CWE-266: Incorrect Privilege Assignment — known CVE vulnerabilities

CVEs classified under CWE-266 (Incorrect Privilege Assignment), ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (50)

• CVE-2026-23800 — CVSS 10.0 (critical): Incorrect Privilege Assignment vulnerability in Modular DS modular-connector allows Privilege Escalation.This issue affects Modular DS…
• CVE-2025-41115 — CVSS 10.0 (critical): SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in…
• CVE-2024-9479: Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation.This issue…
• CVE-2024-9478: Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation.This issue…
• CVE-2026-42368 — CVSS 9.9 (critical): A privilege escalation vulnerability exists in the Web Interface functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted HTTP…
• CVE-2026-32922 — CVSS 9.9 (critical): OpenClaw before 2026.3.11 contains a privilege escalation vulnerability in device.token.rotate that allows callers with operator.pairing…
• CVE-2026-22907 — CVSS 9.9 (critical): An attacker may gain unauthorized access to the host filesystem, potentially allowing them to read and modify system data.
• CVE-2025-62645 — CVSS 9.9 (critical): The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows a remote authenticated attacker to obtain a token…
• CVE-2025-10725 — CVSS 9.9 (critical): A flaw was found in Red Hat Openshift AI Service. A low-privileged attacker with access to an authenticated account, for example as a data…
• CVE-2025-54049 — CVSS 9.9 (critical): Incorrect Privilege Assignment vulnerability in miniOrange Custom API for WP custom-api-for-wp allows Privilege Escalation.This issue…
• CVE-2025-26512 — CVSS 9.9 (critical): SnapCenter versions prior to 6.0.1P1 and 6.1P1 are susceptible to a vulnerability which may allow an authenticated SnapCenter Server user…
• CVE-2026-57692 — CVSS 9.8 (critical): Incorrect Privilege Assignment vulnerability in LCweb PrivateContent allows Privilege Escalation. This issue affects PrivateContent: from…
• CVE-2026-56033 — CVSS 9.8 (critical): Unauthenticated Privilege Escalation in Dokan Pro <= 5.0.4 versions.
• CVE-2026-56030 — CVSS 9.8 (critical): Unauthenticated Privilege Escalation in Paytium <= 5.0.2 versions.
• CVE-2026-56028 — CVSS 9.8 (critical): Unauthenticated Privilege Escalation in Easy Elements for Elementor &#8211; Addons &amp; Website Templates <= 1.4.9 versions.
• CVE-2026-54807 — CVSS 9.8 (critical): Unauthenticated Privilege Escalation in Registration Form for WooCommerce <= 1.0.9 versions.
• CVE-2026-49058 — CVSS 9.8 (critical): Unauthenticated Privilege Escalation in LoginPress Pro <= 6.2.2 versions.
• CVE-2026-27395 — CVSS 9.8 (critical): Unauthenticated Privilege Escalation in Support Board < 3.8.9 versions.
• CVE-2025-69179 — CVSS 9.8 (critical): Unauthenticated Privilege Escalation in Support Ticket Management System <= 1.9 versions.
• CVE-2026-39583 — CVSS 9.8 (critical): Unauthenticated Privilege Escalation in Datalogics Ecommerce Delivery <= 2.6.62 versions.
• CVE-2026-34901 — CVSS 9.8 (critical): Unauthenticated Privilege Escalation in iControlWP <= 5.5.3 versions.
• CVE-2026-49060 — CVSS 9.8 (critical): Incorrect Privilege Assignment vulnerability in Hippoo Mobile App for WooCommerce allows Privilege Escalation. This issue affects Hippoo…
• CVE-2025-53209 — CVSS 9.8 (critical): Incorrect Privilege Assignment vulnerability in Themeisle Masteriyo LMS PRO allows Privilege Escalation. This issue affects Masteriyo LMS…
• CVE-2026-48879 — CVSS 9.8 (critical): Incorrect Privilege Assignment vulnerability in Sergey AIWU allows Privilege Escalation. This issue affects AIWU: from n/a through 1.4.17.
• CVE-2026-42680 — CVSS 9.8 (critical): Incorrect Privilege Assignment vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery Pro allows Privilege…
• CVE-2026-42758 — CVSS 9.8 (critical): Incorrect Privilege Assignment vulnerability in Saleswonder Team: Tobias WebinarIgnition webinar-ignition allows Privilege Escalation.This…
• CVE-2026-42731 — CVSS 9.8 (critical): Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege…
• CVE-2026-48172 — CVSS 9.8 (critical) — actively exploited: LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026…
• CVE-2026-22337 — CVSS 9.8 (critical): Incorrect Privilege Assignment vulnerability in Directorist Directorist Social Login allows Privilege Escalation.This issue affects…
• CVE-2026-33519 — CVSS 9.8 (critical): An incorrect authorization vulnerability exists in Esri Portal for ArcGIS 11.4, 11.5 and 12.0 on Windows, Linux and Kubernetes that did not…
• CVE-2026-33518 — CVSS 9.8 (critical): An incorrect privilege assignment vulnerability exists in Esri Portal for ArcGIS 11.5 in Windows and Linux that allows highly privileged…
• CVE-2026-32520 — CVSS 9.8 (critical): Incorrect Privilege Assignment vulnerability in Andrew Munro / AffiliateWP RewardsWP rewardswp allows Privilege Escalation.This issue…
• CVE-2026-27051 — CVSS 9.8 (critical): Incorrect Privilege Assignment vulnerability in uxper Golo golo allows Privilege Escalation.This issue affects Golo: from n/a through <=…
• CVE-2026-24971 — CVSS 9.8 (critical): Incorrect Privilege Assignment vulnerability in Elated-Themes Search & Go searchgo allows Privilege Escalation.This issue affects Search &…
• CVE-2026-24968 — CVSS 9.8 (critical): Incorrect Privilege Assignment vulnerability in Xagio SEO Xagio SEO xagio-seo allows Privilege Escalation.This issue affects Xagio SEO…
• CVE-2026-27542 — CVSS 9.8 (critical): Incorrect Privilege Assignment vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture woocommerce-wholesale-lead-capture…
• CVE-2026-27983 — CVSS 9.8 (critical): Incorrect Privilege Assignment vulnerability in designthemes LMS Elementor Pro lms-elementor-pro allows Privilege Escalation.This issue…
• CVE-2025-68869 — CVSS 9.8 (critical): Incorrect Privilege Assignment vulnerability in LazyCoders LLC LazyTasks lazytasks-project-task-management allows Privilege Escalation.This…
• CVE-2026-23550 — CVSS 9.8 (critical): Incorrect Privilege Assignment vulnerability in Modular DS Modular DS modular-connector allows Privilege Escalation.This issue affects…
• CVE-2019-25249 — CVSS 9.8 (critical): devolo dLAN 500 AV Wireless+ 3.1.0-1 contains an authentication bypass vulnerability that allows attackers to enable hidden services…
• CVE-2025-64188 — CVSS 9.8 (critical): Incorrect Privilege Assignment vulnerability in PenciDesign Soledad soledad allows Privilege Escalation.This issue affects Soledad: from…
• CVE-2025-6325 — CVSS 9.8 (critical): Incorrect Privilege Assignment vulnerability in KingAddons.com King Addons for Elementor king-addons allows Privilege Escalation.This issue…
• CVE-2025-60243 — CVSS 9.8 (critical): Incorrect Privilege Assignment vulnerability in Holest Engineering Selling Commander for WooCommerce selling-commander-connector allows…
• CVE-2025-60195 — CVSS 9.8 (critical): Incorrect Privilege Assignment vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Privilege Escalation.This issue…
• CVE-2025-60220 — CVSS 9.8 (critical): Incorrect Privilege Assignment vulnerability in pebas CouponXxL couponxxl allows Privilege Escalation.This issue affects CouponXxL: from…
• CVE-2025-49401 — CVSS 9.8 (critical): Incorrect Privilege Assignment vulnerability in axiomthemes smart SEO smartSEO allows Privilege Escalation.This issue affects smart SEO…
• CVE-2024-32444 — CVSS 9.8 (critical): Incorrect Privilege Assignment vulnerability in InspiryThemes RealHomes realhomes allows Privilege Escalation.This issue affects RealHomes…
• CVE-2025-49388 — CVSS 9.8 (critical): Incorrect Privilege Assignment vulnerability in kamleshyadav Miraculous Core Plugin miraculouscore allows Privilege Escalation.This issue…
• CVE-2025-53580 — CVSS 9.8 (critical): Incorrect Privilege Assignment vulnerability in quantumcloud Simple Business Directory Pro simple-business-directory-pro allows Privilege…
• CVE-2025-49422 — CVSS 9.8 (critical): Incorrect Privilege Assignment vulnerability in themepassion Support Ticket support-ticket allows Privilege Escalation.This issue affects…