2963 matches found
CVE-2026-90501: Improper Privilege Management
A security vulnerability has been detected in lenve vhr 1.0-SNAPSHOT. This issue affects the function HrInfoController.updateHr of the file HrMapper.xml. Such manipulation of the argument Password leads to improper privilege management. The attack may be performed from remote. The exploit has bee...
CVE-2026-88764: Improper Privilege Management
The Simple Membership WordPress plugin before 4.7.8 does not validate that the membership level supplied in a PayPal payment notification matches the level configured for the paid payment button, allowing members to pay for a lower-priced membership while being granted a higher, more privileged...
CVE-2026-90487 Xuxueli xxl-job JobGroupController.java privileges management
A vulnerability was found in Xuxueli xxl-job up to 3.4.2. Affected by this issue is some unknown functionality of the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobGroupController.java. The manipulation results in improper privilege management. The attack may be launch...
CVE-2026-90487
Xuxueli xxl-job versions up to 3.4.2 are affected by an improper privilege management flaw in the JobGroupController.java file within the xxl-job-admin module. The root cause is a missing authentication check on the loadById endpoint, allowing a remote, low-privilege attacker to access job group ...
CVE-2026-87759: Improper Privilege Management
The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membership invitation carrying a caller-supplied role, allowing any authenticated user, such as a subscriber, to grant themselves the administrator role on a multisi...
CVE-2026-85681: Improper Privilege Management
The WP Component WordPress plugin through 2.2.4 does not have any capability or nonce checks on one of the actions it makes available to unauthenticated users, and it takes both the option name and the option value from the request, allowing unauthenticated attackers to overwrite any of the site'...
CVE-2026-77752: Improper Privilege Management
The Temporary Login Without Password WordPress plugin before 1.9.9 does not verify that the user requesting a temporary login holds network super admin rights before granting the new account those rights, allowing an administrator of a single site on a multisite network to take over the whole...
CVE-2026-90487: Improper Privilege Management
A vulnerability was found in Xuxueli xxl-job up to 3.4.2. Affected by this issue is some unknown functionality of the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobGroupController.java. The manipulation results in improper privilege management. The attack may be launch...
CISA Adds Three Known Exploited Vulnerabilities to Catalog
CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2026-42016link is external JFrog Artifactory Incorrect Authorization Vulnerability CVE-2026-42018link is external JFrog Artifactory Improper Authentication...
CVE-2026-74925: Improper Privilege Management
The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding its vendor role to grant that role administrator-level capabilities and take over the site...
CVE-2026-75777: Improper Privilege Management
IBM Aspera Enterprise WebApps 1.0.0 through 1.0.5 could allow a local attacker to escape container protections due to unrestricted system calls being permitted within the container...
CVE-2026-81431: Improper Privilege Management
The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post Contributor...
CVE-2026-88891: Improper Privilege Management
OpenPanel through 2.3.0 fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing read-level members to modify, delete, and publish project data. Attackers with explicit read-only access can delete reports and dashboards, schedule entire projects for deletion,...
Improper Privilege Management
Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Improper Privilege Management via the Livewire component lifecycle methods. An attacker can gain unauthorized access to sensitive administrative functions and escalate...
CVE-2026-12858
Improper Privilege Management vulnerability in ESET AV Remover standalone allows Privilege Escalation via especially crafted RPC...
EUVD-2026-74776
Improper Privilege Management vulnerability in ESET AV Remover standalone allows Privilege Escalation via especially crafted RPC...
CVE-2026-12858
CVE-2026-12858 is a local privilege escalation vulnerability in ESET AV Remover (standalone) , caused by improper privilege management when processing especially crafted RPC requests. An attacker with low-privilege local access and no user interaction can exploit this to gain full control of the ...
CVE-2026-12858 Local privilege escalation vulnerability in ESET AV Remover
Improper Privilege Management vulnerability in ESET AV Remover standalone allows Privilege Escalation via especially crafted RPC...
PT-2026-88895
『the attacker would need to have previously obtained administrator rights to execute the attack, as the tool requires elevation to be run.』 CVE-2026-12858 CA9000 ESET Customer Advisory: Local privilege escalation vulnerability in ESET AV Remover fixed https://t.co/QLUsWHiBcZ...
CVE-2026-87998: Improper Privilege Management
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, DELETE /api/v1/knowledge/id/delete in backend/openwebui/routers/knowledge.py authorized deletion against the knowledge base but then removed its administrator-owned external connection...