Monthly
Missing privilege-level checks in phpMyFAQ's GroupController::deleteGroup() let an authenticated administrator who holds only the GROUP_DELETE permission permanently destroy higher-privileged groups by sending a crafted groupId to /admin/api/group/delete, stripping those groups' members of inherited rights. Exposure is confined to the 4.2.0 development line from 4.2.0-alpha up to but not including 4.2.0-beta, which the vendor advisory identifies as the fixed release. Attackers must already hold a delegated, non-SuperAdmin admin account, and no public exploit code has been identified at time of analysis.
Cleartext credential disclosure in P4 Search (formerly Helix Search) 2026.4.2 and earlier allows an authenticated administrator on the connected P4 Server to retrieve stored credentials through the product's configuration API, enabling privilege escalation beyond the administrator's intended scope. The defect is rooted in insufficient granularity of access control (CWE-1220): the API exposes secret material that administrators should not be able to read back, and the resulting credential exposure has cross-boundary confidentiality, integrity, and availability consequences per the assessed scope change (S:C). Exploitation is privilege-gated by the PR:H authentication requirement in the CVSS vector, so this is not reachable by anonymous or unprivileged users, and no public exploit code or confirmed active exploitation has been identified at time of analysis. A vendor patch is available in P4 Search 2026.4.3.
Local privilege escalation in Microsoft Windows Server Update Service (WSUS) allows an authenticated attacker who already holds a low-privileged foothold on a WSUS-enabled host to escalate to higher privileges, with total impact to confidentiality, integrity, and availability (CVSS 7.8, C:H/I:H/A:H). Only servers with the WSUS role installed are exposed, and only builds below the vendor-supplied fixed levels are affected (e.g., Server 2025 < 10.0.26100.33650, Server 2022 < 10.0.20348.5761, Server 2019 < 10.0.17763.9376, Server 2016 < 10.0.14393.9612, Server 2012 R2 < 6.3.9600.23470, Server 2012 < 6.2.9200.26434, plus Windows 10 1607/1809). There is no remote or unauthenticated path (AV:L/PR:L/UI:N), no public exploit identified at time of analysis per CISA SSVC (Exploitation: none) and no KEV listing; Microsoft has released patches.
Local privilege escalation in the Windows Server Update Service (WSUS) lets an authenticated low-privileged user on a WSUS-enabled host gain elevated privileges, rooted in CWE-1220 (insufficient granularity of access control) and rated 7.8 under CVSS 3.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires the WSUS role or component to be present on the target and the attacker to already hold local low-privileged access; no user interaction or unusual complexity is needed, but an unauthenticated or purely remote attacker cannot trigger it from this vector. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' with non-automatable characteristics, and vendor patches are available from Microsoft for all affected builds.
Privilege escalation in Microsoft SQL Server allows a low-privileged, authenticated network attacker to elevate access rights and achieve full control over database confidentiality, integrity, and availability. The root cause is CWE-1220 (Insufficient Granularity of Access Control), meaning SQL Server fails to enforce sufficiently fine-grained permission boundaries between privilege tiers, permitting lateral movement to higher roles without authorization. All active major servicing branches are affected - SQL Server 2017, 2019, 2022, and 2025 - and Microsoft has released patches across both Cumulative Update and GDR servicing tracks. No public exploit or active exploitation (KEV) has been identified at time of analysis.
Privilege escalation in Microsoft SQL Server allows an authenticated low-privileged network attacker to gain complete control over affected database instances across SQL Server 2017, 2019, 2022, and 2025. The flaw stems from CWE-1220 (Insufficient Granularity of Access Control), where the access control model fails to enforce fine-grained permission boundaries, permitting a standard database login to exceed its intended privilege scope. No active exploitation has been confirmed by CISA KEV and no public proof-of-concept has been identified, but the broad version coverage and full C:H/I:H/A:H CVSS impact make patching urgent. Vendor-released patches are available across all affected release tracks.
Local privilege escalation in HP Support Assistant (versions prior to 9.53.2.0) allows a low-privileged local user to gain elevated system privileges by exploiting insufficient granularity in access controls (CWE-1220). The vulnerability requires local authenticated access but no user interaction, and the CVSS 4.0 AT:P metric indicates specific attack conditions must be present. No public exploit code or active exploitation has been identified at time of analysis; HP has released a patched version addressing the issue.
Insufficient access control granularity in docker-socket-proxy allows adjacent-network attackers without credentials to read arbitrary files and exfiltrate entire container filesystems via four unguarded Docker API endpoints. When the CONTAINERS environment variable is set, the HAProxy-based proxy fails to block /containers/{id}/archive, /containers/{id}/export, /containers/{id}/logs, and /containers/{id}/top, treating namespace-level permission as blanket endpoint permission. No active exploitation or confirmed public exploit code has been identified at time of analysis, though a researcher gist is referenced alongside the upstream fix in PR #183.
Tamper protection bypass in BeyondTrust Endpoint Privilege Management (EPM) for Windows allows local high-privileged users to circumvent agent protection controls by exploiting a flaw in how protections are applied to a support utility process. Affected versions are all EPM Windows Deployment releases prior to 26.1.2, per EUVD-2026-60270 and BeyondTrust advisory BT26-04. No public exploit has been identified and this is not in CISA KEV, but the high confidentiality, integrity, and availability impact on the vulnerable system makes this a meaningful concern for any organization relying on EPM as a core endpoint security control.
Local privilege escalation in Windows User-Mode Power Service (UMPS) affects a broad swath of Windows 10, Windows 11, and Windows Server releases from Server 2012 through Server 2025. An authenticated low-privileged local user can exploit insufficient access control granularity (CWE-1220) in UMPS to elevate privileges, achieving full confidentiality, integrity, and availability impact consistent with SYSTEM-level access. No public exploit identified at time of analysis, but Microsoft has released patches across all affected build lines, making this a high-priority patching item for organizations running any of the 19 affected Windows configurations identified in EUVD-2026-56638.
Missing privilege-level checks in phpMyFAQ's GroupController::deleteGroup() let an authenticated administrator who holds only the GROUP_DELETE permission permanently destroy higher-privileged groups by sending a crafted groupId to /admin/api/group/delete, stripping those groups' members of inherited rights. Exposure is confined to the 4.2.0 development line from 4.2.0-alpha up to but not including 4.2.0-beta, which the vendor advisory identifies as the fixed release. Attackers must already hold a delegated, non-SuperAdmin admin account, and no public exploit code has been identified at time of analysis.
Cleartext credential disclosure in P4 Search (formerly Helix Search) 2026.4.2 and earlier allows an authenticated administrator on the connected P4 Server to retrieve stored credentials through the product's configuration API, enabling privilege escalation beyond the administrator's intended scope. The defect is rooted in insufficient granularity of access control (CWE-1220): the API exposes secret material that administrators should not be able to read back, and the resulting credential exposure has cross-boundary confidentiality, integrity, and availability consequences per the assessed scope change (S:C). Exploitation is privilege-gated by the PR:H authentication requirement in the CVSS vector, so this is not reachable by anonymous or unprivileged users, and no public exploit code or confirmed active exploitation has been identified at time of analysis. A vendor patch is available in P4 Search 2026.4.3.
Local privilege escalation in Microsoft Windows Server Update Service (WSUS) allows an authenticated attacker who already holds a low-privileged foothold on a WSUS-enabled host to escalate to higher privileges, with total impact to confidentiality, integrity, and availability (CVSS 7.8, C:H/I:H/A:H). Only servers with the WSUS role installed are exposed, and only builds below the vendor-supplied fixed levels are affected (e.g., Server 2025 < 10.0.26100.33650, Server 2022 < 10.0.20348.5761, Server 2019 < 10.0.17763.9376, Server 2016 < 10.0.14393.9612, Server 2012 R2 < 6.3.9600.23470, Server 2012 < 6.2.9200.26434, plus Windows 10 1607/1809). There is no remote or unauthenticated path (AV:L/PR:L/UI:N), no public exploit identified at time of analysis per CISA SSVC (Exploitation: none) and no KEV listing; Microsoft has released patches.
Local privilege escalation in the Windows Server Update Service (WSUS) lets an authenticated low-privileged user on a WSUS-enabled host gain elevated privileges, rooted in CWE-1220 (insufficient granularity of access control) and rated 7.8 under CVSS 3.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires the WSUS role or component to be present on the target and the attacker to already hold local low-privileged access; no user interaction or unusual complexity is needed, but an unauthenticated or purely remote attacker cannot trigger it from this vector. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' with non-automatable characteristics, and vendor patches are available from Microsoft for all affected builds.
Privilege escalation in Microsoft SQL Server allows a low-privileged, authenticated network attacker to elevate access rights and achieve full control over database confidentiality, integrity, and availability. The root cause is CWE-1220 (Insufficient Granularity of Access Control), meaning SQL Server fails to enforce sufficiently fine-grained permission boundaries between privilege tiers, permitting lateral movement to higher roles without authorization. All active major servicing branches are affected - SQL Server 2017, 2019, 2022, and 2025 - and Microsoft has released patches across both Cumulative Update and GDR servicing tracks. No public exploit or active exploitation (KEV) has been identified at time of analysis.
Privilege escalation in Microsoft SQL Server allows an authenticated low-privileged network attacker to gain complete control over affected database instances across SQL Server 2017, 2019, 2022, and 2025. The flaw stems from CWE-1220 (Insufficient Granularity of Access Control), where the access control model fails to enforce fine-grained permission boundaries, permitting a standard database login to exceed its intended privilege scope. No active exploitation has been confirmed by CISA KEV and no public proof-of-concept has been identified, but the broad version coverage and full C:H/I:H/A:H CVSS impact make patching urgent. Vendor-released patches are available across all affected release tracks.
Local privilege escalation in HP Support Assistant (versions prior to 9.53.2.0) allows a low-privileged local user to gain elevated system privileges by exploiting insufficient granularity in access controls (CWE-1220). The vulnerability requires local authenticated access but no user interaction, and the CVSS 4.0 AT:P metric indicates specific attack conditions must be present. No public exploit code or active exploitation has been identified at time of analysis; HP has released a patched version addressing the issue.
Insufficient access control granularity in docker-socket-proxy allows adjacent-network attackers without credentials to read arbitrary files and exfiltrate entire container filesystems via four unguarded Docker API endpoints. When the CONTAINERS environment variable is set, the HAProxy-based proxy fails to block /containers/{id}/archive, /containers/{id}/export, /containers/{id}/logs, and /containers/{id}/top, treating namespace-level permission as blanket endpoint permission. No active exploitation or confirmed public exploit code has been identified at time of analysis, though a researcher gist is referenced alongside the upstream fix in PR #183.
Tamper protection bypass in BeyondTrust Endpoint Privilege Management (EPM) for Windows allows local high-privileged users to circumvent agent protection controls by exploiting a flaw in how protections are applied to a support utility process. Affected versions are all EPM Windows Deployment releases prior to 26.1.2, per EUVD-2026-60270 and BeyondTrust advisory BT26-04. No public exploit has been identified and this is not in CISA KEV, but the high confidentiality, integrity, and availability impact on the vulnerable system makes this a meaningful concern for any organization relying on EPM as a core endpoint security control.
Local privilege escalation in Windows User-Mode Power Service (UMPS) affects a broad swath of Windows 10, Windows 11, and Windows Server releases from Server 2012 through Server 2025. An authenticated low-privileged local user can exploit insufficient access control granularity (CWE-1220) in UMPS to elevate privileges, achieving full confidentiality, integrity, and availability impact consistent with SYSTEM-level access. No public exploit identified at time of analysis, but Microsoft has released patches across all affected build lines, making this a high-priority patching item for organizations running any of the 19 affected Windows configurations identified in EUVD-2026-56638.