CWE-266

1,014 vulnerabilities with CWE-266

CVE-2026-33518 CRITICAL

Incorrect privilege assignment in Portal for ArcGIS

CVSS 9.8

CVE-2026-40869 HIGH

Decidim amendments can be accepted or rejected by anyone

CVSS 7.5

CVE-2026-6750 HIGH

Privilege escalation in the Graphics: WebRender component

CVSS 8.8

CVE-2026-6634 MEDIUM

usememos UpdateInstanceSetting App.tsx memos_access_token improper authorization

CVSS 6.3

CVE-2026-6609 MEDIUM

liangliangyy DjangoBlog views.py form_valid improper authorization

CVSS 6.3

CVE-2026-6572 MEDIUM

Collabora KodExplorer fileUpload Endpoint share.class.php improper authorization

CVSS 5.6

CVE-2026-6564 MEDIUM

EMQ EMQX Enterprise Session Handling improper authorization

CVSS 4.3

CVE-2026-27668 HIGH

Siemens RUGGEDCOM CROSSBOW SAM-P <V5.8 - Privilege Escalation

CVSS 8.8

CVE-2026-6201 MEDIUM

CodeAstro Online Job Portal Delete Job Posting job-delete.php access control

CVSS 5.4

CVE-2026-6105 HIGH

perfree go-fastdfs-web doInstall InstallController.java improper authorization

CVSS 7.3

CVE-2026-5999 MEDIUM

JeecgBoot SysAnnouncementController improper authorization

CVSS 6.3

CVE-2026-27102 MEDIUM

Dell PowerScale OneFS 9.5.0.0-9.10.1.6/9.11.0.0-9.13.0.1 - Privilege Escalation

CVSS 6.6

CVE-2026-5642 HIGH

Cyber-III Student-Management-System HTTP POST Request update.php improper authorization

CVSS 7.3

CVE-2026-5569 HIGH

Technostrobe HI-LED-WR120-G2 Endpoint access control

CVSS 7.3

CVE-2026-5529 MEDIUM

Dromara lamp-cloud DefUserController pageUser improper authorization

CVSS 4.3

CVE-2026-5526 HIGH

Tenda 4G03 Pro httpd access control

CVSS 7.3

CVE-2026-5484 MEDIUM

BookStackApp BookStack Chapter Export ExportFormatter.php chapterToMarkdown access control

CVSS 5.3

CVE-2026-5330 MEDIUM

SourceCodester/mayuri_k Best Courier Management System User Delete ajax.php access control

CVSS 6.5

CVE-2026-5312 MEDIUM

D-Link DNS-1550-04 dsk_mgr.cgi Get_current_raidtype access control

CVSS 5.3

CVE-2026-5311 MEDIUM

D-Link DNS-1550-04 file_center.cgi Webdav_Access_List access control

CVSS 5.3

CVE-2026-5215 MEDIUM

D-Link DNS-1550-04 network_mgr.cgi cgi_get_ipv6 access control

CVSS 4.3

CVE-2026-32916 CRITICAL

OpenClaw 2026.3.7 < 2026.3.11 - Authorization Bypass in Plugin Subagent Routes via Synthetic Admin Scopes

CVSS 9.4

CVE-2026-33997 MEDIUM

Moby: Off-by-one error in plugin privilege validation

CVSS 6.8

CVE-2026-5124 LOW

osrg GoBGP BGP Header bgp.go BGPHeader.DecodeFromBytes access control

CVSS 3.7

CVE-2026-5122 LOW

osrg GoBGP BGP OPEN Message bgp.go DecodeFromBytes access control

CVSS 3.7