CWE-269 · Improper Privilege Management (page 5)
Page 5 of 32 — CVEs classified under CWE-269, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-12018 | High | 8.8 | 2026-06-11 | Inappropriate implementation in Mojo in Google Chrome on Windows prior to 149.0.7827.115 allowed a local attacker to perform OS-level privilege escalation via… |
CVE-2026-45176 | High | 7.8 | 2026-06-11 | Idira Endpoint Privilege Manager Agent versions prior to 26.5 exhibit improper access control within high-privileged agent components. A local, low-privileged… |
CVE-2025-31272 | High | 7.8 | 2026-06-11 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4. An app may be able to bypass launch constraint protections and execute… |
CVE-2026-50570 | High | 8.5 | 2026-06-10 | Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version… |
CVE-2026-50566 | Critical | 9.9 | 2026-06-10 | Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version… |
CVE-2026-50565 | Medium | 4.9 | 2026-06-10 | Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version… |
CVE-2026-50564 | Critical | 9.9 | 2026-06-10 | Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version… |
CVE-2026-50563 | Critical | 9.9 | 2026-06-10 | Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version… |
CVE-2026-50545 | Critical | 9.9 | 2026-06-10 | Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version… |
CVE-2026-46618 | | 2026-06-10 | Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version… | |
CVE-2026-46617 | | 2026-06-10 | Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version… | |
CVE-2025-6254 | Critical | 9.8 | 2026-06-10 | The Doctreat Core plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.6.8. This is due to the doctreat_process_r… |
CVE-2026-11616 | High | 8.8 | 2026-06-09 | The Events Calendar for GeoDirectory plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 2.3.28. This is due to the ajax… |
CVE-2026-44119 | Medium | 5.5 | 2026-06-08 | Improper Privilege Management vulnerability in Apache HTTP Server 2.4.67 and earlier allows local .htaccess authors to read files with the privileges of the ht… |
CVE-2026-11423 | | 2026-06-05 | A path traversal vulnerability exists in the Altium Enterprise Server Collaboration Service due to improper handling of user-supplied filenames in the MCAD and… | |
CVE-2025-5088 | High | 8.3 | 2026-06-05 | An authenticated Redis session could be used to obtain full root access to all servers in the CVX cluster. Note that this would require an attacker to have bot… |
CVE-2026-11308 | Medium | 6.3 | 2026-06-05 | Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to… |
CVE-2026-11296 | High | 7.5 | 2026-06-05 | Inappropriate implementation in ImageCapture in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to perf… |
CVE-2026-11295 | High | 8.8 | 2026-06-05 | Inappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform privilege escalation via a craf… |
CVE-2026-11276 | Medium | 5.1 | 2026-06-05 | Inappropriate implementation in Cast in Google Chrome prior to 149.0.7827.53 allowed an attacker on the local network segment to bypass discretionary access co… |
CVE-2026-11229 | Medium | 6.1 | 2026-06-04 | Inappropriate implementation in Enterprise in Google Chrome prior to 149.0.7827.53 allowed a local attacker to perform privilege escalation via physical access… |
CVE-2026-11108 | High | 8.8 | 2026-06-04 | Inappropriate implementation in NFC in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform privilege escalation via a crafted… |
CVE-2026-11103 | High | 7.8 | 2026-06-04 | Inappropriate implementation in Installer in Google Chrome on Windows prior to 149.0.7827.53 allowed a local attacker to perform OS-level privilege escalation… |
CVE-2026-10868 | | 2026-06-04 | A mass assignment vulnerability exists in the MISP user edit functionality due to insufficient filtering of user-supplied fields in UsersController::edit(). Wh… | |
CVE-2026-49189 | High | 7.8 | 2026-06-04 | Unchecked public access permissions on a core Broadcast Receiver allow unauthorized local software components to invoke administrative operations. |
CVE-2026-8206 | Critical | 9.8 | 2026-06-02 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions… |
CVE-2026-28586 | Low | 3.3 | 2026-06-01 | In multiple functions of AppOpsService.java, there is a possible missing permission check due to a permissions bypass. This could lead to local information dis… |
CVE-2026-0091 | High | 7.8 | 2026-06-01 | In multiple locations, there is a possible way to execute code in the launcher process due to an over-privileged shell user. This could lead to local escalatio… |
CVE-2026-0089 | High | 7.8 | 2026-06-01 | In multiple functions of PackageInstallerService.java, there is a possible way to install unverified apps due to a missing permission check. This could lead to… |
CVE-2026-0086 | Medium | 6.8 | 2026-06-01 | In onCreate of DisableSupervisionActivity.kt, there is a possible way to delete supervision data due to a missing null check. This could lead to local escalati… |
CVE-2026-0055 | Medium | 6.2 | 2026-06-01 | In createSessionInternal of PackageInstallerService.java, there is a possible to update a Device Policy Controller (DPC) into an invalid directory due to a pat… |
CVE-2026-0050 | Low | 3.3 | 2026-06-01 | In handleBondStateChanged of AdapterService.java, there is a possible sensitive information disclosure due to a permissions bypass. This could lead to local in… |
CVE-2026-0048 | Medium | 6.8 | 2026-06-01 | In hide of WindowState.java, there is a possible way to trick the user into approving permissions due to a tapjacking/overlay attack. This could lead to local… |
CVE-2026-0046 | Medium | 6.2 | 2026-06-01 | In InputInterceptor of Letterbox.java, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack. This could lead… |
CVE-2026-0016 | Low | 3.3 | 2026-06-01 | In updateProvidersWhenServiceRemoved of CredentialManagerService.java, there is a possible way to override settings across users due to a permissions bypass. T… |
CVE-2026-0009 | High | 7.8 | 2026-06-01 | In multiple locations, there is a possible tapjacking due to a logic error in the code. This could lead to local escalation of privilege with no additional exe… |
CVE-2026-10217 | Medium | 6.3 | 2026-06-01 | A flaw has been found in nextlevelbuilder GoClaw up to 3.11.3. The impacted element is the function handleSave of the file internal/http/tts_config.go of the c… |
CVE-2026-48210 | Medium | 5.7 | 2026-05-31 | An improper default configuration in OTRS 2026.3.1 causes ticket article forwarding actions to enforce the “Is visible for customer” flag by default and preven… |
CVE-2026-7465 | High | 8.8 | 2026-05-30 | The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and incl… |
CVE-2026-47744 | Critical | 9.9 | 2026-05-29 | Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, two distinct authorization defects in the team settings allowed any authenticated panel user to t… |
CVE-2026-45632 | Critical | 9.9 | 2026-05-29 | Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.26.7 and earlier, the schedule router does not enforce organization/role checks. As a resul… |
CVE-2026-45043 | | 2026-05-29 | RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, improper validation in the PUT /rustfs/admin/v3/import-iam endpoint allows… | |
CVE-2026-9999 | High | 8.8 | 2026-05-28 | Inappropriate implementation in ANGLE in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via… |
CVE-2026-9918 | Critical | 9.6 | 2026-05-28 | Inappropriate implementation in Tint in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted H… |
CVE-2026-9892 | High | 8.3 | 2026-05-28 | Inappropriate implementation in Skia in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to… |
CVE-2026-8809 | Critical | 9.8 | 2026-05-28 | The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Privilege Escalation via Validation Bypass in all versions up to and including 0.9.2… |
CVE-2026-46837 | High | 8.8 | 2026-05-28 | Vulnerability in the Oracle Flow Manufacturing product of Oracle E-Business Suite (component: Security). Supported versions that are affected are 12.2.9-12.2… |
CVE-2026-46827 | High | 8.8 | 2026-05-28 | Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Self Service Manager). Supported versions that are affected are 12.2.3-12.2… |
CVE-2026-46824 | Critical | 9.9 | 2026-05-28 | Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Site Level Administration). Supported versions t… |
CVE-2026-46817 | Critical | 9.8 | 2026-05-28 | Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.1… |
CVE-2026-44543 | High | 8.7 | 2026-05-28 | Local Path Provisioner provides a way for the Kubernetes users to utilize the local storage in each node. Prior to 0.0.36, a malicious user with permission to… |
CVE-2026-8980 | | 2026-05-28 | The Mennekes Amtron series (firmware versions ≤ 5.22.3) is vulnerable to privilege escalation. An authenticated low-privileged user can change the passwords of… | |
CVE-2026-6226 | High | 8.8 | 2026-05-28 | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthenticated privilege escalation in versions up to and including 3.29.2. This is due… |
CVE-2026-9789 | | 2026-05-28 | A Local Privilege Escalation (LPE) vulnerability affects Acer NitroSense software versions prior to 3.01.3052. The vulnerability stems from the the PSAdminAgen… | |
CVE-2026-33552 | Low | 3.7 | 2026-05-27 | Northern.tech Mender Enterprise Server before 4.1.1 has Incorrect Access Control. |
CVE-2026-46424 | Medium | 4.2 | 2026-05-27 | Budibase is an open-source low-code platform. Prior to 3.38.2, the public API role unassignment endpoint (POST /api/public/v1/roles/unassign) updates user docu… |
CVE-2026-45716 | High | 8.8 | 2026-05-27 | Budibase is an open-source low-code platform. Prior to 3.38.1, the POST /api/global/users/onboard endpoint is protected by workspaceBuilderOrAdmin middleware… |
CVE-2026-48926 | Medium | 4.3 | 2026-05-27 | Jenkins Job Import Plugin 143.v044a_2e819b_27 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permiss… |
CVE-2026-48923 | Medium | 4.3 | 2026-05-27 | Jenkins AppSpider Plugin 1.0.17 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read… |
CVE-2026-8787 | High | 8.8 | 2026-05-27 | The Firebase Support & Chat Management plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.1.1. This is due to t… |
CVE-2025-43306 | High | 7.8 | 2026-05-26 | A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. A malicious app may be able to… |
CVE-2026-9490 | Medium | 5.5 | 2026-05-25 | A security vulnerability has been identified in Acer Care Center where the ACCSvc service creates a Named Pipe with a weak Security Descriptor. This vulnerabil… |
CVE-2026-9489 | | 2026-05-25 | NitroSense 3.x before 3.01.3052 contains Local Privilege Escalation (LPE) vulnerability.The program exposes a Windows Named Pipe that uses a custom protocol to… | |
CVE-2026-6898 | High | 8.8 | 2026-05-23 | The Wishlist Member plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'WishListMember3_Hooks::ge… |
CVE-2026-6897 | High | 8.8 | 2026-05-23 | The Wishlist Member plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'WishListMember\Features\T… |
CVE-2026-6895 | High | 8.8 | 2026-05-23 | The WishList Member plugin for WordPress is vulnerable to Missing Authorization leading to Sensitive Information Disclosure and Privilege Escalation in version… |
CVE-2026-6419 | High | 8.8 | 2026-05-23 | The WishList Member plugin for WordPress is vulnerable to Privilege Escalation via Missing Authorization in versions up to and including 3.30.1. This is due to… |
CVE-2026-23663 | High | 7.5 | 2026-05-22 | Improper privilege management in Azure Entra ID allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-40172 | High | 8.1 | 2026-05-22 | authentik is an open-source identity provider. In versions prior to 2025.12.5 and 2026.2.0-rc1 through 2026.2.2, the PATCH /api/v3/core/users/{pk}/ API allows… |
CVE-2026-9018 | High | 8.8 | 2026-05-22 | The Easy Elements for Elementor – Addons & Website Templates plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1… |
CVE-2026-8327 | Medium | 4.3 | 2026-05-21 | Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass. The user-profile edit controller pass… |
CVE-2026-5118 | Critical | 9.8 | 2026-05-21 | The Divi Form Builder plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.2. This is due to the plugin accepting a… |
CVE-2026-45254 | Medium | 6.5 | 2026-05-21 | In the case of the cap_net service, when a key present in the old limit was omitted from the new limit, the missing key was treated as "allow any" instead of b… |
CVE-2026-7467 | High | 8.8 | 2026-05-20 | The Read More & Accordion plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.5.7. This is due to the 'RadMoreAj… |
CVE-2026-7284 | Critical | 9.8 | 2026-05-20 | The Easy Elements for Elementor – Addons & Website Templates plugin for WordPress is vulnerable to privilege escalation via user registration in all versions u… |
CVE-2026-31070 | Critical | 9.8 | 2026-05-19 | The LalanaChami Pharmacy Management System (commit 5c3d028) allows unauthenticated remote attackers to escalate privileges by self-assigning an administrative… |
CVE-2026-8972 | High | 8.8 | 2026-05-19 | Privilege escalation in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 151 and Thunderbird 151. |
CVE-2026-8970 | High | 8.8 | 2026-05-19 | Privilege escalation in the Security component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. |
CVE-2026-8957 | High | 8.8 | 2026-05-19 | Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 14… |
CVE-2026-8955 | High | 8.8 | 2026-05-19 | Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. |
CVE-2026-8952 | High | 8.8 | 2026-05-19 | Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 151 and Thunderbird 151. |
CVE-2026-32323 | High | 7.3 | 2026-05-19 | Mullvad VPN is a VPN client app for desktop and mobile. When using macOS with versions 2026.1 and below, Mullvad VPN may allow local privilege escalation durin… |
CVE-2026-41085 | High | 8.8 | 2026-05-18 | Thermo Fisher Scientific Torrent Suite Dx through 5.14.2 has a privilege escalation vulnerability that may allow an authenticated user with limited access priv… |
CVE-2026-8719 | High | 8.8 | 2026-05-17 | The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Privilege Escalation in version 3.4.9. This is due to missi… |
CVE-2026-45395 | High | 7.2 | 2026-05-15 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, the tool update endpoint (POST /api/v1/tools… |
CVE-2026-45675 | High | 8.1 | 2026-05-15 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the LDAP and OAuth authentication flows use… |
CVE-2026-46333 | High | 7.1 | 2026-05-15 | In the Linux kernel, the following vulnerability has been resolved: ptrace: slightly saner 'get_dumpable()' logic The 'dumpability' of a task is fundamentall… |
CVE-2026-6228 | High | 8.8 | 2026-05-15 | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 3.28.36. This is due to insufficien… |
CVE-2025-62625 | | 2026-05-14 | Improper privilege management in the KVM key download component could allow an attacker to swap tokens and download sensitive keys, potentially resulting in un… | |
CVE-2026-5193 | Medium | 6.5 | 2026-05-14 | The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to privilege escalation in all versions up to, an… |
CVE-2026-44470 | High | 7.8 | 2026-05-13 | The Claude Desktop app gives you Claude Code with a graphical interface built for running multiple sessions side by side. Prior to 1.3834.0, the CoworkVMServic… |
CVE-2026-42289 | High | 8.8 | 2026-05-12 | ChurchCRM is an open-source church management system. Prior to 7.3.2, UserEditor.php processes user account creation and permission updates entirely through $_… |
CVE-2026-42844 | High | 8.8 | 2026-05-12 | Grav is a file-based Web platform. In Grav 2.0.0-beta.2, a low-privileged authenticated API user with api.media.write can abuse /api/v1/blueprint-upload to wri… |
CVE-2026-44224 | High | 8.8 | 2026-05-12 | Wiki.js is an open source wiki app built on Node.js. Prior to 2.5.313, the users.update GraphQL mutation accepts an arbitrary groups array and applies it direc… |
CVE-2026-44218 | Low | 3.0 | 2026-05-12 | ciguard is a static security auditor for CI/CD pipelines. From 0.1.0 to 0.8.1, the published ghcr.io/jo-jo98/ciguard container image inherits the default root… |
CVE-2026-33821 | High | 7.7 | 2026-05-12 | Improper privilege management in Microsoft Dynamics 365 Customer Insights allows an authorized attacker to elevate privileges over a network. |
CVE-2026-43886 | High | 8.2 | 2026-05-11 | Outline is a service that allows for collaborative documentation. From 0.84.0 to 1.6.1, a logic error in OAuthInterface.validateScope() uses Array.some() to va… |
CVE-2026-41489 | High | 8.8 | 2026-05-11 | Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.0 to before Core 6.4.2 and FTL 6.6.1… |
CVE-2026-28995 | High | 8.8 | 2026-05-11 | A logic issue was addressed with improved restrictions. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 2… |
CVE-2026-28976 | High | 7.5 | 2026-05-11 | An information leakage was addressed with additional validation. This issue is fixed in macOS Tahoe 26.5. An app may be able to gain root privileges. |