CVE-2026-9055

CVE-2026-9055 — Escalada de Privilegios No Autenticada en el Plugin Amelia Booking Informe de investigación de Sentinel AI Defense. Solo análisis defensivo — no se publica aquí ningún exploit funcional ni PoC para esta vulnerabilidad. Una vulnerabilidad de escalada de privilegios no autenticada e...

CVE-2026-62183

CVE-2026-62183 — Escalada de privilegios en el autoservicio de usuario de Apache Syncope Gestión inadecuada de privilegios CWE-269 en Apache Syncope. Un usuario autenticado con pocos privilegios puede otorgarse a sí mismo roles arbitrarios y membresías de grupo, recursos externos y un nuevo realm...

GHSA-X249-CX55-2H87 wger: Trainer Privilege Escalation - Improper Privilege Management

Summary A user with only the gymtrainer permission can deactivate any account in the same gym, including gymmanager and generalgymmanager accounts. The UserDeactivateView grants access to anyone holding any one of gym.managegym, gym.managegyms, or gym.gymtrainer OR logic via...

CVE-2026-106296

Improper privilege management in UI in Google Chrome on on Mac prior t...

Linux Distros Unpatched Vulnerability : CVE-2026-106296

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper privilege management in UI in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system...

CVE-2026-106296

Improper privilege management in UI in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. Chromium security severity: Low...

CVE-2026-106296

Improper privilege management in UI in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. Chromium security severity: Low...

CVE-2026-67269

Dell Container Storage Modules CSM Operator, versions prior to 1.18.0 contains an Improper Privilege Management vulnerability in the ContainerStorageModule Custom Resource reconciler. A low privileged remote attacker could potentially exploit this vulnerability, leading to escalation of privilege...

CVE-2026-67269

Dell Container Storage Modules CSM Operator, versions prior to 1.18.0 contains an Improper Privilege Management vulnerability in the ContainerStorageModule Custom Resource reconciler. A low privileged remote attacker could potentially exploit this vulnerability, leading to escalation of privilege...

EUVD-2026-93432

Dell Container Storage Modules CSM Operator, versions prior to 1.18.0 contains an Improper Privilege Management vulnerability in the ContainerStorageModule Custom Resource reconciler. A low privileged remote attacker could potentially exploit this vulnerability, leading to escalation of privilege...

CVE-2026-67269

The Dell Container Storage Modules (CSM) Operator, versions prior to 1.18.0 , contains an Improper Privilege Management vulnerability (CWE-269) within the ContainerStorageModule Custom Resource reconciler . A low-privileged remote attacker could exploit this flaw to escalate privileges and gain r...

CVE-2026-5118

CVE-2026-5118 — Divi Form Builder ≤ 5.1.2 Escalada de Privilegios No Autenticada mediante Inyección de Rol === Beelze zeroday 1diot9 === 📋 Información de la Vulnerabilidad Campo| Detalles ---|--- CVE ID| CVE-2026-5118 Puntuación CVSS| 9.8 Crítica Vector CVSS|...

CVE-2026-67269: Improper Privilege Management

Dell Container Storage Modules CSM Operator, versions prior to 1.18.0 contains an Improper Privilege Management vulnerability in the ContainerStorageModule Custom Resource reconciler. A low privileged remote attacker could potentially exploit this vulnerability, leading to escalation of privilege...

CVE-2026-106492: Improper Privilege Management

Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaults package is affected by improper preservation of access restrictions during service credential delegation. An external service credential configured with access restrictions...

Improper Privilege Management

Apache Syncope is vulnerable to Improper Privilege Management. The vulnerability is due to insufficient authorization checks in certain user workflow configurations, which allows an authenticated user to grant themselves defined Roles through a REST API and gain their associated entitlements,...

CVE-2026-105634: Improper Privilege Management

Plane is an open-source project management tool. Prior to 1.3.0, the ProjectMemberViewSet.partialupdate method allows any project member, including a user with the lowest GUEST role, to modify another project member's role. The authorization check prevents assigning a role higher than the...

CVE-2026-105687: Improper Privilege Management

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-team-member RPC allows a team administrator to remove any member other than themselves but does not protect the team owner. A non-owner administrator can delete the owner's team-profile-rel membership and lock t...

CVE-2026-104955: Improper Privilege Management

Plane is an open-source project management tool. Prior to 1.4.0, a Project Member with role 15 can send a PATCH request to the project-member update endpoint at /api/workspaces/workspaceslug/projects/projectid/members/memberpk/ to change another user's project role. The role-update logic blocks...

CVE-2026-13610

CVE-2026-13610 KiviCare – Clinic & Patient Management System CWE-269 Gestión inadecuada de privilegios | Registro no autenticado con un rol de personal elegido por el atacante → divulgación de PHI del paciente Resumen Vulnerabilidad crítica en el plugin de WordPress KiviCare – Clinic & Patient...

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2026-102489link is external Zammad GmbH Zammad Session Fixation Vulnerability CVE-2026-102490link is external Zammad GmbH Zammad Improper Privilege Management...