CWE-266
CVEs classified under CWE-266, newest first.
405 CVEsRSS
CVE-2026-12823Low· 3.3A security flaw has been discovered in Browserbase Skills up to 20260526
A security flaw has been discovered in Browserbase Skills up to 20260526. This impacts an unknown function of the component Autobrowse Trace Artifact Handler. The manipulation results in incorrect default permissions. The attack requires…
CVE-2026-12780High· 7.8PoCA vulnerability was determined in AOMEI Backupper up to 8.3.0
A vulnerability was determined in AOMEI Backupper up to 8.3.0. Impacted is an unknown function in the library amwrtdrv.sys of the component Kernel Driver. Executing a manipulation can lead to improper access controls. The attack needs to…
CVE-2026-12799Medium· 4.3BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure
BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure
CVE-2026-12770Medium· 5.4LiteLLM: Admin Key Handler Has Improper Authorization
LiteLLM: Admin Key Handler Has Improper Authorization
CVE-2026-12771Medium· 5.0LiteLLM: M2M JWT Handler Has Improper Authorization
LiteLLM: M2M JWT Handler Has Improper Authorization
GHSA-6jcq-6546-qrrwHigh· 8.8PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable
PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable
CVE-2026-53847MediumOpenClaw: Active Memory write scope could mutate global config
OpenClaw: Active Memory write scope could mutate global config
CVE-2025-59563High· 8.8Subscriber Privilege Escalation in Sonaar <= 4.27.4 versions.
Subscriber Privilege Escalation in Sonaar <= 4.27.4 versions.
CVE-2025-69179Critical· 9.8Unauthenticated Privilege Escalation in Support Ticket Management System <= 1.9 versions.
Unauthenticated Privilege Escalation in Support Ticket Management System <= 1.9 versions.
CVE-2025-69138High· 8.8Subscriber Privilege Escalation in Genemy <= 1.6.6 versions.
Subscriber Privilege Escalation in Genemy <= 1.6.6 versions.
CVE-2026-54196Medium· 6.8Incorrect Privilege Assignment vulnerability in Jetmonsters JetFormBuilder allows Privilege Escalation. This issue affects JetFormBuilder: from n/a through 3.6.1.
Incorrect Privilege Assignment vulnerability in Jetmonsters JetFormBuilder allows Privilege Escalation. This issue affects JetFormBuilder: from n/a through 3.6.1.
CVE-2026-12294Critical· 9.6Sandbox escape in the DOM: Workers component
Sandbox escape in the DOM: Workers component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
CVE-2026-12289High· 8.8Privilege escalation in the Graphics: WebRender component
Privilege escalation in the Graphics: WebRender component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
GHSA-58wc-8wrv-xp9jMedium· 5.4Duplicate Advisory: Active Memory write scope could mutate global config
Duplicate Advisory: Active Memory write scope could mutate global config
GHSA-h9h6-pwqv-j9hvLow· 4.2Duplicate Advisory: Bootstrap token replay could widen pending pairing scopes
Duplicate Advisory: Bootstrap token replay could widen pending pairing scopes
CVE-2025-10263Critical· 9.1PoCArm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may all…
Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may all…
CVE-2025-32747Medium· 5.3Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Incorrect Privilege Assignment vulnerability
Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Incorrect Privilege Assignment vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.
CVE-2026-48172Critical· 9.8CISA KEVPoCLiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026
LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via a command line of grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /u…
CVE-2026-8743Medium· 6.3PoCOpen5GS AMF/MME context.c ran_ue_find_by_amf_ue_ngap_id improper authorization
A vulnerability was found in Open5GS up to 2.7.6. This impacts the function ran_ue_find_by_amf_ue_ngap_id of the file src/amf/context.c of the component AMF/MME. Performing a manipulation results in improper authorization. It is possible…
CVE-2026-8752Medium· 5.3A weakness has been identified in h2oai h2o-3 up to 7402
A weakness has been identified in h2oai h2o-3 up to 7402. This vulnerability affects the function exec of the file h2o-core/src/main/java/water/rapids/ast/prims/misc/AstSetProperty.java of the component Rapids setproperty Primitive Handl…
CVE-2025-68420NoneComarch ERP Optima client connects to a database using a high privileged account regardless of an application account to which a user logs in
Comarch ERP Optima client connects to a database using a high privileged account regardless of an application account to which a user logs in. It is possible for a local attacker who controls the client process to dump it's memory, extra…
CVE-2026-8241Medium· 5.3A vulnerability has been found in Industrial Application Software IAS Canias ERP 8.03
A vulnerability has been found in Industrial Application Software IAS Canias ERP 8.03. The affected element is the function iasGetServerInfoEvent of the component RMI Interface. Such manipulation leads to improper authorization. The atta…
CVE-2026-8233Medium· 4.6A vulnerability was determined in Dotouch XproUPF 2.0.0-release-088aa7c4
A vulnerability was determined in Dotouch XproUPF 2.0.0-release-088aa7c4. Affected is an unknown function of the component UPF. This manipulation causes improper access controls. A high degree of complexity is needed for the attack. The …
CVE-2026-43510Medium· 5.9manage.get.gov is the .gov TLD registrar maintained by CISA
manage.get.gov is the .gov TLD registrar maintained by CISA. manage.get.gov allows an organization administrator to assign domain manager privileges for domains not already in another organization. Fixed in 1.176.0 on or around 2026-04-30.
CVE-2026-5569High· 7.3A vulnerability was found in Technostrobe HI-LED-WR120-G2 5.5.0.1R6.03.30
A vulnerability was found in Technostrobe HI-LED-WR120-G2 5.5.0.1R6.03.30. Impacted is an unknown function of the file /Technostrobe/ of the component Endpoint. The manipulation results in improper access controls. The attack may be perf…
CVE-2026-5529Medium· 4.3A vulnerability was detected in Dromara lamp-cloud up to 5.8.1
A vulnerability was detected in Dromara lamp-cloud up to 5.8.1. This vulnerability affects the function pageUser of the file /defUser/pageUser of the component DefUserController. Performing a manipulation results in improper authorizatio…
CVE-2026-5526High· 7.3A security flaw has been discovered in Tenda 4G03 Pro up to 1.0/1.1/04.03.01.53/192.168.0.1
A security flaw has been discovered in Tenda 4G03 Pro up to 1.0/1.1/04.03.01.53/192.168.0.1. Affected by this vulnerability is an unknown functionality of the file /bin/httpd. The manipulation results in improper access controls. The att…
CVE-2026-5484Medium· 5.3A weakness has been identified in BookStackApp BookStack up to 26.03
A weakness has been identified in BookStackApp BookStack up to 26.03. Affected is the function chapterToMarkdown of the file app/Exports/ExportFormatter.php of the component Chapter Export Handler. Executing a manipulation of the argumen…
CVE-2026-32916Critical· 9.4OpenClaw versions 2026.3.7 before 2026.3.11 contain an authorization bypass vulnerability where plugin subagent routes execute gateway methods through a synthetic operator client with broad administrative scopes
OpenClaw versions 2026.3.7 before 2026.3.11 contain an authorization bypass vulnerability where plugin subagent routes execute gateway methods through a synthetic operator client with broad administrative scopes. Remote unauthenticated r…
CVE-2026-33997Medium· 6.8Moby is an open source container framework
Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins privilege validation to be bypassed during docker plugin install. Due to an error in the daemon's privile…