CWE-269 特权管理不恰当 类弱点 1470 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-269 属于权限管理不当漏洞，指产品未能正确分配、修改、跟踪或检查用户权限，导致攻击者获得非预期的控制范围。攻击者常利用此缺陷提升权限或越权访问敏感资源。开发者应实施最小权限原则，严格验证每次操作的身份与权限，确保权限分配、变更及撤销过程的安全性与完整性，从而防止未授权访问。
def makeNewUserDir(username): if invalidUsername(username): #avoid CWE-22 and CWE-78 print('Usernames cannot contain invalid characters') return False try: raisePrivileges() os.mkdir('/home/' + username) lowerPrivileges() except OSError: print('Unable to create new user directory for user:' + username) return False return Trueseteuid(0); /* do some stuff */ seteuid(getuid());| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2026-114612 | LiteLLM 跨域复用盐密钥导致代理管理员提权漏洞 — litellm | 9.9 | Critical | 2026-10-22 |
| CVE-2026-114658 | Grav Login 3.6.0-3.9.13 权限提升漏洞 — grav-plugin-login | 8.8 | High | 2026-10-22 |
| CVE-2026-110744 | Multicluster-global-hub 越权冒充漏洞 — Multicluster Global Hub | 7.2 | High | 2026-10-21 |
| CVE-2026-20291 | 思科多款产品 Snort 3 软件加固 — Cisco Cyber Vision | 7.8 | High | 2026-10-21 |
| CVE-2026-114069 | Trigger.dev 4.6.0 前 环境密钥披露漏洞 — trigger.dev | 8.1 | High | 2026-10-21 |
| CVE-2026-105312 | Console-operator Kafka 控制台租户镜像权限提升漏洞 — StreamsHub Console for Apache Kafka® | 9.9 | Critical | 2026-10-20 |
| CVE-2026-105453 | IBM Sterling Connect:Direct Unix 权限管理漏洞 — Sterling Connect Direct for Unix | 8.4 | High | 2026-10-19 |
| CVE-2026-111920 | Vikunja 2.6.0 继承项目权限访问控制漏洞 — vikunja | 4.3 | Medium | 2026-10-17 |
| CVE-2026-111909 | phpMyFAQ 4.1.9 前版本 API 权限绕过漏洞 — phpMyFAQ | 8.1 | High | 2026-10-17 |
| CVE-2026-111893 | phpMyFAQ 4.2.0 越权漏洞 — phpMyFAQ | 6.5 | Medium | 2026-10-17 |
| CVE-2026-111890 | phpMyFAQ 4.2.0-alpha.2 权限提升漏洞 — phpMyFAQ | 5.5 | Medium | 2026-10-17 |
| CVE-2026-111891 | phpMyFAQ 4.2.0 权限提升漏洞 — phpMyFAQ | 5.5 | Medium | 2026-10-17 |
| CVE-2026-17491 | IBM i OpenSSH 权限管理不当漏洞 — i | 5.4 | Medium | 2026-10-16 |
| CVE-2026-102917 | IBM i 权限管理不当漏洞 — i | 7.8 | High | 2026-10-16 |
| CVE-2026-111708 | WhaTicket Community 管理员注册绕过漏洞 — whaticket-community | 9.8 | Critical | 2026-10-16 |
| CVE-2026-104755 | WP Compress 7.25.00 未认证权限提升漏洞 — WP Compress – Instant Performance & Speed Optimization | 4.8 | Medium | 2026-10-16 |
| CVE-2026-85659 | PilotPress 2.0.43 权限提升漏洞 — PilotPress | 8.8 | High | 2026-10-16 |
| CVE-2026-109447 | User Profile Builder 4.0.3 未授权权限提升漏洞 — User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor | 8.1 | High | 2026-10-16 |
| CVE-2026-89079 | Theme My Login 7.2.1 远程权限提升漏洞 — Theme My Login | 9.8 | Critical | 2026-10-16 |
| CVE-2026-104798 | My Calendar 3.8.7 未授权权限提升漏洞 — My Calendar – Accessible Event Manager | 9.8 | Critical | 2026-10-16 |
| CVE-2026-111114 | Nexter Extension 4.7.11 认证权限提升漏洞 — Nexter Extension – Security, Performance, Code Snippets & Site Toolkit | 7.5 | High | 2026-10-16 |
| CVE-2026-109400 | InstaWP Connect 0.1.4.1 权限提升及密钥泄露漏洞 — InstaWP Connect – 1-click WP Staging & Migration | 7.5 | High | 2026-10-16 |
| CVE-2026-109515 | MailOptin 1.2.78.6 未认证特权升级漏洞 — MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. | 9.8 | Critical | 2026-10-16 |
| CVE-2026-104745 | WooCommerce 3.3.0 未授权权限提升漏洞 — Customer Email Verification for WooCommerce | 8.1 | High | 2026-10-16 |
| CVE-2026-110724 | api-gateway<=1.7.3限流绕过漏洞 — Eclipse Connected Services Platform | - | - | 2026-10-15 |
| CVE-2026-8145 | WholesaleX <=3.0.8 未授权权限提升漏洞 — WholesaleX – All-in-One B2B Solution with Wholesale Pricing | 5.4 | Medium | 2026-10-15 |
| CVE-2026-77524 | KEDA 命名空间管理员通过 TriggerAuthentication 提权至集群管理员 — keda | 9.9 | Critical | 2026-10-14 |
| CVE-2026-53614 | util-linux LIBMOUNT_FORCE_MOUNT2绕过nosuid和noexec漏洞 — util-linux | 7.0 | High | 2026-10-14 |
| CVE-2026-73802 | Gitea Runner 容器选项导致主机隔离绕过漏洞 — Gitea Runner | - | - | 2026-10-14 |
| CVE-2026-110633 | MyReport Updater 2.1.1 本地提权漏洞 — MyReport Updater | 7.8 | High | 2026-10-14 |
CWE-269（特权管理不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 1470 条 CVE 漏洞。