CVE-2026-34901

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Unauthenticated Privilege Escalation in iControlWP <= 5.5.3 versions.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-266

Affected software

No affected versions have been published.

Timeline

Published
Jun 15, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-349027.1Unauthenticated Cross Site Scripting (XSS) in WooCommerce Product Table Lite <= 4.6.3 versions.CVE-2026-349035.4Missing Authorization vulnerability in OceanWP Ocean Extra allows Exploiting Incorrectly Configured Access Control Security Levels.This issuCVE-2026-349047.5Cross-Site Request Forgery (CSRF) vulnerability in Analytify Simple Social Media Share Buttons allows Cross Site Request Forgery.This issue CVE-2026-349056.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0.CVE-2026-349069.3Server-Side Template Injection (SSTI) in Wirtualna Uczelnia allows an unauthenticated attacker to perform Remote Code Execution (RCE). In thCVE-2026-349075.1Wirtualna Uczelnia is vulnerable to Reflected Cross‑Site Scripting (XSS) due to insecure handling of the locale parameter across multiple enCVE-2026-3490810.0A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthCVE-2026-3490910.0A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the uCVE-2026-3491010.0A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute aCVE-2026-349117.7A malicious actor with access to the network and low privileges could exploit a Path Traversal vulnerability found in UniFi OS devices to acCVE-2026-349124.3A missing access control check when linking banners or campaigns to a zone through the zone-include.php script of Revive Adserver 6.0.6 and CVE-2026-349134.3A missing access control check when linking trackers to campaigns through the campaign-trackers.php script of Revive Adserver 6.0.6 and earl
CVE-2026-34901: Critical severity, CVSS 9.8 | Vulnix