# CWE-282.

Every Advisory and CVE whose sources give the weakness CWE-282, newest first.

## Records, newest first

- [Tanium addressed a local privilege escalation vulnerability in End-User Notifications.](https://agentprime.io/advisories/CVE-2026-108304.md)
  `CVE-2026-108304` · CVE record: Tanium Endpoint Configuration Toolset Solution and 1 more · CVSS 7.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: Path traversal, CWE-282
- [Snipe-IT before 8.7.0 Audit Log Misattribution via Consumables Checkout](https://agentprime.io/advisories/CVE-2026-86769.md)
  `CVE-2026-86769` · CVE record: grokability snipe-it · CVSS 5.3 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: CWE-282
- [Pi-hole: Local privilege escalation from \`pihole\` user to root via \`/etc/pihole/logrotate\`](https://agentprime.io/advisories/CVE-2026-50130.md)
  `CVE-2026-50130` · CVE record: pi-hole pi-hole · CVSS 8.8 High · Not analysed yet · Published 14 Jul 2026 · Tags: CWE-282
- [OpenStack Cyborg's Accelerator Request (ARQ) API does not enforce project ownership at any layer](https://agentprime.io/advisories/GHSA-mmpc-xjxr-5hf8.md)
  `GHSA-mmpc-xjxr-5hf8`, `CVE-2026-40214`, `PYSEC-2026-2854` · PyPI `openstack-cyborg`: affected `<16.0.1`, fixed in `16.0.1` · CVSS 6.3 Medium · Not analysed yet · Published 8 May 2026 · Tags: CWE-282
- [An improper ownership management vulnerability has been identified in Moxa’s Secure Router.](https://agentprime.io/advisories/CVE-2026-3867.md)
  `CVE-2026-3867` · CVE record: Moxa EDR-8010 Series and 1 more · CVSS 6.0 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: CWE-282
- [Kiteworks Core before 9.2.2 is vulnerable to Improper Ownership Management](https://agentprime.io/advisories/CVE-2026-23514.md)
  `CVE-2026-23514` · CVE record: kiteworks core · CVSS 8.8 High · Not analysed yet · Published 25 Mar 2026 · Tags: CWE-282
- [Jenkins HashiCorp Vault Plugin exposes system-scoped Vault credentials](https://agentprime.io/advisories/GHSA-3fm2-hx3h-xm4v.md)
  `GHSA-3fm2-hx3h-xm4v`, `CVE-2025-67642` · Maven `com.datapipe.jenkins.plugins:hashicorp-vault-plugin`: affected `<=371`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 10 Dec 2025 · Tags: CWE-282
- [JetBrains TeamCity: In JetBrains TeamCity before 2025.07.1 privilege escalation was possible due to incorrect…](https://agentprime.io/advisories/CVE-2025-57732.md)
  `CVE-2025-57732` · CVE record: JetBrains TeamCity · CVSS 7.5 High · Not analysed yet · Published 20 Aug 2025 · Tags: CWE-282
- [IBM OpenPages with Watson information disclosure](https://agentprime.io/advisories/CVE-2025-1112.md)
  `CVE-2025-1112` · CVE record: IBM OpenPages with Watson · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: CWE-282
- [Nix: The Nix, Lix, and Guix package managers allow a bypass of build isolation in which a user…](https://agentprime.io/advisories/CVE-2025-46416.md)
  `CVE-2025-46416` · CVE record: NixOS Nix · CVSS 2.9 Low · Not analysed yet · Published 27 Jun 2025 · Tags: CWE-282
- [IBM InfoSphere Information Server file manipulation](https://agentprime.io/advisories/CVE-2025-3629.md)
  `CVE-2025-3629` · CVE record: IBM InfoSphere Information Server · CVSS 4.3 Medium · Not analysed yet · Published 21 Jun 2025 · Tags: CWE-282
- [PeerTube Arbitrary Playlist Creation via ActivityPub Protocol](https://agentprime.io/advisories/CVE-2025-32946.md)
  `CVE-2025-32946` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 15 Apr 2025 · Tags: CWE-282
- [PeerTube Arbitrary Playlist Creation via REST API](https://agentprime.io/advisories/CVE-2025-32945.md)
  `CVE-2025-32945` · CVE record · CVSS 4.3 Medium · Not analysed yet · Published 15 Apr 2025 · Tags: CWE-282
- [GE Vernova EnerVista UR Setup: CWE-282 "Improper Ownership Management" in GE Vernova EnerVista UR Setup allows…](https://agentprime.io/advisories/CVE-2025-27254.md)
  `CVE-2025-27254` · CVE record: GE Vernova EnerVista UR Setup · CVSS 8.0 High · Not analysed yet · Published 10 Mar 2025 · Tags: CWE-282
- [Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-013](https://agentprime.io/advisories/CVE-2024-13249.md)
  `CVE-2024-13249` · CVE record: Drupal Node Access Rebuild Progressive · CVSS 5.4 Medium · Not analysed yet · Published 9 Jan 2025 · Tags: CWE-282
- [Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-010](https://agentprime.io/advisories/CVE-2024-13246.md)
  `CVE-2024-13246` · CVE record: Drupal Node Access Rebuild Progressive · CVSS 5.3 Medium · Not analysed yet · Published 9 Jan 2025 · Tags: CWE-282
- [IBM OpenPages information disclosure](https://agentprime.io/advisories/CVE-2024-43176.md)
  `CVE-2024-43176` · CVE record: IBM OpenPages · CVSS 5.4 Medium · Not analysed yet · Published 9 Jan 2025 · Tags: CWE-282
- [Users can impersonate import requesters if their actor IDs coincide in ImportDump](https://agentprime.io/advisories/CVE-2024-47816.md)
  `CVE-2024-47816` · CVE record: miraheze ImportDump · CVSS 6.4 Medium · Not analysed yet · Published 9 Oct 2024 · Tags: CWE-282
- [Veertu Anka Build: A privilege escalation vulnerability exists in the node update functionality of Veertu…](https://agentprime.io/advisories/CVE-2024-39755.md)
  `CVE-2024-39755` · CVE record: Veertu Anka Build · CVSS 7.8 High · Not analysed yet · Published 3 Oct 2024 · Tags: CWE-282
- [SourceCodester Online Eyewear Shop Cart Content Master.php improper ownership management](https://agentprime.io/advisories/CVE-2024-8949.md)
  `CVE-2024-8949` · CVE record: SourceCodester Online Eyewear Shop · CVSS 5.3 Medium · Not analysed yet · Published 17 Sept 2024 · Tags: CWE-282
- [A valid, authenticated LXCA user without sufficient privileges may be able to use the device identifier to modify an LXCA managed device through a specially crafted web API call.](https://agentprime.io/advisories/CVE-2024-45104.md)
  `CVE-2024-45104` · CVE record: Lenovo XClarity Administrator · CVSS 6.3 Medium · Not analysed yet · Published 13 Sept 2024 · Tags: CWE-282
- [A valid, authenticated LXCA user may be able to unmanage an LXCA managed device in through the LXCA web interface without sufficient privileges.](https://agentprime.io/advisories/CVE-2024-45103.md)
  `CVE-2024-45103` · CVE record: Lenovo XClarity Administrator · CVSS 4.3 Medium · Not analysed yet · Published 13 Sept 2024 · Tags: CWE-282
- [A vulnerability has been identified in Medicalis Workflow Orchestrator (All versions).](https://agentprime.io/advisories/CVE-2024-37999.md)
  `CVE-2024-37999` · CVE record: Siemens Medicalis Workflow Orchestrator · CVSS 8.5 High · Not analysed yet · Published 8 Jul 2024 · Tags: CWE-282
- [PAN-OS: Improper Group Membership Change Vulnerability in Cloud Identity Engine (CIE)](https://agentprime.io/advisories/CVE-2024-3383.md)
  `CVE-2024-3383` · CVE record: Palo Alto Networks PAN-OS and 2 more · CVSS 7.4 High · Not analysed yet · Published 10 Apr 2024 · Tags: CWE-282
- [meetyoucrop big-whale Admin Module all.api improper ownership management](https://agentprime.io/advisories/CVE-2023-7226.md)
  `CVE-2023-7226` · CVE record: meetyoucrop big-whale · CVSS 6.3 Medium · Not analysed yet · Published 11 Jan 2024 · Tags: CWE-282
- [Improper Ownership Management in GitLab](https://agentprime.io/advisories/CVE-2023-0989.md)
  `CVE-2023-0989` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 29 Sept 2023 · Tags: CWE-282
- [Kernel: A flaw was found in the Linux kernel…](https://agentprime.io/advisories/CVE-2023-0386.md)
  `CVE-2023-0386` · CVE record: Kernel · CVSS 7.8 High · Critical (KEV) · In CISA KEV · Not analysed yet · Published 22 Mar 2023 · Tags: CWE-282
- [Bypass of safe.directory protections in Git](https://agentprime.io/advisories/CVE-2022-29187.md)
  `CVE-2022-29187` · CVE record: git git · CVSS 7.8 High · Not analysed yet · Published 12 Jul 2022 · Tags: CWE-282, CWE-427
- [Cortex XDR Agent: Unintended Program Execution Leads to Local Privilege Escalation (PE) Vulnerability](https://agentprime.io/advisories/CVE-2022-0026.md)
  `CVE-2022-0026` · CVE record: Palo Alto Networks Cortex XDR Agent · CVSS 6.7 Medium · Not analysed yet · Published 11 May 2022 · Tags: CWE-282
- [ICSA-20-140-02 Emerson OpenEnterprise](https://agentprime.io/advisories/CVE-2020-10632.md)
  `CVE-2020-10632` · CVE record: Emerson OpenEnterprise SCADA Software · CVSS 8.8 High · Not analysed yet · Published 24 Feb 2022 · Tags: CWE-282
- [Red Hat, Inc. Red Hat JBoss Enterprise Application Platform: It was discovered that the jboss init script as used in Red Hat JBoss Enterprise…](https://agentprime.io/advisories/CVE-2017-12189.md)
  `CVE-2017-12189` · CVE record: Red Hat, Inc. Red Hat JBoss Enterprise Application Platform · No CVSS score · Not analysed yet · Published 10 Jan 2018 · Tags: CWE-282

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-282>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-282/>. Everything for agents: <https://agentprime.io/llms.txt>.