GO-2026-6745 Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0) in code.vikunja.io/api

Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission broken access control / privilege-management regression in v2.6.0 in code.vikunja.io/api...

PT-2026-117698

Name of the Vulnerable Software and Affected Versions IBM Sterling Connect Direct for Unix versions 6.3.0.0 through 6.3.0.7 IBM Sterling Connect Direct for Unix versions 6.4.0.0 through 6.4.0.6 Description Improper privilege management may allow a local attacker to gain elevated privileges...

CVE-2026-17491 IBM i is Affected By An Improper Privilege Management Vulnerability in OpenSSH

IBM i 7.3, 7.4, 7.5, and 7.6 is could allow a remote authenticated attacker to bypass security restrictions due to improper enforcement of the ChrootDirectory configuration directive...

CVE-2026-17491

IBM i versions 7.3, 7.4, 7.5, and 7.6 (product 5733-SC1) are vulnerable to an improper privilege management flaw (CWE-269) in OpenSSH . The root cause is the improper enforcement of the ChrootDirectory configuration directive, which could allow a remote authenticated attacker to bypass security r...

Security Bulletin: IBM Sterling Connect:Direct for Unix is impacted by a vulnerability

Summary The statistics file archive feature is used by IBM Sterling Connect:Direct for UNIX to automatically archive statistics files. IBM Sterling Connect:Direct for UNIX is impacted by a vulnerability in the statistics file archive feature. IBM Sterling Connect:Direct for UNIX has been updated ...

PYSEC-2026-4316 wger: Trainer Privilege Escalation - Improper Privilege Management

Summary A user with only the gymtrainer permission can deactivate any account in the same gym, including gymmanager and generalgymmanager accounts. The UserDeactivateView grants access to anyone holding any one of gym.managegym, gym.managegyms, or gym.gymtrainer OR logic via...

CVE-2026-109145: Improper Privilege Management

The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role that was created as a copy of the administrator role, allowing unauthenticated attackers to register an...

Actor Component DoS

The vulnerability of the Actor component in Google Chrome and Microsoft Edge relates to insecure management of privileges. Exploiting this vulnerability could allow a malicious actor to cause service interruptions through a specially created HTML page...

Regional Capabilities Component DoS

The vulnerability of the Regional Capabilities component in Google Chrome and Microsoft Edge relates to insecure management of privileges. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

Google Chrome Edge FileSystem Data Compromise

The vulnerability of the FileSystem component in Google Chrome and Microsoft Edge relates to insecure management of privileges. Exploiting this vulnerability allows a malicious actor to compromise the integrity of protected information through a specially created HTML page...

Security Bulletin: IBM i is Affected By An Improper Privilege Management Vulnerability in OpenSSH [CVE-2026-17491]

Summary IBM i is vulnerable to bypassing security restrictions due to improper enforcement of ChrootDirectory CVE-2026-17491 in OpenSSH as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-17491 DESCRIPTION: IBM i could allow a remote authenticated attacker to...

CVE-2026-83845

Improper privilege management in Windows Internet (wininet.dll) allows an authorized attacker to perform spoofing locally. The vulnerability is associated with CWE-290 (Authentication Bypass by Spoofing). According to the CVSS 3.1 metrics, the flaw has a High severity score of 8.4, affecting Conf...

Windows Internet (wininet.dll) Spoofing Vulnerability

Improper privilege management in Windows Internet wininet.dll allows an authorized attacker to perform spoofing locally...

CVE-2026-109143

A vulnerability was determined in calcom cal.com and cal.diy up to 6.2.0. This vulnerability affects the function credentials.delete of the file /api/trpc/credentials/delete of the component Credentials Handler. This manipulation of the argument teamId causes improper privilege management. The...

CVE-2026-109143 calcom cal.com/cal.diy Credentials delete credentials.delete privileges management

A vulnerability was determined in calcom cal.com and cal.diy up to 6.2.0. This vulnerability affects the function credentials.delete of the file /api/trpc/credentials/delete of the component Credentials Handler. This manipulation of the argument teamId causes improper privilege management. The...

CVE-2026-109143

The software calcom , cal.com , and cal.diy (versions up to 6.2.0 ) contains a vulnerability in the Credentials Handler component. Specifically, the credentials.delete function within the /api/trpc/credentials/delete file is susceptible to improper privilege management due to the manipulation of ...

CVE-2026-83845: Authentication Bypass by Spoofing

Improper privilege management in Windows Internet wininet.dll allows an authorized attacker to perform spoofing locally...

Microsoft Windows: CVE-2026-83845: Windows Internet (wininet.dll) Spoofing Vulnerability

Improper privilege management in Windows Internet wininet.dll allows an authorized attacker to perform spoofing locally...

PT-2026-111363

Name of the Vulnerable Software and Affected Versions cal.com versions prior to 6.2.1 cal.diy versions prior to 6.2.1 Description Improper privilege management exists within the Credentials Handler component. A remote attacker can manipulate the teamId argument in the credentials.delete function ...

CVE-2026-85990: Improper Privilege Management

Leantime is an open source project management system. Prior to 3.10.0, for the provisionally grouped account-creation and plugin-management surfaces, Leantime's JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php exposes public API service methods, while PermissionEnforcer::enforce allo...