Privilege Escalation
Monthly
Privilege escalation in konflux-ci allows an adjacent-network attacker with low-privilege authenticated access to capture a cluster-scoped impersonation token from the UI proxy when the environment lacks a default service certificate authority, yielding full administrative control of the cluster. The proxy disables TLS certificate verification for internal backend connections under that condition and attaches the token to those requests. Exploitation requires on-path network adjacency and the missing-service-CA deployment state; no public exploit was identified at time of analysis and active exploitation is not confirmed.
Privilege escalation in the User Frontend WordPress plugin through 4.3.13 allows any authenticated Subscriber-level user to plant a functional [wpuf-registration role="editor"] shortcode in a published post by hiding it behind a C0 control byte that the plugin's blocklist misses but WordPress storage processing strips. Once the form is rendered, an unauthenticated visitor or the attacker can submit it to create an Editor account, and with the default autologin_after_registration setting enabled the new Editor is logged in immediately. The issue is scored CVSS 8.8, is prioritized for remediation this week, is not listed in CISA KEV, and no public exploit was identified at time of analysis.
Unauthenticated attackers can escalate to administrator account takeover on WordPress sites running Rox Appointment Booking 1.3.1 and earlier, because the plugin's public booking REST route mass-assigns the raw request body into a customer record whose fillable fields include the internal wp_user_id column. An attacker can seed a poisoned customer row carrying an arbitrary administrator user ID (user ID 1 is a reliable guess) plus an email address they control, but the takeover only completes when an administrator later opens that record and clicks Update Customer, at which point the stored wp_user_id and attacker-supplied email are handed to wp_update_user() and the administrator's email is overwritten, enabling a standard WordPress password reset. The attack is network-reachable and needs no credentials, though the mandatory administrator interaction and the user-ID guess bound real-world exploitation; there is no CISA KEV listing, no confirmed public exploit code, and the fix is the vendor's 1.3.2 release.
Privilege escalation to administrator in the WordPress plugin WP Mail Catcher (Mail Logging & Catcher) affects all versions up to and including 2.2.0: an authenticated subscriber-level user can read stored email logs through the 'message' parameter and recover a valid administrator password-reset key, then complete the reset flow and take over the site. The attack only works when an administrator has changed the plugin's default_view_role option to a capability held by low-privileged users, such as 'read', and when an administrator reset email is already present in the logs; the default manage_options value blocks it. No public exploit has been identified at time of analysis and there is no CISA KEV entry; CVSS 7.5 reflects high confidentiality, integrity and availability impact, with high attack complexity coming from the non-default configuration and logged-reset-email preconditions.
XML signature wrapping in LightSAML (4.x before 4.7.1 and 5.x before 5.0.1) lets an attacker who already holds one genuinely IdP-signed SAML assertion redirect signature validation to a buried copy of that genuine assertion while LightSAML consumes attacker-authored claims from a forged direct-child assertion, yielding authentication bypass and privilege escalation up to full impersonation of arbitrary NameID, Conditions and role attributes. The flaw requires only a low-privilege position (PR:L) - a captured earlier login response or the attacker's own legitimate assertion - and works even when the Service Provider enforces requireSignature=true, since the copied genuine ds:Signature still validates. Fixed in 4.7.1 and 5.0.1; the vendor advisory and a working PoC script are public, and no confirmed active exploitation (CISA KEV) or EPSS signal was provided at time of analysis.
Local privilege escalation in NovumOS allows an authenticated user with shell access to load a malicious .nv script that the Nova interpreter executes in Ring 0, giving unrestricted kernel-memory access and code execution at kernel privilege with scope change and high confidentiality, integrity and availability impact. The root cause is architectural rather than a memory-safety defect: Nova is not confined to a Ring 3 domain and no special feature toggle is required, so any loadable script runs with full kernel rights on versions at or before 0.23. A public PoC reference (a sample Nova script writing to kernel memory) is included in the GitHub advisory; it is not verified as working exploit code, there is no KEV listing, and exploitation is limited by the need for local access and the small installed base.
Privilege escalation in Kargo versions from 0.6.0 before 1.8.14, 1.9.9, and 1.10.8 lets an authenticated user with a delegated Project RBAC-management permission confer rights beyond their own, potentially reaching Project-administrator access and exposing Project Secrets and external Git, container-registry, or Helm-registry credentials. Exploitation requires an administrator-created custom role that permits editing Project Roles or ServiceAccounts plus control of an account assigned that role; default non-administrator roles do not grant the needed permissions, and escalation is bounded to that Project. Vendor fixes are available in 1.8.14, 1.9.9, and 1.10.8; no public exploit identified at time of analysis.
A stack-based buffer overflow in Thales Sentinel Keys Server on Windows (versions lower than 1.3.8.0) lets a local attacker who can send a message to the service overflow a stack buffer by supplying an over-long first field, ultimately allowing code execution as NT AUTHORITY\SYSTEM. The flaw is local-only (CVSS:4.0 AV:L, PR:L, base 7.3 HIGH) and requires an additional, unspecified attack condition (AT:P), with no user interaction needed. It is a privilege-escalation primitive for a low-privileged local user rather than a remote entry point; no public exploit has been identified at time of analysis and no confirmed active exploitation is reported.
Subscriber-level users of the WP BASE Booking WordPress plugin through version 6.5.2 can escalate their privileges because the plugin performs an incorrect privilege assignment (CWE-266), with successful exploitation giving high confidentiality and integrity impact. The attack requires an authenticated subscriber account but no user interaction and is network-reachable; sites that allow open registration make that prerequisite much easier to satisfy. Patchstack reported the issue, the vuln.today priority is this_week, and no public exploit was identified at time of analysis; this is serious but conditionally gated rather than an emergency.
Unauthenticated privilege escalation in the WordPress plugin SMS Alert Order Notifications through version 4.0.2 lets remote attackers obtain elevated privileges without authentication or user interaction, with high confidentiality, integrity, and availability impact (CVSS 9.8). The issue is classified as CWE-266 incorrect privilege assignment and was reported by Patchstack; the vulnerable endpoint or feature that triggers the escalation is not described in the available sources. The vuln.today priority is act_now, no public exploit was identified at time of analysis, and there is no CISA KEV confirmation.
Privilege escalation in the Ak Framework WordPress plugin, bundled with the Newsy - Viral News & Magazine theme, through version 2.9.8 allows attackers to reach the ajax_refresh_nonce and ak_admin_ajax handlers and pass attacker-controlled option names and values into update_option(), including users_can_register and default_role. Setting those options to enable open registration with the administrator role gives an attacker a path to create an administrator account. The advisory describes the handlers as reachable without authentication, while the supplied CVSS vector specifies PR:L (authenticated), so the authentication prerequisite should be confirmed against the vendor advisory before scoping exposure; exploitation is limited to sites running this theme/plugin, and no public exploit code or CISA KEV entry appears in the supplied intelligence.
Unauthenticated privilege escalation in the Essential Addons for Elementor plugin (all versions up to and including 6.8.7) lets any site visitor register an account with a role as high as Editor - gaining edit_others_posts, publish_pages, upload_files and unfiltered_html - by passing a WordPress revision ID as the page_id parameter of the register_user() handler. The escalation is not a default-configuration drive-by: the site must have "Anyone can register" enabled, a page must carry the plugin's Login/Register widget, and an administrator must at some point have saved and then reverted a non-default "New User Role" on that page, leaving a revision whose _elementor_data still holds the elevated role. Those attacker-uncontrolled, non-default prerequisites are why the vector scores AC:H despite PR:N; no public exploit has been identified at time of analysis and the issue is not in CISA KEV. In practice this is a genuine but conditionally-gated issue rather than a drop-everything emergency, though the impact when the preconditions are met is full administrative-adjacent compromise of site content.
Privilege escalation in Dell OpenManage Enterprise versions prior to 4.8.0 is a genuine but not emergency-level priority: a low-privileged attacker who already has local access and an authenticated account on the OME host can raise their privileges to high confidentiality, integrity, and availability impact. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires local access plus a pre-existing low-privileged account, not remote or unauthenticated access. No public exploit identified at time of analysis, and the vendor has released a fix in version 4.8.0.
Broken access control in the Cloud Foundry Cloud Controller API leaves the /internal/v3/staging/:guid/droplet_completed and /internal/v3/staging/:guid/build_completed callback endpoints reachable on the public API listener, because the shipped Nginx routing configuration carries deny rules for /internal/v4/ and /internal/v5/ but omits the equivalent rule for /internal/v3/. An attacker who holds a valid build or droplet GUID - and a SpaceAuditor can enumerate those GUIDs without any write permission - can post a forged staging callback, transition a droplet to STAGED, and persist arbitrary process and sidecar metadata with no associated package or actor, escalating past the intended role boundary. No public exploit code was identified at time of analysis, and the vendor has published fixed versions; triage guidance places remediation in this week's work rather than an emergency response.
Privilege escalation in the WebToffee 'Export and Import Users and Customers' plugin for WordPress (all versions up to and including 2.7.5) lets any authenticated user with Subscriber-level access or above plant a crafted value in the Biographical Info field that is later reinterpreted as a second CSV row during import, creating a brand-new account whose login, password, e-mail and role are fully attacker-chosen - including Administrator. Exploitation is conditional rather than automatic: the payload only detonates when a privileged operator runs the plugin's own export and then re-imports the generated file, so sites that never round-trip exported user data back through the importer are not exposed. No public exploit code or confirmed in-the-wild activity was identified at the time of analysis, but the 8.8 severity and the low Subscriber-level prerequisite make this a this-week remediation priority for any site that uses the plugin's export/import cycle.
Symlink following during same-client allocation data migration in HashiCorp Nomad and Nomad Enterprise allows a workload controlled by a tenant to redirect the ownership and permission changes Nomad applies to allocation data onto host directories, corrupting host file permissions and enabling privilege escalation. Only clusters that schedule untrusted or multi-tenant workloads on shared clients are meaningfully exposed, because the vector is local (AV:L) and requires an attacker to already control a running allocation (PR:L); remote unauthenticated exploitation is not possible. HashiCorp fixed the flaw in Nomad 2.1.0 and Nomad Enterprise 2.1.0, 1.11.12 and 1.10.18, and no public exploit code was identified at time of analysis.
Privilege escalation in the BuddyBoss Platform WordPress plugin through version 3.5.0 allows an authenticated low-privileged subscriber to gain higher privileges over the network without user interaction, with a CVSS score of 8.8. The flaw is an incorrect privilege assignment (CWE-266) affecting WordPress community sites running the plugin, and exposure is greatest where subscriber self-registration is open. No public exploit identified at time of analysis, and no CISA KEV entry is present in the supplied data.
Unauthenticated password reset in the LogixFast Auth WordPress plugin before 1.0.4 allows remote attackers to take over any account, including an administrator account, by supplying an attacker-controlled email address during the reset flow. The plugin sends the one-time reset code to the supplied address rather than the resolved account's registered email, so knowing or guessing a valid username is the main prerequisite. A public PoC reference exists; it is not verified as working exploit code, and active exploitation is not confirmed in the supplied KEV data, but the CVSS 9.8 and act_now priority warrant urgent patching to 1.0.4.
Unauthorized file read in the ProjectMAXS MAXS Module FileRead (versionCode 27) lets a locally installed attacker-controlled app bind to the module's exported AIDL service and pass an absolute path to read files that lie outside the caller's own sandbox. The exposure stems from missing permission enforcement on that inter-process interface, and the reachable data is limited to whatever the MAXS module's process itself can access, not full-device compromise. The supplied CVSS vector (AV:N, I:H, C:N) does not match the observed attack path, which is local IPC with no network reach and confidentiality impact only; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Local privilege escalation in the Alpine iLX-F511 in-vehicle media receiver lets code already running as a low-privileged user reach root through an exposed dangerous method in the Fiv service, with high impact to confidentiality, integrity and availability. The attack is local-only and requires a prior foothold on the device (CVSS PR:L), so it is a post-compromise escalation step rather than a remotely reachable entry point; no user interaction is needed once that prerequisite is met. EUVD lists version 7.0.000 as affected, a public ZDI advisory (ZDI-26-820, ZDI-CAN-29095) documents the finding, and no vendor-released patch was identified at time of analysis, with no public exploit identified at time of analysis and no CISA KEV listing.
Local privilege escalation in GFI KerioConnect's KOFF Outlook Connector (Offline Edition) before 10.0.9 Patch 2 lets a non-administrative local user on a Windows host replace the searchd.exe binary used by the bundled KOFFIndexingService, which runs as LocalSystem, gaining NT AUTHORITY\SYSTEM code execution when the service next starts or the machine reboots. The root cause is CWE-276 incorrect default permissions: the installer leaves the product directory writable by the built-in Users group, so the swap requires only file-write access a standard account already has. Requires local access with low privileges (CVSS 4.0 PR:L, AV:L) and an affected KOFF installation; there is no network vector and closing the hole is a matter of upgrading to 10.0.9 Patch 2 or correcting the directory ACLs. No public exploit code has been identified at time of analysis, and the issue is not in CISA KEV.
Local privilege escalation in Norton Antivirus, Avast Antivirus, and AVG Internet Security before version 26.5.10933 on Windows lets a low-privileged local user gain NT AUTHORITY\SYSTEM through the Data Shredder component. The flaw is a link-following defect (CWE-59): during a privileged shred operation, the component follows attacker-placed filesystem links, resulting in deletion of arbitrary files or folders that the attacker then leverages to elevate to SYSTEM. Exploitation requires authenticated local access with low privileges and depends on the privileged shred operation being performed (UI:R); a vendor patch is available, so this rates as a this-week priority rather than an emergency, and no public exploit code has been identified at time of analysis.
Improper privilege management in Dell PowerProtect Data Domain appliances allows a high-privileged, authenticated attacker with network reachability to elevate their privileges on the appliance, with high impact to confidentiality, integrity and availability. Affected releases are Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40 and LTS2026 8.6.1.0 through 8.6.1.20. The dominant limiting factor is the PR:H prerequisite: this is a post-authentication escalation for a malicious or compromised high-privilege operator rather than a path for an unauthenticated outsider; no public exploit is identified at time of analysis and this is a non-emergency 'this_week' priority.
Privilege escalation in Mage Eventpress (Event Booking Manager for WooCommerce) versions up to and including 5.7.8 allows an authenticated WooCommerce Shop Manager to elevate to Administrator. The mep_grant_shop_manager_access() function hooks user_has_cap and grants manage_options whenever an attacker-controlled $_GET['page'] value begins with 'mep_' or 'mpwem_', without validating that the page is a registered EventPress screen; deployments that assign Shop Manager accounts to non-administrators are exposed. The CVSS 3.1 score is 7.2 with PR:H, reflecting the need for an existing elevated account, and no public exploit identified at time of analysis; vuln.today assigns this CVE a this_week priority.
Authenticated WordPress users holding a delegated non-administrator role can rewrite the GoSMTP plugin's SMTP configuration in any version before 1.2.5, redirecting outbound mail and ultimately taking over an administrator account. The settings page is gated only on the plugin's activation capability and lacks a proper settings-management authorization check, so the flaw is a broken-access-control / improper-privilege-management issue rather than an anonymous remote attack - the attacker must already have a valid sub-administrator account with that capability. No public exploit code has been identified at time of analysis, exploitation is not confirmed in CISA KEV, and EPSS is low at roughly 0.15% (4th percentile), though the vendor has released a fix in 1.2.5 and the priority signal points to patching this week.
EagleCloud Aquila on-premises deployments through version 2.6.7.2 expose stored access keys, secret keys, and deployment secrets to unauthenticated remote attackers who abuse authentication handling in the tunnel gateway and provisioning interfaces. The flaw carries a CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N) with impact confined to confidentiality (VC:H, VI:N, VA:N), matching an independent assessment of CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - the disclosure describes the outcome as privilege escalation, but the measurable effect is read-only access to high-value credentials rather than modification of the system. No CISA KEV listing and no public exploit code were identified in the supplied intelligence, and the vulnerability is triaged as "this_week" priority; exploitation requires that the tunnel gateway or provisioning interfaces be network-reachable on an affected on-premises installation.
Privilege escalation in Cronicle through 0.9.120 lets an authenticated non-administrator user, or a scoped API key, that holds only create_events and run_events privileges inject top-level uid and gid fields into an event, which the root daemon then honours when launching the child process - so the low-privileged principal can run jobs as any local account, including root. Root compromise depends on the deployment mode: the advisory states a root-running daemon is the default per docs/Setup.md, while on a non-root daemon the impact is bounded by the daemon's own privileges; the injected identity also only survives with plugins that do not define their own uid, which is true of the shipped shellplug and urlplug defaults. This is a distinct sibling of the previously patched job-output injection tracked as CVE-2026-39401. Vendor-released patch: 0.9.121; no CISA KEV listing and no confirmed weaponized exploit, though the advisory publishes a working reproduction script; the assessed priority is to remediate this week.
Local privilege escalation in Tanium End-User CX and the Tanium Endpoint Configuration Toolset Solution lets a user who is already logged on with low privileges raise their rights to a high-impact level (C:H/I:H/A:H) on the affected endpoint, with no user interaction required. Affected builds are end-user-cx releases up to 1.8.47, 1.11.605, 1.19.325, 1.21.835, 1.22.1199, 1.23.766 and 1.24.590, plus Endpoint Configuration Toolset Solution 1.51.60, 1.59.50 and 1.71.25; Tanium has released fixes for these branches. No public exploit was identified at time of analysis, and the weakness is classified as CWE-59 link following, although the sources do not describe the precise file or link condition that triggers it. The realistic exposure is a post-compromise scenario on an enterprise agent endpoint rather than a network-facing attack, which is why the priority is 'this_week' rather than emergency action.
Local privilege escalation in Tanium End-User CX and the Endpoint Configuration Toolset Solution allows an authenticated low-privileged user with local access to a managed endpoint to gain high confidentiality, integrity, and availability impact (CVSS 7.8, AV:L/AC:L/PR:L/UI:N). The flaw is in the End-User Notifications component and is classified as CWE-59 link following; Tanium reports a vendor patch in advisory TAN-2026-058. This is a credible but non-emergency issue: no public exploit identified at time of analysis, no CISA KEV active-exploitation signal is present in the supplied data, and exploitation requires an existing local foothold.
Local privilege escalation in Tanium End-User CX (end-user-cx) and the Tanium Endpoint Configuration Toolset Solution lets an attacker who already holds a low-privileged local account on a managed endpoint leverage a link-following flaw (CWE-59) to gain high-integrity code execution, with CVSS 3.1 scoring 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Only hosts running the pre-fix builds are exposed - end-user-cx below 1.8.47, 1.11.605, 1.19.325, 1.21.835, 1.22.1199, 1.23.766 or 1.24.590, and Endpoint Configuration Toolset Solution below 1.51.60, 1.59.50 or 1.71.25. No public exploit code was identified at time of analysis and the flaw is not in CISA KEV; the vendor has released fixed builds, and the practical exposure is limited to endpoints that are already multi-user or already partially compromised.
Local privilege escalation in Veeam Agent for Linux 13.1 allows a local low-privileged user to gain elevated privileges on hosts whose agent installation is managed by a Veeam Backup & Replication instance; standalone/unmanaged deployments are not affected. The flaw is an untrusted search path (CWE-426), the vendor has released a fix in 13.1.2, and no public exploit identified at time of analysis. This is a genuine but moderate-priority issue rather than an emergency.
Local privilege escalation in TeamViewer Remote Management Patch Management for Windows allows an authenticated low-privileged user to execute arbitrary code with elevated privileges by replacing the service executable in an insufficiently protected temporary directory during Patch Management activation. The flaw affects versions prior to 26.9.1 and the legacy v14.7 client branch prior to 24.12.5. Exploitation requires a local foothold and an activation event, and no CISA KEV entry or public exploit code is referenced in the supplied intelligence.
Local privilege escalation in TeamViewer Full Client and Host on Windows allows an authenticated low-privileged user to execute arbitrary commands as SYSTEM by placing a crafted installer options file in the Advanced Asset Management installer staging directory, which is processed during service activation. All Full Client and Host builds prior to 15.82 are affected, along with the legacy Windows 7/8 branch prior to 15.64.10. A vendor patch is available, and no public exploit has been identified at time of analysis.
DLL search-order/planting in the TeamViewer Remote Management Monitoring installer for Windows before 26.10.1 lets a local authenticated low-privileged user plant a malicious DLL that is loaded with elevated privileges when a higher-privileged user runs the installer, yielding arbitrary code execution. Exploitation requires an existing foothold on the host plus user interaction, and no public exploit is identified at time of analysis. Vendor patch 26.10.1 resolves the condition; the assessed priority is this_week, a genuine but not emergency-grade issue.
Local privilege escalation in TeamViewer Remote Management Monitoring for Windows before 26.10.1: a low-privileged authenticated local user can impersonate the IPC broker and cause the Monitoring service to execute arbitrary code as NT AUTHORITY\SYSTEM. Only hosts with the Remote Management Monitoring component installed and its service running are affected (base TeamViewer remote-access installs without the Monitoring module are not indicated as affected by available data), and exploitation requires an existing low-privilege local session (CVSS:3.1/AV:L/AC:L/PR:L/UI:N). This is a credible but non-emergency issue - no public exploit code or active exploitation is confirmed, and the vendor has released a fixed version (26.10.1).
Local privilege escalation in TeamViewer Full Client and Host for macOS lets a low-privileged local attacker exploit a TOCTOU race combined with symbolic-link handling in the privileged helper to bypass installer package verification and install a malicious package as root. Affected builds are prior to 15.83, plus 14.7.x before 14.7.48868 and 13.2.x before 13.2.154007; exploitation is local-only and requires winning the timing window. No public exploit was identified in the supplied sources at time of analysis, and the vendor has released fixed versions.
Privilege escalation in Mozilla Firefox's DOM: Navigation component allows remote attackers to gain elevated privileges within the browser when a victim loads attacker-controlled web content, with the flaw resolved in Firefox 159. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R, score 8.8) indicates no prior authentication or attacker privileges are needed, but the required victim interaction is the primary limiting factor and is consistent with CISA SSVC scoring of Automatable: no and Exploitation: none. No public exploit code or active exploitation has been identified at time of analysis, and the vendor-reported issue is tracked as Mozilla Bugzilla 2075440 with advisories mfsa2026-118 and mfsa2026-121.
Authenticated SQL injection in Dolibarr ERP/CRM through version 23.0.0 lets any user holding the standard 'Third Party: Create/Edit' permission - not just an administrator - read or rewrite arbitrary database content. The unescaped lt1/localtax1_value (and lt2/localtax2_value) POST parameter is concatenated into an UPDATE statement in an unquoted numeric context, so an attacker can append a second SET clause and copy a target value such as a user's password hash into a field they can then read, potentially escalating to admin and onward to RCE via admin-only modules. The vendor advisory GHSA-v5fq-cf5m-vwv7 ships a complete reproduction including working request payloads; no confirmed active exploitation (CISA KEV) has been reported, and no fixed release is listed yet - the package data records composer/dolibarr/dolibarr as vulnerable at <= 23.0.0 with 'not yet patched'. With a CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8) and a this_week decision label, this is a genuine, actionable priority rather than an inflated CVSS score.
Privilege escalation in Octopus Server lets an authenticated user who already holds the System Manager role obtain full system Administrator rights, with risk concentrated in environments that grant that role to users not otherwise trusted as full administrators or where such an account is compromised. The affected ranges are 2019.0.0 through <2026.2.13469 and 2026.3.0 through <2026.3.15863, and the CVSS vector's PR:H metric confirms the required high-privileged account, so this is not a remote-unauthenticated attack. No public exploit is identified at time of analysis, the vendor has released a patch, and the supplied priority label is this_week.
Octopus Server writes user-invitation codes into audit event logs, so an authenticated user who can read audit events in a space may retrieve the code for an unclaimed, space-linked invitation and redeem it. The resulting privilege gain depends entirely on the permissions assigned to the invited account, and exploitation also requires that an unredeemed space-linked invitation already exists; the independent assessment therefore treats this as a moderate-priority authenticated privilege-escalation issue rather than a mass-exploitation threat. Vendor-released fixes are 2026.2.13438 and 2026.3.15829, and no public exploit is identified in the supplied data.
Privilege escalation in the Supermicro BMC IPMI implementation allows an attacker who already holds a low-privilege BMC account to send crafted RAKP+ authentication messages and gain administrator-level access on affected MBD-X12SPI systems running firmware 01.07.20. The issue is rated CVSS 8.8 because exploitation is network-reachable, requires low privileges, and yields high confidentiality, integrity, and availability impact, although EPSS is low at 0.26% (17th percentile). No public exploit identified at time of analysis; reachability is limited to BMC management interfaces, typically IPMI/RMCP+ on UDP 623.
Privilege escalation in the Kirki plugin for WordPress (all versions up to and including 6.2.5) allows authenticated users with only Subscriber-level access to reach a vulnerable deserialization path in the 'get-single-symbol' branch of the kirki_post_apis() AJAX dispatcher, which lacks a capability check, and to inject a PHP object. Because a POP chain is present in the running code, a successful injection can overwrite an administrator's password and hand the attacker full administrative control of the site. The CVSS vector confirms network reachability, low privileges (PR:L), and no user interaction (UI:N) for a high-integrity, high-availability impact; EPSS is low at 0.30% (23rd percentile) and there is no KEV listing, so there is no public exploit identified at time of analysis, though the practical exposure is governed by whether a site permits open user registration.
Improper access restrictions in Apple macOS before Golden Gate 27.2 allow a maliciously crafted archive to cause unexpected app termination or arbitrary code execution when a user unpacks it. The CVSS vector indicates network reachability, no required privileges (PR:N), and mandatory user interaction (UI:R); no public exploit was identified at time of analysis, and EPSS is 0.51% (44th percentile). Apple has released macOS Golden Gate 27.2 as the vendor fix.
Type confusion in Timescale's pgvectorscale extension (all versions before 0.9.1) lets a low-privileged database user who holds CREATE on the vectorscale schema pre-create shadow objects that impersonate pgvector's vector type or operators, then build and query a DiskANN index over crafted values to drive out-of-bounds reads and writes. Successful exploitation can disclose process memory, crash the PostgreSQL server, or escalate privileges within the database; both pgvector and a vulnerable pgvectorscale build must be installed, and the source CVSS 4.0 score of 7.7 reflects full confidentiality, integrity and availability impact confined to the vulnerable system. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the vendor-priority decision is 'this_week' and fixed builds ship in 0.9.1.
Local privilege escalation to root in boneIO Black affects versions prior to 1.6.0, where a low-privileged local attacker can abuse a time-of-check/time-of-use race in the timezone sudoers-file routine to inject arbitrary sudoers rules. Exploitation requires an existing local foothold on the device and either winning a non-deterministic race between validation and installation or pre-creating a symlink at the predictable temporary filename; it is not remotely reachable unauthenticated. No public exploit has been identified at time of analysis, and the vendor-released fix is version 1.6.0.
Local privilege escalation in boneIO black_debian_images builds prior to 1.6.0 lets anyone who controls the boneio service account become root, because that account carries a full passwordless sudo rule and membership in the docker group - either one is sufficient for full root compromise. The flaw is strictly local and requires authenticated access (CVSS:4.0 AV:L/PR:L), so an attacker must already have code execution as the boneio user through some other weakness before this becomes useful. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the vendor-assigned severity of 9.3 and a vuln.today priority of act_now reflect that fielded devices remain exposed until the 1.6.0 upgrade is installed and its migrations run.
Improper file permissions in Japan's Ministry of Land, Infrastructure, Transport and Tourism Electronic delivery item Inspection Support System (versions 0 through Ver.4.0.36) let a low-privileged local user overwrite files inside the application's installation folder, which are then executed in a more privileged context, yielding arbitrary code execution. The flaw is purely local (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, vendor score 8.5), so an attacker must already hold a foothold on the host and a higher-privileged user or service must subsequently invoke the tampered files; it is an integrity and privilege-escalation problem rather than a remotely reachable emergency. No public exploit code was identified at the time of analysis, and the issue is not in CISA KEV; JPCERT reporting places it in the 'this_week' remediation queue, and no fixed version is stated in the available data - consult JVN#75668103 for update status.
A local privilege escalation flaw in the WCH CH340/CH341 USB-to-serial Windows driver setup package CH341SER.EXE version 4.0 lets a low-privileged local user gain elevated privileges on an affected Windows host. Exploitation requires the installer to be present on the machine and the attacker to already hold a standard local account (CVSS: AV:L/PR:L/UI:N); it cannot be reached remotely and needs no victim interaction. A public PoC reference exists on GitHub but is not verified as working exploit code, the issue is not in CISA KEV, and EPSS is low (0.23%, 13th percentile), so real-world risk is moderate rather than urgent.
Privilege escalation in the Duplicator WordPress plugin before 5.0.0 lets an administrator of a WordPress Multisite child site who is not a network administrator use the plugin's one-click upgrade routine to install and execute arbitrary PHP in the network-wide shared plugin directory. The assessed vector requires high privileges (an existing subsite administrator account) and no user interaction; the description's additional claim that the routine is exposed without authentication is unresolved in the available data. No CISA KEV entry is present, a public PoC reference exists but is not verified as working exploit code, and EPSS is low at 0.17% (percentile 7).
Unauthenticated privilege escalation in the Datawiza Proxy Auth Plugin for WordPress lets a remote attacker forge the user-identity and role HTTP headers the plugin consumes and thereby create and authenticate as a WordPress administrator, giving full control of the site (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The disclosed affected range is 1.1.0 up to but not including 1.1.1, and the vendor has released 1.1.1 as the fix. Practical exploitability is topology-dependent: forged headers are only honored if externally supplied copies actually reach the plugin, so a correctly configured front-end proxy that strips or overwrites these headers blocks the attack. A public PoC reference exists but is not verified as working exploit code, and EPSS is low at 0.14% (3rd percentile) despite the maximal severity score, so the vulnerability.today decision label is act_now on the basis of impact rather than observed exploitation.
Privilege escalation in the aBlocks WordPress plugin (Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder) through 2.17.0 lets an authenticated attacker with Contributor-level access or above raise their own WordPress role to Editor and receive a fully authenticated session at the elevated level. The flaw sits in the plugin's `/ablocks/v1/form-builder/registration` REST endpoint, which is registered with `permission_callback => __return_true` and whose `register()` handler reads `roleSlug` from attacker-controlled block attributes without confirming the block's `formType` is actually `registration`; the save-time sanitizer only enforces that constraint for registration blocks. Impact is bounded below administrator - `is_safe_registration_role()` rejects any role carrying `manage_options`, `edit_users`, `delete_users`, `create_users`, `promote_users`, or `edit_theme_options`, so Editor is the highest role practically reachable on a standard installation. No public exploit code or active exploitation is identified at time of analysis, and the CVSS vector (PR:L) confirms the attack requires authentication.
The WordPress plugin User Profile Builder (Beautiful User Registration Forms, User Profiles & User Role Editor) through version 4.0.3 lets an authenticated user with Author-level access or higher create brand-new WordPress accounts that carry the Editor role, because the Gutenberg 'Register' block forwards an attacker-supplied Assigned Role attribute straight into the [wppb-register] shortcode with no server-side authorization check. The built-in role guard only strips roles that hold the manage_options or remove_users capability, so Administrator is blocked but Editor and every other privileged non-Administrator role passes through untouched, giving a limited - not full-admin - privilege escalation with high integrity impact (CVSS 7.1, PR:L). No public exploit code or CISA KEV entry was identified at time of analysis, and the issue is rated a this-week, moderate-priority fix rather than an emergency.
DJI CrystalSky ZS600C firmware 0.3.9.7 through 0.6.6.9 exposes an unauthenticated adbd shell to anyone with physical USB access because the device ships with ro.adb.secure=0 and USB ADB enabled. An attacker can obtain a uid 2000 shell as a foothold for a separate privilege-escalation step to root; ADB over TCP is not enabled by default, but when enabled out-of-band the same unauthenticated shell is reachable over the network. No public exploit was identified at time of analysis and there is no CISA KEV entry; the assessed CVSS 3.1 score is 7.0 (AV:P) because the default path requires physical access, while the reported CVSS 4.0 base score is 9.3.
Local privilege escalation in the optional dnscache package of Zimbra Collaboration Suite lets the low-privileged Unix 'zimbra' service account gain root on the host, affecting the dnscache builds shipped with ZCS 10.1.16 and 10.1.21 (EUVD lists 10.0 through 10.1.21). An attacker who already controls the zimbra account can abuse the passwordless sudo rule for the zmunbound wrapper, which forwards arbitrary arguments to Unbound without constraining the configuration path, to run Unbound with a root-owned configuration that disables chroot, read root-readable files such as password hashes and private keys through Include-directive parser errors, and write or append root-owned files. There is no KEV listing and no confirmed public exploit code in the available data, although Rapid7 has published a research write-up on breaking Zimbra identity boundaries; exploitation is local and requires the optional package to be installed, so it is an authenticated (PR:L) post-compromise escalation rather than a network-facing attack, and the base 7.8 score reflects high confidentiality and integrity impact once that foothold exists.
The Zimbra Collaboration Suite MTA package lets the Unix zimbra account escalate to root: the installed sudo policy permits passwordless root execution of Postfix administration commands without constraining their arguments, and since the zimbra user controls the daemon_directory setting and can write the Postfix configuration directory, invoking 'postfix set-permissions' makes Postfix run an attacker-supplied post-install program as root. Rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N, C/I/A:H), it is strictly a local escalation primitive - an attacker must already have command execution as zimbra on an MTA node, so no remote or unauthenticated path exists, and exploitation is confined to MTA nodes running the affected package. No public exploit code and no confirmed active exploitation were identified at time of analysis; the priority label is 'this_week', reflecting a genuine high-impact chaining primitive whose risk is gated by the local prerequisite.
Local privilege escalation in the zmmailboxdmgr launcher of Zimbra Collaboration Suite lets the Unix zimbra account execute arbitrary commands as root, breaking the boundary between the mail service account and the host. Because the launcher's passwordless sudo path does not adequately restrict JVM arguments (CWE-88 argument injection), an attacker with a zimbra-level foothold on a mailbox server can delay Jetty's privilege drop and register an -XX:OnOutOfMemoryError command that fires while the JVM is still root, although the malicious restart interrupts mailboxd and is therefore disruptive. Affected builds are the identified ZCS 10.1.16 and 10.1.21 releases (EUVD lists versions up to and including 10.1.21); no KEV entry or confirmed working exploit code is present in the available data, though Rapid7 has published a technical research write-up of the technique, and the EPSS/KEV signal base is absent here. CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects full root impact behind a mandatory local prerequisite, which places it at this-week rather than emergency priority.
Privilege escalation in BlueSpice container deployments (bluespice/wiki image, versions 5.2.3 through 5.2.6 and 5.2.7 images published before 2026-10-19 15:37 UTC) lets an attacker who can read the wiki obtain an application token from the REST API and exchange it for a session carrying sysop privileges as the internal service user. Because the token authenticator's IP allow-list is disabled by default when WIKI_SERVICE_TOKEN_AUTH_ALLOWED is unset, no authentication is required on publicly readable wikis (CVSS:3.1 AV:N/AC:L/PR:N/UI:N), while on access-controlled wikis a low-privileged read account suffices. Vendor-released fixes are available (5.2.7 and later, or a 5.2.7 image published on/after 2026-10-19 15:37 UTC); no public exploit code or confirmed active exploitation was identified at time of analysis. Severity is 9.3 (CVSS 4.0), and the priority decision is act_now.
Unauthenticated takeover of a site administrator account is possible in the Advanced Custom Fields: Extended and Extended PRO WordPress plugins before 0.9.2.8 through the front-end Forms module. The update-user action resolves its target inconsistently between the stage that authorises the request and the stage that executes it, so an attacker can direct the update at an administrator account and be issued a valid session for it. The configuration prerequisite is narrow but explicit: the site must publish two separate front-end form configurations whose update-user targets are mapped to visitor-submitted values, which is reflected in the high attack complexity of the assessed CVSS vector. No public exploit code was identified at time of analysis, SSVC records no observed exploitation, and no KEV or EPSS data was supplied; the vendor has released a patch in 0.9.2.8.
Account takeover in the User Profile Builder WordPress plugin before 4.0.5: an Administrator of a Multisite subsite can use the front-end Edit Profile form to select an account other than their own, change that account's email address - including a Network Super Admin's - and then complete the password-reset flow to seize it. The plugin fails to verify that the acting user is authorized to edit the specific account selected (CWE-269, improper privilege management), rated 7.2 High with PR:H because the attacker must already hold subsite Administrator rights, and requiring WordPress Multisite with the front-end profile editor in use; single-site installations are not affected. SSVC records exploitation as none and no public exploit code or active exploitation is identified at time of analysis, though technical impact is total once the prerequisites are met.
Information disclosure in HPE networking products (CVSS 7.1) could let an unauthenticated attacker with adjacent-network access expose or affect sensitive data when a legitimate user is induced to perform an action, though a high-complexity precondition limits reliable exploitation. The affected models, firmware branches, and vulnerable feature are not specified in the available data; HPE bulletin hpesbnw05162en_us is the authoritative reference for scope and fixes. No public exploit code is identified at time of analysis, and the assessed vector rates confidentiality, integrity, and availability impact as High.
Privilege escalation to proxy administrator with follow-on arbitrary command execution affects the LiteLLM proxy server (AI Gateway) from 1.87.0 up to the fixed releases 1.100.4, 1.101.3, 1.102.2, 1.103.1 and 1.104.0-rc.2. An authenticated account holding internal_user privileges can submit crafted metadata through the API-key creation flow so the proxy encrypts and returns a forged administrator credential, then replay that ciphertext as a bearer token to be trusted as a proxy admin and run commands via the MCP stdio endpoint. Versions after 1.91.0 are vulnerable in the default configuration, while 1.87.0 through 1.90.x are only exposed when EXPERIMENTAL_UI_LOGIN=true is explicitly set; CVSS 3.1 scores this 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), the priority label is act_now, and no public exploit code or CISA KEV entry was identified at time of analysis.
Local non-administrative users on hosts running WatchGuard Agent can tamper with, append to, or delete the agent's security logs because the log directory is assigned incorrect permissions, and can stage further local attacks by placing executable content in a directory owned by a privileged service. The issue requires an existing local, authenticated account and the specific directory misconfiguration; there is no remote or unauthenticated path, and privilege escalation depends on a further execution mechanism that is not described in the available data. No public exploit identified at time of analysis, but the vendor has published an advisory and the issue is prioritized for this week.
Privilege escalation in Cozmoslabs Profile Builder through 4.0.4 allows an authenticated low-privilege user to raise their own level of access, with high impact on confidentiality, integrity and availability (CVSS 8.8, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The practical barrier is obtaining an initial account, which is materially lowered on WordPress sites that enable open self-registration, since an attacker can then create their own low-privilege foothold and escalate from it. There is no public exploit identified at time of analysis, and the vendor-published Patchstack record is the only reference available; the priority label places it in this week's remediation queue rather than an emergency response.
Privilege escalation in the HIPAA Forms WordPress plugin (versions before 3.3.2) lets an account that already holds the plugin's own custom user role push that role up to administrator-level capabilities. The plugin handles a request that rebuilds its custom role without any capability check, so a role holder can rewrite their own permissions; per the assessed vector the attacker must be authenticated and must already possess that specific custom role (PR:H), making this an insider or role-holder escalation path rather than unauthenticated remote takeover, and no victim interaction is required. A public PoC reference exists but is not verified as working exploit code, there is no CISA KEV listing, and a vendor fix is available in 3.3.2.
Privilege escalation in the Grav Login plugin (3.6.0 before 3.9.13) allows page authors to obtain super-user accounts by defining an invitation form in page frontmatter and submitting the login.invite task without authentication. The missing authorization check requires an existing authenticated page-author foothold (PR:L) to plant the invitation form, so it is not exploitable by a fully anonymous outsider; no public exploit code or CISA KEV entry was identified at time of analysis. This is a credible, actionable privilege-escalation issue rather than a drop-everything remote-root flaw.
Privilege escalation in the Multicluster Global Hub Operator lets an attacker who already controls the operator or holds its service-account credentials impersonate arbitrary users, groups, and service accounts cluster-wide, then use that identity to obtain full administrative control. The issue is rated CVSS 3.1 7.2 HIGH (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and stems from an overly permissive RBAC configuration in multicluster-global-hub-operator-bundle. No CISA KEV listing, EPSS score, or public exploit code is present in the supplied data; no public exploit identified at time of analysis.
Local privilege escalation in NoMachine allows an attacker who already has low-privileged code execution on the host to abuse predictably generated Redis database credentials and execute arbitrary code in the context of the service account. The flaw is CWE-331 insufficient entropy in the authentication mechanism for NoMachine's bundled Redis database, rated CVSS 7.8 with a local vector requiring low privileges but no user interaction. The supplied intelligence did not include a CISA KEV entry or public exploit code, so no public exploit was identified at time of analysis; risk is bounded because an initial local foothold is mandatory and no remote network vector exists.
Local privilege escalation in NoMachine on Windows lets any user who can already run low-privileged code on the host obtain SYSTEM-level execution by abusing an overly permissive access-control list on a named pipe exposed by the NoMachine Device Service. The flaw is strictly local (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) and requires the Device Service to be installed and running, so it cannot be used for initial access - it is a post-compromise escalation step. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, but successful exploitation yields full confidentiality, integrity and availability impact as SYSTEM; the finding was reported through Trend Micro ZDI as ZDI-CAN-31213 / ZDI-26-773.
Improper privilege management in Cisco Snort 3 allows a locally authenticated low-privilege attacker to escalate privileges on affected deployments, including Cisco Secure Firewall Threat Defense, Cisco UTD Snort IPS Engine, Cisco Cyber Vision, and Open Source Snort 3 installations. Exploitation requires an existing local foothold (AV:L, PR:L) with no user interaction, so the practical risk is post-compromise privilege escalation or abuse of malicious low-privilege local accounts rather than remote attack. No public exploit identified at time of analysis; no CISA KEV active-exploitation confirmation was provided.
Privilege escalation in pfSense-pkg-RESTAPI before 2.9.0 lets an authenticated account holding the scoped settings-sync permission modify REST API configuration secrets through the HA sync endpoint, elevating that non-administrative user to full administrator. The issue is confined to installations of the unofficial pfSense REST API package and is not exploitable against a default configuration with no scoped-permission accounts; no public exploit code was identified at time of analysis. CVSS scores it 8.8, but practical risk is bounded by the deliberately assigned sync privilege and any REST API ACL or firewall restrictions on API endpoints.
Unauthenticated privilege escalation in the WP User Manager WordPress plugin (versions 2.9.21 through 2.9.25) allows an attacker to submit a live paid registration form and receive its configured administrator-equivalent role once the associated payment gateway has been disconnected - the payment gate is silently dropped instead of failing closed. The flaw is rated CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H, CWE-269), but practical exploitation requires the non-default combination of a published paid registration form that assigns a privileged role plus an inactive gateway, so sites that never offered paid registration, never mapped the form to a high-privilege role, or have unpublished the form are not exposed. Publicly available exploit code exists and the issue is fixed in 2.9.26; no KEV listing appears in the supplied intelligence.
Privilege escalation in the Simple Banner WordPress plugin before 3.3.3 lets any role that an administrator has permitted to manage banners gain the full 'administrator' capability, allowing an authenticated low-privileged user to take complete control of the site. The flaw is only reachable when an admin has explicitly delegated banner management to a non-administrator role and the attacker holds an account in that role - a non-default configuration reflected in the AC:H/PR:L vector - so default installs and unauthenticated visitors are not exposed. Publicly available exploit code exists and the vendor has released version 3.3.3 as a fix; no CISA KEV listing is associated with this CVE at time of analysis.
Trigger.dev before 4.6.0 exposes each environment's root TRIGGER_SECRET_KEY and other plaintext secrets through the GET /api/v1/projects/:projectRef/envvars endpoint, so an attacker holding a restricted read:envvars API key can escalate beyond that key's intended read-only scope. The affected environments are staging, production, and preview, and successful exploitation lets the attacker trigger tasks and mint admin public JWTs; exploitation requires a valid scoped key rather than anonymous access. This is a genuine priority rather than a high-score/low-real-risk issue, and no public exploit identified at time of analysis.
Low-privileged authenticated attackers can achieve full takeover of Oracle Data Integrator 12.2.1.4.0 and 14.1.2.0.0 by sending SQL against the Dictionary Repository component over the network. Exploitation requires a valid low-privilege ODI account but no user interaction and only low attack complexity, with high confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit identified at time of analysis, and no CISA KEV status was supplied.
Local privilege escalation to full takeover of Oracle Communications Billing and Revenue Management (BRM) is possible on the Platform component of versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. An attacker who already holds interactive logon access to the BRM host with low-level privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N, base 7.8) can achieve high confidentiality, integrity and availability impact - Oracle describes the outcome as 'takeover' of the product - with low attack complexity and no user interaction. The attack is not remotely reachable: no path exists for an unauthenticated network attacker, so exposure depends entirely on how tightly shell/local access to BRM infrastructure is controlled; no public exploit code was identified at time of analysis and the issue is not in CISA KEV.
Oracle Database's OLAP component in versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3 can be compromised by an authenticated, low-privileged database user who holds the DBMS_AW privilege and can reach the Oracle Net listener; successful exploitation can result in takeover of Oracle OLAP with high confidentiality, integrity, and availability impact (CVSS 8.8). The attack requires network access via Oracle Net but no user interaction, and the main exposure control is limiting who receives DBMS_AW and how broadly the listener is reachable. No public exploit code or confirmed active exploitation was identified at time of analysis.
Takeover of Oracle BI EE 12.2.1.4.0 is possible for an authenticated, low-privileged attacker who already has local logon to the infrastructure hosting the BI Foundation component, though high attack complexity makes reliable exploitation dependent on conditions beyond the attacker's control. The issue carries CVSS 3.1 base score 7.0 with full confidentiality, integrity, and availability impact, but it is not remotely or unauthenticated exploitable. No public exploit is identified at time of analysis, so risk is concentrated on hosts where semi-trusted users hold local accounts.
Takeover of Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 can be achieved by a low-privileged attacker with an existing interactive logon on the OBIEE host, through the Presentation Services component. The local CVSS 3.1 vector (7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high confidentiality, integrity, and availability impact, but the need for local access and valid low-privilege credentials keeps this a genuine, not emergency-grade, priority. No public exploit was identified at time of analysis, and no KEV confirmation is present in the provided data.
Local privilege escalation in Oracle Solaris 11.4 can let a low-privileged attacker with an existing logon compromise the host, with high confidentiality, integrity, and availability impact. The flaw is in the Utility component and has a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); no public exploit has been identified at time of analysis. Exposure is limited to systems where untrusted users can obtain local interactive access.
Privilege escalation in Oracle Database 23ai (versions 23.4.0 through 23.26.3) allows a low-privileged database account holding the DBMS_VECTOR privilege to take over the RDBMS over Oracle Net, with full confidentiality, integrity, and availability impact (CVSS 3.1 base score 8.8). The attack is network-reachable and requires no user interaction, but is gated by the DBMS_VECTOR grant that ships with the Oracle AI Vector Search feature, so environments that do not use vector search or that tightly control this privilege are not exposed to arbitrary low-privileged users. No public exploit code has been identified and the flaw is not listed in CISA KEV at time of analysis; Oracle disclosed it in its October 2026 Critical Patch Update.
Local takeover of Oracle HTTP Server 12.2.1.4.0 is achievable by an authenticated low-privileged user who can log on to the host running the Web Listener, yielding high confidentiality, integrity and availability impact (CVSS 7.8). The AV:L/PR:L/UI:N vector confines realistic exploitation to insiders or attackers who already hold a foothold on the server, and only version 12.2.1.4.0 is listed as affected; no public exploit code exists and there is no CISA KEV entry, so the status is no public exploit identified at time of analysis.
Local low-privilege users with a logon to the infrastructure hosting Oracle HTTP Server 12.2.1.4.0 can exploit the OSSL module to take full control of the HTTP Server, with high confidentiality, integrity, and availability impact. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) confirms the attack is local, requires an authenticated low-privileged account, needs no user interaction, and has low complexity once that access exists. No public exploit identified at time of analysis, and no confirmed active exploitation was provided in the intelligence.
Takeover of Oracle Outside In Technology 8.5.8 is possible for an attacker who already has a local logon on the host running the Outside In Clean Content SDK, with high confidentiality, integrity, and availability impact and no additional authentication or user interaction required. The flaw is rated CVSS 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and no public exploit was identified at time of analysis; risk is concentrated where untrusted documents reach the Clean Content SDK on multi-user or otherwise locally exposed hosts.
Oracle Solaris 11.3 and 11.4 can be fully taken over by an attacker who can already log on to the host, through a flaw in the operating system's 'Utility' component. Exploitation yields high confidentiality, integrity and availability impact - effectively a complete loss of control of the Solaris system - but it requires a local foothold: the CVSS vector is AV:L, and our assessed vector (PR:L) indicates at least a low-privileged local account is needed, contrary to Oracle's PR:N labelling. No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV; with low attack complexity and no user interaction, however, the step from local access to full compromise is short.
Local privilege escalation in Oracle JD Edwards EnterpriseOne Tools (Installation Security component, versions 9.2.0.0 through 9.2.26.5) allows an attacker holding low-privileged logon access on the application host to take over the product, with high confidentiality, integrity, and availability impact (CVSS 7.8). Exploitation is not remote: it requires a local foothold and valid low-privileged credentials on the infrastructure where EnterpriseOne Tools runs, so the practical exposure is insider threat and post-exploitation escalation rather than an internet-facing emergency. No public exploit code has been identified at time of analysis.
A high-severity local privilege escalation and takeover flaw exists in the Installation Security component of Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.5). An attacker who already holds interactive logon access to the host running EnterpriseOne Tools and low-level credentials can exploit the component to gain full control of the application, with complete confidentiality, integrity, and availability impact (CVSS 3.1 base 7.8, AV:L/PR:L/AC:L/UI:N). No public exploit code or confirmed active exploitation was identified at time of analysis, and the requirement for pre-existing local access plus valid credentials is the primary limiting factor on real-world risk.
High-privileged authenticated attackers can take over Oracle iProcurement 12.2.3 through 12.2.15 by sending crafted HTTP requests to the E-Content Manager Catalog component. The flaw is rated CVSS 7.2 with high confidentiality, integrity, and availability impact, but the PR:H vector means an attacker must already hold an elevated account on the E-Business Suite instance. No public exploit identified at time of analysis, and no KEV entry is provided.
Local privilege escalation in the Oracle Solaris 11.4 kernel lets an attacker who already holds a low-privileged logon on the host elevate to full control, compromising confidentiality, integrity, and availability. The flaw is local-only (AV:L) and requires a valid account (PR:L), but needs no user interaction and is low complexity, so a local user meeting the prerequisite can exploit it reliably. The provided intelligence does not confirm CISA KEV active exploitation or publicly available exploit code, so exploitation status is no public exploit identified at time of analysis.
Low-privileged authenticated attackers with network access can take over Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 through its Adapters component, with CVSS 9.9 and a scope change that can extend impact to connected Oracle products. Exploitation requires only low privileges and no user interaction, though authentication requirements keep fully unauthenticated attacks out of scope; no public exploit code or CISA KEV entry was identified at time of analysis. This is a high-priority issue because the Adapters interface is often network-exposed and the scope change can amplify a single compromise across integrated middleware.
Takeover of the Oracle EDI Gateway component in Oracle E-Business Suite 12.2.3 through 12.2.15 is possible for a high-privileged attacker who can reach the application over HTTP, with full confidentiality, integrity, and availability impact (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The critical qualifier is the PR:H prerequisite: the attacker must already hold an elevated EDI Gateway account, so this is not exploitable by unauthenticated or low-privileged users and realistic exposure is confined to trusted operators or adversaries who have already stolen such credentials. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied in the source data.
Privilege escalation in konflux-ci allows an adjacent-network attacker with low-privilege authenticated access to capture a cluster-scoped impersonation token from the UI proxy when the environment lacks a default service certificate authority, yielding full administrative control of the cluster. The proxy disables TLS certificate verification for internal backend connections under that condition and attaches the token to those requests. Exploitation requires on-path network adjacency and the missing-service-CA deployment state; no public exploit was identified at time of analysis and active exploitation is not confirmed.
Privilege escalation in the User Frontend WordPress plugin through 4.3.13 allows any authenticated Subscriber-level user to plant a functional [wpuf-registration role="editor"] shortcode in a published post by hiding it behind a C0 control byte that the plugin's blocklist misses but WordPress storage processing strips. Once the form is rendered, an unauthenticated visitor or the attacker can submit it to create an Editor account, and with the default autologin_after_registration setting enabled the new Editor is logged in immediately. The issue is scored CVSS 8.8, is prioritized for remediation this week, is not listed in CISA KEV, and no public exploit was identified at time of analysis.
Unauthenticated attackers can escalate to administrator account takeover on WordPress sites running Rox Appointment Booking 1.3.1 and earlier, because the plugin's public booking REST route mass-assigns the raw request body into a customer record whose fillable fields include the internal wp_user_id column. An attacker can seed a poisoned customer row carrying an arbitrary administrator user ID (user ID 1 is a reliable guess) plus an email address they control, but the takeover only completes when an administrator later opens that record and clicks Update Customer, at which point the stored wp_user_id and attacker-supplied email are handed to wp_update_user() and the administrator's email is overwritten, enabling a standard WordPress password reset. The attack is network-reachable and needs no credentials, though the mandatory administrator interaction and the user-ID guess bound real-world exploitation; there is no CISA KEV listing, no confirmed public exploit code, and the fix is the vendor's 1.3.2 release.
Privilege escalation to administrator in the WordPress plugin WP Mail Catcher (Mail Logging & Catcher) affects all versions up to and including 2.2.0: an authenticated subscriber-level user can read stored email logs through the 'message' parameter and recover a valid administrator password-reset key, then complete the reset flow and take over the site. The attack only works when an administrator has changed the plugin's default_view_role option to a capability held by low-privileged users, such as 'read', and when an administrator reset email is already present in the logs; the default manage_options value blocks it. No public exploit has been identified at time of analysis and there is no CISA KEV entry; CVSS 7.5 reflects high confidentiality, integrity and availability impact, with high attack complexity coming from the non-default configuration and logged-reset-email preconditions.
XML signature wrapping in LightSAML (4.x before 4.7.1 and 5.x before 5.0.1) lets an attacker who already holds one genuinely IdP-signed SAML assertion redirect signature validation to a buried copy of that genuine assertion while LightSAML consumes attacker-authored claims from a forged direct-child assertion, yielding authentication bypass and privilege escalation up to full impersonation of arbitrary NameID, Conditions and role attributes. The flaw requires only a low-privilege position (PR:L) - a captured earlier login response or the attacker's own legitimate assertion - and works even when the Service Provider enforces requireSignature=true, since the copied genuine ds:Signature still validates. Fixed in 4.7.1 and 5.0.1; the vendor advisory and a working PoC script are public, and no confirmed active exploitation (CISA KEV) or EPSS signal was provided at time of analysis.
Local privilege escalation in NovumOS allows an authenticated user with shell access to load a malicious .nv script that the Nova interpreter executes in Ring 0, giving unrestricted kernel-memory access and code execution at kernel privilege with scope change and high confidentiality, integrity and availability impact. The root cause is architectural rather than a memory-safety defect: Nova is not confined to a Ring 3 domain and no special feature toggle is required, so any loadable script runs with full kernel rights on versions at or before 0.23. A public PoC reference (a sample Nova script writing to kernel memory) is included in the GitHub advisory; it is not verified as working exploit code, there is no KEV listing, and exploitation is limited by the need for local access and the small installed base.
Privilege escalation in Kargo versions from 0.6.0 before 1.8.14, 1.9.9, and 1.10.8 lets an authenticated user with a delegated Project RBAC-management permission confer rights beyond their own, potentially reaching Project-administrator access and exposing Project Secrets and external Git, container-registry, or Helm-registry credentials. Exploitation requires an administrator-created custom role that permits editing Project Roles or ServiceAccounts plus control of an account assigned that role; default non-administrator roles do not grant the needed permissions, and escalation is bounded to that Project. Vendor fixes are available in 1.8.14, 1.9.9, and 1.10.8; no public exploit identified at time of analysis.
A stack-based buffer overflow in Thales Sentinel Keys Server on Windows (versions lower than 1.3.8.0) lets a local attacker who can send a message to the service overflow a stack buffer by supplying an over-long first field, ultimately allowing code execution as NT AUTHORITY\SYSTEM. The flaw is local-only (CVSS:4.0 AV:L, PR:L, base 7.3 HIGH) and requires an additional, unspecified attack condition (AT:P), with no user interaction needed. It is a privilege-escalation primitive for a low-privileged local user rather than a remote entry point; no public exploit has been identified at time of analysis and no confirmed active exploitation is reported.
Subscriber-level users of the WP BASE Booking WordPress plugin through version 6.5.2 can escalate their privileges because the plugin performs an incorrect privilege assignment (CWE-266), with successful exploitation giving high confidentiality and integrity impact. The attack requires an authenticated subscriber account but no user interaction and is network-reachable; sites that allow open registration make that prerequisite much easier to satisfy. Patchstack reported the issue, the vuln.today priority is this_week, and no public exploit was identified at time of analysis; this is serious but conditionally gated rather than an emergency.
Unauthenticated privilege escalation in the WordPress plugin SMS Alert Order Notifications through version 4.0.2 lets remote attackers obtain elevated privileges without authentication or user interaction, with high confidentiality, integrity, and availability impact (CVSS 9.8). The issue is classified as CWE-266 incorrect privilege assignment and was reported by Patchstack; the vulnerable endpoint or feature that triggers the escalation is not described in the available sources. The vuln.today priority is act_now, no public exploit was identified at time of analysis, and there is no CISA KEV confirmation.
Privilege escalation in the Ak Framework WordPress plugin, bundled with the Newsy - Viral News & Magazine theme, through version 2.9.8 allows attackers to reach the ajax_refresh_nonce and ak_admin_ajax handlers and pass attacker-controlled option names and values into update_option(), including users_can_register and default_role. Setting those options to enable open registration with the administrator role gives an attacker a path to create an administrator account. The advisory describes the handlers as reachable without authentication, while the supplied CVSS vector specifies PR:L (authenticated), so the authentication prerequisite should be confirmed against the vendor advisory before scoping exposure; exploitation is limited to sites running this theme/plugin, and no public exploit code or CISA KEV entry appears in the supplied intelligence.
Unauthenticated privilege escalation in the Essential Addons for Elementor plugin (all versions up to and including 6.8.7) lets any site visitor register an account with a role as high as Editor - gaining edit_others_posts, publish_pages, upload_files and unfiltered_html - by passing a WordPress revision ID as the page_id parameter of the register_user() handler. The escalation is not a default-configuration drive-by: the site must have "Anyone can register" enabled, a page must carry the plugin's Login/Register widget, and an administrator must at some point have saved and then reverted a non-default "New User Role" on that page, leaving a revision whose _elementor_data still holds the elevated role. Those attacker-uncontrolled, non-default prerequisites are why the vector scores AC:H despite PR:N; no public exploit has been identified at time of analysis and the issue is not in CISA KEV. In practice this is a genuine but conditionally-gated issue rather than a drop-everything emergency, though the impact when the preconditions are met is full administrative-adjacent compromise of site content.
Privilege escalation in Dell OpenManage Enterprise versions prior to 4.8.0 is a genuine but not emergency-level priority: a low-privileged attacker who already has local access and an authenticated account on the OME host can raise their privileges to high confidentiality, integrity, and availability impact. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires local access plus a pre-existing low-privileged account, not remote or unauthenticated access. No public exploit identified at time of analysis, and the vendor has released a fix in version 4.8.0.
Broken access control in the Cloud Foundry Cloud Controller API leaves the /internal/v3/staging/:guid/droplet_completed and /internal/v3/staging/:guid/build_completed callback endpoints reachable on the public API listener, because the shipped Nginx routing configuration carries deny rules for /internal/v4/ and /internal/v5/ but omits the equivalent rule for /internal/v3/. An attacker who holds a valid build or droplet GUID - and a SpaceAuditor can enumerate those GUIDs without any write permission - can post a forged staging callback, transition a droplet to STAGED, and persist arbitrary process and sidecar metadata with no associated package or actor, escalating past the intended role boundary. No public exploit code was identified at time of analysis, and the vendor has published fixed versions; triage guidance places remediation in this week's work rather than an emergency response.
Privilege escalation in the WebToffee 'Export and Import Users and Customers' plugin for WordPress (all versions up to and including 2.7.5) lets any authenticated user with Subscriber-level access or above plant a crafted value in the Biographical Info field that is later reinterpreted as a second CSV row during import, creating a brand-new account whose login, password, e-mail and role are fully attacker-chosen - including Administrator. Exploitation is conditional rather than automatic: the payload only detonates when a privileged operator runs the plugin's own export and then re-imports the generated file, so sites that never round-trip exported user data back through the importer are not exposed. No public exploit code or confirmed in-the-wild activity was identified at the time of analysis, but the 8.8 severity and the low Subscriber-level prerequisite make this a this-week remediation priority for any site that uses the plugin's export/import cycle.
Symlink following during same-client allocation data migration in HashiCorp Nomad and Nomad Enterprise allows a workload controlled by a tenant to redirect the ownership and permission changes Nomad applies to allocation data onto host directories, corrupting host file permissions and enabling privilege escalation. Only clusters that schedule untrusted or multi-tenant workloads on shared clients are meaningfully exposed, because the vector is local (AV:L) and requires an attacker to already control a running allocation (PR:L); remote unauthenticated exploitation is not possible. HashiCorp fixed the flaw in Nomad 2.1.0 and Nomad Enterprise 2.1.0, 1.11.12 and 1.10.18, and no public exploit code was identified at time of analysis.
Privilege escalation in the BuddyBoss Platform WordPress plugin through version 3.5.0 allows an authenticated low-privileged subscriber to gain higher privileges over the network without user interaction, with a CVSS score of 8.8. The flaw is an incorrect privilege assignment (CWE-266) affecting WordPress community sites running the plugin, and exposure is greatest where subscriber self-registration is open. No public exploit identified at time of analysis, and no CISA KEV entry is present in the supplied data.
Unauthenticated password reset in the LogixFast Auth WordPress plugin before 1.0.4 allows remote attackers to take over any account, including an administrator account, by supplying an attacker-controlled email address during the reset flow. The plugin sends the one-time reset code to the supplied address rather than the resolved account's registered email, so knowing or guessing a valid username is the main prerequisite. A public PoC reference exists; it is not verified as working exploit code, and active exploitation is not confirmed in the supplied KEV data, but the CVSS 9.8 and act_now priority warrant urgent patching to 1.0.4.
Unauthorized file read in the ProjectMAXS MAXS Module FileRead (versionCode 27) lets a locally installed attacker-controlled app bind to the module's exported AIDL service and pass an absolute path to read files that lie outside the caller's own sandbox. The exposure stems from missing permission enforcement on that inter-process interface, and the reachable data is limited to whatever the MAXS module's process itself can access, not full-device compromise. The supplied CVSS vector (AV:N, I:H, C:N) does not match the observed attack path, which is local IPC with no network reach and confidentiality impact only; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Local privilege escalation in the Alpine iLX-F511 in-vehicle media receiver lets code already running as a low-privileged user reach root through an exposed dangerous method in the Fiv service, with high impact to confidentiality, integrity and availability. The attack is local-only and requires a prior foothold on the device (CVSS PR:L), so it is a post-compromise escalation step rather than a remotely reachable entry point; no user interaction is needed once that prerequisite is met. EUVD lists version 7.0.000 as affected, a public ZDI advisory (ZDI-26-820, ZDI-CAN-29095) documents the finding, and no vendor-released patch was identified at time of analysis, with no public exploit identified at time of analysis and no CISA KEV listing.
Local privilege escalation in GFI KerioConnect's KOFF Outlook Connector (Offline Edition) before 10.0.9 Patch 2 lets a non-administrative local user on a Windows host replace the searchd.exe binary used by the bundled KOFFIndexingService, which runs as LocalSystem, gaining NT AUTHORITY\SYSTEM code execution when the service next starts or the machine reboots. The root cause is CWE-276 incorrect default permissions: the installer leaves the product directory writable by the built-in Users group, so the swap requires only file-write access a standard account already has. Requires local access with low privileges (CVSS 4.0 PR:L, AV:L) and an affected KOFF installation; there is no network vector and closing the hole is a matter of upgrading to 10.0.9 Patch 2 or correcting the directory ACLs. No public exploit code has been identified at time of analysis, and the issue is not in CISA KEV.
Local privilege escalation in Norton Antivirus, Avast Antivirus, and AVG Internet Security before version 26.5.10933 on Windows lets a low-privileged local user gain NT AUTHORITY\SYSTEM through the Data Shredder component. The flaw is a link-following defect (CWE-59): during a privileged shred operation, the component follows attacker-placed filesystem links, resulting in deletion of arbitrary files or folders that the attacker then leverages to elevate to SYSTEM. Exploitation requires authenticated local access with low privileges and depends on the privileged shred operation being performed (UI:R); a vendor patch is available, so this rates as a this-week priority rather than an emergency, and no public exploit code has been identified at time of analysis.
Improper privilege management in Dell PowerProtect Data Domain appliances allows a high-privileged, authenticated attacker with network reachability to elevate their privileges on the appliance, with high impact to confidentiality, integrity and availability. Affected releases are Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40 and LTS2026 8.6.1.0 through 8.6.1.20. The dominant limiting factor is the PR:H prerequisite: this is a post-authentication escalation for a malicious or compromised high-privilege operator rather than a path for an unauthenticated outsider; no public exploit is identified at time of analysis and this is a non-emergency 'this_week' priority.
Privilege escalation in Mage Eventpress (Event Booking Manager for WooCommerce) versions up to and including 5.7.8 allows an authenticated WooCommerce Shop Manager to elevate to Administrator. The mep_grant_shop_manager_access() function hooks user_has_cap and grants manage_options whenever an attacker-controlled $_GET['page'] value begins with 'mep_' or 'mpwem_', without validating that the page is a registered EventPress screen; deployments that assign Shop Manager accounts to non-administrators are exposed. The CVSS 3.1 score is 7.2 with PR:H, reflecting the need for an existing elevated account, and no public exploit identified at time of analysis; vuln.today assigns this CVE a this_week priority.
Authenticated WordPress users holding a delegated non-administrator role can rewrite the GoSMTP plugin's SMTP configuration in any version before 1.2.5, redirecting outbound mail and ultimately taking over an administrator account. The settings page is gated only on the plugin's activation capability and lacks a proper settings-management authorization check, so the flaw is a broken-access-control / improper-privilege-management issue rather than an anonymous remote attack - the attacker must already have a valid sub-administrator account with that capability. No public exploit code has been identified at time of analysis, exploitation is not confirmed in CISA KEV, and EPSS is low at roughly 0.15% (4th percentile), though the vendor has released a fix in 1.2.5 and the priority signal points to patching this week.
EagleCloud Aquila on-premises deployments through version 2.6.7.2 expose stored access keys, secret keys, and deployment secrets to unauthenticated remote attackers who abuse authentication handling in the tunnel gateway and provisioning interfaces. The flaw carries a CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N) with impact confined to confidentiality (VC:H, VI:N, VA:N), matching an independent assessment of CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - the disclosure describes the outcome as privilege escalation, but the measurable effect is read-only access to high-value credentials rather than modification of the system. No CISA KEV listing and no public exploit code were identified in the supplied intelligence, and the vulnerability is triaged as "this_week" priority; exploitation requires that the tunnel gateway or provisioning interfaces be network-reachable on an affected on-premises installation.
Privilege escalation in Cronicle through 0.9.120 lets an authenticated non-administrator user, or a scoped API key, that holds only create_events and run_events privileges inject top-level uid and gid fields into an event, which the root daemon then honours when launching the child process - so the low-privileged principal can run jobs as any local account, including root. Root compromise depends on the deployment mode: the advisory states a root-running daemon is the default per docs/Setup.md, while on a non-root daemon the impact is bounded by the daemon's own privileges; the injected identity also only survives with plugins that do not define their own uid, which is true of the shipped shellplug and urlplug defaults. This is a distinct sibling of the previously patched job-output injection tracked as CVE-2026-39401. Vendor-released patch: 0.9.121; no CISA KEV listing and no confirmed weaponized exploit, though the advisory publishes a working reproduction script; the assessed priority is to remediate this week.
Local privilege escalation in Tanium End-User CX and the Tanium Endpoint Configuration Toolset Solution lets a user who is already logged on with low privileges raise their rights to a high-impact level (C:H/I:H/A:H) on the affected endpoint, with no user interaction required. Affected builds are end-user-cx releases up to 1.8.47, 1.11.605, 1.19.325, 1.21.835, 1.22.1199, 1.23.766 and 1.24.590, plus Endpoint Configuration Toolset Solution 1.51.60, 1.59.50 and 1.71.25; Tanium has released fixes for these branches. No public exploit was identified at time of analysis, and the weakness is classified as CWE-59 link following, although the sources do not describe the precise file or link condition that triggers it. The realistic exposure is a post-compromise scenario on an enterprise agent endpoint rather than a network-facing attack, which is why the priority is 'this_week' rather than emergency action.
Local privilege escalation in Tanium End-User CX and the Endpoint Configuration Toolset Solution allows an authenticated low-privileged user with local access to a managed endpoint to gain high confidentiality, integrity, and availability impact (CVSS 7.8, AV:L/AC:L/PR:L/UI:N). The flaw is in the End-User Notifications component and is classified as CWE-59 link following; Tanium reports a vendor patch in advisory TAN-2026-058. This is a credible but non-emergency issue: no public exploit identified at time of analysis, no CISA KEV active-exploitation signal is present in the supplied data, and exploitation requires an existing local foothold.
Local privilege escalation in Tanium End-User CX (end-user-cx) and the Tanium Endpoint Configuration Toolset Solution lets an attacker who already holds a low-privileged local account on a managed endpoint leverage a link-following flaw (CWE-59) to gain high-integrity code execution, with CVSS 3.1 scoring 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Only hosts running the pre-fix builds are exposed - end-user-cx below 1.8.47, 1.11.605, 1.19.325, 1.21.835, 1.22.1199, 1.23.766 or 1.24.590, and Endpoint Configuration Toolset Solution below 1.51.60, 1.59.50 or 1.71.25. No public exploit code was identified at time of analysis and the flaw is not in CISA KEV; the vendor has released fixed builds, and the practical exposure is limited to endpoints that are already multi-user or already partially compromised.
Local privilege escalation in Veeam Agent for Linux 13.1 allows a local low-privileged user to gain elevated privileges on hosts whose agent installation is managed by a Veeam Backup & Replication instance; standalone/unmanaged deployments are not affected. The flaw is an untrusted search path (CWE-426), the vendor has released a fix in 13.1.2, and no public exploit identified at time of analysis. This is a genuine but moderate-priority issue rather than an emergency.
Local privilege escalation in TeamViewer Remote Management Patch Management for Windows allows an authenticated low-privileged user to execute arbitrary code with elevated privileges by replacing the service executable in an insufficiently protected temporary directory during Patch Management activation. The flaw affects versions prior to 26.9.1 and the legacy v14.7 client branch prior to 24.12.5. Exploitation requires a local foothold and an activation event, and no CISA KEV entry or public exploit code is referenced in the supplied intelligence.
Local privilege escalation in TeamViewer Full Client and Host on Windows allows an authenticated low-privileged user to execute arbitrary commands as SYSTEM by placing a crafted installer options file in the Advanced Asset Management installer staging directory, which is processed during service activation. All Full Client and Host builds prior to 15.82 are affected, along with the legacy Windows 7/8 branch prior to 15.64.10. A vendor patch is available, and no public exploit has been identified at time of analysis.
DLL search-order/planting in the TeamViewer Remote Management Monitoring installer for Windows before 26.10.1 lets a local authenticated low-privileged user plant a malicious DLL that is loaded with elevated privileges when a higher-privileged user runs the installer, yielding arbitrary code execution. Exploitation requires an existing foothold on the host plus user interaction, and no public exploit is identified at time of analysis. Vendor patch 26.10.1 resolves the condition; the assessed priority is this_week, a genuine but not emergency-grade issue.
Local privilege escalation in TeamViewer Remote Management Monitoring for Windows before 26.10.1: a low-privileged authenticated local user can impersonate the IPC broker and cause the Monitoring service to execute arbitrary code as NT AUTHORITY\SYSTEM. Only hosts with the Remote Management Monitoring component installed and its service running are affected (base TeamViewer remote-access installs without the Monitoring module are not indicated as affected by available data), and exploitation requires an existing low-privilege local session (CVSS:3.1/AV:L/AC:L/PR:L/UI:N). This is a credible but non-emergency issue - no public exploit code or active exploitation is confirmed, and the vendor has released a fixed version (26.10.1).
Local privilege escalation in TeamViewer Full Client and Host for macOS lets a low-privileged local attacker exploit a TOCTOU race combined with symbolic-link handling in the privileged helper to bypass installer package verification and install a malicious package as root. Affected builds are prior to 15.83, plus 14.7.x before 14.7.48868 and 13.2.x before 13.2.154007; exploitation is local-only and requires winning the timing window. No public exploit was identified in the supplied sources at time of analysis, and the vendor has released fixed versions.
Privilege escalation in Mozilla Firefox's DOM: Navigation component allows remote attackers to gain elevated privileges within the browser when a victim loads attacker-controlled web content, with the flaw resolved in Firefox 159. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R, score 8.8) indicates no prior authentication or attacker privileges are needed, but the required victim interaction is the primary limiting factor and is consistent with CISA SSVC scoring of Automatable: no and Exploitation: none. No public exploit code or active exploitation has been identified at time of analysis, and the vendor-reported issue is tracked as Mozilla Bugzilla 2075440 with advisories mfsa2026-118 and mfsa2026-121.
Authenticated SQL injection in Dolibarr ERP/CRM through version 23.0.0 lets any user holding the standard 'Third Party: Create/Edit' permission - not just an administrator - read or rewrite arbitrary database content. The unescaped lt1/localtax1_value (and lt2/localtax2_value) POST parameter is concatenated into an UPDATE statement in an unquoted numeric context, so an attacker can append a second SET clause and copy a target value such as a user's password hash into a field they can then read, potentially escalating to admin and onward to RCE via admin-only modules. The vendor advisory GHSA-v5fq-cf5m-vwv7 ships a complete reproduction including working request payloads; no confirmed active exploitation (CISA KEV) has been reported, and no fixed release is listed yet - the package data records composer/dolibarr/dolibarr as vulnerable at <= 23.0.0 with 'not yet patched'. With a CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8) and a this_week decision label, this is a genuine, actionable priority rather than an inflated CVSS score.
Privilege escalation in Octopus Server lets an authenticated user who already holds the System Manager role obtain full system Administrator rights, with risk concentrated in environments that grant that role to users not otherwise trusted as full administrators or where such an account is compromised. The affected ranges are 2019.0.0 through <2026.2.13469 and 2026.3.0 through <2026.3.15863, and the CVSS vector's PR:H metric confirms the required high-privileged account, so this is not a remote-unauthenticated attack. No public exploit is identified at time of analysis, the vendor has released a patch, and the supplied priority label is this_week.
Octopus Server writes user-invitation codes into audit event logs, so an authenticated user who can read audit events in a space may retrieve the code for an unclaimed, space-linked invitation and redeem it. The resulting privilege gain depends entirely on the permissions assigned to the invited account, and exploitation also requires that an unredeemed space-linked invitation already exists; the independent assessment therefore treats this as a moderate-priority authenticated privilege-escalation issue rather than a mass-exploitation threat. Vendor-released fixes are 2026.2.13438 and 2026.3.15829, and no public exploit is identified in the supplied data.
Privilege escalation in the Supermicro BMC IPMI implementation allows an attacker who already holds a low-privilege BMC account to send crafted RAKP+ authentication messages and gain administrator-level access on affected MBD-X12SPI systems running firmware 01.07.20. The issue is rated CVSS 8.8 because exploitation is network-reachable, requires low privileges, and yields high confidentiality, integrity, and availability impact, although EPSS is low at 0.26% (17th percentile). No public exploit identified at time of analysis; reachability is limited to BMC management interfaces, typically IPMI/RMCP+ on UDP 623.
Privilege escalation in the Kirki plugin for WordPress (all versions up to and including 6.2.5) allows authenticated users with only Subscriber-level access to reach a vulnerable deserialization path in the 'get-single-symbol' branch of the kirki_post_apis() AJAX dispatcher, which lacks a capability check, and to inject a PHP object. Because a POP chain is present in the running code, a successful injection can overwrite an administrator's password and hand the attacker full administrative control of the site. The CVSS vector confirms network reachability, low privileges (PR:L), and no user interaction (UI:N) for a high-integrity, high-availability impact; EPSS is low at 0.30% (23rd percentile) and there is no KEV listing, so there is no public exploit identified at time of analysis, though the practical exposure is governed by whether a site permits open user registration.
Improper access restrictions in Apple macOS before Golden Gate 27.2 allow a maliciously crafted archive to cause unexpected app termination or arbitrary code execution when a user unpacks it. The CVSS vector indicates network reachability, no required privileges (PR:N), and mandatory user interaction (UI:R); no public exploit was identified at time of analysis, and EPSS is 0.51% (44th percentile). Apple has released macOS Golden Gate 27.2 as the vendor fix.
Type confusion in Timescale's pgvectorscale extension (all versions before 0.9.1) lets a low-privileged database user who holds CREATE on the vectorscale schema pre-create shadow objects that impersonate pgvector's vector type or operators, then build and query a DiskANN index over crafted values to drive out-of-bounds reads and writes. Successful exploitation can disclose process memory, crash the PostgreSQL server, or escalate privileges within the database; both pgvector and a vulnerable pgvectorscale build must be installed, and the source CVSS 4.0 score of 7.7 reflects full confidentiality, integrity and availability impact confined to the vulnerable system. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the vendor-priority decision is 'this_week' and fixed builds ship in 0.9.1.
Local privilege escalation to root in boneIO Black affects versions prior to 1.6.0, where a low-privileged local attacker can abuse a time-of-check/time-of-use race in the timezone sudoers-file routine to inject arbitrary sudoers rules. Exploitation requires an existing local foothold on the device and either winning a non-deterministic race between validation and installation or pre-creating a symlink at the predictable temporary filename; it is not remotely reachable unauthenticated. No public exploit has been identified at time of analysis, and the vendor-released fix is version 1.6.0.
Local privilege escalation in boneIO black_debian_images builds prior to 1.6.0 lets anyone who controls the boneio service account become root, because that account carries a full passwordless sudo rule and membership in the docker group - either one is sufficient for full root compromise. The flaw is strictly local and requires authenticated access (CVSS:4.0 AV:L/PR:L), so an attacker must already have code execution as the boneio user through some other weakness before this becomes useful. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the vendor-assigned severity of 9.3 and a vuln.today priority of act_now reflect that fielded devices remain exposed until the 1.6.0 upgrade is installed and its migrations run.
Improper file permissions in Japan's Ministry of Land, Infrastructure, Transport and Tourism Electronic delivery item Inspection Support System (versions 0 through Ver.4.0.36) let a low-privileged local user overwrite files inside the application's installation folder, which are then executed in a more privileged context, yielding arbitrary code execution. The flaw is purely local (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, vendor score 8.5), so an attacker must already hold a foothold on the host and a higher-privileged user or service must subsequently invoke the tampered files; it is an integrity and privilege-escalation problem rather than a remotely reachable emergency. No public exploit code was identified at the time of analysis, and the issue is not in CISA KEV; JPCERT reporting places it in the 'this_week' remediation queue, and no fixed version is stated in the available data - consult JVN#75668103 for update status.
A local privilege escalation flaw in the WCH CH340/CH341 USB-to-serial Windows driver setup package CH341SER.EXE version 4.0 lets a low-privileged local user gain elevated privileges on an affected Windows host. Exploitation requires the installer to be present on the machine and the attacker to already hold a standard local account (CVSS: AV:L/PR:L/UI:N); it cannot be reached remotely and needs no victim interaction. A public PoC reference exists on GitHub but is not verified as working exploit code, the issue is not in CISA KEV, and EPSS is low (0.23%, 13th percentile), so real-world risk is moderate rather than urgent.
Privilege escalation in the Duplicator WordPress plugin before 5.0.0 lets an administrator of a WordPress Multisite child site who is not a network administrator use the plugin's one-click upgrade routine to install and execute arbitrary PHP in the network-wide shared plugin directory. The assessed vector requires high privileges (an existing subsite administrator account) and no user interaction; the description's additional claim that the routine is exposed without authentication is unresolved in the available data. No CISA KEV entry is present, a public PoC reference exists but is not verified as working exploit code, and EPSS is low at 0.17% (percentile 7).
Unauthenticated privilege escalation in the Datawiza Proxy Auth Plugin for WordPress lets a remote attacker forge the user-identity and role HTTP headers the plugin consumes and thereby create and authenticate as a WordPress administrator, giving full control of the site (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The disclosed affected range is 1.1.0 up to but not including 1.1.1, and the vendor has released 1.1.1 as the fix. Practical exploitability is topology-dependent: forged headers are only honored if externally supplied copies actually reach the plugin, so a correctly configured front-end proxy that strips or overwrites these headers blocks the attack. A public PoC reference exists but is not verified as working exploit code, and EPSS is low at 0.14% (3rd percentile) despite the maximal severity score, so the vulnerability.today decision label is act_now on the basis of impact rather than observed exploitation.
Privilege escalation in the aBlocks WordPress plugin (Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder) through 2.17.0 lets an authenticated attacker with Contributor-level access or above raise their own WordPress role to Editor and receive a fully authenticated session at the elevated level. The flaw sits in the plugin's `/ablocks/v1/form-builder/registration` REST endpoint, which is registered with `permission_callback => __return_true` and whose `register()` handler reads `roleSlug` from attacker-controlled block attributes without confirming the block's `formType` is actually `registration`; the save-time sanitizer only enforces that constraint for registration blocks. Impact is bounded below administrator - `is_safe_registration_role()` rejects any role carrying `manage_options`, `edit_users`, `delete_users`, `create_users`, `promote_users`, or `edit_theme_options`, so Editor is the highest role practically reachable on a standard installation. No public exploit code or active exploitation is identified at time of analysis, and the CVSS vector (PR:L) confirms the attack requires authentication.
The WordPress plugin User Profile Builder (Beautiful User Registration Forms, User Profiles & User Role Editor) through version 4.0.3 lets an authenticated user with Author-level access or higher create brand-new WordPress accounts that carry the Editor role, because the Gutenberg 'Register' block forwards an attacker-supplied Assigned Role attribute straight into the [wppb-register] shortcode with no server-side authorization check. The built-in role guard only strips roles that hold the manage_options or remove_users capability, so Administrator is blocked but Editor and every other privileged non-Administrator role passes through untouched, giving a limited - not full-admin - privilege escalation with high integrity impact (CVSS 7.1, PR:L). No public exploit code or CISA KEV entry was identified at time of analysis, and the issue is rated a this-week, moderate-priority fix rather than an emergency.
DJI CrystalSky ZS600C firmware 0.3.9.7 through 0.6.6.9 exposes an unauthenticated adbd shell to anyone with physical USB access because the device ships with ro.adb.secure=0 and USB ADB enabled. An attacker can obtain a uid 2000 shell as a foothold for a separate privilege-escalation step to root; ADB over TCP is not enabled by default, but when enabled out-of-band the same unauthenticated shell is reachable over the network. No public exploit was identified at time of analysis and there is no CISA KEV entry; the assessed CVSS 3.1 score is 7.0 (AV:P) because the default path requires physical access, while the reported CVSS 4.0 base score is 9.3.
Local privilege escalation in the optional dnscache package of Zimbra Collaboration Suite lets the low-privileged Unix 'zimbra' service account gain root on the host, affecting the dnscache builds shipped with ZCS 10.1.16 and 10.1.21 (EUVD lists 10.0 through 10.1.21). An attacker who already controls the zimbra account can abuse the passwordless sudo rule for the zmunbound wrapper, which forwards arbitrary arguments to Unbound without constraining the configuration path, to run Unbound with a root-owned configuration that disables chroot, read root-readable files such as password hashes and private keys through Include-directive parser errors, and write or append root-owned files. There is no KEV listing and no confirmed public exploit code in the available data, although Rapid7 has published a research write-up on breaking Zimbra identity boundaries; exploitation is local and requires the optional package to be installed, so it is an authenticated (PR:L) post-compromise escalation rather than a network-facing attack, and the base 7.8 score reflects high confidentiality and integrity impact once that foothold exists.
The Zimbra Collaboration Suite MTA package lets the Unix zimbra account escalate to root: the installed sudo policy permits passwordless root execution of Postfix administration commands without constraining their arguments, and since the zimbra user controls the daemon_directory setting and can write the Postfix configuration directory, invoking 'postfix set-permissions' makes Postfix run an attacker-supplied post-install program as root. Rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N, C/I/A:H), it is strictly a local escalation primitive - an attacker must already have command execution as zimbra on an MTA node, so no remote or unauthenticated path exists, and exploitation is confined to MTA nodes running the affected package. No public exploit code and no confirmed active exploitation were identified at time of analysis; the priority label is 'this_week', reflecting a genuine high-impact chaining primitive whose risk is gated by the local prerequisite.
Local privilege escalation in the zmmailboxdmgr launcher of Zimbra Collaboration Suite lets the Unix zimbra account execute arbitrary commands as root, breaking the boundary between the mail service account and the host. Because the launcher's passwordless sudo path does not adequately restrict JVM arguments (CWE-88 argument injection), an attacker with a zimbra-level foothold on a mailbox server can delay Jetty's privilege drop and register an -XX:OnOutOfMemoryError command that fires while the JVM is still root, although the malicious restart interrupts mailboxd and is therefore disruptive. Affected builds are the identified ZCS 10.1.16 and 10.1.21 releases (EUVD lists versions up to and including 10.1.21); no KEV entry or confirmed working exploit code is present in the available data, though Rapid7 has published a technical research write-up of the technique, and the EPSS/KEV signal base is absent here. CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects full root impact behind a mandatory local prerequisite, which places it at this-week rather than emergency priority.
Privilege escalation in BlueSpice container deployments (bluespice/wiki image, versions 5.2.3 through 5.2.6 and 5.2.7 images published before 2026-10-19 15:37 UTC) lets an attacker who can read the wiki obtain an application token from the REST API and exchange it for a session carrying sysop privileges as the internal service user. Because the token authenticator's IP allow-list is disabled by default when WIKI_SERVICE_TOKEN_AUTH_ALLOWED is unset, no authentication is required on publicly readable wikis (CVSS:3.1 AV:N/AC:L/PR:N/UI:N), while on access-controlled wikis a low-privileged read account suffices. Vendor-released fixes are available (5.2.7 and later, or a 5.2.7 image published on/after 2026-10-19 15:37 UTC); no public exploit code or confirmed active exploitation was identified at time of analysis. Severity is 9.3 (CVSS 4.0), and the priority decision is act_now.
Unauthenticated takeover of a site administrator account is possible in the Advanced Custom Fields: Extended and Extended PRO WordPress plugins before 0.9.2.8 through the front-end Forms module. The update-user action resolves its target inconsistently between the stage that authorises the request and the stage that executes it, so an attacker can direct the update at an administrator account and be issued a valid session for it. The configuration prerequisite is narrow but explicit: the site must publish two separate front-end form configurations whose update-user targets are mapped to visitor-submitted values, which is reflected in the high attack complexity of the assessed CVSS vector. No public exploit code was identified at time of analysis, SSVC records no observed exploitation, and no KEV or EPSS data was supplied; the vendor has released a patch in 0.9.2.8.
Account takeover in the User Profile Builder WordPress plugin before 4.0.5: an Administrator of a Multisite subsite can use the front-end Edit Profile form to select an account other than their own, change that account's email address - including a Network Super Admin's - and then complete the password-reset flow to seize it. The plugin fails to verify that the acting user is authorized to edit the specific account selected (CWE-269, improper privilege management), rated 7.2 High with PR:H because the attacker must already hold subsite Administrator rights, and requiring WordPress Multisite with the front-end profile editor in use; single-site installations are not affected. SSVC records exploitation as none and no public exploit code or active exploitation is identified at time of analysis, though technical impact is total once the prerequisites are met.
Information disclosure in HPE networking products (CVSS 7.1) could let an unauthenticated attacker with adjacent-network access expose or affect sensitive data when a legitimate user is induced to perform an action, though a high-complexity precondition limits reliable exploitation. The affected models, firmware branches, and vulnerable feature are not specified in the available data; HPE bulletin hpesbnw05162en_us is the authoritative reference for scope and fixes. No public exploit code is identified at time of analysis, and the assessed vector rates confidentiality, integrity, and availability impact as High.
Privilege escalation to proxy administrator with follow-on arbitrary command execution affects the LiteLLM proxy server (AI Gateway) from 1.87.0 up to the fixed releases 1.100.4, 1.101.3, 1.102.2, 1.103.1 and 1.104.0-rc.2. An authenticated account holding internal_user privileges can submit crafted metadata through the API-key creation flow so the proxy encrypts and returns a forged administrator credential, then replay that ciphertext as a bearer token to be trusted as a proxy admin and run commands via the MCP stdio endpoint. Versions after 1.91.0 are vulnerable in the default configuration, while 1.87.0 through 1.90.x are only exposed when EXPERIMENTAL_UI_LOGIN=true is explicitly set; CVSS 3.1 scores this 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), the priority label is act_now, and no public exploit code or CISA KEV entry was identified at time of analysis.
Local non-administrative users on hosts running WatchGuard Agent can tamper with, append to, or delete the agent's security logs because the log directory is assigned incorrect permissions, and can stage further local attacks by placing executable content in a directory owned by a privileged service. The issue requires an existing local, authenticated account and the specific directory misconfiguration; there is no remote or unauthenticated path, and privilege escalation depends on a further execution mechanism that is not described in the available data. No public exploit identified at time of analysis, but the vendor has published an advisory and the issue is prioritized for this week.
Privilege escalation in Cozmoslabs Profile Builder through 4.0.4 allows an authenticated low-privilege user to raise their own level of access, with high impact on confidentiality, integrity and availability (CVSS 8.8, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The practical barrier is obtaining an initial account, which is materially lowered on WordPress sites that enable open self-registration, since an attacker can then create their own low-privilege foothold and escalate from it. There is no public exploit identified at time of analysis, and the vendor-published Patchstack record is the only reference available; the priority label places it in this week's remediation queue rather than an emergency response.
Privilege escalation in the HIPAA Forms WordPress plugin (versions before 3.3.2) lets an account that already holds the plugin's own custom user role push that role up to administrator-level capabilities. The plugin handles a request that rebuilds its custom role without any capability check, so a role holder can rewrite their own permissions; per the assessed vector the attacker must be authenticated and must already possess that specific custom role (PR:H), making this an insider or role-holder escalation path rather than unauthenticated remote takeover, and no victim interaction is required. A public PoC reference exists but is not verified as working exploit code, there is no CISA KEV listing, and a vendor fix is available in 3.3.2.
Privilege escalation in the Grav Login plugin (3.6.0 before 3.9.13) allows page authors to obtain super-user accounts by defining an invitation form in page frontmatter and submitting the login.invite task without authentication. The missing authorization check requires an existing authenticated page-author foothold (PR:L) to plant the invitation form, so it is not exploitable by a fully anonymous outsider; no public exploit code or CISA KEV entry was identified at time of analysis. This is a credible, actionable privilege-escalation issue rather than a drop-everything remote-root flaw.
Privilege escalation in the Multicluster Global Hub Operator lets an attacker who already controls the operator or holds its service-account credentials impersonate arbitrary users, groups, and service accounts cluster-wide, then use that identity to obtain full administrative control. The issue is rated CVSS 3.1 7.2 HIGH (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and stems from an overly permissive RBAC configuration in multicluster-global-hub-operator-bundle. No CISA KEV listing, EPSS score, or public exploit code is present in the supplied data; no public exploit identified at time of analysis.
Local privilege escalation in NoMachine allows an attacker who already has low-privileged code execution on the host to abuse predictably generated Redis database credentials and execute arbitrary code in the context of the service account. The flaw is CWE-331 insufficient entropy in the authentication mechanism for NoMachine's bundled Redis database, rated CVSS 7.8 with a local vector requiring low privileges but no user interaction. The supplied intelligence did not include a CISA KEV entry or public exploit code, so no public exploit was identified at time of analysis; risk is bounded because an initial local foothold is mandatory and no remote network vector exists.
Local privilege escalation in NoMachine on Windows lets any user who can already run low-privileged code on the host obtain SYSTEM-level execution by abusing an overly permissive access-control list on a named pipe exposed by the NoMachine Device Service. The flaw is strictly local (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) and requires the Device Service to be installed and running, so it cannot be used for initial access - it is a post-compromise escalation step. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, but successful exploitation yields full confidentiality, integrity and availability impact as SYSTEM; the finding was reported through Trend Micro ZDI as ZDI-CAN-31213 / ZDI-26-773.
Improper privilege management in Cisco Snort 3 allows a locally authenticated low-privilege attacker to escalate privileges on affected deployments, including Cisco Secure Firewall Threat Defense, Cisco UTD Snort IPS Engine, Cisco Cyber Vision, and Open Source Snort 3 installations. Exploitation requires an existing local foothold (AV:L, PR:L) with no user interaction, so the practical risk is post-compromise privilege escalation or abuse of malicious low-privilege local accounts rather than remote attack. No public exploit identified at time of analysis; no CISA KEV active-exploitation confirmation was provided.
Privilege escalation in pfSense-pkg-RESTAPI before 2.9.0 lets an authenticated account holding the scoped settings-sync permission modify REST API configuration secrets through the HA sync endpoint, elevating that non-administrative user to full administrator. The issue is confined to installations of the unofficial pfSense REST API package and is not exploitable against a default configuration with no scoped-permission accounts; no public exploit code was identified at time of analysis. CVSS scores it 8.8, but practical risk is bounded by the deliberately assigned sync privilege and any REST API ACL or firewall restrictions on API endpoints.
Unauthenticated privilege escalation in the WP User Manager WordPress plugin (versions 2.9.21 through 2.9.25) allows an attacker to submit a live paid registration form and receive its configured administrator-equivalent role once the associated payment gateway has been disconnected - the payment gate is silently dropped instead of failing closed. The flaw is rated CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H, CWE-269), but practical exploitation requires the non-default combination of a published paid registration form that assigns a privileged role plus an inactive gateway, so sites that never offered paid registration, never mapped the form to a high-privilege role, or have unpublished the form are not exposed. Publicly available exploit code exists and the issue is fixed in 2.9.26; no KEV listing appears in the supplied intelligence.
Privilege escalation in the Simple Banner WordPress plugin before 3.3.3 lets any role that an administrator has permitted to manage banners gain the full 'administrator' capability, allowing an authenticated low-privileged user to take complete control of the site. The flaw is only reachable when an admin has explicitly delegated banner management to a non-administrator role and the attacker holds an account in that role - a non-default configuration reflected in the AC:H/PR:L vector - so default installs and unauthenticated visitors are not exposed. Publicly available exploit code exists and the vendor has released version 3.3.3 as a fix; no CISA KEV listing is associated with this CVE at time of analysis.
Trigger.dev before 4.6.0 exposes each environment's root TRIGGER_SECRET_KEY and other plaintext secrets through the GET /api/v1/projects/:projectRef/envvars endpoint, so an attacker holding a restricted read:envvars API key can escalate beyond that key's intended read-only scope. The affected environments are staging, production, and preview, and successful exploitation lets the attacker trigger tasks and mint admin public JWTs; exploitation requires a valid scoped key rather than anonymous access. This is a genuine priority rather than a high-score/low-real-risk issue, and no public exploit identified at time of analysis.
Low-privileged authenticated attackers can achieve full takeover of Oracle Data Integrator 12.2.1.4.0 and 14.1.2.0.0 by sending SQL against the Dictionary Repository component over the network. Exploitation requires a valid low-privilege ODI account but no user interaction and only low attack complexity, with high confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit identified at time of analysis, and no CISA KEV status was supplied.
Local privilege escalation to full takeover of Oracle Communications Billing and Revenue Management (BRM) is possible on the Platform component of versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. An attacker who already holds interactive logon access to the BRM host with low-level privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N, base 7.8) can achieve high confidentiality, integrity and availability impact - Oracle describes the outcome as 'takeover' of the product - with low attack complexity and no user interaction. The attack is not remotely reachable: no path exists for an unauthenticated network attacker, so exposure depends entirely on how tightly shell/local access to BRM infrastructure is controlled; no public exploit code was identified at time of analysis and the issue is not in CISA KEV.
Oracle Database's OLAP component in versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3 can be compromised by an authenticated, low-privileged database user who holds the DBMS_AW privilege and can reach the Oracle Net listener; successful exploitation can result in takeover of Oracle OLAP with high confidentiality, integrity, and availability impact (CVSS 8.8). The attack requires network access via Oracle Net but no user interaction, and the main exposure control is limiting who receives DBMS_AW and how broadly the listener is reachable. No public exploit code or confirmed active exploitation was identified at time of analysis.
Takeover of Oracle BI EE 12.2.1.4.0 is possible for an authenticated, low-privileged attacker who already has local logon to the infrastructure hosting the BI Foundation component, though high attack complexity makes reliable exploitation dependent on conditions beyond the attacker's control. The issue carries CVSS 3.1 base score 7.0 with full confidentiality, integrity, and availability impact, but it is not remotely or unauthenticated exploitable. No public exploit is identified at time of analysis, so risk is concentrated on hosts where semi-trusted users hold local accounts.
Takeover of Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 can be achieved by a low-privileged attacker with an existing interactive logon on the OBIEE host, through the Presentation Services component. The local CVSS 3.1 vector (7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high confidentiality, integrity, and availability impact, but the need for local access and valid low-privilege credentials keeps this a genuine, not emergency-grade, priority. No public exploit was identified at time of analysis, and no KEV confirmation is present in the provided data.
Local privilege escalation in Oracle Solaris 11.4 can let a low-privileged attacker with an existing logon compromise the host, with high confidentiality, integrity, and availability impact. The flaw is in the Utility component and has a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); no public exploit has been identified at time of analysis. Exposure is limited to systems where untrusted users can obtain local interactive access.
Privilege escalation in Oracle Database 23ai (versions 23.4.0 through 23.26.3) allows a low-privileged database account holding the DBMS_VECTOR privilege to take over the RDBMS over Oracle Net, with full confidentiality, integrity, and availability impact (CVSS 3.1 base score 8.8). The attack is network-reachable and requires no user interaction, but is gated by the DBMS_VECTOR grant that ships with the Oracle AI Vector Search feature, so environments that do not use vector search or that tightly control this privilege are not exposed to arbitrary low-privileged users. No public exploit code has been identified and the flaw is not listed in CISA KEV at time of analysis; Oracle disclosed it in its October 2026 Critical Patch Update.
Local takeover of Oracle HTTP Server 12.2.1.4.0 is achievable by an authenticated low-privileged user who can log on to the host running the Web Listener, yielding high confidentiality, integrity and availability impact (CVSS 7.8). The AV:L/PR:L/UI:N vector confines realistic exploitation to insiders or attackers who already hold a foothold on the server, and only version 12.2.1.4.0 is listed as affected; no public exploit code exists and there is no CISA KEV entry, so the status is no public exploit identified at time of analysis.
Local low-privilege users with a logon to the infrastructure hosting Oracle HTTP Server 12.2.1.4.0 can exploit the OSSL module to take full control of the HTTP Server, with high confidentiality, integrity, and availability impact. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) confirms the attack is local, requires an authenticated low-privileged account, needs no user interaction, and has low complexity once that access exists. No public exploit identified at time of analysis, and no confirmed active exploitation was provided in the intelligence.
Takeover of Oracle Outside In Technology 8.5.8 is possible for an attacker who already has a local logon on the host running the Outside In Clean Content SDK, with high confidentiality, integrity, and availability impact and no additional authentication or user interaction required. The flaw is rated CVSS 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and no public exploit was identified at time of analysis; risk is concentrated where untrusted documents reach the Clean Content SDK on multi-user or otherwise locally exposed hosts.
Oracle Solaris 11.3 and 11.4 can be fully taken over by an attacker who can already log on to the host, through a flaw in the operating system's 'Utility' component. Exploitation yields high confidentiality, integrity and availability impact - effectively a complete loss of control of the Solaris system - but it requires a local foothold: the CVSS vector is AV:L, and our assessed vector (PR:L) indicates at least a low-privileged local account is needed, contrary to Oracle's PR:N labelling. No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV; with low attack complexity and no user interaction, however, the step from local access to full compromise is short.
Local privilege escalation in Oracle JD Edwards EnterpriseOne Tools (Installation Security component, versions 9.2.0.0 through 9.2.26.5) allows an attacker holding low-privileged logon access on the application host to take over the product, with high confidentiality, integrity, and availability impact (CVSS 7.8). Exploitation is not remote: it requires a local foothold and valid low-privileged credentials on the infrastructure where EnterpriseOne Tools runs, so the practical exposure is insider threat and post-exploitation escalation rather than an internet-facing emergency. No public exploit code has been identified at time of analysis.
A high-severity local privilege escalation and takeover flaw exists in the Installation Security component of Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.5). An attacker who already holds interactive logon access to the host running EnterpriseOne Tools and low-level credentials can exploit the component to gain full control of the application, with complete confidentiality, integrity, and availability impact (CVSS 3.1 base 7.8, AV:L/PR:L/AC:L/UI:N). No public exploit code or confirmed active exploitation was identified at time of analysis, and the requirement for pre-existing local access plus valid credentials is the primary limiting factor on real-world risk.
High-privileged authenticated attackers can take over Oracle iProcurement 12.2.3 through 12.2.15 by sending crafted HTTP requests to the E-Content Manager Catalog component. The flaw is rated CVSS 7.2 with high confidentiality, integrity, and availability impact, but the PR:H vector means an attacker must already hold an elevated account on the E-Business Suite instance. No public exploit identified at time of analysis, and no KEV entry is provided.
Local privilege escalation in the Oracle Solaris 11.4 kernel lets an attacker who already holds a low-privileged logon on the host elevate to full control, compromising confidentiality, integrity, and availability. The flaw is local-only (AV:L) and requires a valid account (PR:L), but needs no user interaction and is low complexity, so a local user meeting the prerequisite can exploit it reliably. The provided intelligence does not confirm CISA KEV active exploitation or publicly available exploit code, so exploitation status is no public exploit identified at time of analysis.
Low-privileged authenticated attackers with network access can take over Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 through its Adapters component, with CVSS 9.9 and a scope change that can extend impact to connected Oracle products. Exploitation requires only low privileges and no user interaction, though authentication requirements keep fully unauthenticated attacks out of scope; no public exploit code or CISA KEV entry was identified at time of analysis. This is a high-priority issue because the Adapters interface is often network-exposed and the scope change can amplify a single compromise across integrated middleware.
Takeover of the Oracle EDI Gateway component in Oracle E-Business Suite 12.2.3 through 12.2.15 is possible for a high-privileged attacker who can reach the application over HTTP, with full confidentiality, integrity, and availability impact (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The critical qualifier is the PR:H prerequisite: the attacker must already hold an elevated EDI Gateway account, so this is not exploitable by unauthenticated or low-privileged users and realistic exposure is confined to trusted operators or adversaries who have already stolen such credentials. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied in the source data.