CWE-269

A vulnerability was identified in Webkul Bagisto up to 2.4.4. This vulnerability affects unknown code of the file /admin

Improper privilege management in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging

Budibase is an open-source low-code platform. Prior to 3.38.2, the public API role unassignment endpoint (POST /api/publ

Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.1

Vulnerability in the Oracle Labor Distribution product of Oracle E-Business Suite (component: Internal Operations). Sup

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonom

SysReptor is a fully customizable pentest reporting platform. Prior to version 2026.29, users with "User Admin" permissi

Capgo before 12.128.2 contains an authentication logic flaw: a user with permission to manage team or organization secur

Northern.tech Mender Enterprise Server before 4.1.1 has Incorrect Access Control.

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The suppor

The Forminator Forms WordPress plugin before 1.57.1 does not verify that site registration is enabled on the network be

Vulnerability in the Oracle Order Entry product of Oracle E-Business Suite (component: Internal Operations). Supported

In updateProvidersWhenServiceRemoved of CredentialManagerService.java, there is a possible way to override settings acro

In handleBondStateChanged of AdapterService.java, there is a possible sensitive information disclosure due to a permissi

In multiple functions of AppOpsService.java, there is a possible missing permission check due to a permissions bypass. T

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.5 and iPadOS 26.5. A malic

PcManager is affected by type privilege bypass, successful exploitation of this vulnerability may affect service availab

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper

ciguard is a static security auditor for CI/CD pipelines. From 0.1.0 to 0.8.1, the published ghcr.io/jo-jo98/ciguard con

The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being c

Discourse is an open-source discussion platform. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 allow a mod

The absence of permissions control for the user XXX allows the current configuration in the sudoers file to escalate pri

A local privilege escalation vulnerability has been identified in the Kaba exos 9300 System management application (d9sy

Planting a custom configuration file in ESET Inspect Connector allow load a malicious DLL.

Chef InSpec versions up to 5.23 and before 7.0.107 creates named pipes with overly permissive default Windows access con

rssn is a scientific computing library for Rust, combining a high-performance symbolic computation engine with numerical

crun is an open source OCI Container Runtime fully written in C. In versions 1.19 through 1.26, the `crun exec` option

Improper privilege management in the KVM key download component could allow an attacker to swap tokens and download sens

NitroSense 3.x before 3.01.3052 contains Local Privilege Escalation (LPE) vulnerability.The program exposes a Windows Na

A Local Privilege Escalation (LPE) vulnerability affects Acer NitroSense software versions prior to 3.01.3052. The vulne

The Mennekes Amtron series (firmware versions ≤ 5.22.3) is vulnerable to privilege escalation. An authenticated low-priv

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, improper validation in the PUT /rust

A mass assignment vulnerability exists in the MISP user edit functionality due to insufficient filtering of user-supplie

A path traversal vulnerability exists in the Altium Enterprise Server Collaboration Service due to improper handling of

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applic

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applic

FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 allow a low-privileged

Improper Privilege Management vulnerability in Citrix Secure Access Client for Windows, Citrix Citrix Endpoint Analysis

Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan OIDC-related Meteor methods in packages/wekan-oidc/o

A local privilege escalation vulnerability in ESET Inspect Connector.  The vulnerability was caused by improper authenti

The Altiris WMI provider exposes a class (AltirisAgent_Stream) that allows any local standard user to read the contents

A non-administrator interactive user can obtain full SYSTEM code execution through a DCOM/task scheduler logic chain — n

Improper authorization in the ToolGroupResource and RoleAjax REST/DWR endpoints in dotCMS dotCMS 21.02 through 26.06.22-

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the Platfor

Cwe-269 vulnerability in Johnson Controls victor Web on Windows allows capec-233. This issue affects victor Web: before

Local privilege escalation potentially allowed an attacker to write an arbitrary file with fully controlled content as a

Local privilege escalation potentially allowed an attacker to execute arbitrary code as a privileged user.

Improper Privilege Management (CWE-269) in `/usr/bin/ltsudo` in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI,

The background service of ABP or AES runs as NT AUTHORITY\SYSTEM and implements a file-based inter-process communication

A vulnerability allowing local privilege escalation to the Reporter service context.