CVE-2026-58416 | High | 7.1 | 2026-08-13 | Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard) |
CVE-2026-73239 | Medium | 6.5 | 2026-08-12 | Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types in Apache Allura.
This issue affects Apache Allura: befor… |
CVE-2026-18860 | High | 8.7 | 2026-08-11 | Velociraptor allows multi-tenant deployments named "Orgs".
By default Velociraptor, uses the ROOT org, but users can create child orgs for other tenants withi… |
CVE-2026-11804 | Medium | 5.2 | 2026-07-23 | Improper handling of insufficient permissions or privileges vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Secur… |
CVE-2026-62393 | Medium | 4.3 | 2026-07-14 | Improper Handling of Insufficient Permissions or Privileges vulnerability in Apache Kylin. Improper authorization in job information retrieval, where an attack… |
CVE-2026-45196 | High | 7.8 | 2026-07-10 | Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a GPU register access which can lead to privil… |
CVE-2026-54262 | Medium | 4.3 | 2026-07-01 | Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, a low-level user with the "Can submit transla… |
CVE-2026-54261 | Medium | 6.5 | 2026-07-01 | Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, due to a missing permission check on the imag… |
CVE-2026-54259 | Medium | 4.3 | 2026-07-01 | Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, the Documents and Images chooser's chosen end… |
CVE-2026-20463 | Medium | 6.7 | 2026-07-01 | In Modem, there is a possible escalation of privilege due to a permissions bypass. This could lead to local escalation of privilege if a malicious actor has al… |
CVE-2026-45195 | High | 7.8 | 2026-06-26 | Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a memory read or write outside the permitted r… |
CVE-2026-41566 | | | 2026-06-25 | Improper Handling of Insufficient Permissions or Privileges vulnerability in Apache Kvrocks.
This issue affects Apache Kvrocks: 2.8.0.
Users are recommended… |
CVE-2026-40371 | High | 8.8 | 2026-06-09 | Improper handling of insufficient permissions or privileges in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to elevate privileges over a… |
CVE-2026-11764 | | | 2026-06-09 | When creating an export of all reusable media, the secrets of connected
gift cards were included in the export even if the user creating the
export does not… |
CVE-2026-10549 | | | 2026-06-02 | LDAP filter injection vulnerability in Yandex Database prior to 25.3.1.25 allows a remote attacker with valid LDAP credentials to bypass group membership check… |
CVE-2026-9792 | Medium | 6.5 | 2026-05-28 | A flaw was found in Keycloak's Client Policies, specifically within the `org.keycloak.protocol.oidc` component. When certain condition providers (client-type… |
CVE-2026-46054 | High | 7.1 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved:
selinux: fix overlayfs mmap() and mprotect() access checks
The existing SELinux security… |
CVE-2026-2340 | Medium | 6.5 | 2026-05-27 | A flaw was found in Samba’s vfs_worm module. The module is intended to provide write-once, read-many (WORM) protections by preventing modification of files aft… |
CVE-2026-44201 | Medium | 5.3 | 2026-05-11 | Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in p… |
CVE-2026-44200 | Medium | 6.5 | 2026-05-11 | Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to pages could copy a page… |
CVE-2026-44199 | Medium | 6.5 | 2026-05-11 | Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to form pages could delete… |
CVE-2026-44198 | Medium | 4.3 | 2026-05-11 | Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could still… |
CVE-2026-44197 | Medium | 6.5 | 2026-05-11 | Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access… |
CVE-2026-6805 | High | 7.5 | 2026-05-07 | Vulnerability on the external sharing feature in Cryptobox allows an attacker knowing a sharing link URL to retrieve information from the server allowing an of… |
CVE-2026-20448 | Medium | 6.7 | 2026-05-04 | In geniezone, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege if a malicious ac… |
CVE-2026-21733 | High | 7.3 | 2026-04-17 | Software installed and run as a non-privileged user may conduct improper GPU system calls to gain write permission to read-only wrapped user-mode memory and fi… |
CVE-2026-27910 | High | 7.8 | 2026-04-14 | Improper handling of insufficient permissions or privileges in Windows Installer allows an authorized attacker to elevate privileges locally. |
CVE-2026-24096 | High | 8.8 | 2026-04-01 | Insufficient permission validation on multiple REST API Quick Setup endpoints in Checkmk 2.5.0 (beta) before version 2.5.0b2 and 2.4.0 before version 2.4.0p25… |
CVE-2026-2123 | High | 7.8 | 2026-03-31 | A security audit identified a privilege escalation
vulnerability in Operations Agent(<=OA 12.29) on Windows. Under specific conditions
Operations Agent may run… |
CVE-2026-3190 | Medium | 4.3 | 2026-03-26 | A flaw was found in Keycloak. The User-Managed Access (UMA) 2.0 Protection API endpoint for permission tickets fails to enforce the `uma_protection` role check… |
CVE-2026-21736 | Medium | 4.4 | 2026-03-09 | Software installed and run as a non-privileged user may conduct improper GPU system calls to gain write permission to read-only wrapped user-mode memory.
This… |
CVE-2026-0047 | High | 8.4 | 2026-03-02 | In dumpBitmapsProto of ActivityManagerService.java, there is a possible way for an app to access private information due to a missing permission check. This co… |
CVE-2026-1772 | Medium | 5.3 | 2026-02-24 | RTU500 web interface: An unprivileged user can read user management information. The information cannot be accessed via the RTU500 web user interface but requi… |
CVE-2026-23857 | High | 8.2 | 2026-02-12 | Dell Update Package (DUP) Framework, versions 23.12.00 through 24.12.00, contains an Improper Handling of Insufficient Permissions or Privileges vulnerability… |
CVE-2025-67848 | High | 8.1 | 2026-02-03 | A flaw was found in Moodle. This authentication bypass vulnerability allows suspended users to authenticate through the Learning Tools Interoperability (LTI) P… |
CVE-2026-20817 | High | 7.8 | 2026-01-13 | Improper handling of insufficient permissions or privileges in Windows Error Reporting allows an authorized attacker to elevate privileges locally. |
CVE-2025-46066 | Critical | 9.9 | 2026-01-12 | An issue in Automai Director v.25.2.0 allows a remote attacker to escalate privileges |
CVE-2025-64997 | Medium | 6.5 | 2025-12-18 | Insufficient permission validation in Checkmk versions prior to 2.4.0p17 and 2.3.0p42 allow low-privileged users to view agent information via the REST API, wh… |
CVE-2025-43527 | High | 7.8 | 2025-12-12 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.3, macOS Tahoe 26.2. An app may be able to gain root… |
CVE-2025-58770 | High | 8.8 | 2025-12-12 | APTIOV contains a vulnerability in BIOS where a user may cause “Improper Handling of Insufficient Permissions or Privileges” by local access. Successful exploi… |
CVE-2025-58122 | Medium | 5.4 | 2025-11-18 | Insufficient permission validation in Checkmk 2.4.0 before version 2.4.0p16 allows low-privileged users to modify notification parameters via the REST API, whi… |
CVE-2025-58121 | Medium | 5.4 | 2025-11-18 | Insufficient permission validation on multiple REST API endpoints in Checkmk 2.2.0, 2.3.0, and 2.4.0 before version 2.4.0p16 allows low-privileged users to per… |
CVE-2025-58410 | High | 7.5 | 2025-11-17 | Software installed and run as a non-privileged user may conduct improper GPU system calls to gain write permissions to memory buffers exported as read-only.
T… |
CVE-2025-62510 | High | 8.1 | 2025-10-20 | FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. In version 1.4.0, a regression allowed folder visibilit… |
CVE-2025-62509 | High | 8.1 | 2025-10-20 | FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to version 1.4.0, a business logic flaw in FileRi… |
CVE-2025-62176 | Medium | 4.3 | 2025-10-13 | Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon before 4.4.6, 4.3.14, and 4.2.27, the streaming server accepts serving… |
CVE-2025-45376 | High | 7.5 | 2025-09-29 | Dell Repository Manager (DRM), versions 3.4.7 and 3.4.8, contains an Improper Handling of Insufficient Permissions or Privileges vulnerability. A low privilege… |
CVE-2025-58457 | Medium | 4.3 | 2025-09-24 | Improper permission check in ZooKeeper AdminServer lets authorized clients to run snapshot and restore command with insufficient permissions.
This issue affec… |
CVE-2025-59040 | Medium | 4.3 | 2025-09-18 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. Backlog item representations do not verify the permissions of… |
CVE-2025-50170 | High | 7.8 | 2025-08-12 | Improper handling of insufficient permissions or privileges in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges local… |
CVE-2025-6573 | Critical | 9.8 | 2025-08-09 | Kernel software installed and running inside an untrusted/rich execution environment (REE) could leak information from the trusted execution environment (TEE). |
CVE-2025-8109 | High | 8.8 | 2025-08-04 | Software installed and run as a non-privileged user may conduct ptrace system calls to issue writes to GPU origin read only memory. |
CVE-2025-49731 | Low | 3.1 | 2025-07-08 | Improper handling of insufficient permissions or privileges in Microsoft Teams allows an authorized attacker to elevate privileges over a network. |
CVE-2025-27025 | High | 8.8 | 2025-07-02 | The target device exposes a service on a specific TCP port with a configured
endpoint. The access to that endpoint is granted using a Basic Authentication
me… |
CVE-2025-27024 | Medium | 6.5 | 2025-07-02 | Unrestricted access to OS file system in SFTP service in Infinera G42
version R6.1.3 allows remote authenticated users to read/write OS files
via SFTP connec… |
CVE-2025-46708 | Medium | 4.3 | 2025-06-27 | Software installed and running inside a Guest VM may conduct improper GPU system calls to prevent other Guests from running work on the GPU. |
CVE-2025-22256 | Medium | 6.3 | 2025-06-10 | A improper handling of insufficient permissions or privileges in Fortinet FortiPAM 1.4.0 through 1.4.1, 1.3.0, 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3… |
CVE-2025-25179 | High | 7.8 | 2025-06-02 | Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical memory pages. |
CVE-2025-3931 | High | 7.8 | 2025-05-14 | A flaw was found in Yggdrasil, which acts as a system broker, allowing the processes to communicate to other children's "worker" processes through the DBus com… |
CVE-2025-29826 | High | 7.3 | 2025-05-13 | Improper handling of insufficient permissions or privileges in Microsoft Dataverse allows an authorized attacker to elevate privileges over a network. |
CVE-2025-30453 | High | 7.8 | 2025-05-12 | The issue was addressed with additional permissions checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. A malicious a… |
CVE-2025-46740 | High | 7.5 | 2025-05-12 | An authenticated user without user administrative permissions could change the administrator Account Name. |
CVE-2025-46584 | High | 7.8 | 2025-05-06 | Vulnerability of improper authentication logic implementation in the file system module
Impact: Successful exploitation of this vulnerability may affect servic… |
CVE-2025-31173 | High | 8.8 | 2025-04-07 | Memory write permission bypass vulnerability in the kernel futex module
Impact: Successful exploitation of this vulnerability may affect service confidentialit… |
CVE-2025-31172 | High | 7.8 | 2025-04-07 | Memory write permission bypass vulnerability in the kernel futex module
Impact: Successful exploitation of this vulnerability may affect service confidentialit… |
CVE-2025-0468 | High | 7.1 | 2025-04-04 | Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical memory pages.
Under… |
CVE-2024-55604 | Medium | 4.3 | 2025-03-25 | Appsmith is a platform to build admin panels, internal tools, and dashboards. Users invited as "App Viewer" should not have access to development information o… |
CVE-2024-8315 | | | 2025-03-25 | An Improper Handling of Insufficient Permissions or Privileges vulnerability in scripts used in B&R APROL <4.4-00P5 may allow an authenticated local attacker t… |
CVE-2025-0478 | High | 7.8 | 2025-03-24 | Software installed and run as a non-privileged user may conduct improper GPU system calls to issue reads and writes to arbitrary physical memory pages.
Under… |
CVE-2024-51459 | High | 8.4 | 2025-03-19 | IBM InfoSphere Information Server 11.7 could allow a local user to execute privileged commands due to the improper handling of permissions. |
CVE-2025-27521 | Medium | 6.8 | 2025-03-04 | Vulnerability of improper access permission in the process management module
Impact: Successful exploitation of this vulnerability may affect service confident… |
CVE-2025-20649 | Medium | 6.5 | 2025-03-03 | In Bluetooth Stack SW, there is a possible information disclosure due to a missing permission check. This could lead to remote (proximal/adjacent) information… |
CVE-2024-6697 | Medium | 6.5 | 2025-02-20 | The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions… |
CVE-2025-24029 | Medium | 5.3 | 2025-02-03 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. Users (possibly anonymous ones if the widget is used in the da… |
CVE-2025-22129 | Medium | 4.3 | 2025-02-03 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. In affected versions an unauthorized user might get access to… |
CVE-2024-12430 | High | 7.0 | 2025-01-07 | An attacker who successfully exploited these vulnerabilities could cause enable command execution. A vulnerability exists in the AC500 V3 version mentioned. Af… |
CVE-2025-22395 | High | 8.2 | 2025-01-07 | Dell Update Package Framework, versions prior to 22.01.02, contain(s) a Local Privilege Escalation Vulnerability. A local low privileged attacker could potenti… |
CVE-2024-43705 | High | 7.8 | 2024-12-28 | Software installed and run as a non-privileged user can trigger the GPU kernel driver to write to arbitrary read-only system files that have been mapped into a… |
CVE-2024-42194 | Low | 3.1 | 2024-12-17 | An improper handling of insufficient permissions or privileges affects HCL BigFix Inventory. An attacker having access via a read-only account can possibly ch… |
CVE-2024-46874 | High | 8.1 | 2024-12-06 | Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could allow MQTT clients connecting with device credentials to send messages to some topics. A… |
CVE-2024-43702 | High | 8.1 | 2024-11-30 | Software installed and run as a non-privileged user may conduct improper GPU system calls to allow unprivileged access to arbitrary physical memory page. |
CVE-2024-4692 | Low | 2.4 | 2024-10-16 | Improper Validation of Specified Quantity in Input vulnerability in OpenText OpenText Application Automation Tools allows Exploiting Incorrectly Configured Acc… |
CVE-2024-4211 | Low | 2.4 | 2024-10-16 | Improper Validation of Specified Quantity in Input vulnerability in OpenText OpenText Application Automation Tools allows Exploiting Incorrectly Configured Acc… |
CVE-2024-47767 | Medium | 4.3 | 2024-10-14 | Tuleap is a tool for end to end traceability of application and system developments. Prior to Tuleap Community Edition 15.13.99.113, Tuleap Enterprise Edition… |
CVE-2024-47766 | Medium | 4.9 | 2024-10-14 | Tuleap is a tool for end to end traceability of application and system developments. Prior to Tuleap Community Edition 15.13.99.110, Tuleap Enterprise Edition… |
CVE-2024-46988 | Medium | 4.8 | 2024-10-14 | Tuleap is a tool for end to end traceability of application and system developments. Prior to Tuleap Community Edition 15.13.99.40, Tuleap Enterprise Edition 1… |
CVE-2024-24116 | Critical | 9.8 | 2024-10-02 | An issue in Ruijie RG-NBS2009G-P RGOS v.10.4(1)P2 Release(9736) allows a remote attacker to gain privileges via the system/config_menu.htm. |
CVE-2024-8451 | High | 7.5 | 2024-09-30 | Certain switch models from PLANET Technology have an SSH service that improperly handles insufficiently authenticated connection requests, allowing unauthorize… |
CVE-2024-6660 | High | 8.8 | 2024-07-17 | The BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin plugin for WordPress is vulnerable to unauthorized modification of data tha… |
CVE-2024-36451 | High | 8.8 | 2024-07-10 | Improper handling of insufficient permissions or privileges vulnerability exists in ajaxterm module of Webmin prior to 2.003. If this vulnerability is exploite… |
CVE-2024-39691 | Medium | 4.3 | 2024-07-05 | matrix-appservice-irc is a Node.js IRC bridge for the Matrix messaging protocol. The fix for GHSA-wm4w-7h2q-3pf7 / CVE-2024-32000 included in matrix-appservice… |
CVE-2024-6302 | High | 8.1 | 2024-06-25 | Lack of privilege checking when processing a redaction in Conduit versions v0.6.0 and lower, allowing a local user to redact any message from users on the same… |
CVE-2024-5163 | Critical | 9.8 | 2024-06-17 | Improper permission settings for mobile applications (com.transsion.carlcare) may lead to user password and account security risks. |
CVE-2024-4468 | Medium | 4.3 | 2024-06-08 | The Salon booking system plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on several functi… |
CVE-2024-35228 | Medium | 5.5 | 2024-05-30 | Wagtail is an open source content management system built on Django. Due to an improperly applied permission check in the `wagtail.contrib.settings` module, a… |
CVE-2024-36112 | Medium | 6.3 | 2024-05-28 | Nautobot is a Network Source of Truth and Network Automation Platform. A user with permissions to view Dynamic Group records (`extras.view_dynamicgroup` permis… |
CVE-2024-29852 | Low | 2.7 | 2024-05-22 | Veeam Backup Enterprise Manager allows high-privileged users to read backup session logs. |
CVE-2024-35301 | Medium | 5.5 | 2024-05-16 | In JetBrains TeamCity before 2024.03.1 commit status publisher didn't check project scope of the GitHub App token |
CVE-2024-27837 | Low | 3.3 | 2024-05-14 | A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Sonoma 14.5. A local attacker may gain access to Keycha… |
CVE-2024-23704 | High | 7.8 | 2024-05-07 | In onCreate of WifiDialogActivity.java, there is a possible way to bypass the DISALLOW_ADD_WIFI_CONFIG restriction due to a missing permission check. This coul… |