rootpwn

critical · CVSS v3 8.8 · CVSS v4 8.7

CVE-2026-92761

WebVirtCloud fails to properly validate permission flags in UserInstance grants, allowing view-only users to perform pri…

Description

WebVirtCloud fails to properly validate permission flags in UserInstance grants, allowing view-only users to perform privileged actions. Attackers with read-only grants can power off virtual machines, reset root passwords, install SSH keys, and manage ISO images by exploiting the get_instance gate that only checks grant existence.

Scores

Severity
critical
CVSS v2
9
CVSS v3
8.8
CVSS v4
8.7
EPSS
—

← All CVEs

Related CVEs

critical

CVE-2026-86341

CVE‑2026‑86341 is a critical access‑control flaw that allows an attacker to bypass deployment approval checks by disabling strict policies after a deployment object has been altered. The vulnerability can silently enable unapproved code changes to reach production, compromising the integrity of the deployment pipeline.

View analysis

critical

CVE-2026-76460

A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.

View analysis

critical

CVE-2026-92748

BC Security Empire before 6.7.1 fails to validate the multipart filename parameter in upload endpoints, allowing authenticated operators to write files to arbitrary paths on the C2 server. Attackers can use path traversal sequences in the filename to bypass directory containment and write malicious files to sensitive locations for code execution.

View analysis

critical

CVE-2026-92749

SafeLine through 9.4.1 derives the management console session-signing secret from a time-seeded math/rand generator, allowing attackers to reconstruct the key offline. Unauthenticated remote attackers who can bound the install timestamp can regenerate the secret and forge valid administrator session cookies to gain control of protected sites.

View analysis