192 matches found
CVE-2026-21016
CVE-2026-21016 involves an incorrect privilege assignment in LocationManager, enabling local attackers to access sensitive information. Affected component: LocationManager. Root cause: improper privilege handling leading to information disclosure. Impact: local access to sensitive data, with conf...
CVE-2026-21016
Incorrect privilege assignment in LocationManager prior to SMR May-2026 Release 1 allows local attackers to access sensitive information...
CVE-2026-21016
Incorrect privilege assignment in LocationManager prior to SMR May-2026 Release 1 allows local attackers to access sensitive information...
The vulnerability of the Cisco IOS XE operating system’s command-line interface allows a hacker to trigger a service failure.
The vulnerability of the Cisco IOS XE operating system’s command-line interface is related to the improper assignment of privileges. Exploiting this vulnerability can allow an attacker to cause a service failure...
PT-2026-40569
Incorrect privilege assignment in LocationManager prior to SMR May-2026 Release 1 allows local attackers to access sensitive information...
Astra Linux – Vulnerability in Linux 6.12
In the Linux kernel, the following vulnerability has been resolved: media: rc: igorplugusb: fix control request setup packet The commit eac69475b01f “media: rc: igorplugusb: heed coherency rules“” changed the storage of the control request from an embedded struct to an allocated pointer, so that ...
Esri Portal for ArcGIS 11.5 < Security 2026 Update 1 Incorrect Privilege Assignment (CVE-2026-33518)
The version of Esri Portal for ArcGIS 11.5 installed is missing Security 2026 Update 1. It is, therefore, affected by a vulnerability: - An incorrect privilege assignment vulnerability exists in Portal for ArcGIS that allows highly privileged users to create developer credentials that may grant...
Multiple vulnerabilities in silex technology SD-330AC and AMC Manager
Overview SD-330AC and AMC Manager provided by silex technology, Inc. contain multiple vulnerabilities listed below. Stack-based buffer overflow in processing the redirect URLs CWE-121 - CVE-2026-32955 Heap-based buffer overflow in processing the redirect URLs CWE-122 - CVE-2026-32956 Missing...
CVE-2026-21011
Incorrect privilege assignment in Bluetooth in Maintenance mode prior to SMR Apr-2026 Release 1 allows physical attackers to bypass Extend Unlock...
The vulnerability of the msm_drm_init() function in the driver/gpu/drm/msm/msm_drv.c file, a part of the Direct Rendering Infrastructure (DRI) driver infrastructure for the Linux operating system, allows a malicious actor to cause a service failure.
The vulnerability of the msmdrminit function in the driver/gpu/drm/msm/msmdrv.c file, a part of the Direct Rendering Infrastructure DRI driver for the Linux operating system’s kernel, relates to the assignment of pointers. Exploiting this vulnerability could allow an attacker to cause service...
CVE-2026-25334 WordPress Salon Booking System Pro plugin < 10.30.12 - Account Takeover vulnerability
Incorrect Privilege Assignment vulnerability in wordpresschef Salon Booking System Pro salon-booking-plugin-pro allows Privilege Escalation.This issue affects Salon Booking System Pro: from n/a through 10.30.12...
CVE-2026-24971
CVE-2026-24971 concerns the WordPress theme Search & Go (component searchgo) with an Incorrect Privilege Assignment that enables Privilege Escalation for authenticated users. Affected versions are up to and including 2.8. The vulnerability is documented across multiple feeds, including Red Hat an...
CVE-2026-1497
Neo4j Enterprise suffers an incorrect namespace resolution in composite databases, before versions 2026.02 and 5.26.22. An admin granting access to a remote constituent "namespace.name" can inadvertently grant privileges to any local database or remote alias named "name"; if that target doesn’t e...
CVE-2026-1497 Incorrect privilege assignment in composite databases
Incorrect resolving of namespaces in composite databases in Neo4j Enterprise edition prior to versions 2026.02 and 5.26.22 can lead to the following scenario: an admin that intends to give a user an access to a remote database constituent "namespace.name" will inadvertently grant access to any...
CVE-2026-24291
Incorrect permission assignment for critical resource in Windows Accessibility Infrastructure ATBroker.exe allows an authorized attacker to elevate privileges locally...
CVE-2026-21621 Improper Scope Enforcement in OAuth client_credentials Flow Allows Read-Only API Key to Escalate to Full Access
Incorrect Authorization vulnerability in hexpm hexpm/hexpm 'Elixir.HexpmWeb.API.OAuthController' module allows Privilege Escalation. An API key created with read-only permissions domain: "api", resource: "read" can be escalated to full write access under specific conditions. When exchanging a...
PT-2026-23497
Incorrect Authorization vulnerability in hexpm hexpm/hexpm 'Elixir.HexpmWeb.API.OAuthController' module allows Privilege Escalation. An API key created with read-only permissions domain: "api", resource: "read" can be escalated to full write access under specific conditions. When exchanging a...
CVE-2026-20037
CVE-2026-20037 affects Cisco UCS Manager Software with NX-OS CLI privilege levels. An authenticated, read-only user can connect to the NX-OS CLI and leverage unnecessary privileges to create or overwrite files or perform limited privileged actions on the device. The issue stems from excessive pri...
PT-2026-21964
Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS Evolved on PTX Series versions prior to 25.4R1-S1-EVO, 25.4R2-EVO, and 26.2R1-EVO Description A critical issue exists in Juniper Networks Junos OS Evolved, specifically within the On-Box Anomaly Detection framework on...