CWE-266 · Incorrect Privilege Assignment (page 5)
Page 5 of 12 — CVEs classified under CWE-266, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-4990 | High | 7.3 | 2026-03-27 | A security vulnerability has been detected in chatwoot up to 4.11.1. The affected element is an unknown function of the file /app/login of the component Signup… |
CVE-2026-3121 | Medium | 6.5 | 2026-03-26 | A flaw was found in Keycloak. An administrator with `manage-clients` permission can exploit a misconfiguration where this permission is equivalent to `manage-p… |
CVE-2026-4824 | High | 7.0 | 2026-03-25 | A vulnerability has been found in Enter Software Iperius Backup up to 8.7.3. Affected by this issue is some unknown functionality of the component Backup Job C… |
CVE-2026-32530 | High | 8.8 | 2026-03-25 | Incorrect Privilege Assignment vulnerability in WPFunnels Creator LMS creatorlms allows Privilege Escalation.This issue affects Creator LMS: from n/a through <… |
CVE-2026-32520 | Critical | 9.8 | 2026-03-25 | Incorrect Privilege Assignment vulnerability in Andrew Munro / AffiliateWP RewardsWP rewardswp allows Privilege Escalation.This issue affects RewardsWP: from n… |
CVE-2026-32519 | Critical | 9.0 | 2026-03-25 | Incorrect Privilege Assignment vulnerability in Bit Apps Bit SMTP bit-smtp allows Privilege Escalation.This issue affects Bit SMTP: from n/a through <= 1.2.2. |
CVE-2026-32488 | High | 8.1 | 2026-03-25 | Incorrect Privilege Assignment vulnerability in wpeverest User Registration user-registration allows Privilege Escalation.This issue affects User Registration… |
CVE-2026-27051 | Critical | 9.8 | 2026-03-25 | Incorrect Privilege Assignment vulnerability in uxper Golo golo allows Privilege Escalation.This issue affects Golo: from n/a through <= 1.7.0. |
CVE-2026-25414 | High | 8.8 | 2026-03-25 | Incorrect Privilege Assignment vulnerability in iqonicdesign WPBookit Pro wpbookit-pro allows Privilege Escalation.This issue affects WPBookit Pro: from n/a th… |
CVE-2026-25334 | High | 8.1 | 2026-03-25 | Incorrect Privilege Assignment vulnerability in wordpresschef Salon Booking System Pro salon-booking-plugin-pro allows Privilege Escalation.This issue affects… |
CVE-2026-24971 | Critical | 9.8 | 2026-03-25 | Incorrect Privilege Assignment vulnerability in Elated-Themes Search & Go searchgo allows Privilege Escalation.This issue affects Search & Go: from n/a through… |
CVE-2026-24968 | Critical | 9.8 | 2026-03-25 | Incorrect Privilege Assignment vulnerability in Xagio SEO Xagio SEO xagio-seo allows Privilege Escalation.This issue affects Xagio SEO: from n/a through <= 7.1… |
CVE-2026-24373 | High | 8.1 | 2026-03-25 | Incorrect Privilege Assignment vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager allows Privilege Escalatio… |
CVE-2026-1712 | | 2026-03-25 | Incorrect privilege assignment vulnerability in HYPR Server allows Privilege Escalation.This issue affects HYPR Server: from 10.5.1 before 10.7. | |
CVE-2026-20110 | Medium | 6.5 | 2026-03-25 | A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected de… |
CVE-2026-4617 | High | 7.3 | 2026-03-24 | A weakness has been identified in SourceCodester Patients Waiting Area Queue Management System 1.0. The impacted element is the function ValidateToken of the f… |
CVE-2026-4548 | Medium | 6.3 | 2026-03-22 | A vulnerability was detected in mickasmt next-saas-stripe-starter 1.0.0. Affected by this vulnerability is the function updateUserrole of the file actions/upda… |
CVE-2026-4514 | Medium | 6.3 | 2026-03-21 | A flaw has been found in PbootCMS up to 3.2.12. Affected by this issue is some unknown functionality of the file apps/admin/controller/system/UserController.ph… |
CVE-2026-27542 | Critical | 9.8 | 2026-03-19 | Incorrect Privilege Assignment vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture woocommerce-wholesale-lead-capture allows Privilege E… |
CVE-2026-4194 | High | 7.3 | 2026-03-16 | A vulnerability was detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-3… |
CVE-2026-4193 | High | 7.3 | 2026-03-16 | A security vulnerability has been detected in D-Link DIR-823G 1.0.2B05. The affected element is the function GetDDNSSettings/GetDeviceDomainName/GetDeviceSetti… |
CVE-2026-4180 | High | 7.3 | 2026-03-16 | A vulnerability was identified in D-Link DIR-816 1.10CNB05. The impacted element is an unknown function of the file redirect.asp of the component goahead. The… |
CVE-2026-4013 | Medium | 6.3 | 2026-03-12 | A vulnerability was identified in SourceCodester Web-based Pharmacy Product Management System 1.0. This affects an unknown function of the file add_admin.php… |
CVE-2026-3817 | Medium | 5.3 | 2026-03-09 | A vulnerability was detected in SourceCodester Patients Waiting Area Queue Management System 1.0. This issue affects some unknown processing of the file /patie… |
CVE-2026-3796 | Medium | 5.3 | 2026-03-09 | A weakness has been identified in Qi-ANXIN QAX Virus Removal up to 2025-10-22. The affected element is the function ZwTerminateProcess in the library QKSecureI… |
CVE-2026-3764 | High | 7.3 | 2026-03-08 | A vulnerability was determined in SourceCodester Client Database Management System 1.0. The impacted element is an unknown function of the file /superadmin_use… |
CVE-2026-3762 | High | 7.3 | 2026-03-08 | A vulnerability has been found in SourceCodester Client Database Management System 1.0/3.1. Impacted is an unknown function of the file /superadmin_delete_mana… |
CVE-2026-3761 | Medium | 5.4 | 2026-03-08 | A flaw has been found in SourceCodester Client Database Management System 1.0. This issue affects some unknown processing of the file /superadmin_user_delete.p… |
CVE-2026-3738 | Medium | 6.3 | 2026-03-08 | A vulnerability was identified in SourceCodester Pet Grooming Management Software 1.0. This vulnerability affects unknown code of the component Financial Repor… |
CVE-2026-3737 | Medium | 6.3 | 2026-03-08 | A vulnerability was determined in SourceCodester Pet Grooming Management Software 1.0. This affects an unknown part of the file add_user.php of the component U… |
CVE-2026-3734 | High | 7.3 | 2026-03-08 | A flaw has been found in SourceCodester Client Database Management System 1.0. Affected is an unknown function of the file /fetch_manager_details.php of the co… |
CVE-2026-3724 | Medium | 6.3 | 2026-03-08 | A weakness has been identified in SourceCodester Patients Waiting Area Queue Management System 1.0. This impacts an unknown function of the file /checkin.php… |
CVE-2026-3675 | Medium | 5.3 | 2026-03-07 | A vulnerability was determined in Freedom Factory dGEN1 up to 20260221. Affected by this issue is the function FakeAppReceiver of the component org.ethosmobile… |
CVE-2026-3674 | Medium | 5.3 | 2026-03-07 | A vulnerability was found in Freedom Factory dGEN1 up to 20260221. Affected by this vulnerability is the function FakeAppProvider of the component org.ethosmob… |
CVE-2026-3671 | Low | 3.3 | 2026-03-07 | A flaw has been found in Freedom Factory dGEN1 up to 20260221. Affected by this vulnerability is the function TokenBalanceContentProvider of the component org… |
CVE-2026-3670 | Medium | 5.3 | 2026-03-07 | A vulnerability was detected in Freedom Factory dGEN1 up to 20260221. Affected is an unknown function of the component com.dgen.alarm. Performing a manipulatio… |
CVE-2026-3669 | Medium | 5.3 | 2026-03-07 | A security vulnerability has been detected in Freedom Factory dGEN1 up to 20260221. This impacts the function AlarmService of the component com.dgen.alarm. Suc… |
CVE-2026-3668 | Low | 3.1 | 2026-03-07 | A weakness has been identified in Freedom Factory dGEN1 up to 20260221. This affects the function AndroidEthereum of the component org.ethosmobile.webpwaemul… |
CVE-2026-3667 | Medium | 5.3 | 2026-03-07 | A security flaw has been discovered in Freedom Factory dGEN1 up to 20260221. The impacted element is the function FakeAppService of the component org.ethosmobi… |
CVE-2026-27983 | Critical | 9.8 | 2026-03-05 | Incorrect Privilege Assignment vulnerability in designthemes LMS Elementor Pro lms-elementor-pro allows Privilege Escalation.This issue affects LMS Elementor P… |
CVE-2026-27541 | High | 7.2 | 2026-03-05 | Incorrect Privilege Assignment vulnerability in Josh Kohlbach Wholesale Suite woocommerce-wholesale-prices allows Privilege Escalation.This issue affects Whole… |
CVE-2026-24963 | High | 7.2 | 2026-03-05 | Incorrect Privilege Assignment vulnerability in ameliabooking Amelia ameliabooking allows Privilege Escalation.This issue affects Amelia: from n/a through <= 1… |
CVE-2026-21425 | Medium | 6.7 | 2026-03-04 | Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an incorrect privilege assignment vulnerability. A low privi… |
CVE-2025-15597 | Medium | 6.3 | 2026-03-02 | A vulnerability has been found in Dataease SQLBot up to 1.4.0. This affects an unknown function of the file backend/apps/system/api/assistant.py of the compone… |
CVE-2026-0871 | Medium | 4.9 | 2026-02-27 | A flaw was found in Keycloak. An administrator with `manage-users` permission can bypass the "Only administrators can view" setting for unmanaged attributes, a… |
CVE-2026-3268 | Medium | 5.4 | 2026-02-26 | A vulnerability was detected in psi-probe PSI Probe up to 5.3.0. The affected element is an unknown function of the file psi-probe-core/src/main/java/psiprobe/… |
CVE-2026-3265 | Medium | 6.3 | 2026-02-26 | A vulnerability was identified in go2ismail Free-CRM up to b83c40a90726d5e58f0cc680ffdcaa28a03fb5d1. This affects an unknown part of the file /api/Security/ of… |
CVE-2026-3263 | Medium | 6.3 | 2026-02-26 | A vulnerability was found in go2ismail Asp.Net-Core-Inventory-Order-Management-System up to 9.20250118. Affected by this vulnerability is an unknown functional… |
CVE-2026-3209 | Medium | 6.3 | 2026-02-25 | A vulnerability has been found in fosrl Pangolin up to 1.15.4-s.3. This affects the function verifyRoleAccess/verifyApiKeyRoleAccess of the component Role Hand… |
CVE-2025-33179 | High | 8.0 | 2026-02-24 | NVIDIA Cumulus Linux and NVOS products contain a vulnerability in the NVUE interface, where a low-privileged user could run an unauthorized command. A successf… |
CVE-2026-2983 | High | 7.3 | 2026-02-23 | A vulnerability was determined in SourceCodester Student Result Management System 1.0. The impacted element is an unknown function of the file /admin/core/impo… |
CVE-2026-2938 | High | 7.3 | 2026-02-22 | A vulnerability has been found in SourceCodester Student Result Management System 1.0. The affected element is an unknown function of the file /srms/script/adm… |
CVE-2026-2896 | High | 7.3 | 2026-02-22 | A weakness has been identified in funadmin up to 7.1.0-rc4. This affects the function setConfig of the file app/backend/controller/Ajax.php of the component Co… |
CVE-2026-2860 | Medium | 6.3 | 2026-02-21 | A security vulnerability has been detected in feng_ha_ha/megagao ssm-erp and production_ssm up to 4288d53bd35757b27f2d070057aefb2c07bdd097. Impacted is an unkn… |
CVE-2026-2852 | Medium | 6.3 | 2026-02-20 | A vulnerability was identified in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This issue affects the function addSales/updateSales/deleteS… |
CVE-2026-2851 | Medium | 6.3 | 2026-02-20 | A vulnerability was determined in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This vulnerability affects the function addInport/updateInpo… |
CVE-2026-2850 | Medium | 6.3 | 2026-02-20 | A vulnerability was found in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This affects the function addCustomer/updateCustomer/deleteCustom… |
CVE-2026-2849 | Medium | 5.4 | 2026-02-20 | A vulnerability has been found in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. Affected by this issue is the function deleteCache/removeAll… |
CVE-2025-69378 | High | 7.2 | 2026-02-20 | Incorrect Privilege Assignment vulnerability in XforWooCommerce Product Filter for WooCommerce prdctfltr allows Privilege Escalation.This issue affects Product… |
CVE-2026-22268 | Medium | 6.3 | 2026-02-19 | Dell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Incorrect Privilege Assignment vulnerability. A low privileged attacker with remote ac… |
CVE-2026-22267 | High | 8.1 | 2026-02-19 | Dell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Incorrect Privilege Assignment vulnerability. A low privileged attacker with remote ac… |
CVE-2026-2693 | Medium | 4.3 | 2026-02-19 | A vulnerability was determined in CoCoTeaNet CyreneAdmin up to 1.3.0. This vulnerability affects unknown code of the file /api/system/dashboard/getCount of the… |
CVE-2026-2676 | Medium | 6.3 | 2026-02-18 | A weakness has been identified in GoogTech sms-ssm up to e8534c766fd13f5f94c01dab475d75f286918a8d. Affected by this issue is the function preHandle of the file… |
CVE-2026-2669 | Medium | 6.5 | 2026-02-18 | A vulnerability was determined in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260206. This impacts an unknown function of the file /dm/… |
CVE-2026-2668 | High | 7.3 | 2026-02-18 | A vulnerability was found in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260206. This affects an unknown function of the file /dm/dispa… |
CVE-2026-2667 | Medium | 5.3 | 2026-02-18 | A vulnerability has been found in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260206. The impacted element is an unknown function of th… |
CVE-2026-2563 | Medium | 6.3 | 2026-02-16 | A vulnerability was identified in JingDong JD Cloud Box AX6600 up to 4.5.1.r4533. Affected is the function set_stcreenen_deabled_status/get_status of the file… |
CVE-2026-2562 | Medium | 6.3 | 2026-02-16 | A vulnerability was determined in JingDong JD Cloud Box AX6600 up to 4.5.1.r4533. This impacts the function cast_streen of the file /jdcapi of the component jd… |
CVE-2026-2561 | Medium | 6.3 | 2026-02-16 | A vulnerability was found in JingDong JD Cloud Box AX6600 up to 4.5.1.r4533. This affects the function web_get_ddns_uptime of the file /jdcapi of the component… |
CVE-2026-2549 | High | 7.3 | 2026-02-16 | A vulnerability has been found in zhanghuanhao LibrarySystem 图书馆管理系统 up to 1.1.1. This impacts an unknown function of the file BookController.java. The manipul… |
CVE-2025-14282 | Medium | 5.4 | 2026-02-12 | A flaw was found in Dropbear. When running in multi-user mode and authenticating users, the dropbear ssh server does the socket forwardings requested by the re… |
CVE-2025-14778 | Medium | 5.4 | 2026-02-09 | A flaw was found in Keycloak. A significant Broken Access Control vulnerability exists in the UserManagedPermissionService (UMA Protection API). When updating… |
CVE-2026-2141 | Medium | 6.3 | 2026-02-08 | A security flaw has been discovered in WuKongOpenSource WukongCRM up to 11.3.3. This affects an unknown part of the file gateway/src/main/java/com/kakarote/gat… |
CVE-2026-2209 | Medium | 6.3 | 2026-02-08 | A vulnerability was detected in WeKan up to 8.18. The affected element is the function setCreateTranslation of the file client/components/settings/translationB… |
CVE-2026-2206 | Medium | 6.3 | 2026-02-08 | A security flaw has been discovered in WeKan up to 8.20. This vulnerability affects unknown code of the file server/methods/fixDuplicateLists.js of the compone… |
CVE-2026-2109 | Medium | 5.4 | 2026-02-07 | A vulnerability was identified in jsbroks COCO Annotator up to 0.11.1. Affected is an unknown function of the file /api/undo/ of the component Delete Category… |
CVE-2026-2107 | Medium | 6.3 | 2026-02-07 | A vulnerability was found in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This affects the function loadAllLoginfo/deleteLoginfo/batchDelet… |
CVE-2026-2106 | Medium | 6.3 | 2026-02-07 | A vulnerability has been found in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. The impacted element is the function addNotice/updateNotice/… |
CVE-2026-2105 | Medium | 6.3 | 2026-02-07 | A flaw has been found in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. The affected element is the function addDept/updateDept/deleteDept of… |
CVE-2026-2079 | Medium | 6.3 | 2026-02-07 | A flaw has been found in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This vulnerability affects the function addMenu/updateMenu/deleteMenu… |
CVE-2026-2078 | Medium | 6.3 | 2026-02-07 | A vulnerability was detected in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This affects the function addPermission/updatePermission/delet… |
CVE-2026-2077 | Medium | 6.3 | 2026-02-07 | A security vulnerability has been detected in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. Affected by this issue is the function addRole/u… |
CVE-2026-2076 | Medium | 6.3 | 2026-02-07 | A weakness has been identified in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. Affected by this vulnerability is the function addUser/updat… |
CVE-2026-2075 | Medium | 6.3 | 2026-02-07 | A security flaw has been discovered in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. Affected is the function saveRolePermission of the file… |
CVE-2026-2015 | Medium | 6.3 | 2026-02-06 | A weakness has been identified in Portabilis i-Educar up to 2.10. Affected is an unknown function of the file FinalStatusImportService.php of the component Fin… |
CVE-2026-2010 | Medium | 4.2 | 2026-02-06 | A vulnerability has been found in Sanluan PublicCMS up to 4.0.202506.d/5.202506.d/6.202506.d. Impacted is the function Paid of the file publiccms-parent/public… |
CVE-2026-2009 | Medium | 6.3 | 2026-02-06 | A flaw has been found in SourceCodester Gas Agency Management System 1.0. This issue affects some unknown processing of the file /gasmark/php_action/createUser… |
CVE-2026-1964 | Medium | 4.3 | 2026-02-05 | A vulnerability was determined in WeKan up to 8.20. This impacts an unknown function of the file models/boards.js of the component REST Endpoint. This manipula… |
CVE-2026-1963 | Medium | 6.3 | 2026-02-05 | A vulnerability was found in WeKan up to 8.20. This affects an unknown function of the file models/attachments.js of the component Attachment Storage. The mani… |
CVE-2026-1962 | Medium | 6.3 | 2026-02-05 | A vulnerability has been found in WeKan up to 8.20. The impacted element is an unknown function of the file server/attachmentMigration.js of the component Atta… |
CVE-2026-1898 | Medium | 6.3 | 2026-02-05 | A vulnerability was determined in WeKan up to 8.20. This affects an unknown part of the file packages/wekan-ldap/server/syncUser.js of the component LDAP User… |
CVE-2026-1896 | Medium | 6.3 | 2026-02-05 | A vulnerability has been found in WeKan up to 8.20. Affected by this vulnerability is the function ComprehensiveBoardMigration of the file server/migrations/co… |
CVE-2026-1895 | Medium | 6.3 | 2026-02-04 | A flaw has been found in WeKan up to 8.20. Affected is the function applyWipLimit of the file models/lists.js of the component Attachment Storage Handler. Exec… |
CVE-2026-1894 | Medium | 6.3 | 2026-02-04 | A vulnerability was detected in WeKan up to 8.20. This impacts an unknown function of the file models/checklistItems.js of the component REST API. Performing a… |
CVE-2026-1892 | Medium | 5.0 | 2026-02-04 | A security vulnerability has been detected in WeKan up to 8.20. This affects the function setBoardOrgs of the file models/boards.js of the component REST API… |
CVE-2025-13881 | Low | 2.7 | 2026-02-02 | A flaw was found in Keycloak Admin API. This vulnerability allows an administrator with limited privileges to retrieve sensitive custom attributes via the /unm… |
CVE-2026-1733 | Medium | 4.3 | 2026-02-01 | A vulnerability was identified in Zhong Bang CRMEB up to 5.6.3. This affects the function detail/tidyOrder of the file /api/store_integral/order/detail/:uni. T… |
CVE-2026-1702 | Medium | 6.3 | 2026-01-30 | A vulnerability was detected in SourceCodester Pet Grooming Management Software 1.0. Impacted is an unknown function of the file /admin/operation/user.php of t… |
CVE-2026-1597 | Medium | 6.3 | 2026-01-29 | A vulnerability has been found in Bdtask SalesERP up to 20260116. This issue affects some unknown processing of the component Administrative Endpoint. Such man… |
CVE-2026-1550 | Medium | 6.3 | 2026-01-28 | A security flaw has been discovered in PHPGurukul Hospital Management System 1.0. Affected by this issue is some unknown functionality of the file /hms/hospita… |