CWE-266 · Incorrect Privilege Assignment (page 2)
Page 2 of 11 — CVEs classified under CWE-266, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-13591 | Medium | 5.0 | 2026-06-29 | A weakness has been identified in DeepMyst Mysti 0.4.0. Affected is the function _isTrackedConversation of the file src/managers/ChannelBridge.ts of the compon… |
CVE-2026-13568 | High | 7.3 | 2026-06-29 | A weakness has been identified in SourceCodester Inventory Management System 1.0. This vulnerability affects unknown code of the file /api/users_handler.php of… |
CVE-2026-22078 | High | 7.3 | 2026-06-29 | Because O+ Connect's IPC service does not authenticate clients, external applications can escalate privileges and perform sensitive actions through the IPC cha… |
CVE-2026-13544 | Medium | 6.3 | 2026-06-29 | A flaw has been found in Feehi CMS up to 2.1.1. Affected by this issue is some unknown functionality of the file /api/users of the component API. This manipula… |
CVE-2026-13524 | Medium | 5.6 | 2026-06-29 | A security vulnerability has been detected in CherryHQ cherry-studio up to 1.9.6. This vulnerability affects unknown code of the file src/main/services/mcp/oau… |
CVE-2026-13511 | Low | 3.1 | 2026-06-28 | A vulnerability was determined in VoltAgent up to 2.1.17. Affected by this issue is the function handleGetMemoryConversation of the file packages/server-core/s… |
CVE-2026-49413 | High | 7.1 | 2026-06-27 | The Linuxulator determined whether a binary was set-user-ID or set-group-ID by checking the P_SUGID process flag. During execve(2), this flag is not yet set a… |
CVE-2026-45259 | Medium | 6.5 | 2026-06-27 | sigqueue(2) was marked as permitted in capability mode with the introduction of Capsicum in 2011, but the implementation of kern_sigqueue did not include a cap… |
CVE-2026-56033 | Critical | 9.8 | 2026-06-26 | Unauthenticated Privilege Escalation in Dokan Pro <= 5.0.4 versions. |
CVE-2026-56030 | Critical | 9.8 | 2026-06-26 | Unauthenticated Privilege Escalation in Paytium <= 5.0.2 versions. |
CVE-2026-56028 | Critical | 9.8 | 2026-06-26 | Unauthenticated Privilege Escalation in Easy Elements for Elementor – Addons & Website Templates <= 1.4.9 versions. |
CVE-2026-56010 | High | 8.8 | 2026-06-26 | Subscriber Privilege Escalation in Abandoned Cart Pro for WooCommerce <= 10.4.0 versions. |
CVE-2026-56008 | High | 8.8 | 2026-06-26 | Contributor Privilege Escalation in Fusion Builder <= 3.15.4 versions. |
CVE-2026-12164 | Medium | 4.4 | 2026-06-23 | Fortra File Integrity Monitoring (FIM), formerly Tripwire Enterprise, versions prior to 9.4.0 may assign incorrect or elevated effective permissions to users c… |
CVE-2026-12823 | Low | 3.3 | 2026-06-22 | A security flaw has been discovered in Browserbase Skills up to 20260526. This impacts an unknown function of the component Autobrowse Trace Artifact Handler… |
CVE-2026-56251 | Medium | 6.5 | 2026-06-21 | Capgo before 12.128.2 contains a broken row level security policy in the org_users table that allows authenticated users to elevate privileges from admin to su… |
CVE-2026-12799 | Medium | 4.3 | 2026-06-21 | A security vulnerability has been detected in BerriAI litellm up to 1.82.2. Affected by this issue is the function ui_view_users of the file litellm/proxy/mana… |
CVE-2026-12786 | High | 7.8 | 2026-06-21 | A vulnerability has been found in Ezbsystems UltraISO Premium Edition up to 9.76. Affected by this issue is some unknown functionality in the library bootpt64… |
CVE-2026-12784 | High | 7.8 | 2026-06-21 | A weakness has been identified in IM-Magic Partition Resizer up to 7.9.0. This affects an unknown function in the library MDA_NTDRV.sys of the component Kernel… |
CVE-2026-12782 | High | 7.8 | 2026-06-21 | A security flaw has been discovered in EaseUS Partition Master up to 14.5. The impacted element is an unknown function in the library EUEDKEPM.sys of the compo… |
CVE-2026-12781 | High | 7.8 | 2026-06-21 | A vulnerability was identified in EaseUS Partition Master up to 14.5. The affected element is an unknown function in the library epmntdrv.sys of the component… |
CVE-2026-12780 | High | 7.8 | 2026-06-21 | A vulnerability was determined in AOMEI Backupper up to 8.3.0. Impacted is an unknown function in the library amwrtdrv.sys of the component Kernel Driver. Exec… |
CVE-2026-12779 | High | 7.8 | 2026-06-21 | A vulnerability was found in AOMEI Dynamic Disk Manager up to 10.10.1. This issue affects some unknown processing in the library ddmdrv.sys of the component Ke… |
CVE-2026-12778 | High | 7.8 | 2026-06-21 | A vulnerability has been found in AOMEI Partition Assistant up to 10.10.1. This vulnerability affects unknown code in the library ampa10.sys of the component K… |
CVE-2026-12771 | Medium | 5.0 | 2026-06-21 | A vulnerability was identified in BerriAI litellm up to 1.82.2. This affects an unknown function of the file litellm/proxy/auth/user_api_key_auth.py of the com… |
CVE-2026-12770 | Medium | 5.4 | 2026-06-21 | A vulnerability was determined in BerriAI litellm up to 1.63.1. The impacted element is an unknown function of the file litellm/proxy/management_endpoints/key_… |
CVE-2026-12529 | High | 7.3 | 2026-06-17 | A security vulnerability has been detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. Affected is an unknown function of… |
CVE-2026-54807 | Critical | 9.8 | 2026-06-17 | Unauthenticated Privilege Escalation in Registration Form for WooCommerce <= 1.0.9 versions. |
CVE-2026-54805 | High | 8.8 | 2026-06-17 | Subscriber Privilege Escalation in Falang multilanguage <= 1.4.2 versions. |
CVE-2026-54196 | Medium | 6.8 | 2026-06-17 | Subscriber Privilege Escalation in JetFormBuilder <= 3.6.1 versions. |
CVE-2026-49058 | Critical | 9.8 | 2026-06-17 | Unauthenticated Privilege Escalation in LoginPress Pro <= 6.2.2 versions. |
CVE-2026-39546 | High | 7.6 | 2026-06-17 | Subscriber Privilege Escalation in MultiLoca <= 4.2.15 versions. |
CVE-2026-27395 | Critical | 9.8 | 2026-06-17 | Unauthenticated Privilege Escalation in Support Board < 3.8.9 versions. |
CVE-2025-69179 | Critical | 9.8 | 2026-06-17 | Unauthenticated Privilege Escalation in Support Ticket Management System <= 1.9 versions. |
CVE-2025-69138 | High | 8.8 | 2026-06-17 | Subscriber Privilege Escalation in Genemy <= 1.6.6 versions. |
CVE-2025-59563 | High | 8.8 | 2026-06-17 | Subscriber Privilege Escalation in Sonaar <= 4.27.4 versions. |
CVE-2026-53862 | Medium | 4.2 | 2026-06-16 | OpenClaw before 2026.5.12 contains a bootstrap token replay vulnerability allowing callers with pending token access to reuse tokens with broader requested sco… |
CVE-2026-53847 | Medium | 5.4 | 2026-06-16 | OpenClaw before 2026.5.6 contains a privilege escalation vulnerability in the Active Memory write scope that allows Gateway operators with operator.write acces… |
CVE-2026-12294 | Critical | 9.6 | 2026-06-16 | Sandbox escape in the DOM: Workers component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunder… |
CVE-2026-12289 | High | 8.8 | 2026-06-16 | Privilege escalation in the Graphics: WebRender component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152… |
CVE-2026-49780 | High | 8.8 | 2026-06-15 | Customer Privilege Escalation in Dokan <= 5.0.2 versions. |
CVE-2026-49083 | High | 7.5 | 2026-06-15 | Contributor Privilege Escalation in LatePoint <= 5.5.1 versions. |
CVE-2026-49063 | High | 7.3 | 2026-06-15 | Unauthenticated Privilege Escalation in Listdom <= 5.5.0 versions. |
CVE-2026-48889 | High | 8.8 | 2026-06-15 | Subscriber Privilege Escalation in Amelia <= 2.3 versions. |
CVE-2026-39587 | High | 8.1 | 2026-06-15 | Unauthenticated Privilege Escalation in WP BASE Booking <= 5.9.0 versions. |
CVE-2026-39583 | Critical | 9.8 | 2026-06-15 | Unauthenticated Privilege Escalation in Datalogics Ecommerce Delivery <= 2.6.62 versions. |
CVE-2026-39579 | High | 8.8 | 2026-06-15 | Contributor Privilege Escalation in B Blocks <= 2.0.31 versions. |
CVE-2026-39470 | High | 7.2 | 2026-06-15 | Shop manager Privilege Escalation in WooCommerce Cart Abandonment Recovery < 2.1.0 versions. |
CVE-2026-34901 | Critical | 9.8 | 2026-06-15 | Unauthenticated Privilege Escalation in iControlWP <= 5.5.3 versions. |
CVE-2026-27407 | High | 7.2 | 2026-06-15 | Editor Privilege Escalation in AI Engine <= 3.4.9 versions. |
CVE-2026-49111 | High | 8.8 | 2026-06-15 | Incorrect Privilege Assignment vulnerability in ThemeGrill Masteriyo - LMS allows Privilege Escalation. This issue affects Masteriyo - LMS: from n/a through 2… |
CVE-2026-12217 | High | 7.8 | 2026-06-15 | A security vulnerability has been detected in DVDFab Virtual Drive 2.0.0.5. Impacted is an unknown function in the library dvdfabio.sys of the component Signed… |
CVE-2026-12213 | Medium | 4.3 | 2026-06-15 | A vulnerability was found in hcengineering Huly Platform up to 0.7.0. Affected by this vulnerability is the function getAccountInfo of the file server/account/… |
CVE-2026-12212 | Medium | 4.3 | 2026-06-15 | A vulnerability has been found in hcengineering Huly Platform up to 0.7.0. Affected is the function getMailboxSecret of the file server/account/src/operations… |
CVE-2026-12201 | Medium | 5.3 | 2026-06-15 | A flaw has been found in IObit Malware Fighter up to 13.2.0. Affected by this vulnerability is an unknown functionality of the component DLL Handler. This mani… |
CVE-2026-44173 | Medium | 5.0 | 2026-06-12 | MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11… |
CVE-2026-45830 | High | 8.8 | 2026-06-12 | A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update… |
CVE-2026-49060 | Critical | 9.8 | 2026-06-11 | Incorrect Privilege Assignment vulnerability in Hippoo Mobile App for WooCommerce allows Privilege Escalation. This issue affects Hippoo Mobile App for WooCom… |
CVE-2026-53814 | High | 8.3 | 2026-06-11 | OpenClaw before 2026.5.20 contains a privilege escalation vulnerability where hook-triggered agent runs incorrectly receive owner-scoped MCP loopback authority… |
CVE-2026-47169 | | 2026-06-11 | Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, a user with Manage Server / ManageGuild, but… | |
CVE-2026-45490 | High | 7.8 | 2026-06-09 | Improper authorization in .NET allows an authorized attacker to elevate privileges locally. |
CVE-2025-10263 | Critical | 9.1 | 2026-06-09 | Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C… |
CVE-2026-11620 | Medium | 5.3 | 2026-06-09 | A security flaw has been discovered in TOTOLINK EX200 4.0.3c.7646. This affects an unknown function of the file /etc/vsftpd.conf of the component vsftpd. The m… |
CVE-2026-11619 | Medium | 6.3 | 2026-06-09 | A vulnerability was identified in Dolibarr ERP CRM up to 23.0.2. The impacted element is an unknown function of the file htdocs/core/filemanagerdol/connectors/… |
CVE-2026-11555 | Low | 3.7 | 2026-06-08 | A vulnerability was identified in D-Link DGS-1100-08PD 1.00.006. This issue affects some unknown processing of the file /etc/boa.conf of the component Web Inte… |
CVE-2026-11554 | Medium | 4.3 | 2026-06-08 | A vulnerability was determined in TOTOLINK CP450 4.1.0cu.747. This vulnerability affects unknown code of the file /etc/vsftpd.conf of the component vsftpd. Thi… |
CVE-2026-11533 | Medium | 5.4 | 2026-06-08 | A security vulnerability has been detected in imvks786 student_management_system up to 9599b560ad3c3b83e75d328b76bedcd489ef1f46. Affected by this vulnerability… |
CVE-2026-11532 | Medium | 6.3 | 2026-06-08 | A weakness has been identified in imvks786 student_management_system up to 9599b560ad3c3b83e75d328b76bedcd489ef1f46. Affected is an unknown function of the fil… |
CVE-2026-11521 | Medium | 6.3 | 2026-06-08 | A security vulnerability has been detected in Mohammed-eid35 bank-management-system-springboot up to 7b9bcc65ad7df3db29af71aed9bb500e5f24d948. This affects an… |
CVE-2026-11519 | Medium | 6.3 | 2026-06-08 | A security flaw has been discovered in SourceCodester Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /Product_Inv… |
CVE-2026-11497 | Medium | 5.3 | 2026-06-08 | A vulnerability has been found in D-Link DCS-5615 1.01.00. Affected by this vulnerability is an unknown functionality of the file /etc/conf.d/boa/boa.conf of t… |
CVE-2026-11494 | Medium | 4.3 | 2026-06-08 | A security vulnerability has been detected in TOTOLINK AC1200 T8 4.1.5cu.8611. This affects an unknown function of the file /etc/vsftpd.conf of the component v… |
CVE-2026-11492 | Medium | 4.3 | 2026-06-08 | A security flaw has been discovered in D-Link DIR-823G 1.0.2B05. The affected element is an unknown function of the file /etc/vsftpd.conf of the component vsft… |
CVE-2026-11476 | Medium | 6.3 | 2026-06-08 | A security vulnerability has been detected in Kushan2k student-management-system up to f16a4ceaddd6729c4b306ed4641cda3176c1ef2a. Affected by this issue is the… |
CVE-2026-11466 | Medium | 5.4 | 2026-06-07 | A weakness has been identified in zilliztech deep-searcher up to 0.0.2. This affects the function CollectionRouter.invoke of the file deepsearcher/agent/collec… |
CVE-2026-11462 | High | 7.3 | 2026-06-07 | A vulnerability was found in Chengdu Everbrite Network Technology BeikeShop up to 1.6.0.22. This impacts the function callback of the file plugins/Stripe/Contr… |
CVE-2026-11441 | Medium | 6.3 | 2026-06-06 | A vulnerability was identified in theonedev onedev up to 15.0.5. This vulnerability affects the function canAccessIssue of the file /issues/ of the component P… |
CVE-2026-11440 | Medium | 6.3 | 2026-06-06 | A vulnerability was determined in theonedev onedev up to 15.0.5. This affects an unknown part of the file /repositories/{projectId}/default-branch of the compo… |
CVE-2026-11439 | Medium | 6.3 | 2026-06-06 | A vulnerability was found in theonedev onedev up to 15.0.5. Affected by this issue is some unknown functionality of the file /projects/ of the component Parent… |
CVE-2026-11438 | Medium | 6.3 | 2026-06-06 | A vulnerability has been found in theonedev onedev up to 15.0.5. Affected by this vulnerability is an unknown functionality of the file /projects. The manipula… |
CVE-2026-11336 | Medium | 6.3 | 2026-06-05 | A vulnerability has been found in tittuvarghese CollegeManagementSystem 3e476335cfbfb9a049e09f474c7ec885f69a9df3/a38852979f7e27ae67b610dce5979500ef8ebe01. Affe… |
CVE-2026-10876 | Medium | 6.3 | 2026-06-05 | A weakness has been identified in SourceCodester Ship Ferry Ticket Reservation System 1.0. This affects an unknown function of the file /admin/. This manipulat… |
CVE-2025-15656 | High | 8.8 | 2026-06-03 | Incorrect Privilege Assignment vulnerability in Mojoomla School Management allows Privilege Escalation. This issue affects School Management: from n/a through… |
CVE-2026-10693 | Medium | 6.3 | 2026-06-03 | A security vulnerability has been detected in SourceCodester Online Boat Reservation System 1.0. Affected by this vulnerability is an unknown functionality of… |
CVE-2025-53209 | Critical | 9.8 | 2026-06-02 | Incorrect Privilege Assignment vulnerability in Themeisle Masteriyo LMS PRO allows Privilege Escalation. This issue affects Masteriyo LMS PRO: from n/a throug… |
CVE-2026-10294 | Medium | 4.3 | 2026-06-01 | A vulnerability has been found in PackageKit up to 1.3.5. Affected is the function g_file_test of the file src/pk-transaction.c of the component API. Such mani… |
CVE-2026-10285 | Medium | 5.4 | 2026-06-01 | A vulnerability has been found in DevaslanPHP project-management up to 2.0.0-beta1. Affected by this issue is the function KanbanScrumHelper::recordUpdated of… |
CVE-2026-10284 | Medium | 5.4 | 2026-06-01 | A flaw has been found in DevaslanPHP project-management up to 2.0.0-beta1. Affected by this vulnerability is the function editComment/doDeleteComment of the fi… |
CVE-2026-10282 | Medium | 4.3 | 2026-06-01 | A security vulnerability has been detected in Bottelet DaybydayCRM up to 2.2.1. This impacts the function view of the file app/Http/Controllers/DocumentsContro… |
CVE-2026-10277 | Medium | 6.3 | 2026-06-01 | A vulnerability was found in j3k0 mcp-google-workspace up to 831790e7d5c2663325733d9f5579cc339a267c4c. This issue affects the function saveToDisk of the file s… |
CVE-2026-10272 | Medium | 6.5 | 2026-06-01 | A vulnerability has been found in a4m4 Student-Management-System up to f0c5f6842c5e8c431ff02b5260a565ca844df3a0. The impacted element is an unknown function of… |
CVE-2026-10269 | Medium | 6.3 | 2026-06-01 | A security vulnerability has been detected in decolua 9router up to 0.4.0. This issue affects the function isAuthenticated of the file src/dashboardGuard.js of… |
CVE-2026-48879 | Critical | 9.8 | 2026-06-01 | Incorrect Privilege Assignment vulnerability in Sergey AIWU allows Privilege Escalation. This issue affects AIWU: from n/a through 1.4.17. |
CVE-2026-42680 | Critical | 9.8 | 2026-06-01 | Incorrect Privilege Assignment vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery Pro allows Privilege Escalation. This issue affect… |
CVE-2026-10255 | Medium | 5.3 | 2026-06-01 | A vulnerability has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. Affected by this vulnerability is the function sell_statement of the… |
CVE-2026-10236 | High | 7.3 | 2026-06-01 | A vulnerability has been found in SourceCodester Water Billing Management System 1.0. This issue affects some unknown processing of the file /classes/Users.php… |
CVE-2026-10218 | Medium | 5.4 | 2026-06-01 | A vulnerability has been found in nextlevelbuilder GoClaw up to 3.11.3. This affects the function auth of the file internal/http/evolution_handlers.go. Such ma… |
CVE-2026-10217 | Medium | 6.3 | 2026-06-01 | A flaw has been found in nextlevelbuilder GoClaw up to 3.11.3. The impacted element is the function handleSave of the file internal/http/tts_config.go of the c… |
CVE-2026-10215 | Medium | 4.3 | 2026-06-01 | A security vulnerability has been detected in Dolibarr ERP CRM up to 23.0.1. Impacted is the function checkUserAccessToObject of the file htdocs/holiday/class/… |
CVE-2026-10152 | Medium | 6.3 | 2026-05-30 | A vulnerability was detected in TaleLin lin-cms-spring-boot up to 0.2.1. This issue affects some unknown processing of the file src/main/java/io/github/talelin… |