CVE-2026-96341

The WPMU DEV Forminator WordPress plugin (versions up to and including 1.57.3 ) is vulnerable to an Incorrect Privilege Assignment flaw (CWE-266). This vulnerability allows for Privilege Escalation , potentially enabling an attacker to gain unauthorized elevated permissions within the application...

CVE-2026-106610

The miniOrange OTP Verification WordPress plugin (versions

CVE-2026-106608

The Automattic WooCommerce plugin (versions 9.8.0 through 11.1.2 ) is affected by an Incorrect Privilege Assignment vulnerability. This flaw allows for Privilege Escalation , specifically impacting users with Shop Manager+ permissions. The vulnerability allows for unauthorized elevation of privil...

CVE-2026-96539 WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1...

CVE-2026-96539

The Ultimate Member WordPress plugin (versions

PT-2026-106483

Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affects PublishPress Capabilities: from n/a through 2.45.0...

CVE-2024-54363-Exploit

CVE-2024-54363-Exploit ثغرة تعيين صلاحيات غير صحيحة في إضافة nssTheme Wp NssUser Register تسمح بتصعيد الصلاحيات. تؤثر هذه المشكلة على Wp NssUser Register: من n/a حتى 1.0.0. الوصف إضافة nssTheme Wp NssUser Register الخاصة بووردبريس معرّضة لمشكلة تعيين صلاحيات غير صحيحة ، تؤدي إلى تصعيد الصلاحيات...

Incorrect Privilege Assignment

Overview electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Incorrect Privilege Assignment via WebContents::OpenURLFromTab in shell/browser/api/electronapiwebcontents.cc, which failed...

CVE-2026-63349: Incorrect Privilege Assignment

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. In 4.14.0, AnyIO accepts the POSIX extragroups argument in anyio.runprocess and anyio.openprocess, but openprocess forwards the group argument to the backend instead of extragroups...

CVE-2026-73461: Incorrect Privilege Assignment

On affected EOS platforms with AAA-based gRPC authorization enabled for OpenConfig, gRPC requests of an authenticated user to OpenConfig may use the wrong privilege level, resulting in an authorization using the wrong AAA method list. This does not impact non-gRPC OpenConfig requests such as...

VulnCheck KEV: CVE-2026-54196

Incorrect Privilege Assignment vulnerability in Jetmonsters JetFormBuilder allows Privilege Escalation. This issue affects JetFormBuilder: from n/a through 3.6.1...

PT-2026-93366

Name of the Vulnerable Software and Affected Versions EOS affected versions not specified Description On platforms with AAA-based gRPC authorization enabled for OpenConfig, gRPC requests from an authenticated user may utilize an incorrect privilege level. This leads to authorization being process...

CVE-2026-91930: Incorrect Privilege Assignment

Flowise before 3.1.4 fails to scope enterprise organization and workspace membership APIs to the caller's tenant, allowing authenticated users to supply arbitrary organization IDs. Attackers can add themselves as organization owners, create workspaces, and gain administrative access to victim...

CVE-2026-90812 cosmicstack-labs mercury-agent Shell Command Permission permissions.ts checkShellCommand privileges assignment

A security vulnerability has been detected in cosmicstack-labs mercury-agent up to 1.2.0. This impacts the function checkShellCommand of the file src/capabilities/permissions.ts of the component Shell Command Permission. The manipulation leads to incorrect privilege assignment. The attack may be...

Incorrect Privilege Assignment

Overview Affected versions of this package are vulnerable to Incorrect Privilege Assignment in the JWT authentication process when the JWKS settings, including protocol and key, are disclosed. An attacker can gain administrative privileges by authenticating with a valid low-privilege JWT and...

CVE-2026-78330 Apache Syncope: Privilege escalation for admin user via JWT authentication

Incorrect privilege assignment vulnerability in Apache Syncope. When the configured JWKS settings for internal JWT authentication are disclosed at least protocol and key, an attacker can obtain admin privileges after completing a successful authentication and obtaining a valid low-privileges JWT...

CVE-2026-78330 Apache Syncope: Privilege escalation for admin user via JWT authentication

Incorrect privilege assignment vulnerability in Apache Syncope. When the configured JWKS settings for internal JWT authentication are disclosed at least protocol and key, an attacker can obtain admin privileges after completing a successful authentication and obtaining a valid low-privileges JWT...

CVE-2026-90812: Incorrect Privilege Assignment

A security vulnerability has been detected in cosmicstack-labs mercury-agent up to 1.2.0. This impacts the function checkShellCommand of the file src/capabilities/permissions.ts of the component Shell Command Permission. The manipulation leads to incorrect privilege assignment. The attack may be...

CVE-2026-86830: Incorrect Privilege Assignment

Incorrect privilege assignment in Temporary Elevated Access Management TEAM for AWS IAM Identity Center solution before version 1.5.1 might allow an authenticated remote user with application-level access to read, approve, modify, or revoke arbitrary access requests, thereby obtaining unintended...

CVE-2026-78330: Incorrect Privilege Assignment

Incorrect privilege assignment vulnerability in Apache Syncope. When the configured JWKS settings for internal JWT authentication are disclosed at least protocol and key, an attacker can obtain admin privileges after completing a successful authentication and obtaining a valid low-privileges JWT...