CWE-266 · Incorrect Privilege Assignment (page 3)
Page 3 of 11 — CVEs classified under CWE-266, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-10070 | Medium | 4.7 | 2026-05-29 | A vulnerability was found in macrozheng mall up to 1.0.3. This affects an unknown function of the file /admin/update/ of the component Super Admin Password Han… |
CVE-2026-43000 | Medium | 6.0 | 2026-05-28 | An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an attacker with the mem… |
CVE-2026-35671 | High | 8.8 | 2026-05-28 | phpMyFAQ before 4.1.3 contains an insecure direct object reference vulnerability in the admin API user password endpoint that allows authenticated administrato… |
CVE-2026-9795 | High | 7.3 | 2026-05-28 | A flaw was found in Keycloak's Fine-Grained Admin Permissions (FGAPv2) feature. An administrator with limited client management permissions can exploit this vu… |
CVE-2026-42758 | Critical | 9.8 | 2026-05-27 | Incorrect Privilege Assignment vulnerability in Saleswonder Team: Tobias WebinarIgnition webinar-ignition allows Privilege Escalation.This issue affects Webina… |
CVE-2026-42731 | Critical | 9.8 | 2026-05-27 | Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affec… |
CVE-2026-9604 | Medium | 4.3 | 2026-05-26 | A vulnerability was detected in JeecgBoot up to 3.9.1. This vulnerability affects unknown code of the component AiragModelController. The manipulation of the a… |
CVE-2026-9581 | Medium | 6.3 | 2026-05-26 | A vulnerability was identified in JeecgBoot up to 3.9.1. The impacted element is an unknown function of the file /sys/comment/add. Such manipulation leads to i… |
CVE-2026-9580 | High | 7.3 | 2026-05-26 | A vulnerability was determined in JeecgBoot up to 3.9.1. The affected element is the function LoginController.selectDepart of the file /sys/selectDepart. This… |
CVE-2026-9579 | Medium | 6.3 | 2026-05-26 | A vulnerability was found in JeecgBoot up to 3.9.1. Impacted is the function user.getUsername of the file /sys/user/login/setting/userEdit of the component Sys… |
CVE-2026-9562 | High | 7.3 | 2026-05-26 | A vulnerability has been found in sambitraj STUDENT-MANAGEMENT-SYSTEM up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. The affected element is an unknown functi… |
CVE-2026-9517 | High | 7.3 | 2026-05-26 | A vulnerability was determined in hemant6488 CodeIgniter-StudentManagementSystem. The affected element is an unknown function of the file /index.php/students/a… |
CVE-2026-45216 | High | 8.8 | 2026-05-25 | Incorrect Privilege Assignment vulnerability in StoreApps Smart Manager allows Privilege Escalation. This issue affects Smart Manager: from n/a through 8.85.0. |
CVE-2026-9484 | Medium | 6.3 | 2026-05-25 | A vulnerability was determined in SourceCodester Student Grades Management System 1.0. Affected by this vulnerability is the function getClassroomStudents/remo… |
CVE-2026-9483 | Medium | 6.3 | 2026-05-25 | A vulnerability was found in SourceCodester Student Grades Management System 1.0. Affected is an unknown function of the file grades.php. Performing a manipula… |
CVE-2026-9412 | Medium | 6.3 | 2026-05-25 | A vulnerability was determined in SourceCodester Indian Invoicing System 1.0. Impacted is an unknown function of the component Backend Endpoint. Executing a ma… |
CVE-2026-9410 | Medium | 4.3 | 2026-05-25 | A vulnerability has been found in Sushmi-pal Invoice-System up to a0a3faa16dee2621b231ae227333f5761607283b. This vulnerability affects unknown code of the file… |
CVE-2026-9409 | Medium | 4.3 | 2026-05-25 | A flaw has been found in Sushmi-pal Invoice-System up to a0a3faa16dee2621b231ae227333f5761607283b. This affects an unknown part of the file /user of the compon… |
CVE-2026-9397 | High | 8.1 | 2026-05-24 | A weakness has been identified in Besen BS20 EV Charging Station up to 20260426. Affected by this issue is some unknown functionality of the component OTA Upda… |
CVE-2026-9376 | Medium | 6.3 | 2026-05-24 | A vulnerability was determined in JPress up to 1.0.3. The affected element is an unknown function of the file /ucenter/article/doWriteSave of the component UCe… |
CVE-2025-32747 | Medium | 5.3 | 2026-05-22 | Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Incorrect Privilege Assignment vulnerability. A low privileged attacker with local access could poten… |
CVE-2026-48172 | Critical | 9.8 | 2026-05-21 | LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via… |
CVE-2026-22315 | High | 7.2 | 2026-05-20 | Incorrect Privilege Assignment vulnerability in Mesalvo Meona Client Launcher Component, Mesalvo Meona Server Component enables the export of user data, inclu… |
CVE-2026-8752 | Medium | 5.3 | 2026-05-17 | A weakness has been identified in h2oai h2o-3 up to 7402. This vulnerability affects the function exec of the file h2o-core/src/main/java/water/rapids/ast/prim… |
CVE-2026-8747 | Medium | 6.3 | 2026-05-17 | A weakness has been identified in Z-BlogPHP 1.7.4.3430. This affects the function CheckComment of the file zb_system/function/c_system_event.php of the compone… |
CVE-2026-8743 | Medium | 6.3 | 2026-05-17 | A vulnerability was found in Open5GS up to 2.7.6. This impacts the function ran_ue_find_by_amf_ue_ngap_id of the file src/amf/context.c of the component AMF/MM… |
CVE-2025-68420 | | 2026-05-14 | Comarch ERP Optima client connects to a database using a high privileged account regardless of an application account to which a user logs in. It is possible f… | |
CVE-2026-35062 | Medium | 6.5 | 2026-05-13 | An authenticated iControl SOAP user may be able to obtain information of other accounts. Note: Software versions which have reached End of Technical Support… |
CVE-2026-44997 | Medium | 4.3 | 2026-05-11 | OpenClaw before 2026.4.22 contains a security envelope constraint bypass vulnerability allowing restricted subagents to spawn ACP child sessions that fail to i… |
CVE-2026-8241 | Medium | 5.3 | 2026-05-10 | A vulnerability has been found in Industrial Application Software IAS Canias ERP 8.03. The affected element is the function iasGetServerInfoEvent of the compon… |
CVE-2026-8233 | Medium | 4.6 | 2026-05-10 | A vulnerability was determined in Dotouch XproUPF 2.0.0-release-088aa7c4. Affected is an unknown function of the component UPF. This manipulation causes improp… |
CVE-2026-8148 | High | 7.8 | 2026-05-08 | NAVER MYBOX Explorer for Windows before 3.0.11.160 allows a local attacker to escalate privileges to NT AUTHORITY\SYSTEM via registry manipulation due to impro… |
CVE-2026-8127 | Medium | 6.3 | 2026-05-08 | A vulnerability has been found in eladmin up to 2.7. Impacted is the function checkLevel of the file /rest/UserController.java of the component Users API Endpo… |
CVE-2026-43510 | Medium | 5.9 | 2026-05-07 | manage.get.gov is the .gov TLD registrar maintained by CISA. manage.get.gov allows an organization administrator to assign domain manager privileges for domain… |
CVE-2026-43535 | Medium | 6.8 | 2026-05-05 | OpenClaw before 2026.4.14 contains an authorization context reuse vulnerability in collect-mode queue batches that allows messages from different senders to in… |
CVE-2026-42368 | Critical | 9.9 | 2026-05-04 | A privilege escalation vulnerability exists in the Web Interface functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted HTTP request can lead to… |
CVE-2026-7713 | Medium | 6.3 | 2026-05-04 | A vulnerability was detected in crocodilestick Calibre-Web-Automated up to 4.0.6. Affected by this vulnerability is the function generate_auth_token of the fil… |
CVE-2026-7709 | Medium | 6.3 | 2026-05-03 | A vulnerability was identified in janeczku Calibre-Web up to 0.6.26. The impacted element is the function generate_auth_token of the file cps/kobo_auth.py of t… |
CVE-2026-7686 | Medium | 5.3 | 2026-05-03 | A vulnerability was found in eyeo Adblock Plus up to 4.36.2 on Chrome. Affected by this vulnerability is the function postMessage of the file premium.preload.j… |
CVE-2026-7644 | High | 7.3 | 2026-05-02 | A vulnerability has been found in ChatGPTNextWeb NextChat up to 2.16.1. Affected is the function addMcpServer of the file app/mcp/actions.ts. The manipulation… |
CVE-2026-7631 | Medium | 5.4 | 2026-05-02 | A vulnerability was found in code-projects Online Hospital Management System 1.0. The impacted element is an unknown function of the component Registration Han… |
CVE-2026-7602 | Medium | 6.3 | 2026-05-02 | A vulnerability was found in JeecgBoot up to 3.9.1. Affected by this vulnerability is an unknown functionality of the file /sys/fillRule/edit of the component… |
CVE-2026-7505 | High | 7.3 | 2026-04-30 | A flaw has been found in nextlevelbuilder GoClaw and GoClaw Lite up to 3.8.5. This affects an unknown function of the component RPC Handler. This manipulation… |
CVE-2026-7468 | High | 7.3 | 2026-04-30 | A security vulnerability has been detected in 1024-lab smart-admin up to 3.30.0. This affects an unknown function of the file /smart-admin-api/druid/index.html… |
CVE-2026-5141 | High | 8.8 | 2026-04-29 | Improper Privilege Management, Improper Access Control, Incorrect privilege assignment vulnerability in TUBITAK BILGEM Software Technologies Research Institute… |
CVE-2026-7292 | Medium | 5.6 | 2026-04-28 | A security vulnerability has been detected in o2oa up to 10.0. This impacts the function syncFile of the file NodeAgent.java of the component NodeAgent. The ma… |
CVE-2026-7142 | Medium | 6.3 | 2026-04-27 | A vulnerability was determined in Wooey up to 0.13.2. The impacted element is the function add_or_update_script of the file wooey/api/scripts.py of the compone… |
CVE-2026-22337 | Critical | 9.8 | 2026-04-27 | Incorrect Privilege Assignment vulnerability in Directorist Directorist Social Login allows Privilege Escalation.This issue affects Directorist Social Login: f… |
CVE-2026-7109 | Medium | 5.3 | 2026-04-27 | A vulnerability was detected in code-projects Invoice System in Laravel 1.0. This impacts an unknown function of the file /item of the component API Endpoint… |
CVE-2026-7093 | Medium | 6.3 | 2026-04-27 | A vulnerability was found in code-projects Invoice System in Laravel 1.0. Affected by this vulnerability is an unknown functionality of the file /invoice/ of t… |
CVE-2026-7092 | Medium | 6.3 | 2026-04-27 | A vulnerability has been found in code-projects Invoice System in Laravel 1.0. Affected is an unknown function of the file /profile/ of the component Profile H… |
CVE-2026-7091 | Medium | 6.3 | 2026-04-27 | A flaw has been found in code-projects Invoice System in Laravel 1.0. This impacts an unknown function of the file /user of the component User Management Handl… |
CVE-2026-6977 | High | 7.3 | 2026-04-25 | A security vulnerability has been detected in vanna-ai vanna up to 2.0.2. The affected element is an unknown function of the component Legacy Flask API. The ma… |
CVE-2026-33519 | Critical | 9.8 | 2026-04-21 | An incorrect authorization vulnerability exists in Esri Portal for ArcGIS 11.4, 11.5 and 12.0 on Windows, Linux and Kubernetes that did not correctly check per… |
CVE-2026-33518 | Critical | 9.8 | 2026-04-21 | An incorrect privilege assignment vulnerability exists in Esri Portal for ArcGIS 11.5 in Windows and Linux that allows highly privileged users to create develo… |
CVE-2026-40869 | High | 7.5 | 2026-04-21 | Decidim is a participatory democracy framework. Starting in version 0.19.0 and prior to versions 0.30.5 and 0.31.1, a vulnerability allows any registered and a… |
CVE-2026-6750 | High | 8.8 | 2026-04-21 | Privilege escalation in the Graphics: WebRender component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150… |
CVE-2026-6634 | Medium | 6.3 | 2026-04-20 | A weakness has been identified in usememos memos up to 0.22.1. This affects the function memos_access_token of the file src/App.tsx of the component UpdateInst… |
CVE-2026-6609 | Medium | 6.3 | 2026-04-20 | A flaw has been found in liangliangyy DjangoBlog up to 2.1.0.0. The affected element is the function form_valid of the file oauth/views.py. This manipulation o… |
CVE-2026-6572 | Medium | 5.6 | 2026-04-19 | A security vulnerability has been detected in Collabora KodExplorer up to 4.52. Affected by this issue is some unknown functionality of the file /app/controlle… |
CVE-2026-6564 | Medium | 4.3 | 2026-04-19 | A vulnerability was found in EMQ EMQX Enterprise up to 6.1.0. The impacted element is an unknown function of the component Session Handling. The manipulation r… |
CVE-2026-27668 | High | 8.8 | 2026-04-14 | A vulnerability has been identified in RUGGEDCOM CROSSBOW Secure Access Manager Primary (SAM-P) (All versions < V5.8). User Administrators are allowed to admin… |
CVE-2026-6201 | Medium | 5.4 | 2026-04-13 | A vulnerability was identified in CodeAstro Online Job Portal 1.0. The impacted element is an unknown function of the file /jobs/job-delete.php of the componen… |
CVE-2026-6105 | High | 7.3 | 2026-04-11 | A security vulnerability has been detected in perfree go-fastdfs-web up to 1.3.7. This affects an unknown part of the file src/main/java/com/perfree/controller… |
CVE-2026-5999 | Medium | 6.3 | 2026-04-10 | A vulnerability has been found in JeecgBoot up to 3.9.1. This impacts an unknown function of the component SysAnnouncementController. Such manipulation leads t… |
CVE-2026-27102 | Medium | 6.6 | 2026-04-08 | Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.1.6 and versions 9.11.0.0 through 9.13.0.1, contains an incorrect privilege assignment vulnerability. A lo… |
CVE-2026-5642 | High | 7.3 | 2026-04-06 | A vulnerability was determined in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. This affects an unknown function of the f… |
CVE-2026-5569 | High | 7.3 | 2026-04-05 | A vulnerability was found in Technostrobe HI-LED-WR120-G2 5.5.0.1R6.03.30. Impacted is an unknown function of the file /Technostrobe/ of the component Endpoint… |
CVE-2026-5529 | Medium | 4.3 | 2026-04-05 | A vulnerability was detected in Dromara lamp-cloud up to 5.8.1. This vulnerability affects the function pageUser of the file /defUser/pageUser of the component… |
CVE-2026-5526 | High | 7.3 | 2026-04-04 | A security flaw has been discovered in Tenda 4G03 Pro up to 1.0/1.1/04.03.01.53/192.168.0.1. Affected by this vulnerability is an unknown functionality of the… |
CVE-2026-5484 | Medium | 5.3 | 2026-04-03 | A weakness has been identified in BookStackApp BookStack up to 26.03. Affected is the function chapterToMarkdown of the file app/Exports/ExportFormatter.php of… |
CVE-2026-5330 | Medium | 6.5 | 2026-04-02 | A vulnerability was found in SourceCodester/mayuri_k Best Courier Management System 1.0. Affected by this issue is some unknown functionality of the file /ajax… |
CVE-2026-5312 | Medium | 5.3 | 2026-04-01 | A weakness has been identified in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR… |
CVE-2026-5311 | Medium | 5.3 | 2026-04-01 | A security flaw has been discovered in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L… |
CVE-2026-5215 | Medium | 4.3 | 2026-03-31 | A vulnerability was identified in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR… |
CVE-2026-32916 | Critical | 9.4 | 2026-03-31 | OpenClaw versions 2026.3.7 before 2026.3.11 contain an authorization bypass vulnerability where plugin subagent routes execute gateway methods through a synthe… |
CVE-2026-33997 | Medium | 6.8 | 2026-03-31 | Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins privilege validation to be… |
CVE-2026-5124 | Low | 3.7 | 2026-03-30 | A security vulnerability has been detected in osrg GoBGP up to 4.3.0. Affected is the function BGPHeader.DecodeFromBytes of the file pkg/packet/bgp/bgp.go of t… |
CVE-2026-5122 | Low | 3.7 | 2026-03-30 | A security flaw has been discovered in osrg GoBGP up to 4.3.0. This affects the function DecodeFromBytes of the file pkg/packet/bgp/bgp.go of the component BGP… |
CVE-2026-5107 | Medium | 4.2 | 2026-03-30 | A vulnerability has been found in FRRouting FRR up to 10.5.1. This affects the function process_type2_route of the file bgpd/bgp_evpn.c of the component EVPN T… |
CVE-2026-32922 | Critical | 9.9 | 2026-03-29 | OpenClaw before 2026.3.11 contains a privilege escalation vulnerability in device.token.rotate that allows callers with operator.pairing scope to mint tokens w… |
CVE-2026-4990 | High | 7.3 | 2026-03-27 | A security vulnerability has been detected in chatwoot up to 4.11.1. The affected element is an unknown function of the file /app/login of the component Signup… |
CVE-2026-3121 | Medium | 6.5 | 2026-03-26 | A flaw was found in Keycloak. An administrator with `manage-clients` permission can exploit a misconfiguration where this permission is equivalent to `manage-p… |
CVE-2026-4824 | High | 7.0 | 2026-03-25 | A vulnerability has been found in Enter Software Iperius Backup up to 8.7.3. Affected by this issue is some unknown functionality of the component Backup Job C… |
CVE-2026-32530 | High | 8.8 | 2026-03-25 | Incorrect Privilege Assignment vulnerability in WPFunnels Creator LMS creatorlms allows Privilege Escalation.This issue affects Creator LMS: from n/a through <… |
CVE-2026-32520 | Critical | 9.8 | 2026-03-25 | Incorrect Privilege Assignment vulnerability in Andrew Munro / AffiliateWP RewardsWP rewardswp allows Privilege Escalation.This issue affects RewardsWP: from n… |
CVE-2026-32519 | Critical | 9.0 | 2026-03-25 | Incorrect Privilege Assignment vulnerability in Bit Apps Bit SMTP bit-smtp allows Privilege Escalation.This issue affects Bit SMTP: from n/a through <= 1.2.2. |
CVE-2026-32488 | High | 8.1 | 2026-03-25 | Incorrect Privilege Assignment vulnerability in wpeverest User Registration user-registration allows Privilege Escalation.This issue affects User Registration… |
CVE-2026-27051 | Critical | 9.8 | 2026-03-25 | Incorrect Privilege Assignment vulnerability in uxper Golo golo allows Privilege Escalation.This issue affects Golo: from n/a through <= 1.7.0. |
CVE-2026-25414 | High | 8.8 | 2026-03-25 | Incorrect Privilege Assignment vulnerability in iqonicdesign WPBookit Pro wpbookit-pro allows Privilege Escalation.This issue affects WPBookit Pro: from n/a th… |
CVE-2026-25334 | High | 8.1 | 2026-03-25 | Incorrect Privilege Assignment vulnerability in wordpresschef Salon Booking System Pro salon-booking-plugin-pro allows Privilege Escalation.This issue affects… |
CVE-2026-24971 | Critical | 9.8 | 2026-03-25 | Incorrect Privilege Assignment vulnerability in Elated-Themes Search & Go searchgo allows Privilege Escalation.This issue affects Search & Go: from n/a through… |
CVE-2026-24968 | Critical | 9.8 | 2026-03-25 | Incorrect Privilege Assignment vulnerability in Xagio SEO Xagio SEO xagio-seo allows Privilege Escalation.This issue affects Xagio SEO: from n/a through <= 7.1… |
CVE-2026-24373 | High | 8.1 | 2026-03-25 | Incorrect Privilege Assignment vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager allows Privilege Escalatio… |
CVE-2026-1712 | | 2026-03-25 | Incorrect privilege assignment vulnerability in HYPR Server allows Privilege Escalation.This issue affects HYPR Server: from 10.5.1 before 10.7. | |
CVE-2026-20110 | Medium | 6.5 | 2026-03-25 | A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected de… |
CVE-2026-4617 | High | 7.3 | 2026-03-24 | A weakness has been identified in SourceCodester Patients Waiting Area Queue Management System 1.0. The impacted element is the function ValidateToken of the f… |
CVE-2026-4548 | Medium | 6.3 | 2026-03-22 | A vulnerability was detected in mickasmt next-saas-stripe-starter 1.0.0. Affected by this vulnerability is the function updateUserrole of the file actions/upda… |
CVE-2026-4514 | Medium | 6.3 | 2026-03-21 | A flaw has been found in PbootCMS up to 3.2.12. Affected by this issue is some unknown functionality of the file apps/admin/controller/system/UserController.ph… |
CVE-2026-27542 | Critical | 9.8 | 2026-03-19 | Incorrect Privilege Assignment vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture woocommerce-wholesale-lead-capture allows Privilege E… |