CWE-280 (CWE-280) — 15 disclosed vulnerabilities

Records the NVD classes under CWE-280, highest CVSS first.

HIGH 8.4CVE-2026-79403public PoC2026-09-29
An issue in Kilo Code before v7.4.1 allows a local attacker to execute arbitrary code via the permission/allow-everything endpoint
AI risk analysis on Exploit-DB.ai →
MEDIUM 6.7CVE-2026-205992026-11-02
In Modem, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID:…
AI risk analysis on Exploit-DB.ai →
MEDIUM 6.5CVE-2026-125106public PoC2026-11-09
Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, a Wagtail CMS user with the submit translations permission can call the Admin API copy for translation action for a source page that the user cannot …
AI risk analysis on Exploit-DB.ai →
MEDIUM 6.5CVE-2026-123819public PoC2026-11-09
Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, a CMS user who has add permission for a snippet model but lacks change and view permission for an existing snippet can access the snippet copy view a…
AI risk analysis on Exploit-DB.ai →
MEDIUM 5.4CVE-2026-904622026-09-22
A flaw was found in SSSD. When configured with the LDAP access provider and `ldap_access_order` including `ppolicy` or `lockout`, a fail-open condition in the LDAP ppolicy access check can occur if a user lookup returns zero results. This can incorrectly retur…
AI risk analysis on Exploit-DB.ai →
MEDIUM 5.3CVE-2026-123820public PoC2026-11-09
Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, the Wagtail Documents and Images API V2 excludes directly restricted collections but fails to exclude their descendant collections, even though desce…
AI risk analysis on Exploit-DB.ai →
MEDIUM 5.3CVE-2026-63792public PoC2026-10-14
Gitea's collaborative-owner authorization path for reading cross-repository reusable workflows does not exclude fork pull request runs. An approved fork workflow targeting a private repository can read workflow files from another private repository that trusts…
AI risk analysis on Exploit-DB.ai →
MEDIUM 4.4CVE-2026-205772026-11-02
In Modem, there is a possible permission bypass due to a permissions bypass. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: MOLY01880753; Iss…
AI risk analysis on Exploit-DB.ai →
LOW 3.7CVE-2026-125105public PoC2026-11-09
Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, Wagtail applies ETag conditional request processing to the document serve endpoint before document permission and filename checks complete. An unauth…
AI risk analysis on Exploit-DB.ai →
LOW 3.5CVE-2026-544712026-09-17
Dell SmartFabric Manager, versions prior to 2.2.1, contains an Improper Handling of Insufficient Permissions or Privileges vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosu…
AI risk analysis on Exploit-DB.ai →
UNSCOREDCVE-2026-803012026-11-06
Improper isolation in the Avast sandbox on Windows allows a local, low-privileged attacker executing inside the sandbox to access COM interfaces to the Task Scheduler service, escape containment, and execute code with elevated privileges outside the sandbox. …
AI risk analysis on Exploit-DB.ai →
UNSCOREDCVE-2026-3322public PoC2026-10-26
Due to improper permission checks in Lobster_pro, attackers are able to interact with endpoints that should require administrative privileges. This issue affects Lobster_pro version 4.12.12-LTS and potentially other versions prior to 25.1.3.
AI risk analysis on Exploit-DB.ai →
UNSCOREDCVE-2026-211212026-10-12
Improper handling of insufficient permission in CmcCore prior to SMR Oct-2026 Release 1 allows local attackers to use the privileged APIs.
AI risk analysis on Exploit-DB.ai →
UNSCOREDCVE-2026-56729public PoC2026-09-25
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, when multiple KB categories have different editor roles assigned, a user with knowledge_base.editor in one category can see answer titles and updated_at timestamps from categor…
AI risk analysis on Exploit-DB.ai →
UNSCOREDCVE-2026-968722026-09-23
Improper handling of insufficient permissions or privileges vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension on Linux, MacOS, and Windows allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki -…
AI risk analysis on Exploit-DB.ai →