A flaw was found in search-v2-operator. This component's `search-serviceaccount` has overly broad...
CVE-2026-70495
A flaw was found in search-v2-operator. This component's `search-serviceaccount` has overly broad permissions, allowing
#cwe-269
共收录 809 条相关情报。
← 返回所有主题SkyPilot fails to validate that authenticated users are entitled to grant administrator roles when updating service account permissions. Attackers can create a service account, ...
CVE-2026-75481
SkyPilot fails to validate that authenticated users are entitled to grant administrator roles when updating service acco
A flaw was found in search-v2-operator. This component's `search-serviceaccount` has overly broad permissions, allowing it to impersonate users and groups across the entire clus...
CVE-2026-70495
A flaw was found in search-v2-operator. This component's `search-serviceaccount` has overly broad permissions, allowing
An issue in GAPTEQ Designer v.3.5 allows a remote attacker to escalate privileges via the Company Manger role.
CVE-2026-50774
An issue in GAPTEQ Designer v.3.5 allows a remote attacker to escalate privileges via the Company Manger role.
An issue in Squirro Cognitive Search before v.3.14.2 allows a remote attacker to escalate privileges via a crafted request.
CVE-2026-50770
An issue in Squirro Cognitive Search before v.3.14.2 allows a remote attacker to escalate privileges via a crafted reque
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in...
CVE-2026-18432
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and i
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because `Actio...
CVE-2026-18432
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and i
A vulnerability was determined in OpenBoxes up to 0.9.7. This affects the function needManager of the file grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy of the...
CVE-2026-19928
A vulnerability was determined in OpenBoxes up to 0.9.7. This affects the function needManager of the file grails-app/co
OpenBoxes Role Interceptor RoleInterceptor.groovy needManager privileges management
CVE-2026-19928
A vulnerability was determined in OpenBoxes up to 0.9.7. This affects the function needManager of the file grails-app/co
The Real Estate Manager Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 12.8.6. This is due to improper capability handling ...
CVE-2026-15142
The Real Estate Manager Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and includ
The Wholesale Market plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.2.2 via the ced_wholesale_request_send AJAX action. The ced_w...
CVE-2026-14279
The Wholesale Market plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.2.2
The Propovoice: All-in-One Client Management System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8. This is due to the `c...
CVE-2026-15312
The Propovoice: All-in-One Client Management System plugin for WordPress is vulnerable to Privilege Escalation in all ve
The bLoyal: Loyalty & Promotions by bLoyal plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.611.78. This is due to the AJAX a...
CVE-2026-15001
The bLoyal: Loyalty & Promotions by bLoyal plugin for WordPress is vulnerable to Privilege Escalation in all versions up
Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "ShieldBreak ".
CVE-2026-69414
Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicl
Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Improper Deserialization...
CVE-2026-63701
Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Improper Deserialization of Untrusted Data vuln
Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Incorrect Default...
CVE-2026-63700
Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Incorrect Default Permission vulnerability. A l
Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Improper Deserialization of Untrusted Data vulnerability. A low privileged attacker with local access co...
CVE-2026-63701
Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Improper Deserialization of Untrusted Data vuln
Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Incorrect Default Permission vulnerability. A low privileged attacker with local access could potentiall...
CVE-2026-63700
Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Incorrect Default Permission vulnerability. A l
In Akaunting versions <= 3.1.21, low‑privileged authenticated users can modify their own account to assign themselves the admin role ID, granting full administrator privileges. ...
CVE-2026-16772
In Akaunting versions sync()` call without verifying whether the caller is authorized to manage roles. Users only requir
The Grav API plugin (getgrav/grav-plugin-api) versions >= 1.0.6 and <= 1.0.11 contain a privilege escalation vulnerability. A scoped API key minted on a super-admin account bypa...
CVE-2026-72833
The Grav API plugin (getgrav/grav-plugin-api) versions >= 1.0.6 and <= 1.0.11 contain a privilege escalation vulnerabili