CVE-2026-58566

HighCVSS 8.8/10Last modified Sep 4, 2026

Description

Dell PowerStore, an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Sep 1, 2026
Last modified
Sep 4, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-585678.8Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit thisCVE-2026-585698.8Dell PowerStore contains an Inclusion of Functionality from Untrusted Control Sphere vulnerability. An authenticated user with limited priviCVE-2026-58578.1Contiki-NG's MQTT client parse_publish_vhdr() in os/net/app-layer/mqtt/mqtt.c sets topic_len_received=1 before checking topic_len against thCVE-2026-585718.8Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit thisCVE-2026-585728.8Dell PowerStore contains a Code Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerCVE-2026-585749.8Dell PowerStore contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with network access to thCVE-2026-585758.8Dell PowerStore contains an Authentication Bypass by Spoofing vulnerability. An authenticated attacker could potentially exploit this vulnerCVE-2026-585786.5LobeChat before version 2.2.10-canary.15 contains a regular expression denial of service (ReDoS) vulnerability that allows authenticated attCVE-2026-585795.4RAGFlow before 0.26.3 stores an agent pipeline (DSL) node name without sanitization: the agent update endpoint normalizes the submitted DSL CVE-2026-58588.8Heap buffer overflow in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code via a crafted HTMLCVE-2026-585805.9LobeChat through 2.2.9 server-database deployments are vulnerable to broken object-level authorization in MessageModel. The updateMessagePluCVE-2026-585837.1FluxInk (formerly Sunia SPB Peripheral) Color Management Driver (TcnPeripheral64.sys) 1.0.7.2 allows local privilege escalation for a standa