CWE-269

2,642 vulnerabilities with CWE-269

CVE-2026-40291 HIGH

Chamilo LMS has Privilege Escalation via API User Role Modification

CVSS 8.8

CVE-2026-32212 MEDIUM

Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability

CVSS 5.5

CVE-2026-32181 MEDIUM

Connected User Experiences and Telemetry Service Denial of Service Vulnerability

CVSS 5.5

CVE-2026-38529 HIGH

Webkul Krayin CRM 2.2.x - Auth Bypass

CVSS 8.8

CVE-2026-5144 HIGH

BuddyPress Groupblog <= 1.9.3 - Authenticated (Subscriber+) Privilege Escalation to Administrator via Group Blog IDOR

CVSS 8.8

CVE-2026-33706 HIGH

Chamilo LMS has a REST API Self-Privilege Escalation (Student → Teacher)

CVSS 7.1

CVE-2026-35595 HIGH

Vikunja Affected by Privilege Escalation via Project Reparenting

CVSS 8.3

CVE-2026-29923 HIGH

EnTech Taiwan PowerStrip <=3.90.736 - Privilege Escalation

CVSS 7.8

CVE-2026-39961 MEDIUM

Aiven Operator has cross-namespace secret exfiltration via ClickhouseUser connInfoSecretSource

CVSS 6.8

CVE-2026-35607 HIGH

File Browser: Proxy auth auto-provisioned users inherit Execute permission and Commands

CVSS 8.1

CVE-2026-5373 HIGH

runZero Platform superuser privilege escalation

CVSS 8.1

CVE-2026-33727 MEDIUM

Pi-hole has a Local Privilege Escalation (post-compromise, pihole -> root).

CVSS 6.4

CVE-2026-27456 MEDIUM

util-linux: TOCTOU Race Condition in util-linux mount(8) - Loop Device Setup

CVSS 4.7

CVE-2026-34528 HIGH

File Browser's Signup Grants Execution Permissions When Default Permissions Includes Execution

CVSS 8.1

CVE-2026-34397 MEDIUM

himmelblau: NSS fake-primary group lookup reintroduces name collision risk

CVSS 6.3

CVE-2026-33074 MEDIUM

Discourse: Vulnerability in discourse-subscriptions plugin allowing users to self-grant to higher tier subscriptions

CVSS 5.3

CVE-2026-34218 MEDIUM

ClearanceKit: Managed and user-defined policy rules not enforced between opfilter start and first policy modification

CVSS 5.5

CVE-2026-33906 HIGH

Ella Core has Privilege Escalation via Database Restore by NetworkManager role

CVSS 7.2

CVE-2026-2931 HIGH

Amelia Booking <= 9.1.2 - Authenticated (Customer+) Insecure Direct Object Reference to Arbitrary User Password Change

CVSS 8.8

CVE-2026-30892 NONE

Crun incorrectly parses `crun exec` option `-u`, leading to privilege escalation

CVE-2026-4824 HIGH

Enter Software Iperius Backup Backup Job Configuration File privileges management

CVSS 7.0

CVE-2026-28889 MEDIUM

Apple Xcode <26.4 - Privilege Escalation

CVSS 6.2

CVE-2026-20607 MEDIUM

macOS <14.8.5 - Privilege Escalation

CVSS 4.0

CVE-2026-33509 HIGH

pyload-ng: SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script Configuration

CVSS 7.5

CVE-2026-33334 CRITICAL

Vikunja Desktop: Any frontend XSS escalates to Remote Code Execution due to nodeIntegration

CVSS 9.6