CVE-2026-19005

CVE-2026-19005 affects nanacoai NanoClaw up to version 2.0.64. The vulnerability is in the function handleCreateAgent of the file src/modules/agent-to-agent/create-agent.ts within the Child-Agent Creation component, where a manipulation leads to improper privilege management. The advisory states ...

EUVD-2026-53717

A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. Affected is the function handleCreateAgent of the file src/modules/agent-to-agent/create-agent.ts of the component Child-Agent Creation. Performing a manipulation results in improper privilege management. Remote exploitation of the...

CVE-2026-9193

An improper privilege management vulnerability in the Hadoop integration of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged Hadoop role to escalate privileges and execute privileged operations against the Security database...

CVE-2026-18606

RCE-like local privilege escalation in Razer RzUpdateService 1.10.14.0 via Named Pipe Handler (RzUpdateService.exe). Manipulating lpThreadParameter is reported to cause improper privilege management; requires local access. Publicly available exploit noted; vendor contacted early. No remediation d...

Siemens SIMATIC S7-1500 CPU 1518 MFP Improper Privilege Management (CVE-2026-46333)

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid505727; scriptversion"1.2"; scriptsetattributeattribute:"pluginmodificationdate",...

CVE-2026-12502

Loytec LINX firmware (LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD) through version 8.4.16 on LINX-A64 suffers CWE-269 due to improper privilege management in /usr/bin/ltsudo. The issue allows a user in the superadmin group to reset any LARM user password (including the larmapp s...

EUVD-2026-48590

Improper Privilege Management CWE-269 in /usr/bin/ltsudo in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a superadmin-group attacker to reset the password of any LARM user including the larmapp service account via the set-passwd...

PT-2026-64296

Name of the Vulnerable Software and Affected Versions Loytec LIP-ME201C versions prior to 8.4.17 Loytec L-INX versions prior to 8.4.17 Loytec L-GATE versions prior to 8.4.17 Loytec L-ROC versions prior to 8.4.17 Loytec L-IOB versions prior to 8.4.17 Loytec L-DALI versions prior to 8.4.17 Loytec...

CVE-2026-16764 OWASP DefectDojo API/Web serializers.py UserSerializer privileges management

A vulnerability was identified in OWASP DefectDojo 2.59.0. This issue affects the function UserSerializer of the file dojo/apiv2/serializers.py of the component API/Web. Such manipulation of the argument isstaff leads to improper privilege management. The attack may be performed from remote. The...

CVE-2026-16764

The CVE pertains to OWASP DefectDojo 2.59.0, where the UserSerializer in dojo/api_v2/serializers.py mishandles the is_staff argument, enabling improper privilege management. This issue can be exploited remotely; an exploit exists publicly. Remediation is to upgrade to DefectDojo 2.58.3 or 3.0.0, ...

httpd: Apache HTTP Server: Local .htaccess authors can read files with httpd user privileges

A flaw was found in Apache HTTP Server. This improper privilege management vulnerability allows local .htaccess authors to read files with the privileges of the httpd user. This could lead to unauthorized information disclosure...

The vulnerability of the WalletService service in the Windows operating system allows a perpetrator to escalate their privileges.

The vulnerability of the WalletService service in the Windows operating system is related to insecure management of privileges. Exploiting this vulnerability could allow an attacker to enhance their privileges...

PT-2026-61608

Name of the Vulnerable Software and Affected Versions Apache Syncope versions 3.0.0-M0 through 3.0.16 Apache Syncope versions 4.0.0-M0 through 4.0.6 Apache Syncope versions 4.1.0-M0 through 4.1.1 Description Improper Privilege Management allows a user to escalate privileges when the all-Java user...

CVE-2026-49501

Dell PowerScale OneFS versions 9.5.0.0 through 9.10.1.7, and versions 9.11.0.0 through 9.13.0.2 contains an Improper Privilege Management vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges...

EUVD-2026-44606

Dell PowerScale OneFS versions 9.5.0.0 through 9.10.1.7, and versions 9.11.0.0 through 9.13.0.2 contains an Improper Privilege Management vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges...

CVE-2026-49501

CVE-2026-49501 affects Dell PowerScale OneFS for all listed versions (9.5.0.0–9.10.1.7 and 9.11.0.0–9.13.0.2) with an Improper Privilege Management flaw that could allow a highly privileged attacker with local access to elevate privileges. The public descriptions identify the vulnerable component...

EUVD-2026-43984

Improper privilege management in Windows WalletService allows an authorized attacker to elevate privileges locally...

CVE-2026-50295

Improper privilege management in Microsoft Windows DNS allows an authorized attacker to bypass a security feature locally...

CVE-2026-50295

Technical details about CVE-2026-50295 are not publicly provided in the supplied documents. Monitor for updates from official sources.

CVE-2026-49176

Summary: CVE-2026-49176 is a Windows WalletService elevation of privilege vulnerability described as improper privilege management that could allow an authorized local attacker to escalate privileges. The available sources (NVD/CVE records) confirm the issue but do not provide concrete details on...