Base de CVEs

CVE-2026-106589 Baixa · 2.9 CWE-272 06/10/2026

In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO…

In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can unexpectedly have root privileges. This is related to the GatewayPorts and StreamLocalForwarding configuration options, and lack of support for file-descriptor passing and unprivileged allocation of PTY devices.

CVE-2026-103504 Alta · 8.1 CWE-272 06/10/2026

Gitea API team demotion not applied to unit permissions

Changing an organization team's permission through the API with only the `permission` field did not rebuild the team's per-unit access, and the requested level was not applied as a cap. After an organization owner demoted a team, for example from admin to read, the team's members kept their previous unit permissions, including write access to the team's repositories. The web form was not affected.

CVE-2026-79944 Baixa · 3.4 CWE-272 09/09/2026

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application…

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Least Privilege Violation vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to unauthorized access.

CVE-2026-79693 Baixa · 3.4 CWE-272 09/09/2026

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application…

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Least Privilege Violation vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to unauthorized access.

CVE-2025-62299 Média · 6.6 CWE-272 20/08/2026

HCL IntelliOps Event Management is affected by multiple security vulnerabilities.

HCL IntelliOps Event Management (IEM) is affected by a least privileges violation which could allow an attacker to access the resource with the elevated privilege that could not be accessed with the attacker's original privileges.

CVE-2026-59915 Alta · 7.3 CWE-272 18/08/2026

Dell Alienware Command Center (AWCC), versions prior to 6.14.20.0, contain a Least…

Dell Alienware Command Center (AWCC), versions prior to 6.14.20.0, contain a Least Privilege Violation vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.

CVE-2026-49500 Média · 6.0 CWE-272 18/08/2026

Dell Alienware Command Center (AWCC), versions prior to 6.14.20.0, contain an Improper…

Dell Alienware Command Center (AWCC), versions prior to 6.14.20.0, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of Service and Elevation of Privileges.

CVE-2026-39459 Alta · 7.2 CWE-272 13/05/2026

iControl REST and tmsh vulnerability

A vulnerability exists in iControl REST and the TMOS Shell (tmsh) where a highly privileged, authenticated attacker with at least the Manager role can create configuration objects that allow running arbitrary commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-32655 Alta · 7.8 CWE-272 27/04/2026

Dell Alienware Command Center (AWCC), versions prior to 6.13.8.0, contain a Least…

Dell Alienware Command Center (AWCC), versions prior to 6.13.8.0, contain a Least Privilege Violation vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.

CVE-2025-9711 Alta · 7.8 CWE-272 03/02/2026

Privilege escalation in Brocade Fabric OS before 9.2.1c3, and 9.2.2 though 9.2.2b

A vulnerability in Brocade Fabric OS before 9.2.1c3 could allow elevating the privileges of the local authenticated user to “root” using the export option of seccertmgmt and seccryptocfg commands.

CVE-2025-59106 Alta · 8.8 CWE-272 26/01/2026

Web Server Running with Root Privileges in dormakaba access manager

The binary serving the web server and executing basically all actions launched from the Web UI is running with root privileges. This is against the least privilege principle. If an attacker is able to execute code on the system via other vulnerabilities it is possible to directly execute commands with highest privileges.

CVE-2026-23634 Média · 4.3 CWE-272 16/01/2026

Pepr Overly Permissive RBAC ClusterRole in Admin Mode

Pepr is a type safe K8s middleware. Prior to 1.0.5 , Pepr defaults to a cluster-admin RBAC configuration and does not explicitly force or enforce least-privilege guidance for module authors. The default behavior exists to make the “getting started” experience smooth: new users can experiment with Pepr and create resources dynamically without needing to pre-configure RBAC. This vulnerability is fixed in 1.0.5.

CVE-2025-68267 Média · 6.5 CWE-272 16/12/2025

In JetBrains TeamCity before 2025.11.1 excessive privileges were possible due to storing…

In JetBrains TeamCity before 2025.11.1 excessive privileges were possible due to storing GitHub personal access token instead of an installation token