CWE-269 · Improper Privilege Management (page 3)
Page 3 of 32 — CVEs classified under CWE-269, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-60957 | Medium | 5.4 | 2026-07-21 | Vulnerability in the Oracle Transportation Execution product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected… |
CVE-2026-60952 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle Transportation Execution product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected… |
CVE-2026-60943 | High | 7.5 | 2026-07-21 | Vulnerability in the Oracle Service Fulfillment Manager product of Oracle E-Business Suite (component: Fulfillment Engine). Supported versions that are affect… |
CVE-2026-60941 | High | 8.7 | 2026-07-21 | Vulnerability in the Oracle Service Fulfillment Manager product of Oracle E-Business Suite (component: Fulfillment Engine). Supported versions that are affect… |
CVE-2026-60938 | Medium | 4.1 | 2026-07-21 | Vulnerability in the Oracle Labor Distribution product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 1… |
CVE-2026-60932 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle Labor Distribution product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 1… |
CVE-2026-60931 | High | 7.5 | 2026-07-21 | Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected… |
CVE-2026-60927 | High | 7.5 | 2026-07-21 | Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected… |
CVE-2026-60925 | High | 7.2 | 2026-07-21 | Vulnerability in the Oracle Public Sector Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected ar… |
CVE-2026-60924 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle Public Sector Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected ar… |
CVE-2026-60920 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle Customer Care product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3… |
CVE-2026-60918 | High | 7.2 | 2026-07-21 | Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 1… |
CVE-2026-60901 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle Project Intelligence product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are… |
CVE-2026-60900 | High | 7.2 | 2026-07-21 | Vulnerability in the Oracle HCM Configuration Workbench product of Oracle E-Business Suite (component: Rapid Implementation). Supported versions that are affe… |
CVE-2026-60898 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle Warehouse Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are… |
CVE-2026-60897 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2… |
CVE-2026-60894 | High | 7.5 | 2026-07-21 | Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2… |
CVE-2026-60890 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2… |
CVE-2026-60886 | High | 7.6 | 2026-07-21 | Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2… |
CVE-2026-60872 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools). Supported versions that are affected ar… |
CVE-2026-60863 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle Advanced Pricing product of Oracle E-Business Suite (component: Pricing Installation). Supported versions that are affected are 12… |
CVE-2026-60859 | High | 7.5 | 2026-07-21 | Vulnerability in the Oracle Quoting product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2… |
CVE-2026-60855 | High | 7.5 | 2026-07-21 | Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2… |
CVE-2026-60854 | High | 8.2 | 2026-07-21 | Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2… |
CVE-2026-60847 | Low | 3.4 | 2026-07-21 | Vulnerability in the Oracle Order Entry product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-1… |
CVE-2026-60837 | High | 8.4 | 2026-07-21 | Vulnerability in the Oracle Price Protection product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12… |
CVE-2026-60836 | High | 7.2 | 2026-07-21 | Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected… |
CVE-2026-60833 | High | 7.0 | 2026-07-21 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). The supported version that is affected is 11.4. Difficult to exploit vuln… |
CVE-2026-60719 | Critical | 9.9 | 2026-07-21 | Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API). Supported versions that are affected are 8.2.0.0.0, 12.2.1… |
CVE-2026-60678 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2… |
CVE-2026-60663 | Critical | 9.9 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions that are affected ar… |
CVE-2026-60661 | High | 7.8 | 2026-07-21 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystems). The supported version that is affected is 11.4. Difficult to exploit… |
CVE-2026-60654 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions that are affected ar… |
CVE-2026-60625 | High | 7.8 | 2026-07-21 | Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Studio). Supported versions that are affected are 12.2.1.4.0 and… |
CVE-2026-60619 | High | 7.5 | 2026-07-21 | Vulnerability in the JD Edwards EnterpriseOne HCM Foundation product of Oracle JD Edwards (component: Time Accounting and HRM Base). The supported version th… |
CVE-2026-60583 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: Install). The supported version that is affected is 6.5.3. E… |
CVE-2026-60576 | High | 7.2 | 2026-07-21 | Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core). The supported version that is affected… |
CVE-2026-60567 | Critical | 9.1 | 2026-07-21 | Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4… |
CVE-2026-60566 | Critical | 9.8 | 2026-07-21 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4… |
CVE-2026-60546 | High | 7.2 | 2026-07-21 | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Integration Business Insight). Supported versions that are affected are… |
CVE-2026-60532 | Critical | 9.8 | 2026-07-21 | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: PeopleSoft Applications). Supported versions that are a… |
CVE-2026-60530 | High | 7.8 | 2026-07-21 | Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: mod_http2.so). The supported version that is affected is 14.1.2.0.0… |
CVE-2026-60492 | High | 7.1 | 2026-07-21 | Vulnerability in the JD Edwards EnterpriseOne HCM Foundation product of Oracle JD Edwards (component: OW HR PR Foundation). The supported version that is aff… |
CVE-2026-60454 | High | 7.8 | 2026-07-21 | Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2… |
CVE-2026-60419 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affected are 12.2.1.4.0 a… |
CVE-2026-60418 | High | 7.2 | 2026-07-21 | Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affected are 12.2.1.4.0 a… |
CVE-2026-60406 | Medium | 6.7 | 2026-07-21 | Vulnerability in the TimesTen In-Memory Database product of Oracle TimesTen In-Memory Database (component: Kubernetes Operator). The supported version that i… |
CVE-2026-60342 | Medium | 5.3 | 2026-07-21 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12… |
CVE-2026-60340 | High | 7.2 | 2026-07-21 | Vulnerability in the Oracle Project Costing product of Oracle E-Business Suite (component: Enterprise Command Center). Supported versions that are affected ar… |
CVE-2026-60271 | High | 7.8 | 2026-07-21 | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0… |
CVE-2026-60248 | Critical | 9.3 | 2026-07-21 | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0… |
CVE-2026-60183 | Medium | 6.4 | 2026-07-21 | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin). Supported versions that are affected are MySQL Ser… |
CVE-2026-60175 | High | 8.8 | 2026-07-21 | Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 19.3-19.31, 21.3-21.22 and 23.4.0-23.26.2. Easily ex… |
CVE-2026-60162 | Medium | 6.1 | 2026-07-21 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.12. Difficult to… |
CVE-2026-60150 | High | 7.8 | 2026-07-21 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.12. Easily exploi… |
CVE-2026-47054 | High | 7.8 | 2026-07-21 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.12. Easily exploi… |
CVE-2026-47047 | High | 7.8 | 2026-07-21 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.12. Easily exploi… |
CVE-2026-46995 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin). Supported versions that are af… |
CVE-2026-47416 | Critical | 9.6 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 are vulnerable to vertical privilege escalation. T… |
CVE-2026-47413 | Critical | 9.6 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have aprivilege escalation / cross-tenant member i… |
CVE-2026-47412 | High | 8.1 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling destructive… |
CVE-2026-47411 | Medium | 6.5 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling workspace me… |
CVE-2026-47409 | High | 8.1 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling owner lockou… |
CVE-2026-47407 | | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the Platform server exposes resources under `/api/… | |
CVE-2026-16401 | High | 8.8 | 2026-07-21 | Privilege escalation in the Data Loss Prevention component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16396 | High | 8.8 | 2026-07-21 | Privilege escalation in WebExtensions. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
CVE-2026-16379 | High | 8.8 | 2026-07-21 | Privilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird… |
CVE-2026-16372 | High | 8.8 | 2026-07-21 | Privilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16371 | High | 8.8 | 2026-07-21 | Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
CVE-2026-16366 | High | 8.8 | 2026-07-21 | Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16365 | High | 8.8 | 2026-07-21 | Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-13439 | Critical | 9.8 | 2026-07-21 | The Easy Form Builder by WhiteStudio plugin for WordPress is vulnerable to Unauthenticated Privilege Escalation to Administrator in versions up to, and includi… |
CVE-2026-55550 | High | 7.1 | 2026-07-20 | NextCRM is open-source customer relationship management (CRM) software. The CRM product catalog is an organization-wide business object. Normal application ser… |
CVE-2026-44231 | Critical | 9.1 | 2026-07-20 | RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10, 6.0.0 and above, prior to 6.0.3 contain an information discl… |
CVE-2026-16337 | | 2026-07-20 | Improper authorization in the ToolGroupResource and RoleAjax REST/DWR endpoints in dotCMS dotCMS 21.02 through 26.06.22-03 on all platforms allows a low-privil… | |
CVE-2026-62183 | Critical | 9.8 | 2026-07-20 | Improper Privilege Management vulnerability in Apache Syncope. When: * the all-Java user workflow adapter is configured, or * the Flowable user workflow adap… |
CVE-2026-13142 | High | 8.1 | 2026-07-20 | The Social Login, Passkeys, Magic Link & Email OTP WordPress plugin before 1.4.1 does not enforce rate limiting or a working attempt lockout on its passwordle… |
CVE-2026-47870 | High | 7.1 | 2026-07-18 | VMware Avi Load Balancer contains a privilege escalation vulnerability. A malicious authenticated user with network access may be able to execute remote code. … |
CVE-2026-47868 | High | 7.8 | 2026-07-18 | VMware Avi Load Balancer contains a local privilege escalation vulnerability. A malicious user with local access may be able to escalate their privileges to ru… |
CVE-2026-48010 | Medium | 6.5 | 2026-07-17 | Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, UserController::upsertUser() in src/Core/Framework/Api/Controller/UserController.php wr… |
CVE-2026-15380 | | 2026-07-17 | A non-administrator interactive user can obtain full SYSTEM code execution through a DCOM/task scheduler logic chain — no network access, no memory corruption… | |
CVE-2026-15379 | | 2026-07-17 | The Altiris WMI provider exposes a class (AltirisAgent_Stream) that allows any local standard user to read the contents of any file accessible to the SYSTEM ac… | |
CVE-2026-9810 | Critical | 9.8 | 2026-07-17 | The AI Copilot WordPress plugin before 1.5.4 does not bind OAuth access tokens to a WordPress user, and accepts any valid token as an administrator session, a… |
CVE-2026-11961 | High | 8.1 | 2026-07-17 | The User Registration & Membership WordPress plugin before 5.2.3 does not validate that the membership tier submitted during public registration is one of the… |
CVE-2026-15982 | Critical | 9.8 | 2026-07-17 | The Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit plugin for WordPress is vulnerable to Privilege Escalation in all versions… |
CVE-2026-14956 | Critical | 9.8 | 2026-07-17 | The Bricksforge plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.8.6. This is due to improper validation of… |
CVE-2026-43978 | High | 8.1 | 2026-07-16 | wger is a free, open-source workout and fitness manager. In versions prior to 2.6, a gym trainer can escalate their session to any higher-privileged account (g… |
CVE-2026-36425 | Medium | 6.5 | 2026-07-16 | An issue in OPSWAT AppRemover Driver (ardrv.sys) v2017.10.02.1551 and earlier in IOCTL handler 0x2420031. Any local user can open the device and send process t… |
CVE-2026-6423 | | 2026-07-16 | A local privilege escalation vulnerability in ESET Inspect Connector. The vulnerability was caused by improper authentication in an IPC channel. | |
CVE-2026-15103 | High | 8.8 | 2026-07-16 | The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Privilege Escalation via arbitrary option… |
CVE-2026-13741 | High | 8.8 | 2026-07-16 | The Digits: WordPress Mobile Number Signup and Login plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 9.1.0.5… |
CVE-2026-12525 | High | 8.8 | 2026-07-16 | The Redux Framework WordPress plugin before 4.5.13 does not restrict which user meta keys can be written when saving custom profile fields, allowing users with… |
CVE-2026-53444 | | 2026-07-15 | Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan OIDC-related Meteor methods in packages/wekan-oidc/oidc_server.js, server/models/org.js, an… | |
CVE-2026-62355 | Medium | 5.4 | 2026-07-15 | TDengine is an open source, time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, a Data Reader admin_user on a TDengine Cloud DB i… |
CVE-2026-53515 | High | 7.1 | 2026-07-15 | Better Auth is an authentication and authorization library for TypeScript. From 1.2.10 until 1.6.11, the @better-auth/sso plugin's POST /sso/register endpoint… |
CVE-2026-14961 | Medium | 6.2 | 2026-07-15 | Pegatron `Tdelo64.sys` exposes a privileged device interface, `\\.\TdeIo`, that fails to properly restrict access to sensitive IOCTL functionality. The driver'… |
CVE-2026-14960 | Critical | 9.8 | 2026-07-15 | Pegatron `Tdelo64.sys` improperly exposes privileged hardware access functionality through the `\\.\TdeIo` device interface. IOCTL handlers including `TDE_IOCT… |
CVE-2026-57996 | High | 8.8 | 2026-07-15 | phpMyFAQ before 4.1.5 contains a privilege escalation vulnerability in the user/add API endpoint that allows non-SuperAdmin administrators to create SuperAdmin… |
CVE-2026-49501 | Medium | 6.7 | 2026-07-15 | Dell PowerScale OneFS versions 9.5.0.0 through 9.10.1.7, and versions 9.11.0.0 through 9.13.0.2 contains an Improper Privilege Management vulnerability. A high… |
CVE-2026-50391 | High | 7.8 | 2026-07-14 | Improper privilege management in Windows Group Policy allows an authorized attacker to elevate privileges locally. |