CVE Database

CVE-2026-109892 Critical · 9.8 CWE-266 Oct 15, 2026

WordPress Frontend Admin by DynamiApps plugin <= 3.29.13 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-element allows Privilege Escalation.This issue affects Frontend Admin by DynamiApps: from n/a through 3.29.13.

CVE-2026-109693 High · 8.8 CWE-266 Oct 15, 2026

WordPress Fluent CRM plugin <= 3.2.5 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation.This issue affects Fluent CRM: from n/a through 3.2.5.

CVE-2026-109694 Critical · 9.8 CWE-266 Oct 15, 2026

WordPress Fluent CRM plugin <= 3.2.5 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation.This issue affects Fluent CRM: from n/a through 3.2.5.

CVE-2026-16438 Critical · 9.4 CWE-266 Oct 15, 2026

An arbitrary operation vulnerability in GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, and MC Works64

Incorrect Privilege Assignment vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, MC Works64 all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, and MobileHMI 10.97.3 and prior allows an attacker who can log in using the same administrator account for the affected products to launch and operate DCOM objects locally or remotely. During installation, the installers of the affected products unnecessarily grant default DCOM permissions to the administrator account of the affected products. Users with that administrator accounts can locally or remotely launch and operate DCOM objects that should require UAC elevation. As a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition.

CVE-2026-73814 Unknown CWE-266 Oct 14, 2026

Gitea repository ownership escalation by administrators

Gitea's collaboration access-mode endpoint accepts the Owner access mode from an authenticated repository collaborator with Admin access. The collaborator can promote their effective permissions from Admin to Owner and then perform owner-only operations, including transferring the repository to their own account. This bypasses the intended boundary between repository administration and ownership.

CVE-2026-73804 Unknown CWE-266 Oct 14, 2026

Gitea API token scope escalation through HTTP signatures

Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account. API requests signed with the corresponding private key authenticate as that account through HTTP Signature without API token scope information, causing route-level token scope checks to be skipped. This converts a user-scoped token into an unscoped API authentication method while retaining the account's normal role and repository permissions.

CVE-2026-60010 Medium · 6.5 CWE-266 Oct 14, 2026

Gitea organization team policy bypass through repository API

Gitea's repository-side team-link API allows a repository administrator who is not an organization owner to attach organization teams to a repository despite RepoAdminChangeTeamAccess being disabled. The endpoint does not enforce the organization's restriction on repository administrators changing team access. This allows unauthorized changes to which organization teams receive repository access.

CVE-2026-107424 Critical · 9.8 CWE-266 Oct 14, 2026

WordPress Frontend Dashboard plugin <= 3.0.7 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in M A Vinoth Kumar Frontend Dashboard frontend-dashboard allows Privilege Escalation.This issue affects Frontend Dashboard: from n/a through 3.0.7.

CVE-2026-102851 Medium · 6.1 CWE-266 Oct 13, 2026

Visual Studio Code Security Feature Bypass Vulnerability

Incorrect privilege assignment in Visual Studio Code allows an authorized attacker to bypass a security feature locally.

CVE-2026-105445 Critical · 9.4 CWE-266 Oct 13, 2026

Docker Hub account conversion could reassign an active personal access token to another user

An Incorrect Privilege Assignment vulnerability in Docker Hub's account-to-organization conversion feature allowed an authenticated attacker to reassign a personal access token (PAT) they controlled to another Docker Hub user without rotating or revoking the token secret. The unchanged PAT then authenticated to the registry as the recipient and could pull, push, or delete images, within its scopes, in repositories accessible to that user, including organization repositories.

CVE-2026-109605 High · 7.3 CWE-266 Oct 13, 2026

A security vulnerability has been detected in SourceCodester Simple Cafe Billing System 1.0. This...

A security vulnerability has been detected in SourceCodester Simple Cafe Billing System 1.0. This affects the function Action::save_user of the file admin_class.php of the component User Management. The manipulation of the argument Type leads to improper authorization. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.

CVE-2026-65199 Medium · 5.4 CWE-266 Oct 13, 2026

Huawei openUBMC low-privilege SNMP to administrator privilege escalation

openUBMC assigns the full privilege set to pseudo-identities representing SNMP callers. An authenticated, but low-privilege, SNMP user can therefore invoke mapped backend operations as an administrative identity. In `route_mapper/account.lua`, `get_user_privilege` returns the complete nine-privilege set for a `special_users` group that includes the `SNMPv1_v2c` pseudo-user.

CVE-2026-109520 High · 8.8 CWE-266 Oct 13, 2026

A flaw has been found in Colorful iGameCenter 2.0.0.82. Affected by this vulnerability is the...

A flaw has been found in Colorful iGameCenter 2.0.0.82. Affected by this vulnerability is the function MmMapIoSpace in the library AMDRyzenMasterDriver.sys of the component Dispatch Handler. This manipulation of the argument SystemBuffer causes privilege defined with unsafe actions. The attack needs to be launched locally. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-59241 High · 8.8 CWE-266 Oct 13, 2026

A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All...

A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions < V8.0 Update 11), SIMATIC WinCC V8.1 (All versions < V8.1 Update 7). The affected application does not sufficiently restrict the permissions assigned to a database role. This could allow an authenticated remote attacker with database access to escalate privileges and execute arbitrary commands on the host system where SIMATIC WinCC is installed, potentially leading to a compromise of the system.

CVE-2026-109143 Medium · 5.4 CWE-266 Oct 13, 2026

calcom cal.com/cal.diy Credentials delete credentials.delete privileges management

A vulnerability was determined in calcom cal.com and cal.diy up to 6.2.0. This vulnerability affects the function credentials.delete of the file /api/trpc/credentials/delete of the component Credentials Handler. This manipulation of the argument teamId causes improper privilege management. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-104661 Medium · 4.3 CWE-266 Oct 12, 2026

Incorrect Privilege Assignment in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 17.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user holding a custom role with compliance framework administration permissions to configure and execute a specially crafted compliance pipeline across group projects due to improper privilege assignment.

CVE-2026-108923 Medium · 6.3 CWE-266 Oct 12, 2026

1024-lab smart-admin Support Config Query queryByKey access control

A vulnerability was determined in 1024-lab smart-admin up to 3.30.0. Affected by this vulnerability is an unknown functionality of the file /support/config/queryByKey of the component Support Config Query. Executing a manipulation of the argument configKey can lead to improper access controls. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

CVE-2026-108899 High · 7.3 CWE-266 Oct 12, 2026

tobychui zoraxy Path Exception Matcher authProviders.go handleBasicAuth improper authorization

A flaw has been found in tobychui zoraxy up to 3.3.4. This impacts the function handleBasicAuth of the file mod/dynamicproxy/authProviders.go of the component Path Exception Matcher. This manipulation of the argument PathPrefix causes improper authorization. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 3.3.5-rc1 will fix this issue. Patch name: 37cd0f27b17cd15cfa4af409bfec943146f5fdfe. Upgrading the affected component is advised.

CVE-2026-108890 Medium · 6.3 CWE-266 Oct 12, 2026

BlackBeltTechnology pi-agent-dashboard Terminal terminal-handler.ts terminalManager.spawn improper authorization

A vulnerability has been found in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. Affected by this issue is the function terminalManager.spawn of the file packages/server/src/browser-handlers/terminal-handler.ts of the component Terminal Handler. The manipulation of the argument cwd leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 48fd0bad5adfe76af9736599699d51a5f60019f6. It is suggested to install a patch to address this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

CVE-2026-108835 Medium · 4.4 CWE-266 Oct 12, 2026

Yungengxin Yun Jia Security Guard kgameprotect.sys sub_14000885C privileges management

A flaw has been found in Yungengxin Yun Jia Security Guard up to 2.7.1.9. Impacted is the function sub_14000885C in the library kgameprotect.sys. Executing a manipulation of the argument Pid can lead to improper privilege management. The attack requires local access. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-108825 Medium · 5.4 CWE-266 Oct 12, 2026

yangzongzhuan RuoYi authDataScope checkRoleAllowed privileges management

A vulnerability has been found in yangzongzhuan RuoYi up to 4.8.3. This affects the function checkRoleAllowed of the file /system/role/authDataScope. Such manipulation of the argument roleKey leads to improper privilege management. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-108812 Medium · 6.5 CWE-266 Oct 12, 2026

SEMCMS SEMCMS_User.php user improper authorization

A security vulnerability has been detected in SEMCMS up to 5.0. The impacted element is an unknown function of the file /admin/SEMCMS_User.php?Class=Deleted&CF=user. Such manipulation leads to improper authorization. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-108795 Medium · 4.3 CWE-266 Oct 12, 2026

ZKTeco BioTime System Settings API systemSettings access control

A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is some unknown functionality of the file /base/api/systemSettings of the component System Settings API. Performing a manipulation results in improper access controls. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-108575 Medium · 6.3 CWE-266 Oct 11, 2026

BerriAI LiteLLM Secret Resolution main.py get_secret improper authorization

A vulnerability has been found in BerriAI LiteLLM up to 1.94.0. This affects the function get_secret of the file secret_managers/main.py of the component Secret Resolution. The manipulation of the argument api_key leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-62022 Critical · 9.8 CWE-266 Oct 10, 2026

WordPress Tonda Membership plugin <= 1.0.1 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Tonda Membership <= 1.0.1 versions.