CVE-2026-62355: Improper Privilege Management

TDengine is an open source, time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, a Data Reader adminuser on a TDengine Cloud DB instance could run create udf even though standard users should have read-only permissions for non-database objects and show dnodes and crea...

CVE-2026-50295

Improper privilege management in Microsoft Windows DNS allows an authorized attacker to bypass a security feature locally...

PT-2026-58017

Name of the Vulnerable Software and Affected Versions Citrix Secure Access Client for Windows versions prior to 26.6.1.20 Citrix Endpoint Analysis Client for Windows versions prior to 26.5.1.7 Description Improper privilege management allows a low-privileged user with local access to escalate the...

CVE-2026-49176: Improper Privilege Management

Improper privilege management in Windows WalletService allows an authorized attacker to elevate privileges locally...

CVE-2026-53565: Improper Privilege Management

Improper Privilege Management vulnerability in Citrix Secure Access Client for Windows, Citrix Citrix Endpoint Analysis Client for Windows. This issue affects Secure Access Client for Windows: before 26.6.1.20; Citrix Endpoint Analysis Client for Windows: before 26. 5.1.7...

CVE-2026-59260: Improper Privilege Management

OpenWrt luci-app-samba4 read ACL grants file.exec permission on /usr/sbin/smbd, allowing authenticated delegated users to execute the Samba daemon with caller-controlled command-line arguments. Attackers can pass arbitrary Samba global options such as message command to a root smbd process,...

Improper Privilege Management

Overview Affected versions of this package are vulnerable to Improper Privilege Management in its user rename handling, which reserves the internalauditor username as a privileged internal account but does not prevent an ordinary user from renaming their own account to that name. A user with an...

EUVD-2026-42837

Improper Privilege Management, Improper Access Control vulnerability in Apache IoTDB. Authenticated users can escalate to full tree-path access by renaming themselves to internalauditor. This issue affects Apache IoTDB: from 2.0.8 before 2.0.10. Users are recommended to upgrade to version 2.0.10,...

CVE-2026-40009: Improper Privilege Management

Improper Privilege Management, Improper Access Control vulnerability in Apache IoTDB. Authenticated users can escalate to full tree-path access by renaming themselves to internalauditor. This issue affects Apache IoTDB: from 2.0.8 before 2.0.10. Users are recommended to upgrade to version 2.0.10,...

CVE-2026-55843: Improper Privilege Management

Snipe-IT is an IT asset/license management system. Prior to 8.6.0, UsersController::update passes a missing permission request field through NormalizePermissionsPayloadAction and PreserveUnauthorizedPrivilegedPermissionsAction in a way that can overwrite a target user’s permissions with a sparse...

Improper Privilege Management

Overview Affected versions of this package are vulnerable to Improper Privilege Management in the ActiveDirectoryIdentityProvider process. An attacker can gain elevated permissions in Kubernetes clusters by editing the distinguished name DN of group entries in the Active Directory server's databa...

Improper Privilege Management

Overview Affected versions of this package are vulnerable to Improper Privilege Management in the ActiveDirectoryIdentityProvider process. An attacker can gain elevated permissions in Kubernetes clusters by editing the distinguished name DN of group entries in the Active Directory server's databa...

CVE-2026-44787: Improper Privilege Management

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, the signup flow could allow newly registered users to set primarygroupid and gain whisper-group privileges without legitimate group membership on sites with whispersallowedgroups configured. This...

CVE-2026-54652: Improper Privilege Management

Frigate is an open source network video recorder. In version 0.17.1, the GET /api/logs/service endpoint allows any authenticated user including the viewer role to download Frigate and nginx logs, exposing auto-generated admin passwords and camera credentials logged in request query strings and...

CVE-2026-53645: Improper Privilege Management

FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 allow a low-privileged staff account to grant arbitrary module permissions to itself through the admin API, resulting in persistent privilege escalation. A staff user that only has...

CVE-2026-14719: Improper Privilege Management

A flaw has been found in SourceCodester Onlne Examination & Learning Management System 1.0. The impacted element is an unknown function of the file register.php of the component Registration Endpoint. Executing a manipulation of the argument role can lead to improper privilege management. The...

Vulnerability of hardware and software solutions for data storage and information processing in Dell PowerFlex Manager, PowerFlex Appliance, PowerFlex Rack—related to improper privilege assignment, allowing attackers to escalate their privileges.

The vulnerability of hardware and software solutions for data storage and information processing in Dell PowerFlex Manager, PowerFlex Appliance, and PowerFlex Rack is related to improper privilege assignment. Exploiting this vulnerability can allow attackers to enhance their privileges...

Authentication Bypass by Primary Weakness

Overview Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness due to improper privilege handling in the Project Owner role. An attacker can gain unauthorized access to host-level privileges by exploiting insufficient access control mechanisms. Remediation...

CVE-2026-41052: Authentication Bypass by Primary Weakness

Improper privilege handling could be used by users with Project Owner role to escalate privileges, in Rancher versions 2.14 before 2.14.2, 2.13 before 2.13.6, and 2.12 before 2.12.10...

CVE-2026-54099: Improper Privilege Management

A flaw was found in the Windows Machine Config Operator WMCO for Red Hat OpenShift Container Platform. The WICD CSR auto-approver validates that a Certificate Signing Request contains the organization system:wicd-nodes but does not reject additional organization values such as system:masters. A...