reseller) to execute arbitrary… | |
CVE-2026-71468 | Medium | 5.3 | 2026-08-11 | A flaw was found in acm-search-v2-api-rhel9. When the `getFederationConfig` function refreshes its cache, it improperly reuses a user's bearer token for all su… |
CVE-2026-18950 | High | 8.8 | 2026-08-10 | A flaw was found in odh-dashboard. An authenticated user of the dashboard can exploit a vulnerability related to how RoleBindings are created. The system does… |
CVE-2026-18621 | High | 7.6 | 2026-08-10 | A flaw was found in Data Science Pipelines (DSP). An attacker with namespace editor privileges can bypass security hardening by submitting a malicious Argo Wor… |
CVE-2026-15467 | High | 8.1 | 2026-08-10 | A flaw was found in the trustyai-service-operator's LMEvalJob controller. An authenticated user within the cluster can exploit this vulnerability by configurin… |
CVE-2026-19381 | High | 7.8 | 2026-08-10 | A security flaw has been discovered in Kingston FURY CTRL RGB Control Software 2.0.65.0. The impacted element is an unknown function in the library NTIOLib_KSF… |
CVE-2026-19376 | High | 7.3 | 2026-08-10 | A vulnerability has been found in Uasoft Badaso 3.0.0-alpha. This vulnerability affects the function ApiRequest::class of the file src/Routes/api.php of the co… |
CVE-2026-19360 | Medium | 4.7 | 2026-08-09 | A vulnerability was detected in wongcyrus ExcelLexBot up to 0.0.3. This affects the function ExcelLexBotS3TriggerFunction of the component Lambda Function Hand… |
CVE-2026-19359 | Medium | 4.7 | 2026-08-09 | A security vulnerability has been detected in nxp-auto-goldvip gvip up to 1.4.0. Affected by this issue is the function SitewiseCustomFunction of the component… |
CVE-2026-19358 | Medium | 6.3 | 2026-08-09 | A weakness has been identified in 3CORESec Trapdoor up to 1.2.2. Affected by this vulnerability is the function DefaultFunction. This manipulation causes impro… |
CVE-2026-19244 | Medium | 4.7 | 2026-08-07 | A vulnerability was detected in HKUDS nanobot up to 0.2.1. The affected element is the function connect_mcp_servers of the file nanobot/agent/tools/mcp.py of t… |
CVE-2026-19195 | High | 7.8 | 2026-08-07 | A vulnerability has been found in V-Secure Jingyun Antivirus 2.4.2.39. The affected element is an unknown function in the library ZyArk.sys of the component Ke… |
CVE-2026-19193 | High | 7.8 | 2026-08-07 | A flaw has been found in Jiangmin Antivirus 21. Impacted is the function MessageNotifyCallback in the library kvcore.sys of the component Minifilter Port. Exec… |
CVE-2026-19192 | High | 7.8 | 2026-08-07 | A vulnerability was detected in DeepCool DisplayService 1.2.12. This issue affects some unknown processing of the file C:\DeepCool\resources\service\x64\DeepCo… |
CVE-2026-19191 | High | 7.8 | 2026-08-07 | A security vulnerability has been detected in StableBit DrivePool 2.3.13.1687. This vulnerability affects unknown code of the file C:\Program Files\StableBit\D… |
CVE-2026-19190 | High | 7.8 | 2026-08-07 | A weakness has been identified in StableBit Scanner 2.6.13.4088. This affects an unknown part of the file C:\Program Files (x86)\StableBit\Scanner\Service\Scan… |
CVE-2026-19189 | High | 7.8 | 2026-08-07 | A security flaw has been discovered in Power Sofware PowerISO 9.3.0.0. Affected by this issue is some unknown functionality in the library C:\Windows\System32\… |
CVE-2026-66662 | Critical | 9.8 | 2026-08-06 | Unauthenticated Privilege Escalation in Frontend Admin by DynamiApps <= 3.29.10 versions. |
CVE-2026-65559 | High | 7.2 | 2026-08-06 | Shop manager Privilege Escalation in Order Delivery Date for WooCommerce <= 4.6.0 versions. |
CVE-2026-65507 | Critical | 9.8 | 2026-08-06 | Unauthenticated Privilege Escalation in AIWU <= 1.5.6 versions. |
CVE-2026-28183 | High | 7.2 | 2026-08-06 | Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affec… |
CVE-2026-28111 | High | 8.8 | 2026-08-06 | Contributor Privilege Escalation in Forminator <= 1.56.0 versions. |
CVE-2026-19007 | Medium | 6.3 | 2026-08-06 | A vulnerability was determined in mf-yang openclaw-cn up to 0.2.1. This vulnerability affects the function isApprovedElevatedSender of the file src/auto-reply/… |
CVE-2026-19005 | Medium | 6.3 | 2026-08-06 | A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. Affected is the function handleCreateAgent of the file src/modules/agent-to-agent/create-agent… |
CVE-2026-18998 | Medium | 6.3 | 2026-08-06 | A vulnerability was determined in cosmicstack-labs mercury-agent up to 1.1.12. Impacted is the function SubAgent.run of the file src/core/sub-agent.ts of the c… |
CVE-2026-18996 | Medium | 6.3 | 2026-08-06 | A vulnerability has been found in cosmicstack-labs mercury-agent up to 1.1.12. This vulnerability affects the function PermissionManager.checkShellCommand of t… |
CVE-2026-18993 | Medium | 6.3 | 2026-08-06 | A vulnerability was detected in NousResearch hermes-agent up to 0.16.0. Affected by this issue is some unknown functionality of the file hermes-agent/model_too… |
CVE-2026-18976 | Medium | 6.3 | 2026-08-06 | A vulnerability was determined in NousResearch hermes-agent up to 0.16.0. This impacts the function get_tool_definitions of the file agent/agent_init.py of the… |
CVE-2026-20028 | Medium | 5.0 | 2026-08-05 | A vulnerability in the network driver of Cisco Terminal Service (TS) Agent could allow an authenticated, remote attacker to bypass firewall rules that are asso… |
CVE-2026-17626 | High | 8.8 | 2026-08-05 | IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow an authenticated attacker to read, modify, or expose sensitive host files via Docker-based MCP serve… |
CVE-2026-10059 | Critical | 9.1 | 2026-08-05 | A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this… |
CVE-2026-18817 | Low | 2.2 | 2026-08-04 | A security flaw has been discovered in Baserow up to 2.3.2. Affected by this issue is the function BaserowImpersonateAuthTokenSerializer of the file backend/sr… |
CVE-2026-18723 | Medium | 6.3 | 2026-08-04 | A vulnerability was determined in diaowen DWSurvey up to 6.14.0. The affected element is an unknown function of the file /api/dwsurvey/app/survey/up-survey-sta… |
CVE-2026-18720 | Medium | 5.3 | 2026-08-04 | A flaw has been found in kalcaddle kodbox 1.67 Build 02. This vulnerability affects unknown code of the file /index.php?plugin/msgWarning/action of the compone… |
CVE-2026-18606 | High | 7.8 | 2026-08-03 | A weakness has been identified in Razer RzUpdateService 1.10.14.0. Affected by this vulnerability is an unknown functionality of the file C:\Program Files (x86… |
CVE-2026-18584 | Medium | 5.4 | 2026-08-03 | A security vulnerability has been detected in GL.iNet E5800, E750, X2000, X3000, XE3000 and XE300 up to 20260707. Impacted is an unknown function of the file /… |
CVE-2026-52791 | | 2026-07-29 | fuse-overlayfs is an implementation of overlayfs in FUSE for rootless containers. Prior to 1.17, the release-1.x C branch preserves SUID and SGID mode bits in… | |
CVE-2026-17434 | Medium | 6.3 | 2026-07-26 | A flaw has been found in nanocoai NanoClaw up to 2.0.64. Affected is the function handleAddMcpServer of the file src/modules/self-mod/request.ts of the compone… |
CVE-2026-17433 | Medium | 5.3 | 2026-07-26 | A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. This impacts the function createChatSdkBridge.setup of the file src/channels/chat-sdk-bridge.ts… |
CVE-2026-17432 | Medium | 5.0 | 2026-07-26 | A vulnerability was detected in NousResearch hermes-agent 2026.6.5. Affected by this vulnerability is an unknown functionality of the file hermes-agent/plugins… |
CVE-2026-16764 | Medium | 6.3 | 2026-07-23 | A vulnerability was identified in OWASP DefectDojo 2.59.0. This issue affects the function UserSerializer of the file dojo/api_v2/serializers.py of the compone… |
CVE-2026-61951 | Critical | 9.8 | 2026-07-23 | Unauthenticated Privilege Escalation in TrueBooker <= 1.2.3 versions. |
CVE-2026-59541 | High | 8.8 | 2026-07-23 | Subscriber Privilege Escalation in WP BASE Booking <= 6.3.1 versions. |
CVE-2026-59540 | Critical | 9.8 | 2026-07-23 | Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.6 versions. |
CVE-2026-47237 | High | 8.0 | 2026-07-21 | Kubeflow Community Distribution helps users to install Kubeflow Platform in popular Kubernetes clusters. Prior to version 26.03-rc.1, a Kubeflow setup based on… |
CVE-2026-21824 | High | 8.8 | 2026-07-20 | HCL Commerce contains an privilege escalation vulnerability that could allow denial of service, disclosure of user personal data, and performing of unauthorize… |
CVE-2026-16224 | Medium | 4.3 | 2026-07-19 | A vulnerability was identified in jxxghp MoviePilot up to 2.13.5. The affected element is an unknown function of the file /jxxghp/MoviePilot of the component A… |
CVE-2026-16199 | Medium | 6.3 | 2026-07-19 | A flaw has been found in nextlevelbuilder GoClaw up to 3.13.3-beta.3. This affects the function ExecTool.Execute of the file goclaw/internal/tools/credentialed… |
CVE-2026-16121 | Medium | 6.3 | 2026-07-18 | A vulnerability was identified in nextlevelbuilder GoClaw up to 3.13.2. Affected is the function isSafeBin of the file internal/tools/exec_approval.go. The man… |
CVE-2026-50562 | | 2026-07-15 | FastGPT is a knowledge-based AI application platform. At commit 22ebfacbb43311e9b73294040ae0eb87390c6bba and earlier, artifacts built from untrusted pull reque… | |
CVE-2026-15594 | Low | 3.7 | 2026-07-13 | A vulnerability was found in waooAI waoowaoo up to 0.4.1. Impacted is the function stablePublicIdFromStorageKey in the library src/lib/media/hash.ts of the com… |
CVE-2026-57813 | Critical | 9.8 | 2026-07-13 | Incorrect Privilege Assignment vulnerability in properfraction MailOptin mailoptin allows Privilege Escalation.This issue affects MailOptin: from n/a through <… |
CVE-2026-57768 | High | 8.2 | 2026-07-13 | Incorrect Privilege Assignment vulnerability in favethemes Houzez Login Register houzez-login-register allows Privilege Escalation.This issue affects Houzez Lo… |
CVE-2026-57410 | High | 8.8 | 2026-07-13 | Incorrect Privilege Assignment vulnerability in MailerPress Team MailerPress mailerpress allows Privilege Escalation.This issue affects MailerPress: from n/a t… |
CVE-2026-57386 | High | 8.8 | 2026-07-13 | Incorrect Privilege Assignment vulnerability in Kodezen LLC aBlocks ablocks allows Privilege Escalation.This issue affects aBlocks: from n/a through < 2.9.1. |
CVE-2026-15510 | Medium | 6.3 | 2026-07-12 | A vulnerability was found in Leantime up to 3.8.0. Affected is the function Setting::saveSetting of the component API. The manipulation results in improper aut… |
CVE-2026-15509 | Medium | 6.3 | 2026-07-12 | A vulnerability has been found in Leantime up to 3.8.0. This impacts the function editUser/addUser of the component JSON-RPC Endpoint. The manipulation of the… |
CVE-2026-15499 | Medium | 6.3 | 2026-07-12 | A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.2. Affected is the function FutureTaskTool.call of the file astrbot/core/tools/cron_tools… |
CVE-2026-15476 | Medium | 5.3 | 2026-07-12 | A security vulnerability has been detected in QILING Disk Master 6.0.0.0. The impacted element is an unknown function in the library diskbckp.sys of the compon… |
CVE-2026-15475 | Medium | 5.3 | 2026-07-12 | A weakness has been identified in MiniTool Partition Wizard up to 13.6. The affected element is an unknown function in the library pwdrvio.sys of the component… |
CVE-2026-15474 | Medium | 4.3 | 2026-07-12 | A security flaw has been discovered in Eleveo Call Recording Software 9.7.0. Impacted is an unknown function of the file /callrec/audio.jsp of the component Ca… |
CVE-2026-15473 | Medium | 6.3 | 2026-07-12 | A vulnerability was identified in Eleveo Call Recording Software 9.7.0. This issue affects some unknown processing of the file /callrec/restoreCallAction.do of… |
CVE-2026-15472 | Medium | 4.3 | 2026-07-12 | A vulnerability was determined in Eleveo Call Recording Software 9.7.0. This vulnerability affects unknown code of the file /callrec/composeEmailAction.do. Exe… |
CVE-2026-15471 | Medium | 4.3 | 2026-07-12 | A vulnerability was found in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/pci_dss_status.jsp. Performing a manipulat… |
CVE-2026-15470 | Medium | 4.3 | 2026-07-12 | A vulnerability has been found in Eleveo Call Recording Software 9.7.0. Affected by this issue is some unknown functionality of the file /callrec/group.jsp. Su… |
CVE-2026-15377 | Medium | 4.3 | 2026-07-10 | A vulnerability was determined in Eleveo Call Recording Software 9.7.0. Affected by this vulnerability is an unknown functionality of the file /callrec/sendlog… |
CVE-2026-15376 | Medium | 6.3 | 2026-07-10 | A vulnerability was found in Eleveo Call Recording Software 9.7.0. Affected is an unknown function of the file /callrec/statisticReportAction.do. The manipulat… |
CVE-2026-15375 | Medium | 4.3 | 2026-07-10 | A vulnerability has been found in Eleveo Call Recording Software 9.7.0. This impacts an unknown function of the file /callrec/users_ldap.jsp of the component L… |
CVE-2026-15374 | Medium | 6.3 | 2026-07-10 | A flaw has been found in Eleveo Call Recording Software 9.7.0. This affects an unknown function of the file /callrec/roleAddAction.do of the component Group In… |