Monthly
Privilege escalation in Red Hat OpenShift Container Platform 4's insights-runtime-extractor DaemonSet lets an authenticated low-privileged tenant who can schedule a pod on a node run attacker-controlled code as root in the host user namespace. The extractor scanner enters the workload's namespaces and executes the workload's argv[0] via exec.Command after only seteuid() has changed, leaving real/saved UID 0 and retaining capabilities; a malicious pod binary matching node, python, python3, MainThread, or any path containing java can call setuid(0) and reach the host CRI-O socket from the inherited cwd. CVSS 8.8 (AV:L/PR:L/S:C) reflects local, non-network exploitation requiring workload scheduling, and no public exploit was identified at time of analysis.
Unauthenticated remote attackers can achieve code execution and privilege escalation against NVIDIA AIStore for Linux by injecting arbitrary Kubernetes host-namespace and container security settings into the legacy ETL Kubernetes PodSpec initialization API, rated CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) because the impact escapes the AIStore workload and extends to the underlying Kubernetes node and cluster. The vector confirms the attack is network-reachable with no privileges or user interaction required, though practical exploitation depends on the legacy ETL/transformation feature being enabled and the ETL API being exposed, and on Kubernetes RBAC and PodSecurity admission being permissive enough for AIStore to actually schedule host-namespaced or privileged pods. At time of analysis there is no confirmed active exploitation (CISA KEV) and no public exploit code identified, but the vendor-reported severity, the scope-changed impact, and CWE-250 (execution with unnecessary privileges) place this in top-priority territory for any cluster running an exposed AIStore ETL endpoint.
Unauthenticated SQL execution in mJobTime (all builds through 15.7.3.32) allows any remote attacker who can reach Login.aspx to submit arbitrary SQL that executes with DBA/sysadmin privileges on the backing Sybase SQL Anywhere database and, via xp_cmdshell and xp_read_file, achieve remote code execution as LocalSystem in a single HTTP request. The runQueryButton postback and exportSqlQuery_Server PageMethod are gated only by a client-side sessionStorage flag, so no credentials, user interaction, or non-default configuration are required (independent assessment CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, consistent with the reported CVSS 4.0 score of 9.3 under AV:N/AC:L/AT:N/PR:N/UI:N). There is no CISA KEV listing for this CVE and no public exploit identified at time of analysis, though the technique is documented in the VulnCheck advisory and Sprocket Security write-up.
Sandbox escape in Google Chrome on macOS, affecting releases prior to 155.0.8059.39, allows an attacker who has already compromised the browser's renderer process to execute arbitrary code outside the sandbox when the victim views a crafted HTML page. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, base 8.3) confirms a network-reachable, scope-changing escape that requires user interaction and carries high confidentiality, integrity and availability impact once triggered, but the AC:H rating and CISA SSVC 'Automatable: no' reflect that it cannot be used standalone - a prior renderer compromise is a hard prerequisite. Per the authoritative assessment this is a chained second-stage exploit limited to macOS; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Broken access control in HCL iControl (CVSS 3.1 score 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) allows a low-privileged authenticated user to bypass authorization checks or manipulate object identifiers directly, resulting in privilege escalation and unauthorized modification or deletion of sensitive application data. Because the exploit requires a valid low-privilege account (PR:L), an unauthenticated external attacker cannot exploit this despite the 'Authentication Bypass' tag on the report, but any user with even minimal credentials can escalate to full confidentiality, integrity, and availability impact without user interaction. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; prioritization should focus on environments where low-privilege accounts are broadly provisioned or externally reachable.
Local privilege escalation on Reachy Mini Wireless robots running OS images built from pollen-robotics/reachy-mini-os prior to v0.2.4, where a sudoers entry granted the low-privileged pollen daemon user (uid 1000) passwordless root access to /usr/bin/systemctl with no subcommand or argument restriction. Any code already executing as pollen - for example through a compromised reachy daemon - can escalate to full root (uid 0) without user interaction or a TTY, because systemctl can be pointed at an attacker-supplied unit file whose ExecStart runs as root. Rated CVSS 3.1 7.8 HIGH (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), confirmed by the vendor advisory GHSA-7rhg-9v48-x3h2 and closed by release v0.2.4; no public exploit code or CISA KEV entry was identified at time of analysis, and exploitation requires an existing foothold as the pollen user on an unpatched image.
Privilege escalation in FastAdmin (versions 1.6.1.20250430 and 1.6.5.20260602) lets an attacker who already holds an authenticated administrator session manipulate the Database Management component via application/database.php so that code runs with privileges beyond those intended, resulting in full compromise of confidentiality, integrity, and availability of the affected instance. Exploitation is network-reachable but heavily gated: the assessed vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:R, score 7.1) requires high privileges and user interaction, so an unauthenticated attacker against a default install cannot trigger it directly. Publicly available exploit code exists and is referenced in a public GitHub issue, though there is no KEV confirmation of active exploitation; the EPSS-style exploit maturity flag in the CVSS 4.0 vector (E:P) reinforces that a working proof of concept is circulating.
Privilege escalation in SUSE Rancher Fleet (0.14.x before 0.14.11, 0.15.x before 0.15.7, and 0.16.x before 0.16.2) lets a low-privileged tenant - an authenticated user able to push a Fleet Bundle or GitRepo - have resources written to a shared downstream cluster under the Fleet agent's own cluster-admin credentials rather than the ServiceAccount pinned to the deployment, allowing that tenant to overwrite configuration owned by other tenants. Exploitation is gated by topology: it only matters in multi-tenant Fleet deployments where privileged and untrusted teams share the same downstream cluster, since single-tenant or per-tenant-isolated clusters have no crossed trust boundary. Rated 8.8 by the vendor (the independent assessment scores it higher, 9.9, because the trust boundary crossing changes scope); no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis.
Any holder of a valid low-privileged cPanel account can escalate to root and execute arbitrary code on the underlying host, because a privileged cPanel operation is executed with unnecessary root privileges (CWE-250). The flaw is remotely reachable over the network with low attack complexity and no user interaction, but it does require an authenticated account (CVSS 4.0 vector PR:L) - a trivial barrier on shared hosting where accounts are commonly sold or self-provisioned, and a meaningful one on locked-down single-tenant deployments. It carries a 9.4 CVSS 4.0 score and is rated a genuine high-priority issue rather than a high-score/low-real-risk case, though no public exploit code and no confirmed active exploitation were identified at time of analysis; no EPSS estimate was available in the supplied intelligence.
Privilege escalation in Zoho ManageEngine OpManager and Firewall Analyzer 12.8.710 and earlier allows an authenticated low-privilege user to gain Administrator privileges by importing a crafted Report Profile. The issue is network-reachable with low attack complexity and requires no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1 High), but the attacker must already hold working low-privilege credentials on the target instance and no non-default configuration is needed. No public exploit identified at time of analysis.
Privilege escalation in Red Hat OpenShift Container Platform 4's insights-runtime-extractor DaemonSet lets an authenticated low-privileged tenant who can schedule a pod on a node run attacker-controlled code as root in the host user namespace. The extractor scanner enters the workload's namespaces and executes the workload's argv[0] via exec.Command after only seteuid() has changed, leaving real/saved UID 0 and retaining capabilities; a malicious pod binary matching node, python, python3, MainThread, or any path containing java can call setuid(0) and reach the host CRI-O socket from the inherited cwd. CVSS 8.8 (AV:L/PR:L/S:C) reflects local, non-network exploitation requiring workload scheduling, and no public exploit was identified at time of analysis.
Unauthenticated remote attackers can achieve code execution and privilege escalation against NVIDIA AIStore for Linux by injecting arbitrary Kubernetes host-namespace and container security settings into the legacy ETL Kubernetes PodSpec initialization API, rated CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) because the impact escapes the AIStore workload and extends to the underlying Kubernetes node and cluster. The vector confirms the attack is network-reachable with no privileges or user interaction required, though practical exploitation depends on the legacy ETL/transformation feature being enabled and the ETL API being exposed, and on Kubernetes RBAC and PodSecurity admission being permissive enough for AIStore to actually schedule host-namespaced or privileged pods. At time of analysis there is no confirmed active exploitation (CISA KEV) and no public exploit code identified, but the vendor-reported severity, the scope-changed impact, and CWE-250 (execution with unnecessary privileges) place this in top-priority territory for any cluster running an exposed AIStore ETL endpoint.
Unauthenticated SQL execution in mJobTime (all builds through 15.7.3.32) allows any remote attacker who can reach Login.aspx to submit arbitrary SQL that executes with DBA/sysadmin privileges on the backing Sybase SQL Anywhere database and, via xp_cmdshell and xp_read_file, achieve remote code execution as LocalSystem in a single HTTP request. The runQueryButton postback and exportSqlQuery_Server PageMethod are gated only by a client-side sessionStorage flag, so no credentials, user interaction, or non-default configuration are required (independent assessment CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, consistent with the reported CVSS 4.0 score of 9.3 under AV:N/AC:L/AT:N/PR:N/UI:N). There is no CISA KEV listing for this CVE and no public exploit identified at time of analysis, though the technique is documented in the VulnCheck advisory and Sprocket Security write-up.
Sandbox escape in Google Chrome on macOS, affecting releases prior to 155.0.8059.39, allows an attacker who has already compromised the browser's renderer process to execute arbitrary code outside the sandbox when the victim views a crafted HTML page. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, base 8.3) confirms a network-reachable, scope-changing escape that requires user interaction and carries high confidentiality, integrity and availability impact once triggered, but the AC:H rating and CISA SSVC 'Automatable: no' reflect that it cannot be used standalone - a prior renderer compromise is a hard prerequisite. Per the authoritative assessment this is a chained second-stage exploit limited to macOS; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Broken access control in HCL iControl (CVSS 3.1 score 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) allows a low-privileged authenticated user to bypass authorization checks or manipulate object identifiers directly, resulting in privilege escalation and unauthorized modification or deletion of sensitive application data. Because the exploit requires a valid low-privilege account (PR:L), an unauthenticated external attacker cannot exploit this despite the 'Authentication Bypass' tag on the report, but any user with even minimal credentials can escalate to full confidentiality, integrity, and availability impact without user interaction. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; prioritization should focus on environments where low-privilege accounts are broadly provisioned or externally reachable.
Local privilege escalation on Reachy Mini Wireless robots running OS images built from pollen-robotics/reachy-mini-os prior to v0.2.4, where a sudoers entry granted the low-privileged pollen daemon user (uid 1000) passwordless root access to /usr/bin/systemctl with no subcommand or argument restriction. Any code already executing as pollen - for example through a compromised reachy daemon - can escalate to full root (uid 0) without user interaction or a TTY, because systemctl can be pointed at an attacker-supplied unit file whose ExecStart runs as root. Rated CVSS 3.1 7.8 HIGH (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), confirmed by the vendor advisory GHSA-7rhg-9v48-x3h2 and closed by release v0.2.4; no public exploit code or CISA KEV entry was identified at time of analysis, and exploitation requires an existing foothold as the pollen user on an unpatched image.
Privilege escalation in FastAdmin (versions 1.6.1.20250430 and 1.6.5.20260602) lets an attacker who already holds an authenticated administrator session manipulate the Database Management component via application/database.php so that code runs with privileges beyond those intended, resulting in full compromise of confidentiality, integrity, and availability of the affected instance. Exploitation is network-reachable but heavily gated: the assessed vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:R, score 7.1) requires high privileges and user interaction, so an unauthenticated attacker against a default install cannot trigger it directly. Publicly available exploit code exists and is referenced in a public GitHub issue, though there is no KEV confirmation of active exploitation; the EPSS-style exploit maturity flag in the CVSS 4.0 vector (E:P) reinforces that a working proof of concept is circulating.
Privilege escalation in SUSE Rancher Fleet (0.14.x before 0.14.11, 0.15.x before 0.15.7, and 0.16.x before 0.16.2) lets a low-privileged tenant - an authenticated user able to push a Fleet Bundle or GitRepo - have resources written to a shared downstream cluster under the Fleet agent's own cluster-admin credentials rather than the ServiceAccount pinned to the deployment, allowing that tenant to overwrite configuration owned by other tenants. Exploitation is gated by topology: it only matters in multi-tenant Fleet deployments where privileged and untrusted teams share the same downstream cluster, since single-tenant or per-tenant-isolated clusters have no crossed trust boundary. Rated 8.8 by the vendor (the independent assessment scores it higher, 9.9, because the trust boundary crossing changes scope); no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis.
Any holder of a valid low-privileged cPanel account can escalate to root and execute arbitrary code on the underlying host, because a privileged cPanel operation is executed with unnecessary root privileges (CWE-250). The flaw is remotely reachable over the network with low attack complexity and no user interaction, but it does require an authenticated account (CVSS 4.0 vector PR:L) - a trivial barrier on shared hosting where accounts are commonly sold or self-provisioned, and a meaningful one on locked-down single-tenant deployments. It carries a 9.4 CVSS 4.0 score and is rated a genuine high-priority issue rather than a high-score/low-real-risk case, though no public exploit code and no confirmed active exploitation were identified at time of analysis; no EPSS estimate was available in the supplied intelligence.
Privilege escalation in Zoho ManageEngine OpManager and Firewall Analyzer 12.8.710 and earlier allows an authenticated low-privilege user to gain Administrator privileges by importing a crafted Report Profile. The issue is network-reachable with low attack complexity and requires no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1 High), but the attacker must already hold working low-privilege credentials on the target instance and no non-default configuration is needed. No public exploit identified at time of analysis.