EUVD-2026-40991

Incorrect Privilege Assignment vulnerability in LCweb PrivateContent allows Privilege Escalation. This issue affects PrivateContent: from n/a through 9.9.2...

CVE-2026-57692 WordPress PrivateContent plugin <= 9.9.2 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in LCweb PrivateContent allows Privilege Escalation. This issue affects PrivateContent: from n/a through 9.9.2...

CVE-2026-57692

WordPress PrivateContent plugin

CVE-2026-5136 Foreman: foreman: privilege escalation to administrator-level access via usergroup role assignment manipulation

A flaw was found in Foreman. The Usergroup model in Foreman does not properly validate role assignments against the calling user's permissions. This allows an authenticated user with usergroup management permissions to attach arbitrary roles, including administrative roles, to a user group and th...

CVE-2026-5136 Foreman: foreman: privilege escalation to administrator-level access via usergroup role assignment manipulation

A flaw was found in Foreman. The Usergroup model in Foreman does not properly validate role assignments against the calling user's permissions. This allows an authenticated user with usergroup management permissions to attach arbitrary roles, including administrative roles, to a user group and th...

CVE-2026-5136

Summary : CVE-2026-5136 affects Foreman. A flaw in the Usergroup model allows an authenticated user with usergroup management permissions to attach arbitrary roles (including administrator) to a user group and then add themselves as a member, enabling full privilege escalation to administrator-le...

CVE-2026-5136

A flaw was found in Foreman. The Usergroup model in Foreman does not properly validate role assignments against the calling user's permissions. This allows an authenticated user with usergroup management permissions to attach arbitrary roles, including administrative roles, to a user group and th...

EUVD-2026-40429

Capgo before 12.128.2 allows org admins to assign org-scoped RBAC roles at app scope without validating role scope compatibility, including to pending invitees. Attackers can pre-seed malformed high-privilege bindings that survive invite acceptance, enabling accepted low-privilege users to perfor...

PT-2026-54886

Name of the Vulnerable Software and Affected Versions PrivateContent versions prior to 9.9.2 Description An incorrect privilege assignment in LCweb PrivateContent enables privilege escalation, allowing a user to gain higher levels of access than intended. Recommendations Update PrivateContent to...

CVE-2026-57692: Incorrect Privilege Assignment

Incorrect Privilege Assignment vulnerability in LCweb PrivateContent allows Privilege Escalation. This issue affects PrivateContent: from n/a through 9.9.2...

CVE-2026-50160: Improperly Controlled Modification of Dynamically-Determined Object Attributes

Hoppscotch is an API development ecosystem. In self-hosted deployments of hoppscotch-backend from version 2026.4.1 and earlier, the unauthenticated POST /v1/onboarding/config endpoint is vulnerable to mass assignment. The global NestJS ValidationPipe is configured without whitelist: true, so extr...

CVE-2026-13769: Incorrect Permission Assignment for Critical Resource

Overly permissive file permissions in AWS CLI before 1.44.78 v1 and 2.34.29 v2 on Unix-like systems where the umask has not been configured to restrict file permissions the default on most systems may allow other local users on the same host to read credentials written by certain CLI subcommands...

Linux kernel networking function Heap Buffer Overflow DoS

The vulnerability of the monhandleauthdone function in the net/ceph/monclient.c module, which is part of the Linux kernel’s networking functions, relates to the assignment of pointers. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

CVE-2026-5136: Incorrect Privilege Assignment

A flaw was found in Foreman. The Usergroup model in Foreman does not properly validate role assignments against the calling user's permissions. This allows an authenticated user with usergroup management permissions to attach arbitrary roles, including administrative roles, to a user group and th...

Dell PowerFlex Manager Privilege Escalation

The vulnerability of hardware and software solutions for data storage and information processing in Dell PowerFlex Manager, PowerFlex Appliance, and PowerFlex Rack is related to improper privilege assignment. Exploiting this vulnerability can allow attackers to enhance their privileges...

Incorrect Permission Assignment for Critical Resource

Overview Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource due to improper application of privilege reduction in the process and insufficient permission restrictions on the FastCGI unix socket. An attacker can gain unauthorized access or...

Incorrect Permission Assignment for Critical Resource

Overview Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource due to improper application of privilege reduction in the process and insufficient permission restrictions on the FastCGI unix socket. An attacker can gain unauthorized access or...

Incorrect Privilege Assignment

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Incorrect Privilege Assignment in the Identity Provider mapper process. An attacker can gain unauthorized...

CVE-2026-58174: Incorrect Permission Assignment for Critical Resource

Hermes WebUI before 0.51.521 validates the workspace of an imported session under the active named profile but constructs the Session object without setting its profile in the /api/session/import handler, so the imported session is persisted with a null profile. Because a null profile is treated ...

PT-2026-53971

Name of the Vulnerable Software and Affected Versions Paymenter affected versions not specified Description Authenticated users can inject arbitrary key-value pairs into server provisioning parameters due to improper input validation and mass assignment of user-controlled fields. The system fails...