CWE-266 · Incorrect Privilege Assignment (page 4)
Page 4 of 11 — CVEs classified under CWE-266, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-4194 | High | 7.3 | 2026-03-16 | A vulnerability was detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-3… |
CVE-2026-4193 | High | 7.3 | 2026-03-16 | A security vulnerability has been detected in D-Link DIR-823G 1.0.2B05. The affected element is the function GetDDNSSettings/GetDeviceDomainName/GetDeviceSetti… |
CVE-2026-4180 | High | 7.3 | 2026-03-16 | A vulnerability was identified in D-Link DIR-816 1.10CNB05. The impacted element is an unknown function of the file redirect.asp of the component goahead. The… |
CVE-2026-4013 | Medium | 6.3 | 2026-03-12 | A vulnerability was identified in SourceCodester Web-based Pharmacy Product Management System 1.0. This affects an unknown function of the file add_admin.php… |
CVE-2026-3817 | Medium | 5.3 | 2026-03-09 | A vulnerability was detected in SourceCodester Patients Waiting Area Queue Management System 1.0. This issue affects some unknown processing of the file /patie… |
CVE-2026-3796 | Medium | 5.3 | 2026-03-09 | A weakness has been identified in Qi-ANXIN QAX Virus Removal up to 2025-10-22. The affected element is the function ZwTerminateProcess in the library QKSecureI… |
CVE-2026-3764 | High | 7.3 | 2026-03-08 | A vulnerability was determined in SourceCodester Client Database Management System 1.0. The impacted element is an unknown function of the file /superadmin_use… |
CVE-2026-3762 | High | 7.3 | 2026-03-08 | A vulnerability has been found in SourceCodester Client Database Management System 1.0/3.1. Impacted is an unknown function of the file /superadmin_delete_mana… |
CVE-2026-3761 | Medium | 5.4 | 2026-03-08 | A flaw has been found in SourceCodester Client Database Management System 1.0. This issue affects some unknown processing of the file /superadmin_user_delete.p… |
CVE-2026-3738 | Medium | 6.3 | 2026-03-08 | A vulnerability was identified in SourceCodester Pet Grooming Management Software 1.0. This vulnerability affects unknown code of the component Financial Repor… |
CVE-2026-3737 | Medium | 6.3 | 2026-03-08 | A vulnerability was determined in SourceCodester Pet Grooming Management Software 1.0. This affects an unknown part of the file add_user.php of the component U… |
CVE-2026-3734 | High | 7.3 | 2026-03-08 | A flaw has been found in SourceCodester Client Database Management System 1.0. Affected is an unknown function of the file /fetch_manager_details.php of the co… |
CVE-2026-3724 | Medium | 6.3 | 2026-03-08 | A weakness has been identified in SourceCodester Patients Waiting Area Queue Management System 1.0. This impacts an unknown function of the file /checkin.php… |
CVE-2026-3675 | Medium | 5.3 | 2026-03-07 | A vulnerability was determined in Freedom Factory dGEN1 up to 20260221. Affected by this issue is the function FakeAppReceiver of the component org.ethosmobile… |
CVE-2026-3674 | Medium | 5.3 | 2026-03-07 | A vulnerability was found in Freedom Factory dGEN1 up to 20260221. Affected by this vulnerability is the function FakeAppProvider of the component org.ethosmob… |
CVE-2026-3671 | Low | 3.3 | 2026-03-07 | A flaw has been found in Freedom Factory dGEN1 up to 20260221. Affected by this vulnerability is the function TokenBalanceContentProvider of the component org… |
CVE-2026-3670 | Medium | 5.3 | 2026-03-07 | A vulnerability was detected in Freedom Factory dGEN1 up to 20260221. Affected is an unknown function of the component com.dgen.alarm. Performing a manipulatio… |
CVE-2026-3669 | Medium | 5.3 | 2026-03-07 | A security vulnerability has been detected in Freedom Factory dGEN1 up to 20260221. This impacts the function AlarmService of the component com.dgen.alarm. Suc… |
CVE-2026-3668 | Low | 3.1 | 2026-03-07 | A weakness has been identified in Freedom Factory dGEN1 up to 20260221. This affects the function AndroidEthereum of the component org.ethosmobile.webpwaemul… |
CVE-2026-3667 | Medium | 5.3 | 2026-03-07 | A security flaw has been discovered in Freedom Factory dGEN1 up to 20260221. The impacted element is the function FakeAppService of the component org.ethosmobi… |
CVE-2026-27983 | Critical | 9.8 | 2026-03-05 | Incorrect Privilege Assignment vulnerability in designthemes LMS Elementor Pro lms-elementor-pro allows Privilege Escalation.This issue affects LMS Elementor P… |
CVE-2026-27541 | High | 7.2 | 2026-03-05 | Incorrect Privilege Assignment vulnerability in Josh Kohlbach Wholesale Suite woocommerce-wholesale-prices allows Privilege Escalation.This issue affects Whole… |
CVE-2026-24963 | High | 7.2 | 2026-03-05 | Incorrect Privilege Assignment vulnerability in ameliabooking Amelia ameliabooking allows Privilege Escalation.This issue affects Amelia: from n/a through <= 1… |
CVE-2026-21425 | Medium | 6.7 | 2026-03-04 | Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an incorrect privilege assignment vulnerability. A low privi… |
CVE-2025-15597 | Medium | 6.3 | 2026-03-02 | A vulnerability has been found in Dataease SQLBot up to 1.4.0. This affects an unknown function of the file backend/apps/system/api/assistant.py of the compone… |
CVE-2026-0871 | Medium | 4.9 | 2026-02-27 | A flaw was found in Keycloak. An administrator with `manage-users` permission can bypass the "Only administrators can view" setting for unmanaged attributes, a… |
CVE-2026-3268 | Medium | 5.4 | 2026-02-26 | A vulnerability was detected in psi-probe PSI Probe up to 5.3.0. The affected element is an unknown function of the file psi-probe-core/src/main/java/psiprobe/… |
CVE-2026-3265 | Medium | 6.3 | 2026-02-26 | A vulnerability was identified in go2ismail Free-CRM up to b83c40a90726d5e58f0cc680ffdcaa28a03fb5d1. This affects an unknown part of the file /api/Security/ of… |
CVE-2026-3263 | Medium | 6.3 | 2026-02-26 | A vulnerability was found in go2ismail Asp.Net-Core-Inventory-Order-Management-System up to 9.20250118. Affected by this vulnerability is an unknown functional… |
CVE-2026-3209 | Medium | 6.3 | 2026-02-25 | A vulnerability has been found in fosrl Pangolin up to 1.15.4-s.3. This affects the function verifyRoleAccess/verifyApiKeyRoleAccess of the component Role Hand… |
CVE-2025-33179 | High | 8.0 | 2026-02-24 | NVIDIA Cumulus Linux and NVOS products contain a vulnerability in the NVUE interface, where a low-privileged user could run an unauthorized command. A successf… |
CVE-2026-2983 | High | 7.3 | 2026-02-23 | A vulnerability was determined in SourceCodester Student Result Management System 1.0. The impacted element is an unknown function of the file /admin/core/impo… |
CVE-2026-2938 | High | 7.3 | 2026-02-22 | A vulnerability has been found in SourceCodester Student Result Management System 1.0. The affected element is an unknown function of the file /srms/script/adm… |
CVE-2026-2896 | High | 7.3 | 2026-02-22 | A weakness has been identified in funadmin up to 7.1.0-rc4. This affects the function setConfig of the file app/backend/controller/Ajax.php of the component Co… |
CVE-2026-2860 | Medium | 6.3 | 2026-02-21 | A security vulnerability has been detected in feng_ha_ha/megagao ssm-erp and production_ssm up to 4288d53bd35757b27f2d070057aefb2c07bdd097. Impacted is an unkn… |
CVE-2026-2852 | Medium | 6.3 | 2026-02-20 | A vulnerability was identified in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This issue affects the function addSales/updateSales/deleteS… |
CVE-2026-2851 | Medium | 6.3 | 2026-02-20 | A vulnerability was determined in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This vulnerability affects the function addInport/updateInpo… |
CVE-2026-2850 | Medium | 6.3 | 2026-02-20 | A vulnerability was found in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This affects the function addCustomer/updateCustomer/deleteCustom… |
CVE-2026-2849 | Medium | 5.4 | 2026-02-20 | A vulnerability has been found in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. Affected by this issue is the function deleteCache/removeAll… |
CVE-2025-69378 | High | 7.2 | 2026-02-20 | Incorrect Privilege Assignment vulnerability in XforWooCommerce Product Filter for WooCommerce prdctfltr allows Privilege Escalation.This issue affects Product… |
CVE-2026-22268 | Medium | 6.3 | 2026-02-19 | Dell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Incorrect Privilege Assignment vulnerability. A low privileged attacker with remote ac… |
CVE-2026-22267 | High | 8.1 | 2026-02-19 | Dell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Incorrect Privilege Assignment vulnerability. A low privileged attacker with remote ac… |
CVE-2026-2693 | Medium | 4.3 | 2026-02-19 | A vulnerability was determined in CoCoTeaNet CyreneAdmin up to 1.3.0. This vulnerability affects unknown code of the file /api/system/dashboard/getCount of the… |
CVE-2026-2676 | Medium | 6.3 | 2026-02-18 | A weakness has been identified in GoogTech sms-ssm up to e8534c766fd13f5f94c01dab475d75f286918a8d. Affected by this issue is the function preHandle of the file… |
CVE-2026-2669 | Medium | 6.5 | 2026-02-18 | A vulnerability was determined in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260206. This impacts an unknown function of the file /dm/… |
CVE-2026-2668 | High | 7.3 | 2026-02-18 | A vulnerability was found in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260206. This affects an unknown function of the file /dm/dispa… |
CVE-2026-2667 | Medium | 5.3 | 2026-02-18 | A vulnerability has been found in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260206. The impacted element is an unknown function of th… |
CVE-2026-2563 | Medium | 6.3 | 2026-02-16 | A vulnerability was identified in JingDong JD Cloud Box AX6600 up to 4.5.1.r4533. Affected is the function set_stcreenen_deabled_status/get_status of the file… |
CVE-2026-2562 | Medium | 6.3 | 2026-02-16 | A vulnerability was determined in JingDong JD Cloud Box AX6600 up to 4.5.1.r4533. This impacts the function cast_streen of the file /jdcapi of the component jd… |
CVE-2026-2561 | Medium | 6.3 | 2026-02-16 | A vulnerability was found in JingDong JD Cloud Box AX6600 up to 4.5.1.r4533. This affects the function web_get_ddns_uptime of the file /jdcapi of the component… |
CVE-2026-2549 | High | 7.3 | 2026-02-16 | A vulnerability has been found in zhanghuanhao LibrarySystem 图书馆管理系统 up to 1.1.1. This impacts an unknown function of the file BookController.java. The manipul… |
CVE-2025-14282 | Medium | 5.4 | 2026-02-12 | A flaw was found in Dropbear. When running in multi-user mode and authenticating users, the dropbear ssh server does the socket forwardings requested by the re… |
CVE-2025-14778 | Medium | 5.4 | 2026-02-09 | A flaw was found in Keycloak. A significant Broken Access Control vulnerability exists in the UserManagedPermissionService (UMA Protection API). When updating… |
CVE-2026-2141 | Medium | 6.3 | 2026-02-08 | A security flaw has been discovered in WuKongOpenSource WukongCRM up to 11.3.3. This affects an unknown part of the file gateway/src/main/java/com/kakarote/gat… |
CVE-2026-2209 | Medium | 6.3 | 2026-02-08 | A vulnerability was detected in WeKan up to 8.18. The affected element is the function setCreateTranslation of the file client/components/settings/translationB… |
CVE-2026-2206 | Medium | 6.3 | 2026-02-08 | A security flaw has been discovered in WeKan up to 8.20. This vulnerability affects unknown code of the file server/methods/fixDuplicateLists.js of the compone… |
CVE-2026-2109 | Medium | 5.4 | 2026-02-07 | A vulnerability was identified in jsbroks COCO Annotator up to 0.11.1. Affected is an unknown function of the file /api/undo/ of the component Delete Category… |
CVE-2026-2107 | Medium | 6.3 | 2026-02-07 | A vulnerability was found in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This affects the function loadAllLoginfo/deleteLoginfo/batchDelet… |
CVE-2026-2106 | Medium | 6.3 | 2026-02-07 | A vulnerability has been found in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. The impacted element is the function addNotice/updateNotice/… |
CVE-2026-2105 | Medium | 6.3 | 2026-02-07 | A flaw has been found in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. The affected element is the function addDept/updateDept/deleteDept of… |
CVE-2026-2079 | Medium | 6.3 | 2026-02-07 | A flaw has been found in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This vulnerability affects the function addMenu/updateMenu/deleteMenu… |
CVE-2026-2078 | Medium | 6.3 | 2026-02-07 | A vulnerability was detected in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This affects the function addPermission/updatePermission/delet… |
CVE-2026-2077 | Medium | 6.3 | 2026-02-07 | A security vulnerability has been detected in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. Affected by this issue is the function addRole/u… |
CVE-2026-2076 | Medium | 6.3 | 2026-02-07 | A weakness has been identified in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. Affected by this vulnerability is the function addUser/updat… |
CVE-2026-2075 | Medium | 6.3 | 2026-02-07 | A security flaw has been discovered in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. Affected is the function saveRolePermission of the file… |
CVE-2026-2015 | Medium | 6.3 | 2026-02-06 | A weakness has been identified in Portabilis i-Educar up to 2.10. Affected is an unknown function of the file FinalStatusImportService.php of the component Fin… |
CVE-2026-2010 | Medium | 4.2 | 2026-02-06 | A vulnerability has been found in Sanluan PublicCMS up to 4.0.202506.d/5.202506.d/6.202506.d. Impacted is the function Paid of the file publiccms-parent/public… |
CVE-2026-2009 | Medium | 6.3 | 2026-02-06 | A flaw has been found in SourceCodester Gas Agency Management System 1.0. This issue affects some unknown processing of the file /gasmark/php_action/createUser… |
CVE-2026-1964 | Medium | 4.3 | 2026-02-05 | A vulnerability was determined in WeKan up to 8.20. This impacts an unknown function of the file models/boards.js of the component REST Endpoint. This manipula… |
CVE-2026-1963 | Medium | 6.3 | 2026-02-05 | A vulnerability was found in WeKan up to 8.20. This affects an unknown function of the file models/attachments.js of the component Attachment Storage. The mani… |
CVE-2026-1962 | Medium | 6.3 | 2026-02-05 | A vulnerability has been found in WeKan up to 8.20. The impacted element is an unknown function of the file server/attachmentMigration.js of the component Atta… |
CVE-2026-1898 | Medium | 6.3 | 2026-02-05 | A vulnerability was determined in WeKan up to 8.20. This affects an unknown part of the file packages/wekan-ldap/server/syncUser.js of the component LDAP User… |
CVE-2026-1896 | Medium | 6.3 | 2026-02-05 | A vulnerability has been found in WeKan up to 8.20. Affected by this vulnerability is the function ComprehensiveBoardMigration of the file server/migrations/co… |
CVE-2026-1895 | Medium | 6.3 | 2026-02-04 | A flaw has been found in WeKan up to 8.20. Affected is the function applyWipLimit of the file models/lists.js of the component Attachment Storage Handler. Exec… |
CVE-2026-1894 | Medium | 6.3 | 2026-02-04 | A vulnerability was detected in WeKan up to 8.20. This impacts an unknown function of the file models/checklistItems.js of the component REST API. Performing a… |
CVE-2026-1892 | Medium | 5.0 | 2026-02-04 | A security vulnerability has been detected in WeKan up to 8.20. This affects the function setBoardOrgs of the file models/boards.js of the component REST API… |
CVE-2025-13881 | Low | 2.7 | 2026-02-02 | A flaw was found in Keycloak Admin API. This vulnerability allows an administrator with limited privileges to retrieve sensitive custom attributes via the /unm… |
CVE-2026-1733 | Medium | 4.3 | 2026-02-01 | A vulnerability was identified in Zhong Bang CRMEB up to 5.6.3. This affects the function detail/tidyOrder of the file /api/store_integral/order/detail/:uni. T… |
CVE-2026-1702 | Medium | 6.3 | 2026-01-30 | A vulnerability was detected in SourceCodester Pet Grooming Management Software 1.0. Impacted is an unknown function of the file /admin/operation/user.php of t… |
CVE-2026-1597 | Medium | 6.3 | 2026-01-29 | A vulnerability has been found in Bdtask SalesERP up to 20260116. This issue affects some unknown processing of the component Administrative Endpoint. Such man… |
CVE-2026-1550 | Medium | 6.3 | 2026-01-28 | A security flaw has been discovered in PHPGurukul Hospital Management System 1.0. Affected by this issue is some unknown functionality of the file /hms/hospita… |
CVE-2026-1411 | Medium | 6.1 | 2026-01-26 | A flaw has been found in Beetel 777VR1 up to 01.00.09/01.00.09_55. The affected element is an unknown function of the component UART Interface. This manipulati… |
CVE-2025-69293 | High | 8.8 | 2026-01-22 | Incorrect Privilege Assignment vulnerability in e-plugins Final User final-user allows Privilege Escalation.This issue affects Final User: from n/a through <=… |
CVE-2025-69292 | High | 8.8 | 2026-01-22 | Incorrect Privilege Assignment vulnerability in e-plugins WP Membership wp-membership allows Privilege Escalation.This issue affects WP Membership: from n/a th… |
CVE-2025-69183 | High | 8.8 | 2026-01-22 | Incorrect Privilege Assignment vulnerability in e-plugins Hospital Doctor Directory hospital-doctor-directory allows Privilege Escalation.This issue affects Ho… |
CVE-2025-69182 | High | 8.8 | 2026-01-22 | Incorrect Privilege Assignment vulnerability in e-plugins Institutions Directory institutions-directory allows Privilege Escalation.This issue affects Institut… |
CVE-2025-68869 | Critical | 9.8 | 2026-01-22 | Incorrect Privilege Assignment vulnerability in LazyCoders LLC LazyTasks lazytasks-project-task-management allows Privilege Escalation.This issue affects LazyT… |
CVE-2025-68027 | High | 7.3 | 2026-01-22 | Incorrect Privilege Assignment vulnerability in Themefic Hydra Booking hydra-booking allows Privilege Escalation.This issue affects Hydra Booking: from n/a thr… |
CVE-2025-67966 | High | 8.8 | 2026-01-22 | Incorrect Privilege Assignment vulnerability in e-plugins Lawyer Directory lawyer-directory allows Privilege Escalation.This issue affects Lawyer Directory: fr… |
CVE-2025-67953 | High | 8.1 | 2026-01-22 | Incorrect Privilege Assignment vulnerability in Booking Activities Team Booking Activities booking-activities allows Privilege Escalation.This issue affects Bo… |
CVE-2025-50007 | High | 8.8 | 2026-01-22 | Incorrect Privilege Assignment vulnerability in Jthemes xSmart xsmart allows Privilege Escalation.This issue affects xSmart: from n/a through <= 1.2.9.4. |
CVE-2026-1193 | Medium | 6.3 | 2026-01-19 | A vulnerability was identified in MineAdmin 1.x/2.x. The impacted element is an unknown function of the file /system/cache/view of the component View Interface… |
CVE-2026-1141 | Medium | 6.3 | 2026-01-19 | A vulnerability was identified in PHPGurukul News Portal 1.0. The affected element is an unknown function of the file /admin/add-subadmins.php of the component… |
CVE-2026-1112 | Medium | 5.4 | 2026-01-18 | A vulnerability was found in Sanluan PublicCMS up to 5.202506.d. Affected is the function delete of the file publiccms-trade/src/main/java/com/publiccms/contro… |
CVE-2026-1106 | Medium | 5.4 | 2026-01-18 | A security flaw has been discovered in Chamilo LMS up to 2.0.0 Beta 1. This issue affects the function deleteLegal of the file src/CoreBundle/Controller/Social… |
CVE-2026-23800 | Critical | 10.0 | 2026-01-16 | Incorrect Privilege Assignment vulnerability in Modular DS modular-connector allows Privilege Escalation.This issue affects Modular DS: from 2.5.2 before 2.6.0. |
CVE-2021-47799 | Medium | 6.2 | 2026-01-15 | Visual Tools DVR VX16 version 4.2.28 contains a local privilege escalation vulnerability in its Sudo configuration that allows attackers to gain root access. A… |
CVE-2026-22916 | Medium | 4.3 | 2026-01-15 | An attacker with low privileges may be able to trigger critical system functions such as reboot or factory reset without proper restrictions, potentially leadi… |
CVE-2026-22914 | Medium | 4.3 | 2026-01-15 | An attacker with limited permissions may still be able to write files to specific locations on the device, potentially leading to system manipulation. |
CVE-2026-22908 | Critical | 9.1 | 2026-01-15 | Uploading unvalidated container images may allow remote attackers to gain full access to the system, potentially compromising its integrity and confidentiality. |