Weakness (CWE)
CWE-269: Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
How to prevent it (3 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Follow the principle of least privilege when assigning access rights to entities in a software system.
-
Architecture and Design
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
Source: MITRE CWE-269
100 results · Clear filters · Feed
-
High 7.8CVE-2026-106781 Public exploit
An issue in WCH CH340/CH341 USB-to-Serial Windows Driver setup package CH341SER.EXE version 4.0 allows a local attacker…
-
High 8.1CVE-2026-104745 Public exploit
Customer Email Verification for WooCommerce <= 3.3.0 - Unauthenticated Privilege Escalation to 'alg_wc_ev_verify_email' Parameter
The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the `alg_wc_ev_verify_email` parameter in versions up to, and including, 3.3.0. The vulnerability exists because `alg_wc_ev_generate_user_code()` ge…
-
High 8.8CVE-2026-73802 Public exploit
Gitea Runner host isolation bypass through container options
Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled. Host namespace settings, expanded capabilities, and security profile overrides can remain effective despite Privileged being f…
-
High 8.8CVE-2026-94609 Public exploit
authentik: Privilege Escalation to Superuser via Group Hierarchy
authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an account with delegated permission to manage a group, group membership, or a user can grant superuser status to an account or assign an existing role to a group withou…
-
High 8.1CVE-2026-80467 Public exploit
Advanced Custom Fields: Extended 0.9.2.2 - 0.9.2.6 - Unauthenticated Privilege Escalation via Front-End User Insert Action
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms to the roles the form actually offers, and its safeguard against privileged roles is incomplete, allowing unauthenticate…
-
High 8.8CVE-2026-74939 Public exploit
Privilege escalation in the DOM: Navigation component
Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
-
High 7.8CVE-2026-69414 Public exploit
Microsoft Defender Elevation of Privilege Vulnerability
Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "ShieldBreak ".
-
High 7.5CVE-2026-13610 Public exploit
KiviCare < 4.5.2 - Unauthenticated Privilege Escalation via Registration
The KiviCare WordPress plugin before 4.5.2 does not restrict the roles assignable through its unauthenticated registration endpoint, allowing unauthenticated attackers to create an active, privileged clinic-staff (doctor) account with full access to patient r…
-
High 8.8CVE-2026-18322 Public exploit
Smart Popup by Supsystic <= 1.12.0 - Unauthenticated Privilege Escalation to Administrator
The Smart Popup by Supsystic plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.12.0. This is due to a permission map collision in the `havePermissions()` function in `classes/frame.php`, where `array_merge()` o…
-
High 7.8CVE-2026-18107 Public exploit
Criu: criu: container escape via rseq critical section hijack during checkpoint/restore
A flaw was found in CRIU's handling of restartable sequences (rseq) during checkpoint/restore. A malicious process inside a container can register an rseq critical section that hijacks CRIU's parasite code injection during checkpoint, allowing it to spoof the…
-
High 8.1CVE-2026-13152 Public exploit
Custom Fields Account Registration For WooCommerce < 1.4 - Unauthenticated Privilege Escalation
The Custom Fields Account Registration For Woocommerce WordPress plugin before 1.4 does not prevent its custom registration fields from writing to the user capabilities meta key on sites that use a non-default database table prefix, so an unauthenticated user…
-
High 7.8CVE-2026-38764 Public exploit
An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate privileges via the kern…
-
High 7.8CVE-2026-38765 Public exploit
An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate privileges via the kern…
-
High 7.8CVE-2026-38766 Public exploit
An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate privileges via the sub_…
-
High 7.8CVE-2026-50343 Public exploit
Microsoft Install Service Elevation of Privilege Vulnerability
Improper privilege management in Microsoft Install Service allows an authorized attacker to elevate privileges locally.
-
High 7.8CVE-2026-49176 Public exploit
Windows WalletService Elevation of Privilege Vulnerability
Improper privilege management in Windows WalletService allows an authorized attacker to elevate privileges locally.
-
High 7.3CVE-2026-46680 Public exploit
containerd user ID handling bypass allows runAsNonRoot evasion
containerd is an open-source container runtime. In versions prior to 1.7.32, 2.0.9, 2.2.4 and 2.3.1, containers launched with a numeric User directive that cannot be parsed as a 32-bit integer are incorrectly treated as a username, leading to runAsNonRoot eva…
-
High 8.1CVE-2026-54415 Public exploit
Broken Access Control in Azuriom CMS Server Routes Allows Account Takeover
Missing Authorization in the server management routes (routes/admin.php) in Azuriom Azuriom CMS before 1.2.11 on all platforms allows an authenticated attacker with the admin.access permission to create AzLink server tokens and take over non-admin user accoun…
-
High 7.8CVE-2026-36213 Public exploit
An issue in Microvirt MEmu Android Emulator 9.2.7.0 allows a local attacker to escalate privileges via the MemuService.…
-
High 8.8CVE-2026-11108 Public exploit
Inappropriate implementation in NFC in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to per…
-
High 7.8CVE-2026-11103 Public exploit
Inappropriate implementation in Installer in Google Chrome on Windows prior to 149.0.7827.53 allowed a local attacker t…
-
High 7.8CVE-2026-0091 Public exploit
In multiple locations, there is a possible way to execute code in the launcher process due to an over-privileged shell …
-
High 7.8CVE-2026-0009 Public exploit
In multiple locations, there is a possible tapjacking due to a logic error in the code. This could lead to local escala…
-
High 8.8CVE-2026-7465 Public exploit
Spectra Gutenberg Blocks <= 2.19.25 - Authenticated (Contributor+) Remote Code Execution via Arbitrary PHP Function Call via Block Attributes
The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.19.25. This makes it possible for authenticated attackers, with Contributor-level access an…
-
High 8.8CVE-2026-9999 Public exploit
Inappropriate implementation in ANGLE in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to exec…
-
High 8.5CVE-2026-9789 Public exploit
NitroSense V3: Security Vulnerability Information
A Local Privilege Escalation (LPE) vulnerability affects Acer NitroSense software versions prior to 3.01.3052. The vulnerability stems from the the PSAdminAgent service, which creates a Named Pipe with a weak Access Control List (ACL). This allows any authent…
-
High 7.1CVE-2026-46333 Public exploit
ptrace: slightly saner 'get_dumpable()' logic
In the Linux kernel, the following vulnerability has been resolved: ptrace: slightly saner 'get_dumpable()' logic The 'dumpability' of a task is fundamentally about the memory image of the task - the concept comes from whether it can core dump or not - and ma…
-
High 8.8CVE-2026-28995 Public exploit
A logic issue was addressed with improved restrictions. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 a…
-
High 8.5CVE-2026-8069 Public exploit
PredatorSense V3: Local Privilege Escalation (LPE) vulnerability
PredatorSense version 3.00.3136 to 3.00.3196 contain Local Privilege Escalation (LPE) vulnerability.The program exposes a Windows Named Pipe that uses a custom protocol to invoke internal functions. However, this Named Pipe is misconfigured, allowing any auth…
-
High 8.8CVE-2026-24072 Public exploit
Apache HTTP Server: mod_rewrite elevation of privileges via ap_expr
An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user. Users are recommended to upgrade to version 2.4.67, which fixes this issue.
-
High 7.8CVE-2026-29923 Public exploit
The pstrip64.sys driver in EnTech Taiwan PowerStrip <=3.90.736 allows local users to escalate privileges to SYSTEM via …
-
High 8.8CVE-2026-2931 Public exploit
Amelia Booking <= 9.1.2 - Authenticated (Customer+) Insecure Direct Object Reference to Arbitrary User Password Change
The Amelia Booking plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 9.1.2. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system re…
-
High 8.1CVE-2026-3629 Public exploit
Import and export users and customers <= 1.29.7 - Privilege Escalation to Administrator via save_extra_user_profile_fields
The Import and export users and customers plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.29.7. This is due to the 'save_extra_user_profile_fields' function not properly restricting which user meta keys can b…
-
High 8.8CVE-2026-26416 Public exploit
An authorization bypass vulnerability in Tata Consultancy Services Cognix Recon Client v3.0 allows authenticated users …
-
High 7.8CVE-2026-0023 Public exploit
In createSessionInternal of PackageInstallerService.java, there is a possible way for an app to update its ownership du…
-
High 7.8
Windows Remote Desktop Services Elevation of Privilege Vulnerability
Improper privilege management in Windows Remote Desktop allows an authorized attacker to elevate privileges locally.
KEV Feb 10, 2026 -
High 8.8CVE-2025-15100 Public exploit
JAY Login & Register <= 2.6.03 - Authenticated (Subscriber+) Privilege Escalation via jay_panel_ajax_update_profile
The JAY Login & Register plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.6.03. This is due to the plugin allowing a user to update arbitrary user meta through the 'jay_panel_ajax_update_profile' function. Thi…
-
High 8.0CVE-2026-1010 Public exploit
Stored Cross-Site Scripting in Altium Enterprise Server Workflow Engine Allows Privilege Escalation
A stored cross-site scripting (XSS) vulnerability exists in the Altium Workflow Engine due to missing server-side input sanitization in workflow form submission APIs. A regular authenticated user can inject arbitrary JavaScript into workflow data. When an adm…
-
High 7.3CVE-2025-67246 Public exploit
A local information disclosure vulnerability exists in the Ludashi driver before 5.1025 due to a lack of access control…
-
High 8.0CVE-2026-22804 Public exploit
Termix has a Stored XSS in File Manager leading to Local File Inclusion (LFI) in Electron and Session Hijacking in Browser
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 to 1.9.0, Stored Cross-Site Scripting (XSS) vulnerability exists in the Termix File Manager component. The application fails to sanitize S…