PT-2026-86872

In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update permissions grant themselves Project Admin...

EUVD-2026-9502

Vaultwarden has Privilege Escalation via Bulk Permission Update to Unauthorized Collections by Manager...

CVE-2026-27802: Improper Privilege Management

Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwardenrs. Prior to version 1.35.4, there is a privilege escalation vulnerability via bulk permission update to unauthorized collections by Manager. This issue has been patched in version 1.35.4...

CVE-2022-31791

WatchGuard Firebox and XTM appliances allow a local attacker that has already obtained shell access to elevate their privileges and execute code with root permissions. This is fixed in Fireware OS 12.8.1, 12.5.10, and 12.1.4...

EUVD-2025-0227

Malicious code in bioql PyPI...

EUVD-2024-2499

Malicious code in bioql PyPI...

CVE-2025-48067 OctoPrint vulnerable to possible file extraction via upload endpoints

OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.11.1 contain a vulnerability that allows an attacker with the FILEUPLOAD permission to exfiltrate files from the host that OctoPrint has read access to, by moving them into the...

PT-2025-24361 · Unknown · Openharmony

Name of the Vulnerable Software and Affected Versions: OpenHarmony versions prior to 5.0.3 Description: The issue allows a local attacker to cause an information leak through the get permission. Recommendations: For versions prior to 5.0.3, update to a version that contains a fix for this issue. ...

CVE-2021-32953

An attacker could utilize SQL commands to create a new user MDT AutoSave versions prior to v6.02.06 and update the user’s permissions, granting the attacker the ability to login...

CVE-2023-50333

Mattermost fails to update the permissions of the current session for a user who was just demoted to guest, allowing freshly demoted guests to change group names...

Change Uploaded File Permissions <= 4.0.0 - File Permission Update via CSRF

Due to missing checks the plugin is vulnerable to CSRF attacks. This can be used to change the file and folder permissions of any folder. This could be problematic when specific files like ini files are made readable for everyone due to this. document.getElementById"test".submit;...

Change Uploaded File Permissions <= 4.0.0 - File Permission Update via CSRF

Due to missing checks the plugin is vulnerable to CSRF attacks. This can be used to change the file and folder permissions of any folder. This could be problematic when specific files like ini files are made readable for everyone due to this. PoC...

GHSA-WP79-CPV2-9G7M Arbitrary shell command execution in Jenkins EC2 Plugin

Users with permission to create or configure agents in Jenkins 1.37 and earlier could configure an EC2 agent to run arbitrary shell commands on the master node whenever the agent was supposed to be launched. Configuration of these agents now requires the 'Run Scripts' permission typically only...

Security update for permissions (moderate)

openSUSE Security Update: Security update for permissions Announcement ID: openSUSE-SU-2021:1520-1 Rating: moderate References: 1028975 1029961 1093414 1133678 1148788 1150345 1150366 1151190 1157498 1160285 1160764 1161335 1161779 1163588 1167163 1169614 1171164 1171173 1171569 1171580 1171686...

PT-2020-15620

Name of the Vulnerable Software and Affected Versions ForLogic Qualiex versions v1 through v3 Description The issue allows any authenticated customer to achieve privilege escalation through various means such as creating users, changing passwords, or updating user permissions. Recommendations For...

CVE-2020-13266

Insecure authorization in Project Deploy Keys in GitLab CE/EE 12.8 and later through 13.0.1 allows users to update permissions of other users' deploy keys under certain conditions...

CVE-2020-13266: Missing Authorization

Insecure authorization in Project Deploy Keys in GitLab CE/EE 12.8 and later through 13.0.1 allows users to update permissions of other users' deploy keys under certain conditions...

Privilege escalation

A potential incorrect privilege assignment vulnerability exists in the app permission update API of the Bosch Smart Home Controller SHC before 9.8.905 that may result in a restricted app obtaining default app permissions. In order to exploit the vulnerability, the adversary needs to have...

PT-2019-12550

Name of the Vulnerable Software and Affected Versions Bosch Smart Home Controller SHC versions prior to 9.8.905 Description A potential incorrect privilege assignment issue exists in the app permission update API, which may allow a restricted app to obtain default app permissions. To exploit this...

CVE-2019-11893: Incorrect Privilege Assignment

A potential incorrect privilege assignment vulnerability exists in the app permission update API of the Bosch Smart Home Controller SHC before 9.8.905 that may result in a restricted app obtaining default app permissions. In order to exploit the vulnerability, the adversary needs to have...