Dell Alienware Command Center (AWCC) versions prior to 6.14.54.0 have a least privilege violation vulnerability. This flaw allows a low privileged local attacker to potentially elevate privileges and cause denial of service. The vulnerability is identified as CWE-272 and carries a high severity rating with a CVSS score of 7. The issue affects versions from initial releases up to but not including 6.14.54.0.
CVE-2026-106589 is a least privilege violation vulnerability in OpenSSH through version 10.6. In certain environments such as QNX 6 and SCO OpenServer 5, the sshd-session process can unexpectedly run with root privileges due to issues related to GatewayPorts and StreamLocalForwarding configuration options and lack of support for file-descriptor passing and unprivileged PTY allocation. The vulnerability has a low CVSS score of 2.9 and is rated medium severity. No known exploits are reported in the wild. No patch information is provided.
Strimzi Kafka Operator versions prior to 1.0.1 have an improper privilege management vulnerability where the Entity Operator ServiceAccount retains RBAC permissions for both Topic Operator and User Operator components even when only one is deployed. This can lead to unauthorized access to KafkaUser custom resources and Secrets or KafkaTopic custom resources depending on which operator is absent. The issue is fixed in versions 1.0.1 and 1.1.0.
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Least Privilege Violation vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to unauthorized access.
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Least Privilege Violation vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to unauthorized access.
CVE-2025-62299 is a least privilege violation vulnerability in HCL IntelliOps Event Management (IEM) version 1.4.0. This flaw allows an attacker with certain privileges to access resources with elevated privileges that they should not normally have. The vulnerability has a medium severity rating with a CVSS score of 6.6.
Dell Alienware Command Center (AWCC) versions prior to 6.14.20.0 have a least privilege violation vulnerability (CWE-272) that allows a low privileged local attacker to potentially elevate their privileges. This vulnerability is rated high severity with a CVSS score of 7.3. No official patch or remediation details are provided in the input data.
Dell Alienware Command Center (AWCC) versions prior to 6.14.20.0 have a vulnerability involving improper link resolution before file access. This flaw allows a low privileged local attacker to exploit link following issues, potentially causing denial of service and elevation of privileges. The vulnerability is classified under CWE-272 (Least Privilege Violation).
A weakness has been identified in D-link DIR-823G 1.0.2B05_20181207. Affected by this vulnerability is an unknown functionality of the file /etc/boa/boa.conf of the component Web Interface. Executing a manipulation can lead to least privilege violation. The attack can be launched remotely. The attack requires a high level of complexity. The exploitation appears to be difficult. The exploit has been made available to the public and could be used for attacks.
CVE-2026-39459 is a high-severity vulnerability in F5 BIG-IP affecting iControl REST and TMOS Shell (tmsh). It allows a highly privileged, authenticated attacker with at least the Manager role to create configuration objects that enable running arbitrary commands. This violates the principle of least privilege and could lead to full system compromise. The affected versions include 16.1.0, 17.1.0, 17.5.0, and 21.
Dell Alienware Command Center (AWCC) versions prior to 6.13.8.0 contain a least privilege violation vulnerability (CWE-272) that allows a low privileged local attacker to potentially elevate their privileges. The vulnerability has a CVSS v3.1 score of 5.3, indicating a medium severity level. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported. The vulnerability requires local access and high attack complexity, with no user interaction needed. Confidentiality is not impacted, but integrity and availability impacts are rated high and low respectively.
A vulnerability in Brocade Fabric OS before 9.2.1c3 could allow elevating the privileges of the local authenticated user to “root” using the export option of seccertmgmt and seccryptocfg commands.
CVE-2025-59106 is a high-severity vulnerability in dormakaba Access Manager 92xx-k7 versions prior to BAME 06.00. The core issue is that the binary responsible for the web server and executing all actions from the Web UI runs with root privileges, violating the least privilege principle (CWE-272). This design flaw allows an attacker who has already gained code execution on the system via other vulnerabilities to escalate privileges to root, enabling full control over the device. The vulnerability has a CVSS score of 8.8, indicating high impact on confidentiality, integrity, and availability without requiring user interaction. Although no known exploits are currently in the wild, the risk is significant due to the ease of privilege escalation once initial access is obtained. European organizations using dormakaba Access Manager 92xx-k7 should prioritize patching and implement compensating controls to limit exposure. Countries with high adoption of dormakaba physical access control systems and critical infrastructure relying on them are at greater risk.
The Social Streams plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.0.1. This is due to the plugin not properly validating a user's identity prior to updating their user meta information in the update_user_meta() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change their user type to that of an administrator.
Least Privilege Violation (CWE-272) Vulnerability exists in the communication function between the NJ/NX-series Machine Automation Controllers and the Sysmac Studio Software. An attacker may use this vulnerability to perform unauthorized access and to execute unauthorized code remotely to the controller products.