CVE-2026-63727 | High | 8.8 | 2026-07-28 | Anchore Enterprise versions from 5.11.0 to 5.27.1 and 6.0.0 contain an improper privilege escalation vulnerability in the user management API. An authenticated… |
CVE-2026-54424 | High | 8.4 | 2026-07-04 | An Incorrect Use of Privileged APIs vulnerability in Unity Parsec on Windows hosts leads to a potential Elevation of Privilege. This issue affects Parsec throu… |
CVE-2026-11877 | High | 7.5 | 2026-06-24 | An unauthorized user can modify configuration through API
calls that affects the OpenText Access
Manager. This issue affects Access Manager before 5.1.3. |
CVE-2026-9560 | High | 7.8 | 2026-05-26 | Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS allows attackers to execute arbitrary commands with elevated privil… |
CVE-2026-41225 | Critical | 9.1 | 2026-05-13 | A vulnerability exists in iControl REST where a highly privileged, authenticated attacker with at least the Manager role can create configuration objects that… |
CVE-2026-41386 | Critical | 9.1 | 2026-04-28 | OpenClaw before 2026.3.22 contains a privilege escalation vulnerability where bootstrap setup codes are not bound to intended device roles and scopes during pa… |
CVE-2026-41329 | Critical | 9.9 | 2026-04-21 | OpenClaw before 2026.3.31 contains a sandbox bypass vulnerability allowing attackers to escalate privileges via heartbeat context inheritance and senderIsOwner… |
CVE-2025-54502 | High | 7.5 | 2026-04-16 | Incorrect use of boot service in the AMD Platform Configuration Blob (APCB) SMM driver could allow a privileged attacker with local access (Ring 0) to achieve… |
CVE-2026-35669 | High | 8.8 | 2026-04-10 | OpenClaw before 2026.3.25 contains a privilege escalation vulnerability in gateway-authenticated plugin HTTP routes that incorrectly mint operator.admin runtim… |
CVE-2026-35663 | High | 8.8 | 2026-04-10 | OpenClaw before 2026.3.25 contains a privilege escalation vulnerability allowing non-admin operators to self-request broader scopes during backend reconnect. A… |
CVE-2026-35645 | High | 8.1 | 2026-04-09 | OpenClaw before 2026.3.25 contains a privilege escalation vulnerability in the gateway plugin subagent fallback deleteSession function that uses a synthetic op… |
CVE-2026-35639 | High | 8.8 | 2026-04-09 | OpenClaw before 2026.3.22 contains a privilege escalation vulnerability in the device.pair.approve method that allows an operator.pairing approver to approve p… |
CVE-2026-35625 | High | 7.8 | 2026-04-09 | OpenClaw before 2026.3.25 contains a privilege escalation vulnerability where silent local shared-auth reconnects auto-approve scope-upgrade requests, widening… |
CVE-2026-20126 | High | 8.8 | 2026-02-25 | A vulnerability in Cisco Catalyst SD-WAN Manager could allow an authenticated, local attacker with low privileges to gain root privileges on the underlying ope… |
CVE-2026-20122 | Medium | 5.4 | 2026-02-25 | A vulnerability in the API of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to overwrite arbitrary files on the local file system… |
CVE-2026-22922 | Medium | 6.5 | 2026-02-09 | Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access t… |
CVE-2025-1161 | High | 7.1 | 2025-12-10 | Incorrect Use of Privileged APIs vulnerability in NomySoft Information Technology Training and Consulting Inc. Nomysem allows Privilege Escalation.
This issue… |
CVE-2025-63291 | Medium | 5.4 | 2025-11-14 | When processing API requests, the Alteryx server 2022.1.1.42654 and 2024.1 used MongoDB object IDs to uniquely identify the data being requested by the caller… |
CVE-2024-32008 | High | 7.8 | 2025-11-11 | A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to a local privilege escal… |
CVE-2025-54769 | High | 8.8 | 2025-07-29 | An authenticated, read-only user can upload a file and perform a directory traversal to have the uploaded file placed in a location of their choosing. This ca… |
CVE-2025-54768 | Medium | 5.3 | 2025-07-29 | An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The en… |
CVE-2025-54767 | Medium | 6.5 | 2025-07-29 | An authenticated, read-only user can kill any processes running on the Xormon Original virtual appliance as the lpar2rrd user. |
CVE-2025-54766 | Medium | 5.3 | 2025-07-29 | An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The en… |
CVE-2025-54765 | Medium | 5.3 | 2025-07-29 | An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The en… |
CVE-2025-5997 | High | 8.8 | 2025-07-28 | Incorrect Use of Privileged APIs vulnerability in Beamsec PhishPro allows Privilege Abuse.
This issue affects PhishPro: before 7.5.4.2. |
CVE-2025-7344 | High | 8.8 | 2025-07-21 | The EAI developed by Digiwin has a Privilege Escalation vulnerability, allowing remote attackers with regular privileges to elevate their privileges to adminis… |
CVE-2025-23375 | High | 7.8 | 2025-04-28 | Dell PowerProtect Data Manager Reporting, version(s) 19.17, contain(s) an Incorrect Use of Privileged APIs vulnerability. A low privileged attacker with local… |
CVE-2022-26323 | | | 2025-04-17 | Incorrect Use of Privileged APIs vulnerability in OpenText™ Operations Bridge Manager, OpenText™ Operations Bridge Suite (Containerized), OpenText™ UCMDB ( Cla… |
CVE-2025-2311 | Critical | 9.0 | 2025-03-20 | Incorrect Use of Privileged APIs, Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials vulnerability in Sechard Information Te… |
CVE-2025-0589 | Medium | 5.3 | 2025-02-11 | In affected versions of Octopus Deploy where customers are using Active Directory for authentication it was possible for an unauthenticated user to make an API… |
CVE-2024-53007 | Medium | 6.4 | 2025-01-31 | Bentley Systems ProjectWise Integration Server before 10.00.03.288 allows unintended SQL query execution by an authenticated user via an API call. |
CVE-2024-8785 | Critical | 9.8 | 2024-12-02 | In WhatsUp Gold versions released before 2024.0.1, a remote unauthenticated attacker could leverage NmAPI.exe to create or change an existing registry value in… |
CVE-2024-11068 | Critical | 9.8 | 2024-11-11 | The D-Link DSL6740C modem has an Incorrect Use of Privileged APIs vulnerability, allowing unauthenticated remote attackers to modify any user’s password by lev… |
CVE-2024-46978 | Medium | 6.5 | 2024-09-18 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible for any user knowing the ID of a notific… |
CVE-2024-37018 | Critical | 9.1 | 2024-05-31 | The OpenDaylight 0.15.3 controller allows topology poisoning via API requests because an application can manipulate the path that is taken by discovery packets. |
CVE-2023-6522 | High | 7.2 | 2024-04-05 | Incorrect Use of Privileged APIs vulnerability in ExtremePacs Extreme XDS allows Collect Data as Provided by Users.
This issue affects Extreme XDS: before 391… |
CVE-2023-4993 | High | 7.5 | 2024-02-15 | Incorrect Use of Privileged APIs vulnerability in Utarit Information Technologies SoliPay Mobile App allows Collect Data as Provided by Users.
This issue affe… |
CVE-2024-22042 | High | 7.8 | 2024-02-13 | A vulnerability has been identified in Unicam FX (All versions). The windows installer agent used in affected product contains incorrect use of privileged APIs… |
CVE-2023-6151 | High | 7.5 | 2023-11-28 | Incorrect Use of Privileged APIs vulnerability in ESKOM Computer e-municipality module allows Collect Data as Provided by Users.
This issue affects e-municipa… |
CVE-2023-6150 | High | 7.5 | 2023-11-28 | Incorrect Use of Privileged APIs vulnerability in ESKOM Computer e-municipality module allows Collect Data as Provided by Users.
This issue affects e-municipa… |
CVE-2023-4972 | Critical | 9.8 | 2023-09-14 | Incorrect Use of Privileged APIs vulnerability in Yepas Digital Yepas allows Collect Data as Provided by Users.
This issue affects Digital Yepas: before 1.0.1. |
CVE-2023-4009 | High | 7.2 | 2023-08-08 | In MongoDB Ops Manager v5.0 prior to 5.0.22 and v6.0 prior to 6.0.17 it is possible for an authenticated user with project owner or project user admin access t… |
CVE-2023-20136 | Medium | 4.3 | 2023-06-28 | A vulnerability in the OpenAPI of Cisco Secure Workload could allow an authenticated, remote attacker with the privileges of a read-only user to execute operat… |
CVE-2023-29507 | Critical | 9.1 | 2023-04-16 | XWiki Commons are technical libraries common to several other top level XWiki projects. The Document script API returns directly a DocumentAuthors allowing to… |
CVE-2023-28062 | High | 8.8 | 2023-04-11 |
Dell PPDM versions 19.12, 19.11 and 19.10, contain an improper access control vulnerability. A remote authenticated malicious user with low privileges could p… |
CVE-2022-20965 | Medium | 4.3 | 2023-01-20 | A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to take privileges action… |
CVE-2022-4805 | Medium | 4.3 | 2022-12-28 | Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4796 | High | 8.1 | 2022-12-28 | Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4687 | High | 8.1 | 2022-12-23 | Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.0. |
CVE-2022-20956 | High | 7.1 | 2022-11-04 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to bypass authoriza… |
CVE-2022-23720 | High | 7.5 | 2022-06-30 | PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties file. An IT administr… |
CVE-2022-2023 | Critical | 9.8 | 2022-06-20 | Incorrect Use of Privileged APIs in GitHub repository polonel/trudesk prior to 1.2.4. |
CVE-2022-24821 | Medium | 6.8 | 2022-04-08 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Simple users can create global SSX/JSX without specifi… |
CVE-2022-24073 | High | 7.1 | 2022-03-17 | The Web Request API in Whale browser before 3.12.129.18 allowed to deny access to the extension store or redirect to any URL when users access the store. |
CVE-2022-24071 | Medium | 4.3 | 2022-01-28 | A Built-in extension in Whale browser before 3.12.129.46 allows attackers to compromise the rendering process which could lead to controlling browser internal… |
CVE-2020-7927 | High | 8.1 | 2020-11-23 | Specially crafted API calls may allow an authenticated user who holds Organization Owner privilege to obtain an API key with Global Role privilege. This issue… |
CVE-2020-5291 | High | 7.2 | 2020-03-31 | Bubblewrap (bwrap) before version 0.4.1, if installed in setuid mode and the kernel supports unprivileged user namespaces, then the `bwrap --userns2` option ca… |
CVE-2019-14812 | High | 7.8 | 2019-11-27 | A flaw was found in all ghostscript versions 9.x before 9.50, in the .setuserparams2 procedure where it did not properly secure its privileged calls, enabling… |
CVE-2019-10216 | High | 7.8 | 2019-11-27 | In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions… |
CVE-2019-14869 | High | 8.8 | 2019-11-15 | A flaw was found in all versions of ghostscript 9.x before 9.50, where the `.charkeys` procedure, where it did not properly secure its privileged calls, enabli… |
CVE-2019-14813 | Critical | 9.8 | 2019-09-06 | A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did not properly secure its privileged calls, enabling scr… |
CVE-2019-14817 | High | 7.8 | 2019-09-03 | A flaw was found in, ghostscript versions prior to 9.50, in the .pdfexectoken and other procedures where it did not properly secure its privileged calls, enabl… |
CVE-2019-14811 | High | 7.8 | 2019-09-03 | A flaw was found in, ghostscript versions prior to 9.50, in the .pdf_hook_DSC_Creator procedure where it did not properly secure its privileged calls, enabling… |
CVE-2019-1010178 | Critical | 9.8 | 2019-07-24 | Fred MODX Revolution < 1.0.0-beta5 is affected by: Incorrect Access Control - CWE-648. The impact is: Remote Code Execution. The component is: assets/component… |
CVE-2019-3839 | High | 7.8 | 2019-05-16 | It was found that in ghostscript some privileged operators remained accessible from various places after the CVE-2019-6116 fix. A specially crafted PostScript… |
CVE-2019-3838 | Medium | 5.5 | 2019-03-25 | It was found that the forceput operator could be extracted from the DefineResource method in ghostscript before 9.27. A specially crafted PostScript file could… |
CVE-2019-3835 | Medium | 5.5 | 2019-03-25 | It was found that the superexec operator was available in the internal dictionary in ghostscript before 9.27. A specially crafted PostScript file could use thi… |