Monthly
Local privilege escalation in Zscaler Client Connector enables a standard (non-administrative) local user to execute arbitrary code in a privileged context via multiple improper privilege handling flaws (CWE-280). The scope change captured in the CVSS vector (S:C) reflects that exploitation breaks the security boundary of the Client Connector's privileged agent process, extending impact beyond the attacker's initial user context to full High-rated confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized page content disclosure in Wagtail's internal Pages admin API allows any authenticated Wagtail admin user to read draft and live page fields - including title, slug, seo_title, search_description, and all custom fields declared in api_fields - for pages outside their permitted access scope. The root cause is CWE-280: the get_base_queryset method on PagesAdminAPIViewSet does not scope its queryset through the page permission policy, bypassing page-level access controls entirely. Patched releases (7.0.9, 7.3.4, 7.4.3, 8.0rc2) are available, and no public exploit or active exploitation has been identified at time of analysis.
Insecure Direct Object Reference (IDOR) in Apache Allura before 1.19.1 allows unauthorized access to multiple Artifact types due to missing server-side permission checks. Attackers who can interact with the platform can reference artifact objects directly by their identifiers and retrieve content beyond their authorization level, resulting in information disclosure across potentially broad artifact categories. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Broken access control in Winter CMS (composer/winter/wn-cms-module ≤ 1.2.12) allows any authenticated backend user holding at least one Theme Editor permission to pivot beyond their authorized scope via crafted AJAX requests. The Cms\Controllers\Index controller gated section access with OR-logic across five permissions but individual handlers - onSave(), onDelete(), onDeleteTemplates(), and AssetList.onUpload() - performed no per-template-type authorization check, enabling cross-template actions such as deleting layouts, modifying partials, reading content files, and uploading arbitrary files to the active theme asset directory. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; vendor-released fix is v1.2.13.
Privilege escalation in Rapid7 Velociraptor's multi-tenant org management allows child org administrators to delete any org in the deployment by exploiting a misplaced permission check. The server incorrectly validates the ORG_ADMIN permission against the caller's own child org rather than the ROOT org, and child org admins can self-grant this permission within their local ACL scope. An attacker with child org admin credentials can permanently delete peer orgs - including all their forensic artifacts, hunt data, and client configurations - well outside their authorized boundary.
Privilege abuse in Tridium Niagara Framework and Niagara Enterprise Security allows an authenticated high-privileged user on an adjacent network to improperly access confidential data and perform limited unauthorized modifications beyond their sanctioned scope. Affected platforms span Windows, Linux, and QNX, and versions prior to 4.14.6 and 4.15.5 are vulnerable. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Gitea's Actions permission engine grants fork-PR task tokens unauthorized code-read access to third private repositories via a missing fork-PR discriminator in the collaborative-owner branch of `GetActionsUserRepoPermission`. All Gitea instances running versions up to and including 1.26.4 are affected when the collaborative-owner Actions feature is configured, as confirmed by vendor advisory GHSA-fj8v-hjwv-qm88 and EUVD-2026-58151. An attacker who has had at least one fork PR previously approved can exploit this to clone the full source of a private repository they were never authorized to access; impact is strictly read-only, with no write or code-execution capability. A functional PoC was included in the security advisory; this CVE is not in the CISA KEV catalog and no EPSS score was provided in the available data.
Improper authorization in Apache Kylin's REST API job endpoints allows authenticated users to retrieve job metadata from projects they are not authorized to access. The `JobController.getJobList` and `JobController.getJobDetail` endpoints lack project-scoped permission verification, meaning any authenticated user can query build job information across project boundaries within a shared Kylin deployment. Apache Kylin versions 4 through 5.0.3 are affected; no public exploit code or active exploitation has been identified at time of analysis.
Privilege escalation in Imagination Technologies' Graphics DDK GPU driver allows kernel-level software inside a Host VM to post malformed commands to the GPU firmware, forcing an improper GPU register access that can be leveraged to gain elevated privileges. The flaw (CWE-280, improper handling of permissions) affects multiple DDK release branches from 1.18 through 26.1 and is rated CVSS 7.8 (local, low complexity). There is no public exploit identified at time of analysis, and its EPSS probability is low (0.14%).
Authorization bypass in Wagtail CMS allows authenticated low-privilege users to create translations for pages beyond their permitted scope. Versions prior to 7.0.8, 7.3.3, and 7.4.2 fail to enforce page-level permission checks when a user submits a translation request, exposing content of restricted pages to anyone holding the 'Can submit translation' permission. No public exploit code or active exploitation (CISA KEV) has been identified, but the low attack complexity and network-accessible vector make this straightforward to abuse for information disclosure.
Local privilege escalation in Zscaler Client Connector enables a standard (non-administrative) local user to execute arbitrary code in a privileged context via multiple improper privilege handling flaws (CWE-280). The scope change captured in the CVSS vector (S:C) reflects that exploitation breaks the security boundary of the Client Connector's privileged agent process, extending impact beyond the attacker's initial user context to full High-rated confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized page content disclosure in Wagtail's internal Pages admin API allows any authenticated Wagtail admin user to read draft and live page fields - including title, slug, seo_title, search_description, and all custom fields declared in api_fields - for pages outside their permitted access scope. The root cause is CWE-280: the get_base_queryset method on PagesAdminAPIViewSet does not scope its queryset through the page permission policy, bypassing page-level access controls entirely. Patched releases (7.0.9, 7.3.4, 7.4.3, 8.0rc2) are available, and no public exploit or active exploitation has been identified at time of analysis.
Insecure Direct Object Reference (IDOR) in Apache Allura before 1.19.1 allows unauthorized access to multiple Artifact types due to missing server-side permission checks. Attackers who can interact with the platform can reference artifact objects directly by their identifiers and retrieve content beyond their authorization level, resulting in information disclosure across potentially broad artifact categories. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Broken access control in Winter CMS (composer/winter/wn-cms-module ≤ 1.2.12) allows any authenticated backend user holding at least one Theme Editor permission to pivot beyond their authorized scope via crafted AJAX requests. The Cms\Controllers\Index controller gated section access with OR-logic across five permissions but individual handlers - onSave(), onDelete(), onDeleteTemplates(), and AssetList.onUpload() - performed no per-template-type authorization check, enabling cross-template actions such as deleting layouts, modifying partials, reading content files, and uploading arbitrary files to the active theme asset directory. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; vendor-released fix is v1.2.13.
Privilege escalation in Rapid7 Velociraptor's multi-tenant org management allows child org administrators to delete any org in the deployment by exploiting a misplaced permission check. The server incorrectly validates the ORG_ADMIN permission against the caller's own child org rather than the ROOT org, and child org admins can self-grant this permission within their local ACL scope. An attacker with child org admin credentials can permanently delete peer orgs - including all their forensic artifacts, hunt data, and client configurations - well outside their authorized boundary.
Privilege abuse in Tridium Niagara Framework and Niagara Enterprise Security allows an authenticated high-privileged user on an adjacent network to improperly access confidential data and perform limited unauthorized modifications beyond their sanctioned scope. Affected platforms span Windows, Linux, and QNX, and versions prior to 4.14.6 and 4.15.5 are vulnerable. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Gitea's Actions permission engine grants fork-PR task tokens unauthorized code-read access to third private repositories via a missing fork-PR discriminator in the collaborative-owner branch of `GetActionsUserRepoPermission`. All Gitea instances running versions up to and including 1.26.4 are affected when the collaborative-owner Actions feature is configured, as confirmed by vendor advisory GHSA-fj8v-hjwv-qm88 and EUVD-2026-58151. An attacker who has had at least one fork PR previously approved can exploit this to clone the full source of a private repository they were never authorized to access; impact is strictly read-only, with no write or code-execution capability. A functional PoC was included in the security advisory; this CVE is not in the CISA KEV catalog and no EPSS score was provided in the available data.
Improper authorization in Apache Kylin's REST API job endpoints allows authenticated users to retrieve job metadata from projects they are not authorized to access. The `JobController.getJobList` and `JobController.getJobDetail` endpoints lack project-scoped permission verification, meaning any authenticated user can query build job information across project boundaries within a shared Kylin deployment. Apache Kylin versions 4 through 5.0.3 are affected; no public exploit code or active exploitation has been identified at time of analysis.
Privilege escalation in Imagination Technologies' Graphics DDK GPU driver allows kernel-level software inside a Host VM to post malformed commands to the GPU firmware, forcing an improper GPU register access that can be leveraged to gain elevated privileges. The flaw (CWE-280, improper handling of permissions) affects multiple DDK release branches from 1.18 through 26.1 and is rated CVSS 7.8 (local, low complexity). There is no public exploit identified at time of analysis, and its EPSS probability is low (0.14%).
Authorization bypass in Wagtail CMS allows authenticated low-privilege users to create translations for pages beyond their permitted scope. Versions prior to 7.0.8, 7.3.3, and 7.4.2 fail to enforce page-level permission checks when a user submits a translation request, exposing content of restricted pages to anyone holding the 'Can submit translation' permission. No public exploit code or active exploitation (CISA KEV) has been identified, but the low attack complexity and network-accessible vector make this straightforward to abuse for information disclosure.