CWE-269 · Improper Privilege Management (page 4)
Page 4 of 37 — CVEs classified under CWE-269, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-74925 | High | 7.2 | 2026-09-11 | The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding its vendor role to g… |
CVE-2026-87958 | High | 8.1 | 2026-09-10 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service where a specific functionality on a Db2 server can be disabled by… |
CVE-2026-75777 | High | 8.8 | 2026-09-10 | IBM Aspera Enterprise WebApps 1.0.0 through 1.0.5 could allow a local attacker to escape container protections due to unrestricted system calls being permitted… |
CVE-2026-9327 | Medium | 6.3 | 2026-09-10 | IBM WebSphere Application Server 9.0, and 8.5 could allow an authenticated user with a low-privilege administrative role to modify security configuration. This… |
CVE-2026-88891 | High | 8.3 | 2026-09-10 | OpenPanel through 2.3.0 fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing read-level members to modify, delete, and pub… |
CVE-2026-88863 | High | 8.1 | 2026-09-10 | capgo.app (npm package `capgo`) through version 12.207.1 does not compare the caller's role rank against the requested role in the validateInvite() function of… |
CVE-2026-84042 | High | 7.8 | 2026-09-10 | A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking (krun.use_passt), crun can execute attacker-… |
CVE-2026-81431 | High | 7.2 | 2026-09-10 | The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration… |
CVE-2026-87998 | High | 7.1 | 2026-09-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, DELETE /api/v1/knowledge/{id}/delete in backend… |
CVE-2026-73788 | Medium | 6.5 | 2026-09-09 | A vulnerability in the ClearPass OnGuard agent could allow an authenticated remote attacker to elevate their own privileges on a vulnerable ClearPass OnGuard d… |
CVE-2026-86746 | Medium | 6.4 | 2026-09-09 | Snipe-IT before 8.7.0 contains an authorization bypass vulnerability in Livewire components that enforce authorization only at the route level, not within comp… |
CVE-2026-14359 | High | 8.8 | 2026-09-09 | The YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 3.35.0. This is due to the a… |
CVE-2026-12858 | | 2026-09-09 | Improper Privilege Management vulnerability in ESET AV Remover (standalone) allows Privilege Escalation via especially crafted RPC. | |
CVE-2026-75927 | High | 7.2 | 2026-09-09 | The PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus plugin for WordPress is vulnerable to Privilege Escalation… |
CVE-2026-17553 | High | 7.2 | 2026-09-09 | The WP EasyCart plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.9.3. This is due to the ec_ajax_save_page_defaul… |
CVE-2026-76801 | High | 8.8 | 2026-09-09 | The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to Remote Code Execution in all v… |
CVE-2026-84869 | Critical | 9.9 | 2026-09-08 | A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmat… |
CVE-2026-49883 | Medium | 5.5 | 2026-09-08 | In checkReadPermission of PermissionsManager.java, there is a possible way to monitor sensitive device state data due to a missing permission check. This could… |
CVE-2026-28659 | High | 7.8 | 2026-09-08 | In MicroXR Blobstore, there is a possible way to access other app's files due to a missing permission check. This could lead to local escalation of privilege w… |
CVE-2026-58874 | High | 7.8 | 2026-09-08 | In multiple functions of SmsController.java, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation… |
CVE-2026-58846 | High | 7.8 | 2026-09-08 | In kvm_iommu_map_sg of iommu.c, there is a possible use after free due to a missing permission check. This could lead to local escalation of privilege with no… |
CVE-2026-68830 | Medium | 5.5 | 2026-09-08 | Improper link resolution before file access ('link following') in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to disclose… |
CVE-2026-66818 | High | 8.8 | 2026-09-08 | Improper privilege management in SQL Server allows an authorized attacker to elevate privileges over a network. |
CVE-2026-77968 | High | 8.2 | 2026-09-08 | A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: [create, get, list, update, watch] across all namespaces. While the operator us… |
CVE-2026-86516 | Medium | 4.7 | 2026-09-08 | A vulnerability was detected in elenavanengelenmaslova mocknest-serverless 0.9.0. The affected element is an unknown function of the file deployment/aws/shared… |
CVE-2026-80166 | High | 7.8 | 2026-09-07 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Privilege Management vulner… |
CVE-2026-14444 | High | 7.5 | 2026-09-07 | The WP Fusion (Pro) plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.47.13. This is due to insufficient autho… |
CVE-2026-80178 | Medium | 5.5 | 2026-09-07 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Privilege Management vulner… |
CVE-2026-85640 | Medium | 6.3 | 2026-09-07 | Zohocorp ManageEngine Endpoint Central versions below 11.5.2600.15 are vulnerable to Privilege Escalation Due to Outdated Component |
CVE-2026-77699 | Medium | 5.0 | 2026-09-07 | Zohocorp ManageEngine Endpoint Central versions below 11.5.2605.01 are vulnerable to Local privilege escalation due to loading a dll from an untrusted path. |
CVE-2026-77697 | Medium | 6.3 | 2026-09-07 | Zohocorp ManageEngine Endpoint Central versions below 11.4.2540.23 are vulnerable to Privilege Escalation During JAR Extraction |
CVE-2026-77698 | Medium | 5.7 | 2026-09-07 | Zohocorp ManageEngine Endpoint Central versions before 11.5.2605.01 are vulnerable to local privilege escalation due to Agent upgrade. |
CVE-2026-86275 | Medium | 5.3 | 2026-09-07 | A vulnerability was detected in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. This vulnerability affects the function register… |
CVE-2026-18480 | High | 8.8 | 2026-09-06 | The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same account its permission check authorised… |
CVE-2026-86153 | Critical | 9.1 | 2026-09-06 | A vulnerability has been found in Tenda CP3 27.5.57.101. This affects the function CRedirServer::SetRedirectEnable of the file Functions/Redirect.cpp. The mani… |
CVE-2026-86195 | | 2026-09-05 | grav-plugin-api versions before 1.0.20 contain a privilege escalation vulnerability in the InvitationsController where the stripSuperFlags() method only remove… | |
CVE-2026-81543 | High | 8.8 | 2026-09-05 | The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.7.1. This is due to… |
CVE-2026-78362 | Critical | 9.8 | 2026-09-05 | The SEO Flow by LupsOnline WordPress plugin before 3.0.3 does not correctly validate the credential supplied with its API requests, allowing unauthenticated us… |
CVE-2026-71625 | Critical | 9.8 | 2026-09-04 | An issue in slimkit plus ThinkSNS+ v.2.4 allows a remote attacker to escalate privileges via the ResetPasswordController.php component |
CVE-2026-75166 | High | 8.8 | 2026-09-04 | Insecure Permission vulnerability in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows the low-privileged service user to execute /usr/bin/tcpdump as root… |
CVE-2026-75160 | Critical | 9.1 | 2026-09-04 | An issue in X-Serie Gateway Firmware V6_00_05 allows a remote attacker to escalate privileges via the endpoints /cgi-bin/wwwugw.cgi and /cgi-bin/ugwdownload.cg… |
CVE-2026-85514 | Medium | 6.3 | 2026-09-04 | A security vulnerability has been detected in StackStorm st2 up to 3.9.0. Impacted is an unknown function of the file st2api/st2api/controllers/v1/auth.py of t… |
CVE-2026-85513 | Medium | 6.3 | 2026-09-04 | A weakness has been identified in StackStorm st2 up to 3.9.0. This issue affects the function assert_user_is_admin_if_user_query_param_is_provided of the file… |
CVE-2026-15354 | Critical | 9.8 | 2026-09-04 | The ACPT (Premium) plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.66. This is due to missing authorizatio… |
CVE-2026-85154 | Critical | 9.8 | 2026-09-03 | WWBN AVideo contains an authentication failure vulnerability where the video_id_hash credential is a non-expiring, non-revocable bearer token that grants full… |
CVE-2026-84830 | | 2026-09-03 | SEPPmail Secure Email Gateway before 15.0.7 contains a command injection vulnerability that allows authenticated administrators to execute commands with elevat… | |
CVE-2026-84795 | Critical | 9.8 | 2026-09-02 | Craft CMS before 5.10.11 fails to validate the admin flag during user registration, allowing it to persist from deactivated admin accounts. Attackers can regis… |
CVE-2026-81583 | Medium | 5.4 | 2026-09-02 | The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site signups on multisite installations, allowi… |
CVE-2026-80467 | High | 8.1 | 2026-09-02 | The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms to the roles the for… |
CVE-2026-19453 | High | 7.1 | 2026-09-02 | The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the account it preserves across a restore or migration before grant… |
CVE-2026-9055 | Critical | 9.8 | 2026-09-02 | The Booking for Appointments and Events Calendar – Amelia (Premium) plugin for WordPress is vulnerable to Privilege Escalation in versions 8.0 - 9.6.2. This is… |
CVE-2026-84358 | Medium | 4.2 | 2026-09-02 | Improper privilege management in Downloads in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to spoof… |
CVE-2026-73779 | High | 8.2 | 2026-09-01 | Vulnerabilities have been identified in the operating system of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent exis… |
CVE-2026-73758 | Medium | 6.5 | 2026-09-01 | A privilege escalation vulnerability exists in the API endpoint of AOS-CX. Successful exploitation could allow an authenticated low privilege operator user to… |
CVE-2026-73755 | Medium | 5.7 | 2026-09-01 | A privilege escalation vulnerability exists in the API endpoint of AOS-CX. Successful exploitation could allow an authenticated low-privilege operator user, af… |
CVE-2026-73747 | Low | 2.5 | 2026-09-01 | A local privilege-escalation vulnerability has been discovered in HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low priv… |
CVE-2026-73740 | Medium | 4.4 | 2026-09-01 | A local privilege escalation vulnerability in HPE Networking Fabric Composer could allow an authenticated privileged user on the underlying host to elevate the… |
CVE-2026-73730 | Medium | 6.5 | 2026-09-01 | A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege op… |
CVE-2026-73729 | Medium | 6.5 | 2026-09-01 | A vulnerability in the underlying operating system of HPE Networking Fabric Composer could allow an authenticated low privilege operator user with local access… |
CVE-2026-73725 | High | 7.0 | 2026-09-01 | A local privilege-escalation vulnerability has been discovered in HPE Networking Fabric Composer. Successful exploitation of this vulnerability could allow a l… |
CVE-2026-73724 | High | 7.1 | 2026-09-01 | Privilege escalation vulnerabilities exist in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege ope… |
CVE-2026-73723 | High | 7.1 | 2026-09-01 | A privilege escalation vulnerability exists in the web-based management interface of HPE Networking Fabric Composer. Successful exploitation could allow an aut… |
CVE-2026-73714 | High | 7.6 | 2026-09-01 | A sensitive information disclosure vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low… |
CVE-2026-73713 | High | 7.8 | 2026-09-01 | Local privilege-escalation vulnerabilities have been discovered in HPE Networking Fabric Composer. Successful exploitation of these vulnerabilities could allow… |
CVE-2026-73711 | High | 8.1 | 2026-09-01 | A privilege escalation vulnerability exists in the API endpoint of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remot… |
CVE-2026-84115 | High | 8.3 | 2026-09-01 | A vulnerability was found in Cleo Harmony up to 5.8.1.10. The affected element is an unknown function of the file /api/connections of the component JWT Refresh… |
CVE-2026-18550 | Critical | 9.8 | 2026-09-01 | The Nokri - Job Board WordPress Theme for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.6.6. Thi… |
CVE-2026-79744 | High | 8.8 | 2026-08-31 | MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies… |
CVE-2026-82807 | High | 8.8 | 2026-08-31 | A vulnerability was determined in ieungSoft Ultra RAMDisk Pro 1.82. This issue affects some unknown processing in the library URDSCSI.sys of the component Kern… |
CVE-2026-82671 | Low | 3.4 | 2026-08-31 | A vulnerability has been found in IObit Unlocker 1.3.0.12. This vulnerability affects the function ZwTerminateProcess in the library IObitUnlocker.sys of the c… |
CVE-2026-82670 | Medium | 4.4 | 2026-08-31 | A flaw has been found in IObit Uninstaller 15.5.0.11. This affects the function IRP_MJ_DEVICE_CONTROL in the library IUForceDelete.sys of the component IOCTL H… |
CVE-2026-82860 | Critical | 9.8 | 2026-08-31 | @hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail. Attackers can craf… |
CVE-2026-82857 | Critical | 9.8 | 2026-08-31 | hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration IAM policy that allows role lifecycle operations on af-e2e… |
CVE-2026-82628 | High | 8.8 | 2026-08-31 | A vulnerability was found in Colorful iGameCenter 2.0.0.81. This vulnerability affects the function sub_11504 in the library WinRing0x64.sys of the component I… |
CVE-2026-81766 | Medium | 6.6 | 2026-08-30 | The Really Simple Security WordPress plugin before 9.8.0 does not check that the user is allowed to install Really Simple Security WordPress plugin before 9… |
CVE-2026-15369 | Critical | 9.8 | 2026-08-29 | The Custom User Registration Fields for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.3. This is… |
CVE-2026-16259 | Critical | 9.8 | 2026-08-29 | The Uix UserCenter WordPress plugin through 1.0.3 does not verify that the account being modified through an unauthenticated profile-update action belongs to t… |
CVE-2026-10522 | Critical | 9.8 | 2026-08-29 | The MemberHero WordPress plugin through 6.9 does not restrict which account fields can be supplied during its frontend registration process, allowing unauthen… |
CVE-2026-55485 | High | 8.8 | 2026-08-28 | Piccolo Admin is an admin interface and content management system for Python, built on top of Piccolo. Prior to 1.14.0, piccolo_admin/endpoints.py uses superus… |
CVE-2026-79996 | High | 7.2 | 2026-08-28 | The User Registration & Membership WordPress plugin before 5.2.6 does not perform a capability check when saving its login settings, allowing authenticated us… |
CVE-2026-19423 | High | 8.1 | 2026-08-28 | The Ultimate Member WordPress plugin before 2.13.0 does not validate a submitted role selection when it cannot resolve the set of roles a profile form permits… |
CVE-2026-78174 | | 2026-08-28 | WatchGuard Dimension records unredacted session identifiers for logged-in users in its web UI diagnostic log. A low-privileged Dimension Administrator can retr… | |
CVE-2026-37071 | Critical | 9.8 | 2026-08-27 | Arbitrary File Rename Leading to Privilege Escalation in Actions::renameFile() function in Veno File Manager Project 4.4.9 allows an authenticated attacker wit… |
CVE-2026-36102 | High | 7.2 | 2026-08-27 | An issue in the inviteController.js component in Bluewave Labs Checkmate <=3.3.0 allows remote authenticated administrators to escalate privileges to superadmi… |
CVE-2026-81818 | | 2026-08-27 | Affected versions of Flowintel contain an authorization flaw in the administrative user-edit API. The existing authorization check correctly prevented an org… | |
CVE-2026-13415 | High | 7.2 | 2026-08-27 | The CMP WordPress plugin before 4.1.18 does not enforce an option-name allow-list when importing settings via one of its AJAX actions, allowing users with the… |
CVE-2026-75977 | High | 8.8 | 2026-08-26 | The Mang Board WP plugin for WordPress is vulnerable to Missing Authorization via Authentication Cookie Forgery in all versions up to, and including, 2.3.7. Th… |
CVE-2026-19220 | Low | 3.7 | 2026-08-26 | The Forminator Forms WordPress plugin before 1.57.1 does not verify that site registration is enabled on the network before creating a site signup, allowing u… |
CVE-2026-79276 | Medium | 4.3 | 2026-08-25 | Improper privilege management in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system ac… |
CVE-2026-79226 | High | 8.8 | 2026-08-25 | Improper privilege management in Regional Capabilities in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypas… |
CVE-2026-79090 | Critical | 9.8 | 2026-08-25 | Improper privilege management in Actor in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access… |
CVE-2026-78999 | High | 8.3 | 2026-08-25 | Improper privilege management in Navigation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leve… |
CVE-2026-43657 | Low | 3.3 | 2026-08-25 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.5 and iPadOS 26.5. A malicious app may be able to enumerate insta… |
CVE-2026-75971 | High | 7.2 | 2026-08-25 | The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to Privilege Escalation in all versions… |
CVE-2026-12878 | High | 8.8 | 2026-08-25 | In affected versions of the Codefresh platform an authenticated user can utilize an API endpoint to elevate to Admin permissions. |
CVE-2026-77003 | Low | 2.7 | 2026-08-23 | The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as l… |
CVE-2026-13598 | Critical | 9.8 | 2026-08-23 | The RestrictMate WordPress plugin before 1.3.0 does not restrict the user role supplied during account registration, allowing unauthenticated attackers to cre… |
CVE-2026-16149 | High | 8.8 | 2026-08-23 | The Security Hardener plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.4. The vulnerability exists because… |
CVE-2026-19222 | Medium | 6.6 | 2026-08-22 | The Forminator Forms WordPress plugin before 1.57.0.7 does not consistently enforce the role restriction it applies to registration forms, allowing users who… |
CVE-2026-19883 | High | 8.8 | 2026-08-22 | The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing c… |