CWE-269 · Improper Privilege Management (page 4)
Page 4 of 32 — CVEs classified under CWE-269, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-50343 | High | 7.8 | 2026-07-14 | Improper privilege management in Microsoft Install Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-50295 | Medium | 5.5 | 2026-07-14 | Improper privilege management in Microsoft Windows DNS allows an authorized attacker to bypass a security feature locally. |
CVE-2026-49176 | High | 7.8 | 2026-07-14 | Improper privilege management in Windows WalletService allows an authorized attacker to elevate privileges locally. |
CVE-2026-53565 | | 2026-07-14 | Improper Privilege Management vulnerability in Citrix Secure Access Client for Windows, Citrix Citrix Endpoint Analysis Client for Windows. This issue affects… | |
CVE-2026-52533 | Critical | 9.8 | 2026-07-13 | An issue in D-Link DIR-1253 v.1.0.1.250923.142435 allows an attacker to escalate privileges via the etc/shadow component file |
CVE-2026-61463 | High | 8.8 | 2026-07-13 | Shiori contains a privilege escalation vulnerability in the account update endpoint that allows authenticated users to modify the owner field without authoriza… |
CVE-2026-59245 | High | 8.1 | 2026-07-13 | In the Apache Airflow FAB auth manager, a DAG whose `dag_id` is `DAGs` collided with the global all-DAGs permission resource name produced by `resource_name()`… |
CVE-2026-59260 | High | 8.8 | 2026-07-12 | OpenWrt luci-app-samba4 read ACL grants file.exec permission on /usr/sbin/smbd, allowing authenticated delegated users to execute the Samba daemon with caller-… |
CVE-2026-14262 | High | 8.8 | 2026-07-11 | The Simple JWT Login – Allows you to use JWT on REST endpoints. plugin for WordPress is vulnerable to Authentication Bypass to Privilege Escalation in all vers… |
CVE-2026-13756 | High | 8.8 | 2026-07-11 | The WP Grid Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.3.3. This is due to missing authorizatio… |
CVE-2026-55843 | Medium | 6.5 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.0, UsersController::update() passes a missing permission request field through NormalizePermiss… |
CVE-2026-51119 | Critical | 9.1 | 2026-07-10 | An issue in Invixium IXM WEB v.2.3.85.25 allows an attacker to escalate privileges via the /SystemUsers/CreateAppUser components |
CVE-2026-40009 | Medium | 6.5 | 2026-07-10 | Improper Privilege Management, Improper Access Control vulnerability in Apache IoTDB. Authenticated users can escalate to full tree-path access by renaming the… |
CVE-2026-44787 | High | 8.2 | 2026-07-09 | Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, the signup flow could allow newly registered users to set… |
CVE-2026-0276 | High | 7.8 | 2026-07-09 | A privilege escalation vulnerability in Palo Alto Networks Cortex® XDR Broker VM enables a locally authenticated user to perform actions as the root user. |
CVE-2026-0275 | Medium | 6.7 | 2026-07-09 | A local privilege escalation vulnerability in Palo Alto Networks Prisma® Browser allows a locally authenticated administrator with access to the macOS local fi… |
CVE-2026-54652 | High | 8.1 | 2026-07-08 | Frigate is an open source network video recorder. In version 0.17.1, the GET /api/logs/{service} endpoint allows any authenticated user including the viewer ro… |
CVE-2026-14250 | Medium | 6.3 | 2026-07-08 | The Themehunk Login Registration plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.0.2. This is due to the handle_… |
CVE-2026-9842 | High | 7.5 | 2026-07-08 | The Backstage - Customizer Demo Access plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2. This is due to t… |
CVE-2026-14482 | High | 8.8 | 2026-07-08 | The 多说社会化评论框 plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2. The vulnerability exists due to a missing ca… |
CVE-2026-58583 | High | 7.1 | 2026-07-07 | FluxInk (formerly Sunia SPB Peripheral) Color Management Driver (TcnPeripheral64.sys) 1.0.7.2 allows local privilege escalation for a standard user account via… |
CVE-2026-53645 | | 2026-07-06 | FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 allow a low-privileged staff account to grant arbitrary module… | |
CVE-2026-14719 | High | 7.3 | 2026-07-05 | A flaw has been found in SourceCodester Onlne Examination & Learning Management System 1.0. The impacted element is an unknown function of the file register.ph… |
CVE-2026-46680 | High | 7.8 | 2026-07-01 | containerd is an open-source container runtime. In versions prior to 1.7.32, 2.0.9, 2.2.4 and 2.3.1, containers launched with a numeric User directive that can… |
CVE-2026-13228 | High | 8.8 | 2026-07-01 | The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up… |
CVE-2026-12224 | High | 8.8 | 2026-07-01 | The Dokan Pro plugin for WordPress is vulnerable to privilege escalation via update_capabilities REST Endpoint in all versions up to, and including, 5.0.4. Th… |
CVE-2026-57995 | High | 8.8 | 2026-06-30 | phpMyFAQ before 4.1.5 contains a privilege escalation vulnerability in GroupController::updatePermissions that allows GROUP_EDIT administrators to grant arbitr… |
CVE-2026-14124 | High | 7.8 | 2026-06-30 | Inappropriate implementation in CredentialProvider in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to perform OS-level privilege es… |
CVE-2026-14101 | Critical | 9.6 | 2026-06-30 | Insufficient policy enforcement in Sandbox in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to… |
CVE-2025-7406 | High | 7.8 | 2026-06-30 | Nokia MantaRay NM is vulnerable to a sudo privilege escalation vulnerability where a local attacker possessing administrative (local admin) privileges can esca… |
CVE-2026-58053 | Critical | 9.9 | 2026-06-28 | Gitea act_runner with the Docker backend (through act 0.262.0) passes a workflow's container.options string to the Docker job container's HostConfig and, when… |
CVE-2026-12415 | Critical | 9.8 | 2026-06-27 | The Invoice Generator plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the pravel_invoice_edit_account() AJAX ac… |
CVE-2026-45256 | Medium | 5.5 | 2026-06-26 | When used to deliver a signal to a specific thread, thr_kill2(2) called p_cansignal() to determine whether the operation was permitted but did not check the re… |
CVE-2026-52808 | High | 7.1 | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, three API endpoints — PATCH /api/v1/repos/:owner/:repo/issue-tracker, PATCH /api/v1/repos/:own… |
CVE-2026-56245 | High | 8.2 | 2026-06-24 | Supabase Capgo before 12.128.2 contains an authorization bypass vulnerability in the SECURITY DEFINER record_build_time RPC function that allows unauthenticate… |
CVE-2026-54319 | Medium | 4.2 | 2026-06-23 | Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.186, a sandbox volume reference (volumeI… |
CVE-2026-56225 | High | 8.3 | 2026-06-23 | Capgo before 12.128.2 contains an authorization bypass vulnerability in its public API key management handlers (get/put/delete/post). API keys created with mod… |
CVE-2026-54099 | High | 8.8 | 2026-06-22 | A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. The WICD CSR auto-approver validates that a Certificat… |
CVE-2026-8157 | High | 8.8 | 2026-06-22 | The Vitepos WordPress plugin before 3.4.2 does not properly restrict the roles that can be assigned when creating new users via one of its REST API endpoints… |
CVE-2026-56239 | High | 7.6 | 2026-06-21 | Capgo before 12.128.2 contains a potential privilege escalation vulnerability in the public.apply_usage_overage SECURITY DEFINER function, which performs sensi… |
CVE-2026-56216 | High | 8.8 | 2026-06-20 | Capgo before 12.128.2 contains a scope escalation vulnerability in the POST /functions/v1/apikey endpoint that allows app-limited API keys to mint unrestricted… |
CVE-2026-56212 | Low | 3.8 | 2026-06-20 | Capgo before 12.128.2 contains an authentication logic flaw: a user with permission to manage team or organization security settings can enable mandatory two-f… |
CVE-2026-50201 | Medium | 6.5 | 2026-06-17 | Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Management.Endpoint pr… |
CVE-2026-20246 | Medium | 6.0 | 2026-06-17 | A vulnerability in the vmadmin CLI of Cisco Umbrella Virtual Appliance could allow an authenticated, local attacker to elevate privileges on an affected device… |
CVE-2026-54415 | High | 8.1 | 2026-06-17 | Missing Authorization in the server management routes (routes/admin.php) in Azuriom Azuriom CMS before 1.2.11 on all platforms allows an authenticated attacker… |
CVE-2026-12450 | Medium | 6.5 | 2026-06-17 | Inappropriate implementation in Media in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to obtain potentially sensitive information from proce… |
CVE-2026-12448 | High | 8.8 | 2026-06-17 | Inappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker to perform privilege escalation via a cra… |
CVE-2026-12165 | High | 8.8 | 2026-06-17 | The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Privilege Escalation in all versions up to… |
CVE-2026-0063 | High | 7.8 | 2026-06-17 | In setAllowedCarriers of PhoneInterfaceManager.java, there is a possible way to disable carrier restrictions due to a logic error in the code. This could lead… |
CVE-2026-0019 | High | 7.8 | 2026-06-17 | In SettingsLib, there is a possible way to disable system components due to a logic error in the code. This could lead to local escalation of privilege with no… |
CVE-2026-46973 | High | 8.8 | 2026-06-17 | Vulnerability in the Oracle Outsourced Mfg for Discrete Industries product of Oracle E-Business Suite (component: Internal Operations). Supported versions tha… |
CVE-2026-46972 | High | 8.8 | 2026-06-17 | Vulnerability in the Oracle Outsourced Mfg for Discrete Industries product of Oracle E-Business Suite (component: Internal Operations). Supported versions tha… |
CVE-2026-46971 | High | 7.5 | 2026-06-17 | Vulnerability in the Oracle HR Intelligence product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2… |
CVE-2026-46970 | High | 7.2 | 2026-06-17 | Vulnerability in the Oracle HR Intelligence product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2… |
CVE-2026-46966 | High | 7.5 | 2026-06-17 | Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Site Level Administration). Supported versions t… |
CVE-2026-46964 | Critical | 9.9 | 2026-06-17 | Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Site Level Administration). Supported versions t… |
CVE-2026-46962 | High | 8.8 | 2026-06-17 | Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affect… |
CVE-2026-46961 | High | 8.8 | 2026-06-17 | Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affect… |
CVE-2026-46959 | High | 7.5 | 2026-06-17 | Vulnerability in the Oracle Subledger Accounting product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are… |
CVE-2026-46958 | High | 7.5 | 2026-06-17 | Vulnerability in the Oracle Subledger Accounting product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are… |
CVE-2026-46953 | High | 7.2 | 2026-06-17 | Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: UK Payroll). Supported versions that are affected are 12.2.3-12.2.15. Eas… |
CVE-2026-46952 | High | 8.8 | 2026-06-17 | Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2… |
CVE-2026-46951 | High | 8.8 | 2026-06-17 | Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2… |
CVE-2026-46942 | High | 8.8 | 2026-06-17 | Vulnerability in the Oracle Process Manufacturing Process Planning product of Oracle E-Business Suite (component: Internal Operations). Supported versions tha… |
CVE-2026-46940 | High | 8.8 | 2026-06-17 | Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning). Supported versions that are affected are 12.2.3-12… |
CVE-2026-46937 | High | 8.8 | 2026-06-17 | Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger Update Transform, Reports). Supported versions that are affec… |
CVE-2026-46935 | High | 7.5 | 2026-06-17 | Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite (component: Internal Operations). Supported versions t… |
CVE-2026-46934 | High | 7.5 | 2026-06-17 | Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite (component: Internal Operations). Supported versions t… |
CVE-2026-46933 | Critical | 9.9 | 2026-06-17 | Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are… |
CVE-2026-46929 | High | 8.8 | 2026-06-17 | Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning). Supported versions that are affected are 12.2.3-12… |
CVE-2026-46928 | High | 8.8 | 2026-06-17 | Vulnerability in the Oracle Spares Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12… |
CVE-2026-46922 | High | 7.2 | 2026-06-17 | Vulnerability in the Oracle HR Intelligence product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2… |
CVE-2026-46921 | High | 8.8 | 2026-06-17 | Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 17… |
CVE-2026-46916 | High | 8.8 | 2026-06-17 | Vulnerability in the Oracle Process Manufacturing Product Development product of Oracle E-Business Suite (component: Quality Management Specs). Supported vers… |
CVE-2026-46914 | High | 7.1 | 2026-06-17 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystem). The supported version that is affected is 11.4. Easily exploitable vul… |
CVE-2026-46903 | High | 8.8 | 2026-06-17 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infrastructure Security). Supported versions that… |
CVE-2026-46901 | Critical | 9.9 | 2026-06-17 | Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core). Supported versions that are affected are… |
CVE-2026-46900 | Critical | 9.9 | 2026-06-17 | Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core). Supported versions that are affected are… |
CVE-2026-46899 | Critical | 9.6 | 2026-06-17 | Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core). Supported versions that are affected are… |
CVE-2026-46895 | Critical | 9.9 | 2026-06-17 | Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core). Supported versions that are affected are… |
CVE-2026-46893 | Critical | 9.9 | 2026-06-17 | Vulnerability in the JD Edwards EnterpriseOne General Ledger product of Oracle JD Edwards (component: E1 Foundation). The supported version that is affected… |
CVE-2026-46885 | High | 8.8 | 2026-06-17 | Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: EAI). Supported versions that are affected are 17.0-26.5. Easily exploita… |
CVE-2026-46877 | Medium | 6.0 | 2026-06-17 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA device). The supported version that is affected is 7.2.8. Easil… |
CVE-2026-46873 | High | 7.5 | 2026-06-17 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA device). The supported version that is affected is 7.2.8. Diffi… |
CVE-2026-46867 | High | 7.2 | 2026-06-17 | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Extensibility Framework). Supported versions tha… |
CVE-2026-46852 | Critical | 9.9 | 2026-06-17 | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin). Supported versions that are af… |
CVE-2026-46804 | High | 8.7 | 2026-06-17 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 14.1… |
CVE-2026-46794 | Critical | 9.9 | 2026-06-17 | Vulnerability in the Identity Manager Connector product of Oracle Fusion Middleware (component: Generic Unix Connector). Supported versions that are affected… |
CVE-2026-35291 | Medium | 6.6 | 2026-06-17 | Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 14.1.2.0.0 and 15.1.1… |
CVE-2026-35288 | High | 8.2 | 2026-06-17 | Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Deployment Package). Supported versions that are affected a… |
CVE-2026-35272 | High | 8.4 | 2026-06-17 | Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Deployment Package). Supported versions that are affected a… |
CVE-2024-38487 | High | 7.0 | 2026-06-16 | api-gateway container running with root privilege would allow an attacker to escape the container and access host system to perform unintended actions. |
CVE-2026-12313 | Medium | 4.7 | 2026-06-16 | Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderb… |
CVE-2026-12289 | High | 8.8 | 2026-06-16 | Privilege escalation in the Graphics: WebRender component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152… |
CVE-2026-8176 | High | 7.5 | 2026-06-16 | The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up… |
CVE-2025-9912 | Medium | 6.3 | 2026-06-16 | Nokia SR Linux is vulnerable to a local privilege escalation vulnerability. Successful exploitation of this vulnerability may allow an authenticated user to ex… |
CVE-2026-39118 | High | 8.4 | 2026-06-15 | An issue in Iru, Inc Kandji Agent before v.4.7.5(5374) allows a local attacker to escalate privileges via a client validation gap to invoke restricted agent fu… |
CVE-2026-36213 | High | 7.8 | 2026-06-15 | An issue in Microvirt MEmu Android Emulator 9.2.7.0 allows a local attacker to escalate privileges via the MemuService.exe component. |
CVE-2026-12217 | High | 7.8 | 2026-06-15 | A security vulnerability has been detected in DVDFab Virtual Drive 2.0.0.5. Impacted is an unknown function in the library dvdfabio.sys of the component Signed… |
CVE-2026-46716 | Critical | 9.9 | 2026-06-12 | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to before version 2.0.8, a RoleMember user c… |