Skip to content
Noroxi

CWE-267 · 66 records

Privilege Defined With Unsafe Actions

CVEs in this class

66 records

  • CVE-2025-41244
    64This week

    VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246)

    HighCVSS 7.8KEVWeaponizedEPSS 8%

    vmware · aria operationsSep 29, 2025

  • CVE-2026-29646
    39Monitor

    In OpenXiangShan NEMU prior to 55295c4, when running with RVH (Hypervisor extension) enabled, a VS-mode guest write to the supervisor interr

    CriticalCVSS 9.8No exploitEPSS 0%

    Apr 20, 2026

  • CVE-2024-42365
    36Monitor

    Asterisk allows `Write=originate` as sufficient permissions for code execution / `System()` dialplan

    HighCVSS 8.8WeaponizedEPSS 4%

    asterisk · asteriskAug 8, 2024

  • CVE-2020-29396
    36Monitor

    A sandboxing issue in Odoo Community 11.0 through 13.0 and Odoo Enterprise 11.0 through 13.0, when running with Python 3.6 or later, allows

    HighCVSS 8.8No exploitEPSS 3%

    odoo · odooDec 22, 2020

  • CVE-2021-44547
    36Monitor

    A sandboxing issue in Odoo Community 15.0 and Odoo Enterprise 15.0 allows authenticated administrators to executed arbitrary code, leading t

    CriticalCVSS 9.1No exploitEPSS 0%

    odoo · odooApr 25, 2023

  • CVE-2026-10090
    36Monitor

    Multicluster-operators-subscription: multicluster-operators-subscription: namespace edit user can deploy cluster-scoped clusterrolebinding and become cluster-ad

    CriticalCVSS 9.0No exploitEPSS 0%

    red hat · red hat advanced cluster management for kubernetes 2.11Aug 5, 2026

  • CVE-2026-96659
    36Monitor

    Foreman: excessive permissions for viewer role on preview

    CriticalCVSS 9.1No exploitEPSS 0%

    red hat · red hat satellite 6.19 for rhel 9Oct 1, 2026

  • CVE-2021-32739
    35Monitor

    Results of queries for ApiListener objects include the ticket salt which allows in turn to steal (more privileged) identities

    HighCVSS 8.8No exploitEPSS 1%

    icinga · icingaJul 15, 2021

  • CVE-2025-53900
    35Monitor

    Kiteworks MFT has a Privilege Defined With Unsafe Actions

    HighCVSS 8.8No exploitEPSS 1%

    accellion · kiteworks managed file transferNov 29, 2025

  • CVE-2024-55968
    35Monitor

    An issue was discovered in DTEX DEC-M (DTEX Forwarder) 6.1.1.

    HighCVSS 8.8Proof of conceptEPSS 1%

    Jan 28, 2025

  • CVE-2025-23015
    35Monitor

    Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions

    HighCVSS 8.8No exploitEPSS 1%

    apache · cassandraFeb 4, 2025

  • CVE-2023-2983
    35Monitor

    Privilege Defined With Unsafe Actions in pimcore/pimcore

    HighCVSS 8.8No exploitEPSS 0%

    pimcore · pimcoreMay 30, 2023

  • CVE-2026-18951
    35Monitor

    Odh-training-operator-rhel9: [trainer v2 security] trn-02: rhoai overlay aggregates trainjobs crud into standard edit clusterrole

    HighCVSS 8.8No exploitEPSS 0%

    red hat · red hat openshift ai 3.3Aug 10, 2026

  • CVE-2023-32457
    35Monitor

    Dell PowerScale OneFS, versions 8.2.2.x-9.5.0.x, contains an improper privilege management vulnerability.

    HighCVSS 8.8No exploitEPSS 0%

    dell · powerscale onefsAug 29, 2023

  • CVE-2023-41966
    35Monitor

    Sielco Radio Link and Analog FM Transmitters Privilege Defined With Unsafe Actions

    HighCVSS 8.8No exploitEPSS 0%

    sielco · analog fm transmitter exc5000gx firmwareOct 26, 2023

  • CVE-2025-26467
    35Monitor

    Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions (4.0.16 only)

    HighCVSS 8.8No exploitEPSS 0%

    apache · cassandraAug 25, 2025

  • CVE-2025-14349
    35Monitor

    Business Logic Error in Universal Software's FlexCity/Kiosk

    HighCVSS 8.8No exploitEPSS 0%

    uni-yaz · flexcityFeb 13, 2026

  • CVE-2025-7691
    35Monitor

    Privilege Defined With Unsafe Actions in GitLab

    HighCVSS 8.8No exploitEPSS 0%

    gitlab · gitlabSep 26, 2025

  • CVE-2026-27314
    35Monitor

    Apache Cassandra: Privilege escalation via ADD IDENTITY authorization bypass

    HighCVSS 8.8No exploitEPSS 0%

    apache · cassandraApr 7, 2026

  • CVE-2026-0945
    35Monitor

    Role Delegation - Moderately critical - Access bypass - SA-CONTRIB-2026-002

    HighCVSS 8.8No exploitEPSS 0%

    role delegation project · role delegationFeb 4, 2026

  • CVE-2025-36255
    35Monitor

    DS8900F and DS8A00 Privilege Escalation

    HighCVSS 8.8No exploitEPSS 0%

    ibm · ds8900f firmwareAug 19, 2026

  • CVE-2021-23166
    34Monitor

    A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to read and w

    HighCVSS 8.7No exploitEPSS 0%

    odoo · odooApr 25, 2023

  • CVE-2021-23186
    34Monitor

    A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to access and

    HighCVSS 8.7No exploitEPSS 0%

    odoo · odooApr 25, 2023

  • CVE-2023-43746
    34Monitor

    BIG-IP Appliance mode external monitor vulnerability

    HighCVSS 8.7No exploitEPSS 0%

    f5 · big-ip access policy managerOct 10, 2023

  • CVE-2026-23526
    34Monitor

    CVAT vulnerable to privilege escalation of users with staff status

    HighCVSS 8.5No exploitEPSS 0%

    cvat · computer vision annotation toolJan 21, 2026

All vulnerability classes