Monthly
Local privilege escalation in Entevo HMI V2 R5 P0 M4 enables a low-privileged local user to break out of Kiosk Mode and gain administrative command execution on Windows. The escape path exploits the application's built-in PDF manual viewer: opening the manual triggers an external PDF reader, whose Print dialog exposes Windows Explorer shell access, ultimately permitting arbitrary command execution as an administrator. A proof-of-concept demonstration is publicly available via GitHub gist; EPSS is low at 0.17% and CISA SSVC indicates no confirmed active exploitation, though the public POC meaningfully lowers the skill bar for any attacker with local session access.
Privilege elevation in Google Chrome's Import feature before version 151.0.7922.173 enables sandbox escape and arbitrary code execution at the OS level, exploitable by a remote attacker who can deliver a crafted file and socially engineer a user into opening it. The vulnerability stems from CWE-250 (Execution with Unnecessary Privileges) within the Import component, yielding full confidentiality, integrity, and availability impact per CVSS C:H/I:H/A:H. No public exploit code has been identified at time of analysis, and SSVC confirms exploitation status as none, though the total technical impact rating and sandbox-escape primitive warrant prompt patching across all Chrome deployments.
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 stems from the search-v2-operator being bound to a ClusterRole with cluster-administrator-equivalent permissions - including user impersonation, RBAC write, Certificate Signing Request approval, and ManifestWork management. An attacker who gains control of the operator's service account (a low-privileged cluster foothold) can leverage these excessive grants to take over the entire hub cluster and its managed clusters. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 9.9 rating reflects the near-total loss of cluster control if the operator identity is abused.
Local privilege escalation in NVIDIA Cumulus Linux exposes network switch operating systems to full compromise by unprivileged local users. The flaw resides in the user management component, where improper privilege assignment (CWE-250) allows a low-privileged authenticated user to escalate to higher privilege levels - likely root - with low attack complexity and no user interaction required. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the CVSS 7.8 High score reflects the full triad impact once local access is obtained.
Excessive Kubernetes RBAC privileges in the insights-client ServiceAccount within Red Hat Advanced Cluster Management for Kubernetes 2 expose all cluster Secrets to any attacker who compromises the pod or obtains its token. The ServiceAccount is bound to a ClusterRole granting cluster-wide get, list, and watch on all Secrets, far exceeding the single Secret the component actually requires. If the insights-client pod is breached, an attacker can read every Secret across the hub cluster - including managed-cluster kubeconfigs - enabling lateral movement to downstream managed clusters. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 lets a namespace-scoped tenant abuse the multicloud-operators-subscription controller as a confused deputy: by crafting Subscription Custom Resources, a namespace-admin causes the controller's highly privileged ServiceAccount to deploy attacker-chosen cluster-scoped resources. This breaks tenant isolation and can yield cluster-wide privilege escalation and arbitrary code execution. Rated CVSS 9.9 (scope-changing), with no public exploit identified at time of analysis and no active exploitation reported (not in CISA KEV).
Security restriction bypass in IBM i 7.3 through 7.6 allows remote authenticated attackers to circumvent access controls by supplying a crafted user profile name that passes improper validation logic. The vulnerability is tagged as a privilege escalation path, meaning successful exploitation likely enables access to resources or operations beyond the attacker's authorized scope. No public exploit code or CISA KEV listing is present at time of analysis, but a vendor patch is available and should be prioritized given the high confidentiality impact indicated by CVSS.
Privilege escalation to root authority in IBM i 7.3 through 7.6 is achievable by any authenticated low-privileged user via a remote code execution flaw in the activation engine component. The activation engine executes with unnecessary system privileges (CWE-250), allowing a planted malicious script to run with root authority, resulting in full compromise of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis, though the vendor has released a patch and the low attack complexity makes this a credible near-term threat for unpatched IBM i environments.
Remote authenticated attackers can execute arbitrary commands on IBM i 7.3 through 7.6 by exploiting improper privilege management (CWE-250), achieving full confidentiality, integrity, and availability compromise on affected systems. The CVSS vector of AV:N/AC:L/PR:L/UI:N confirms that only a low-privileged account and network reachability are required - no complex preconditions or user interaction needed. IBM has confirmed the vulnerability and released a patch via advisory; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Microsoft High Performance Computing (HPC) Pack allows a network-authenticated attacker with low-privilege access to elevate privileges to a higher level, potentially achieving full system compromise. The flaw stems from CWE-250 (Execution with Unnecessary Privileges), meaning a component within HPC Pack runs with more rights than its function requires, providing a lever for a legitimately authenticated user to abuse. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, but the CVSS 8.8 score and full C/I/A impact triad indicate a serious risk in any environment where untrusted low-privilege users have network access to HPC Pack services.
Local privilege escalation in Entevo HMI V2 R5 P0 M4 enables a low-privileged local user to break out of Kiosk Mode and gain administrative command execution on Windows. The escape path exploits the application's built-in PDF manual viewer: opening the manual triggers an external PDF reader, whose Print dialog exposes Windows Explorer shell access, ultimately permitting arbitrary command execution as an administrator. A proof-of-concept demonstration is publicly available via GitHub gist; EPSS is low at 0.17% and CISA SSVC indicates no confirmed active exploitation, though the public POC meaningfully lowers the skill bar for any attacker with local session access.
Privilege elevation in Google Chrome's Import feature before version 151.0.7922.173 enables sandbox escape and arbitrary code execution at the OS level, exploitable by a remote attacker who can deliver a crafted file and socially engineer a user into opening it. The vulnerability stems from CWE-250 (Execution with Unnecessary Privileges) within the Import component, yielding full confidentiality, integrity, and availability impact per CVSS C:H/I:H/A:H. No public exploit code has been identified at time of analysis, and SSVC confirms exploitation status as none, though the total technical impact rating and sandbox-escape primitive warrant prompt patching across all Chrome deployments.
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 stems from the search-v2-operator being bound to a ClusterRole with cluster-administrator-equivalent permissions - including user impersonation, RBAC write, Certificate Signing Request approval, and ManifestWork management. An attacker who gains control of the operator's service account (a low-privileged cluster foothold) can leverage these excessive grants to take over the entire hub cluster and its managed clusters. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 9.9 rating reflects the near-total loss of cluster control if the operator identity is abused.
Local privilege escalation in NVIDIA Cumulus Linux exposes network switch operating systems to full compromise by unprivileged local users. The flaw resides in the user management component, where improper privilege assignment (CWE-250) allows a low-privileged authenticated user to escalate to higher privilege levels - likely root - with low attack complexity and no user interaction required. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the CVSS 7.8 High score reflects the full triad impact once local access is obtained.
Excessive Kubernetes RBAC privileges in the insights-client ServiceAccount within Red Hat Advanced Cluster Management for Kubernetes 2 expose all cluster Secrets to any attacker who compromises the pod or obtains its token. The ServiceAccount is bound to a ClusterRole granting cluster-wide get, list, and watch on all Secrets, far exceeding the single Secret the component actually requires. If the insights-client pod is breached, an attacker can read every Secret across the hub cluster - including managed-cluster kubeconfigs - enabling lateral movement to downstream managed clusters. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 lets a namespace-scoped tenant abuse the multicloud-operators-subscription controller as a confused deputy: by crafting Subscription Custom Resources, a namespace-admin causes the controller's highly privileged ServiceAccount to deploy attacker-chosen cluster-scoped resources. This breaks tenant isolation and can yield cluster-wide privilege escalation and arbitrary code execution. Rated CVSS 9.9 (scope-changing), with no public exploit identified at time of analysis and no active exploitation reported (not in CISA KEV).
Security restriction bypass in IBM i 7.3 through 7.6 allows remote authenticated attackers to circumvent access controls by supplying a crafted user profile name that passes improper validation logic. The vulnerability is tagged as a privilege escalation path, meaning successful exploitation likely enables access to resources or operations beyond the attacker's authorized scope. No public exploit code or CISA KEV listing is present at time of analysis, but a vendor patch is available and should be prioritized given the high confidentiality impact indicated by CVSS.
Privilege escalation to root authority in IBM i 7.3 through 7.6 is achievable by any authenticated low-privileged user via a remote code execution flaw in the activation engine component. The activation engine executes with unnecessary system privileges (CWE-250), allowing a planted malicious script to run with root authority, resulting in full compromise of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis, though the vendor has released a patch and the low attack complexity makes this a credible near-term threat for unpatched IBM i environments.
Remote authenticated attackers can execute arbitrary commands on IBM i 7.3 through 7.6 by exploiting improper privilege management (CWE-250), achieving full confidentiality, integrity, and availability compromise on affected systems. The CVSS vector of AV:N/AC:L/PR:L/UI:N confirms that only a low-privileged account and network reachability are required - no complex preconditions or user interaction needed. IBM has confirmed the vulnerability and released a patch via advisory; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Microsoft High Performance Computing (HPC) Pack allows a network-authenticated attacker with low-privilege access to elevate privileges to a higher level, potentially achieving full system compromise. The flaw stems from CWE-250 (Execution with Unnecessary Privileges), meaning a component within HPC Pack runs with more rights than its function requires, providing a lever for a legitimately authenticated user to abuse. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, but the CVSS 8.8 score and full C/I/A impact triad indicate a serious risk in any environment where untrusted low-privilege users have network access to HPC Pack services.