CWE-269 · Improper Privilege Management (page 3)
Page 3 of 37 — CVEs classified under CWE-269, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-83293 | High | 7.8 | 2026-09-15 | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: FNDN). The supported version that is affected is… |
CVE-2026-83292 | High | 7.5 | 2026-09-15 | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). Supported versions that are a… |
CVE-2026-83291 | High | 7.8 | 2026-09-15 | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). Supported versions that are a… |
CVE-2026-83290 | High | 7.8 | 2026-09-15 | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). Supported versions that are a… |
CVE-2026-83289 | High | 7.5 | 2026-09-15 | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web General). Supported versions that a… |
CVE-2026-83288 | High | 7.8 | 2026-09-15 | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Search). Supported versions that are affected… |
CVE-2026-83286 | High | 8.1 | 2026-09-15 | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). Supported versions that are a… |
CVE-2026-83282 | Critical | 9.9 | 2026-09-15 | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). The supported version that i… |
CVE-2026-83273 | High | 7.2 | 2026-09-15 | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). The supported version that i… |
CVE-2026-83272 | High | 8.5 | 2026-09-15 | Vulnerability in the Oracle Text component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Dif… |
CVE-2026-83271 | High | 8.8 | 2026-09-15 | Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Easily ex… |
CVE-2026-83268 | Critical | 9.1 | 2026-09-15 | Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0, 12… |
CVE-2026-83263 | High | 7.5 | 2026-09-15 | Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues). The supported version that is affect… |
CVE-2026-83262 | High | 7.5 | 2026-09-15 | Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues). The supported version that is affect… |
CVE-2026-83260 | Critical | 9.1 | 2026-09-15 | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Event Java PX). The supported version that is affected is 9.3.6. Easily expl… |
CVE-2026-83258 | High | 8.1 | 2026-09-15 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version… |
CVE-2026-83257 | High | 7.5 | 2026-09-15 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version… |
CVE-2026-83256 | High | 8.1 | 2026-09-15 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version… |
CVE-2026-83255 | High | 8.1 | 2026-09-15 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version… |
CVE-2026-83254 | High | 8.1 | 2026-09-15 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version… |
CVE-2026-83253 | High | 7.8 | 2026-09-15 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller)… |
CVE-2026-83249 | High | 7.8 | 2026-09-15 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version… |
CVE-2026-83247 | High | 7.8 | 2026-09-15 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version… |
CVE-2026-83246 | High | 8.1 | 2026-09-15 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version… |
CVE-2026-83245 | High | 8.1 | 2026-09-15 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version… |
CVE-2026-83241 | High | 7.5 | 2026-09-15 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version… |
CVE-2026-83239 | High | 7.0 | 2026-09-15 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller)… |
CVE-2026-83216 | High | 7.8 | 2026-09-15 | Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.7… |
CVE-2026-83214 | High | 7.8 | 2026-09-15 | Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.7… |
CVE-2026-83212 | High | 8.8 | 2026-09-15 | Vulnerability in the Siebel Apps - Self Service product of Oracle Siebel CRM (component: Helpdesk/Training). Supported versions that are affected are 17.0-26… |
CVE-2026-83211 | High | 7.8 | 2026-09-15 | Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.7… |
CVE-2026-83196 | Critical | 9.1 | 2026-09-15 | Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.7… |
CVE-2026-83195 | High | 7.2 | 2026-09-15 | Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.7… |
CVE-2026-83194 | High | 8.8 | 2026-09-15 | Vulnerability in the Oracle Depot Repair product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.10… |
CVE-2026-83193 | High | 7.3 | 2026-09-15 | Vulnerability in the Siebel Apps - Life Sciences product of Oracle Siebel CRM (component: Life Sciences). Supported versions that are affected are 17.0-26.7… |
CVE-2026-83192 | High | 8.1 | 2026-09-15 | Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26.7. Difficult to e… |
CVE-2026-83191 | High | 8.1 | 2026-09-15 | Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.7… |
CVE-2026-83190 | High | 7.3 | 2026-09-15 | Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.7… |
CVE-2026-83189 | High | 8.8 | 2026-09-15 | Vulnerability in the Oracle User Management product of Oracle E-Business Suite (component: Proxy User Delegation). Supported versions that are affected are 12… |
CVE-2026-83176 | High | 7.2 | 2026-09-15 | Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite (component: CRM User Management Framework). Supported versions that are aff… |
CVE-2026-83170 | High | 8.0 | 2026-09-15 | Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Documents). Supported versions that are affected are 12.2.3-… |
CVE-2026-83169 | High | 8.1 | 2026-09-15 | Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Java Server Issues). Supported versions that are affected ar… |
CVE-2026-83168 | High | 8.8 | 2026-09-15 | Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Oracle Diagnostics Interfaces). Supported versions that are af… |
CVE-2026-83150 | High | 7.0 | 2026-09-15 | Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Difficult to exploit vulnerability allows unauthentica… |
CVE-2026-83148 | High | 8.8 | 2026-09-15 | Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows low privileged… |
CVE-2026-83147 | High | 7.8 | 2026-09-15 | Vulnerability in the PeopleSoft Enterprise FIN Inventory Brazil product of Oracle PeopleSoft (component: Inventory). The supported version that is affected i… |
CVE-2026-83121 | High | 8.8 | 2026-09-15 | Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Audience). Supported versions that are affected are 12.2.3-12.2.15. Easil… |
CVE-2026-83120 | High | 8.8 | 2026-09-15 | Vulnerability in the Oracle Alert product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15… |
CVE-2026-83119 | High | 8.8 | 2026-09-15 | Vulnerability in the Oracle User Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2… |
CVE-2026-83118 | High | 7.8 | 2026-09-15 | Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities). Supported versions that are affected are 12.2.3-12.2.15. E… |
CVE-2026-83117 | High | 7.2 | 2026-09-15 | Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities). Supported versions that are affected are 12.2.3-12.2.15. E… |
CVE-2026-83114 | High | 7.5 | 2026-09-15 | Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2… |
CVE-2026-83112 | High | 7.2 | 2026-09-15 | Vulnerability in the Oracle Lease and Finance Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affe… |
CVE-2026-76694 | Medium | 6.6 | 2026-09-15 | A privilege escalation vulnerability exists in the command line interface of HPE Networking EdgeConnect SD-WAN Gateways. Successful exploitation could allow an… |
CVE-2026-76687 | High | 7.5 | 2026-09-15 | A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Orchestrator could allow a low-privilege authenticated remote attacker to escalate pri… |
CVE-2026-76678 | High | 8.8 | 2026-09-15 | A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways could allow a low-privilege authenticated remote attacker to escalate privile… |
CVE-2026-76677 | High | 8.8 | 2026-09-15 | A privilege escalation vulnerability exists in the API of EdgeConnect SD-WAN Gateways. Successful exploitation could allow a remote low-privileged authenticate… |
CVE-2026-76670 | Critical | 9.9 | 2026-09-15 | Privilege escalation vulnerabilities exist in the API of HPE Networking EdgeConnect SD-WAN Orchestrator. Successful exploitation could allow a remote low-privi… |
CVE-2026-76669 | Critical | 9.9 | 2026-09-15 | Privilege escalation vulnerabilities exist in the API of HPE Networking EdgeConnect SD-WAN Orchestrator. Successful exploitation could allow a remote low-privi… |
CVE-2026-79411 | High | 8.8 | 2026-09-15 | Incorrect privilege assignment in the admin user-management component of Webkul Bagisto 2.4.9 allows an authenticated backend user holding only the settings.us… |
CVE-2026-0179 | Medium | 6.7 | 2026-09-15 | In Bootloader, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with System execution… |
CVE-2026-55226 | Medium | 5.4 | 2026-09-15 | Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In Strimzi 1.0.0 and earlier, deploying… |
CVE-2026-55225 | High | 8.0 | 2026-09-15 | Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In Strimzi 1.0.0 and earlier, an attacke… |
CVE-2026-65831 | High | 7.7 | 2026-09-15 | ArcadeDB is a Multi-Model DBMS. Prior to 26.7.1, a reader-role user can submit POST /api/v1/command/{database} with language: js because PolyglotQueryEngine.co… |
CVE-2026-61549 | | 2026-09-15 | Woodpecker is a CI/CD engine. From 1.0.0 until 3.16.0, pipeline/backend/kubernetes/backend_options.go defines backend_options.kubernetes.serviceAccountName, an… | |
CVE-2026-54168 | Medium | 6.5 | 2026-09-15 | Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub… |
CVE-2026-92073 | High | 8.8 | 2026-09-15 | Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153… |
CVE-2026-92062 | High | 8.8 | 2026-09-15 | Privilege escalation in the Session Restore component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
CVE-2026-92055 | High | 8.8 | 2026-09-15 | Privilege escalation in the DevTools component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
CVE-2026-92053 | High | 8.8 | 2026-09-15 | Privilege escalation in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 1… |
CVE-2026-92047 | High | 8.8 | 2026-09-15 | Privilege escalation in the Crash Reporting component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
CVE-2026-92033 | High | 8.8 | 2026-09-15 | Privilege escalation in Firefox for Android. This vulnerability was fixed in Firefox 156. |
CVE-2026-92017 | High | 8.8 | 2026-09-15 | Privilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 15… |
CVE-2026-92015 | High | 8.8 | 2026-09-15 | Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Th… |
CVE-2026-14805 | High | 8.8 | 2026-09-15 | The Consulting theme for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 6.7.16. This is due to a combination of two flaws: (… |
CVE-2026-75983 | High | 7.5 | 2026-09-15 | The Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, an… |
CVE-2026-90856 | High | 7.3 | 2026-09-15 | A security vulnerability has been detected in SourceCodester College Notes Gallery Management System 1.0. This impacts an unknown function of the file signup.p… |
CVE-2026-86893 | Low | 3.3 | 2026-09-14 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, tvOS 27, visionOS 27, watchOS 27. An app may be ab… |
CVE-2026-86888 | Low | 3.3 | 2026-09-14 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, tvOS 27, v… |
CVE-2026-86884 | Medium | 5.5 | 2026-09-14 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, watchOS 27. An app… |
CVE-2026-84603 | Medium | 5.5 | 2026-09-14 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, visionOS 27, watchOS 27. An app may be able to acc… |
CVE-2026-84587 | Medium | 5.5 | 2026-09-14 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may b… |
CVE-2026-65354 | High | 8.2 | 2026-09-14 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. A malicious app may be able… |
CVE-2026-64753 | Medium | 6.5 | 2026-09-14 | A permissions issue was addressed by removing the vulnerable code. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visio… |
CVE-2026-46696 | Low | 3.3 | 2026-09-14 | October System provides the system module for October Content Management System. Versions prior to 3.7.17 and 4.2.21 have a vulnerability in the Twig sandbox s… |
CVE-2026-90787 | High | 7.3 | 2026-09-14 | A vulnerability was identified in Soarkey StudentManagement up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. Affected is the function RegisterServlet.doPost of… |
CVE-2026-73470 | Critical | 9.8 | 2026-09-14 | Improper Privilege Management vulnerability in Apache Syncope. Delegations can be created or updated with Roles not owned by the delegating User, or not f… |
CVE-2026-90894 | High | 7.8 | 2026-09-14 | Parallels Desktop runs prl_disp_service as root. Local clients reach it on the world-writable socket /var/run/prl_disp_service.socket. PrlSrv_LoginLocal accept… |
CVE-2026-12518 | | 2026-09-14 | A local privilege escalation vulnerability in the Logitech Logi Options+ updater service on Windows allows a low-privileged local user to execute arbitrary cod… | |
CVE-2026-90523 | High | 7.3 | 2026-09-13 | A vulnerability was identified in jaychouchannel Tourism-Management-System up to 229956e20dbd4a80eeff14535e44d3099502af09. The affected element is an unknown f… |
CVE-2026-90501 | Medium | 6.3 | 2026-09-13 | A security vulnerability has been detected in lenve vhr 1.0-SNAPSHOT. This issue affects the function HrInfoController.updateHr of the file HrMapper.xml. Such… |
CVE-2026-88764 | Medium | 5.4 | 2026-09-13 | The Simple Membership WordPress plugin before 4.7.8 does not validate that the membership level supplied in a PayPal payment notification matches the level con… |
CVE-2026-86406 | High | 7.5 | 2026-09-13 | The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase, and does not validate… |
CVE-2026-80071 | High | 7.2 | 2026-09-13 | The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate the plan a user attac… |
CVE-2026-90487 | Medium | 4.3 | 2026-09-12 | A vulnerability was found in Xuxueli xxl-job up to 3.4.2. Affected by this issue is some unknown functionality of the file xxl-job-admin/src/main/java/com/xxl/… |
CVE-2026-15451 | High | 8.8 | 2026-09-12 | The MemberPress Corporate Accounts plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.39. This is due to a mass a… |
CVE-2026-87759 | High | 8.8 | 2026-09-12 | The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membership invitation carry… |
CVE-2026-85681 | Critical | 9.8 | 2026-09-12 | The WP Component WordPress plugin through 2.2.4 does not have any capability or nonce checks on one of the actions it makes available to unauthenticated users… |
CVE-2026-77752 | High | 7.2 | 2026-09-12 | The Temporary Login Without Password WordPress plugin before 1.9.9 does not verify that the user requesting a temporary login holds network super admin rights… |
CVE-2026-85979 | | 2026-09-11 | Affected versions of Puppet Enterprise contain a command injection vulnerability. An authenticated user with Puppet administrative privileges can inject arbitr… |