Wagtail CMS versions prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 contain a vulnerability where users with the submit translations permission can copy a source page they cannot edit into a translation. This allows unauthorized viewing of the source page content despite lacking edit permissions. The issue is addressed in the specified fixed versions.
Wagtail versions prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 have an issue where ETag conditional request processing occurs before document permission and filename checks. This allows an unauthenticated attacker who knows a document ID and a candidate SHA1 hash to determine if that hash exists in the document library by submitting If-Match or If-None-Match headers. The vulnerability does not expose document contents, filenames, or other metadata beyond confirming the presence of known hashes. The issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.
Wagtail versions prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 have a vulnerability in the Documents and Images API V2 where descendant collections of directly restricted collections are not properly excluded. This allows API users to list filenames and names of documents and images in descendant collections that should be private. The issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.
A permission handling vulnerability in Wagtail CMS prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 allows users with add permission but without change or view permissions on snippet models to access and copy snippet content they are not authorized to view. This improper permission check exposes snippet contents to unauthorized users. The issue is fixed in the specified versions.
CVE-2026-80301 is a vulnerability in Gen Digital's Avast Antivirus products where the sandbox on Windows improperly isolates COM interface access to the Task Scheduler service. This flaw allows a local, low-privileged attacker executing inside the sandbox to escape containment by scheduling and executing code with elevated privileges on the host system. The sandbox virtualizes file system and registry access but does not block the Task Scheduler COM pathway, enabling arbitrary code execution outside the sandbox boundaries.
CVE-2026-20599 is a vulnerability in MediaTek chipsets involving improper handling of insufficient permissions in the modem component. The flaw allows escalation of privilege locally if an attacker already has System-level privileges. Exploitation does not require user interaction. Multiple MediaTek chipset versions are affected.
CVE-2026-20577 is a vulnerability in MediaTek chipsets that involves improper handling of insufficient permissions, leading to a permissions bypass in the modem component. This flaw can be exploited locally by an attacker who already has System privileges to cause a denial of service without requiring user interaction. The vulnerability affects multiple MediaTek chipset models. The CVSS score is 4.4, indicating medium severity.
CVE-2026-3322 is a vulnerability in Lobster DATA GmbH's Lobster_pro product involving improper permission checks. Attackers with limited privileges can interact with endpoints that should require administrative rights. The issue affects Lobster_pro version 4.12.12-LTS and potentially other versions before 25.1.3. The vulnerability has a CVSS 4.0 base score of 5.6, indicating medium severity.
CVE-2026-21121 is a medium severity vulnerability in Samsung Mobile Devices involving improper handling of insufficient permissions in the CmcCore component prior to the SMR Oct-2026 Release 1. This flaw allows local attackers to access privileged APIs without proper authorization.
Improper handling of insufficient permissions or privileges vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension on Linux, MacOS, and Windows allows Accessing Functionality Not Properly Constrained by ACLs.
This issue affects Mediawiki - WikiLambda Extension: before 1.47.0.
Dell SmartFabric Manager, versions prior to 2.2.1, contains an Improper Handling of Insufficient Permissions or Privileges vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
Improper handling of insufficient permissions or privileges vulnerability in Secomea GateManager allows Privilege Escalation.
This issue affects GateManager: 11.5;0, 11.4.625515072:0.
Fixed in Version 11.6 or 11.4.626194074 and above
CVE-2026-21099 is a medium severity vulnerability in Samsung Mobile Devices involving improper access control in the SettingsProvider component prior to the SMR Sep-2026 Release 1. This flaw allows local attackers to access sensitive information due to insufficient permission handling.
CVE-2026-69907 is a high-severity vulnerability in Microsoft Windows 10 Version 1607 related to improper handling of insufficient permissions or privileges in Windows Enterprise App Management. This flaw allows an authorized local attacker to elevate their privileges. The issue affects multiple Windows 10 builds prior to specific fixed versions. Microsoft has released official fixes for all affected versions.
CVE-2026-59567 is a high-severity vulnerability in Zscaler Client Connector involving improper handling of insufficient permissions or privileges. It allows local privilege escalation, enabling an unprivileged user to execute arbitrary code with elevated privileges. The vulnerability is identified as CWE-280 and has a CVSS 3.1 score of 8.8, indicating high impact on confidentiality, integrity, and availability. No specific affected versions or patch information are provided. There are no known exploits in the wild at this time.
CVE-2026-58416 is a high-severity vulnerability in Gitea Open Source Git Server versions up to 1.26.4. It involves a missing fork-PR guard that allows Fork-PR Actions tasks to read a third private repository via the collaborative-owner branch. This flaw can lead to unauthorized read access to private repository data.
Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types in Apache Allura.
This issue affects Apache Allura: before 1.19.1.
Users are recommended to upgrade to version 1.19.1, which fixes the issue.
Velociraptor allows multi-tenant deployments named "Orgs".
By default Velociraptor, uses the ROOT org, but users can create child orgs for other tenants within the same deployment.
Users can have different permissions in each org. To manage Orgs, Velociraptor usually examines the ORG_ADMIN permission on the ROOT org.
This issue results from the Velociraptor server allowing for the deletion of Orgs by incorrectly checking the ORG_ADMIN permission of callers within the calling ORG instead of the ROOT org. However, Org admins of child orgs were able to add this permission to their ACL token within their own org. This allows an administrator in a child org, which is not also an administrator in the ROOT org, to delete other orgs.
Improper handling of insufficient permissions or privileges vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Privilege Abuse.
This issue affects Niagara Framework: before 4.14.6, before 4.15.5; Niagara Enterprise Security: before 4.14.6, before 4.15.5.