Privilege Escalation

CVE-2026-12793 Sep 16, 03:28 CRITICAL Act Now

We need answer as JSON only. Need synthesize. Need obey precision rules. Let's parse input. CVE-2026-12793. Product: JetFormBuilder - Dynamic Blocks Form Builder plugin for WordPress. Vulnerability Privilege Escalation up to 3.6.2. Due to not validating submitted form ID belongs to JetFormBuilder form before parsing referenced post's content as form schema and executing Advanced Validation server-side callback. Unauthenticated attackers can create new administrator-level user account. CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE-269 improper privilege management. Reported by Wordfence. CPE cpe:2.3:a:jetmonsters:jetformbuilder_—_dynamic_blocks_form_builder:*:*:*:*:*:*:*:* (weird underscores en dash). Tags: WordPress, Privilege Escalation, Jetformbuilder Dynamic Blocks Form Builder. References: wordfence threat intel, trac changeset 3575346/jetformbuilder. Need output fields. Important: product_name 1-3 words. Could be "JetFormBuilder" or "JetFormBuilder Dynamic Blocks Form Builder"? 1-3 words only. Product name maybe "JetFormBuilder" or "JetFormBuilder Dynamic Blocks"? Let's choose "JetFormBuilder" (one word? Actually JetFormBuilder). It is plugin. Specific product or service. "JetFormBuilder" = 1 word, okay. But CPE product includes jetformbuilder_—_dynamic_blocks_form_builder. Product_name can be JetFormBuilder. summary: 2-3 sentences, original, not copy. Start impact verb and product. Need include actively exploited? KEV absent; POC absent. EPSS absent. Say "Privilege escalation in JetFormBuilder plugin for WordPress up to 3.6.2 permits unauthenticated attackers to create administrator-level accounts by abusing Advanced Validation callbacks with an attacker-supplied form ID." Need mention no known active exploitation? Could include "No KEV or public exploit identified." Maybe. Need not start "A vulnerability". Start "Unauthenticated privilege escalation in JetFormBuilder..." Good. technical_context: Explain underlying technology: WordPress plugin dynamic

Privilege escalation in the HPE Networking EdgeConnect SD-WAN Orchestrator API lets an attacker who already holds a low-privilege account elevate to root and run arbitrary operating-system commands on the appliance. The flaw is remotely reachable (AV:N) but requires authentication plus a high-complexity exploitation path per the assigned CVSS vector (7.5, AC:H, PR:L). No public exploit code or CISA KEV entry was present in the supplied intelligence, so this is currently a post-authentication hardening priority rather than an actively exploited zero-day.

Low-privilege authenticated attackers can escalate to root on HPE Networking EdgeConnect SD-WAN Gateways by abusing an API endpoint, gaining the ability to run arbitrary operating-system commands. The flaw carries a CVSS base score of 8.8 (AV:N/AC:L/PR:L/UI:N), meaning the attacker needs only valid low-privileged credentials and network reachability to the management API — no user interaction is required. Affected branches span EdgeConnect SD-WAN Gateways 9.4.x through 9.7.0.0; no public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis.

Privilege escalation in the EdgeConnect SD-WAN Gateway API lets a remote, authenticated low-privileged user gain administrative rights on the web-management interface, resulting in complete compromise of the gateway (CVSS 8.8, AV:N/PR:L). Affected branches are 9.4.0.0–9.4.8.2, 9.5.0.0–9.5.8.1, 9.6.0.0–9.6.3.1, and 9.7.0.0. No public exploit code, EPSS score, or CISA KEV listing was provided at time of analysis; exploitation requires a valid low-privileged account and reachability of the management API.

We need answer JSON only. Need synthesize. Need parse input. CVE-2026-76670. Description: Privilege escalation vulnerabilities exist in API of HPE Networking EdgeConnect SD-WAN Orchestrator. Successful exploitation could allow remote low-privileged authenticated user to escalate privileges to administrative user, leading to complete system compromise. CVSS 9.9 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. CWE N/A. Reported HPE. Tags: Privilege Escalation. ENISA affected versions listed Gateway versions? But product says Orchestrator? Need careful. Affected versions EUVD: EdgeConnect SD-WAN Gateways 9.7.0 ≤9.7.0 etc. Hmm CVE description says Orchestrator. Maybe affected versions are gateways? Need not copy exactly? Need product_name 1-3 words. Could be "HPE EdgeConnect SD-WAN Orchestrator" maybe 4 words? Need specific product. Product name: "HPE EdgeConnect SD-WAN Orchestrator" is 4? HPE is vendor but part. Maybe "EdgeConnect SD-WAN Orchestrator" = 3 words? Actually "EdgeConnect", "SD-WAN", "Orchestrator" = 3. Good. Need fields plain strings. Summary original, not copy. Mention not actively exploited? KEV absent. POC absent. EPSS absent? Input no EPSS. We can mention no public exploit identified. CVSS 9.9 critical, low-privileged authenticated remote, scope changed. Need use all data. Technical context: API of SD-WAN orchestrator, privilege escalation, CWE missing. Use CPE? None given. Affected products from EUVD: Gateways versions; but description says Orchestrator. We must flag discrepancy? Confidence notes perhaps: EUVD affected product names/versions list EdgeConnect SD-WAN Gateways not Orchestrator; likely vendor advisory refers to same ecosystem? Need state. Product name primary should be Orchestrator due CVE description. Affected products should include versions from EUVD but note product name mismatch maybe. Need avoid bullet points. Need every field plain text string. Data_quality_flags array of objects. We can emit? There is possible wrong_product? Tags only Privi

We need answer as JSON. Need follow all instructions. We have CVE-2026-76669 description: Privilege escalation vulnerabilities in API of HPE Networking EdgeConnect SD-WAN Orchestrator. Successful exploitation could allow remote low-privileged authenticated user to escalate to administrative, complete system compromise. CVSS 9.9 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. CWE N/A. Reported HPE. Tags Privilege Escalation. EUVD ID. Affected versions EUVD list: EdgeConnect SD-WAN Gateways 9.5.0 ≤9.5.8, 9.6.0 ≤9.6.3, 9.4.0 ≤9.4.10, 9.7.0 ≤9.7.0. References HPE support doc. Need synthesize. Fields plain strings. Need product_name: 1-3 words. HPE EdgeConnect SD-WAN Orchestrator? But affected versions say EdgeConnect SD-WAN Gateways. Product likely HPE Networking EdgeConnect SD-WAN Orchestrator. Primary product name: "EdgeConnect SD-WAN Orchestrator"? 3 words maybe "HPE EdgeConnect Orchestrator" but actual product. Use "EdgeConnect SD-WAN Orchestrator" 3 words? "EdgeConnect SD-WAN Orchestrator" is 3 tokens? EdgeConnect, SD-WAN, Orchestrator = 3. Good. Summary: original synthesis. Start with impact verb and product. Mention privilege escalation in API, remote low-priv authenticated to admin, complete compromise. Mention CVSS 9.9, EPSS? no EPSS/KEV/POC in input. KEV absent. So no public exploit identified. Use "No public exploit or KEV listing provided". Need not copy description. Summary 2-3 sentences. "Privilege escalation in the HPE Networking EdgeConnect SD-WAN Orchestrator API allows remote low-privileged authenticated users to gain administrative privileges and fully compromise the system. Affected versions include EdgeConnect SD-WAN Gateways 9.4.0 through 9.4.10, 9.5.0 through 9.5.8, 9.6.0 through 9.6.3, and 9.7.0. CVSS 9.9 reflects network attack and high impact; no EPSS, KEV, or public exploit data accompanies this advisory." Technical context: underlying API, privilege escalation, CWE N/A. CPE data? not given except EUVD affected. Need reference exact affected products.

CVE-2026-82310 Sep 15, 19:56 CRITICAL Act Now

Deactivated user accounts in the Apache Airflow FAB auth provider (apache-airflow-providers-fab 2.0.0 before 3.9.0) keep working through the Airflow 3 Core API: the password login path correctly rejects a disabled account, but any JWT access token issued before deactivation is still accepted and can be exchanged for a fresh token indefinitely. The result is that an administrative deactivation — typically performed as a containment action against a departing employee or compromised account — silently fails, leaving the account with its original role-scoped access to the Airflow control plane. No signature forgery or privilege escalation is involved; the holder simply replays their own still-valid credential. The issue is rated moderate by the project, with no CVSS vector, CWE, EPSS score, KEV entry, or public exploit code supplied in the available intelligence, and remediation is available in version 3.9.0.

Local privilege escalation in the Android kernel's Arm SMMUv3 driver (arm-smmu-v3.c) allows an attacker holding a low-privileged local context to subvert the IOMMU's protection mechanism and reach kernel-level access on a vulnerable device. The flaw is a logic error affecting multiple functions of the driver, rated CVSS 7.8 with a local attack vector, low privileges, and no user interaction required. Google ships the fix in the September 2026 Pixel/Android security bulletin; no CISA KEV listing and no public exploit code were identified at the time of analysis.

CVE-2026-58744 Sep 15, 18:34 HIGH This Week

Improper input validation in multiple locations of the Android kernel allows a locally installed application to escalate privileges on affected Pixel and Android devices, with no additional execution privileges or user interaction required. The flaw is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting a local attacker who already holds low-privileged code execution but can reach high-integrity kernel operations. It is addressed in the September 2026 Android/Pixel security bulletin; at time of analysis there is no CISA KEV listing, no confirmed public exploit code, and no EPSS signal was supplied with the source data.

An out-of-bounds write reachable through a race condition in google_mba_recv_msg() in google_mba_poll.c allows a locally installed low-privilege application on an affected Android device to corrupt kernel memory and escalate to system/kernel privileges. Rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N), the flaw requires no user interaction but does need the attacker to already run code on the device and to win a timing window, which keeps it materially below a remote, unauthenticated severity. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis; no EPSS score was supplied in the source data.

Memory corruption in the ARM64 TLB-invalidation path of the Android kernel allows a local attacker holding low privileges to win a race condition and escalate to kernel/root privileges, with no user interaction and no additional execution privileges required. Affected builds are Google Android (CPE cpe:2.3:a:google:android:*:*:*:*:*:*:*:*), specifically ARM64 devices; Google's September 2026 Pixel security bulletin is the vendor reference for the fix. No EPSS score, CISA KEV listing, or public proof-of-concept was present in the supplied intelligence, so active exploitation is unconfirmed and no public exploit code has been identified at time of analysis.

Let me build the JSON. CVE-2026-58724: Android kernel use-after-free due to race condition, local EoP requiring System execution privileges, no UI. CVSS 7.0 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. Reported by Google Devices. CPE: google:android. Tags: Privilege Escalation, Google, Race Condition. Reference: Android security bulletin September 2026 Pixel. Note: "System execution privileges needed" — this is Android bulletin phrasing meaning the attacker needs System-level privileges already... Actually in Android bulletins, "System execution privileges needed" means the vulnerability requires the attacker to already have System privileges? Hmm, actually Android bulletin says "This could lead to local escalation of privilege with System execution privileges needed" — meaning the attacker needs System execution privileges? Historically it means exploitation requires the attacker to run code with System privileges already... Actually it means the vulnerability can lead to local escalation of privilege with System execution privileges needed — i.e., it requires System-level privileges to exploit. That means privilege escalation from System to... hmm, in Android, "System" is a UID (system uid 1000). So it escalates to kernel. Actually "with System execution privileges needed" means the attacker must already have System privileges. CVSS PR:L is consistent-ish. Actually PR:L. Hmm but if System privileges needed, PR:H might be more apt. Given CVSS says PR:L, I'll assess PR:L... Hmm. My own assessment: AV:L/AC:H/PR:H? Let me think. The Android phrasing "System execution privileges needed" — needed to exploit — implies significant privileges already (system UID, not just any app). That's PR:H arguably. But CVSS gives PR:L. I'll go with PR:H? Let's be careful — I should ground my assessment in the description. The description says "with System execution privileges needed" — this means the exploit requires system-level privileges. So PR:H is honest. But the vendor's own CVSS says

CVE-2026-58704 Sep 15, 18:34 HIGH This Week

A permission bypass in the Android Cellular Modem (baseband) component lets an attacker who is within radio range of the device escalate privileges inside the modem context, exposing confidentiality, integrity and availability of device data with no user interaction. Exploitation requires the attacker to already hold low-level privileges on the modem interface (CVSS PR:L) and to be network-adjacent (AV:A), which in practice points to a rogue or compromised cellular base station rather than an internet-based attacker. The flaw stems from a logic error in permission checking rather than a memory-safety bug, and at time of analysis there is no public exploit code and no CISA KEV listing, though the vendor has published a fix in the September 2026 Pixel security bulletin that should be treated as authoritative.

A race condition in the trusty_dputc() debug output path of generic-arm64-smcall.c in the Android kernel allows an out-of-bounds write that can be leveraged for local privilege escalation. The flaw is only reachable by a process already running with System execution privileges, and exploitation requires winning a timing window (AC:H, PR:L), with no user interaction. Impact is high across confidentiality, integrity and availability because the corrupted memory is kernel/secure-monitor adjacent, but no public exploit code or in-the-wild exploitation is known from the available intelligence.

An out-of-bounds write in the NXP NFC hardware abstraction layer (phNxpNciHal_ext_process_nfc_init_rsp in phNxpNciHal_ext.cc) lets a local attacker corrupt memory beyond the intended buffer while the HAL processes an NFC initialization response. Affected are Android devices that ship the NXP NFC HAL, which the Android CPE lists without a version bound; the flaw requires no user interaction and, per Google's bulletin wording, no additional execution privileges, so a typical app-level foothold is enough to attempt escalation. There is no CISA KEV listing and no public exploit code reported in the supplied intelligence, so exploitation is assessed as feasible but not yet observed.

An out-of-bounds write in Av1DecodeFrameTag (vp9hwd_headers.cc) in the Android media decoding stack allows crafted AV1/VP9 media content to corrupt memory and potentially achieve remote code execution in the codec process, which runs with elevated system privileges relative to a normal app. Google's Pixel security bulletin dated 2026-09-01 lists the fix, and no user interaction is required, though the provided CVSS vector (PR:L) implies the attacker must already be able to route content into the decoder path. No EPSS score, CISA KEV entry, or public exploit code was supplied with this record, so active exploitation is unconfirmed.

Local privilege escalation in Google Android's VPU (Video Processing Unit) driver lets an unprivileged app trigger an out-of-bounds write through a confused-deputy path, corrupting kernel memory and gaining root-level code execution on the device. Per the CVSS vector, the attacker must already hold local code execution (PR:L) but needs no user interaction, and the September 2026 Pixel/Android Security Bulletin confirms a vendor fix. No public exploit code or CISA KEV activity has been identified at time of analysis.

An out-of-bounds write in ReadTileInfo of vp9hwd_headers.cc lets a crafted VP9 bitstream corrupt memory inside Android's VP9 hardware-decoder header parser, which Google rates as remote escalation of privilege with no additional execution privileges and no user interaction required. Affected builds are those tracked under the Google Android CPE and addressed by the Android/Pixel security bulletin dated 2026-09-01. There is no CISA KEV listing and no public exploit code identified at time of analysis, so this is currently a patch-window issue rather than a confirmed in-the-wild campaign.

An integer overflow in the Android VPU (video processing unit) driver's size handling leads to an out-of-bounds write in kernel memory, allowing a locally installed application to escalate privileges to kernel/system level on affected Pixel devices. Exploitation requires only local low-privileged access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) and no user interaction, making it attractive for a malicious or trojanized app. No public exploit code or CISA KEV listing was identified at time of analysis, and the EPSS signal is not provided; the vulnerability is addressed in the September 2026 Android/Pixel security bulletin.

Local privilege escalation in the Android kernel's fingerprint (gf) driver allows a process with access to the fingerprint device interface to corrupt kernel heap memory and gain root-level code execution. The flaw is a heap-based out-of-bounds write in gf_base_update_finger_base() within gf_base.c, exploitable with a low-privileged local context and no user interaction, consistent with a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N). Fixes are delivered through the Android/Pixel Security Bulletin dated 2026-09-01; no public exploit code or CISA KEV listing was identified at time of analysis.

Remote exploitation of the cellular modem stack in Google Android devices allows an attacker who controls the radio path to trigger a heap-based out-of-bounds write and escalate privileges on the handset, without any user interaction. The supplied CVSS 3.1 base score of 8.8 reflects high confidentiality, integrity and availability impact, but its PR:L metric (low privileges required) conflicts with the vendor description stating that no additional execution privileges are needed. No public exploit code, EPSS score, or CISA KEV entry was included in the intelligence feed, so active exploitation is unconfirmed at the time of analysis.

An out-of-bounds write in the Goodix fingerprint trusted-application test handler (gf_ta_test_set_config in gf_ta_test.c) on Android allows a locally installed application holding low privileges to corrupt memory and escalate to kernel-level privileges without any user interaction. The flaw stems from improper validation of caller-supplied input reaching a memory-write path inside the fingerprint TA interface. Google addressed it in the Pixel security bulletin dated 2026-09-01; no public exploit code or CISA KEV entry was identified at time of analysis.

An out-of-bounds write in Android's VP9 hardware decoder (Vp9DecodeFrameTag in vp9hwd_headers.cc) lets a crafted VP9 video stream corrupt memory in the codec context, giving an attacker code execution at the decoder's privilege level. Affected devices are those running Android builds that include the vulnerable VP9 hardware decoding path prior to the September 2026 Pixel security bulletin fix. No public exploit code or CISA KEV entry was identified at time of analysis, so exploitation appears to require a motivated actor with a delivery path for malicious media.

CVE-2026-92180 Sep 15, 18:05 HIGH This Week

Local privilege escalation in pdfforge PDF Architect allows an attacker who already holds low-privileged code execution on a Windows host to hijack a library loaded by the product's activation-service (Update Service) process and run code as SYSTEM. The flaw is an uncontrolled search path element (CWE-427) in which the service resolves a DLL from a location an unprivileged user can write to, so no remote vector or user interaction is required once the foothold exists. It was reported through Trend Micro's Zero Day Initiative as ZDI-CAN-29536 / ZDI-26-615; no public exploit code, EPSS telemetry, or CISA KEV entry is present in the supplied data.

CVE-2026-40058 Sep 15, 17:47 HIGH PATCH This Week

Local privilege escalation in the CrowdStrike Falcon sensor for Windows occurs when the Microsoft Office File Malicious Macro Removal policy setting is enabled, letting an unprivileged process race the sensor's macro-cleanup file operation (CWE-367) and write arbitrary files to protected locations, ultimately reaching SYSTEM-level privileges. Affected builds are the Falcon sensor for Windows at 7.34 and above, the 7.32 LTS line, and 7.16 on Windows 7/2008 R2; the CrowdStrike Laroux Malware Cleanup Tool is also affected, while Mac, Linux, and Legacy sensor platforms are not. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, though the CVSS 3.1 base score is 8.8.

CVE-2026-65831 Sep 15, 15:18 HIGH PATCH This Week

Authenticated users holding only read-only (reader) privileges on an ArcadeDB database can escalate to arbitrary JVM scripting by POSTing a {"language":"js"} command to /api/v1/command/{database}, because the polyglot query engine never applies the database-administrator authorization check enforced on the SQL/Cypher paths. A cooperating sandbox flaw lets those scripts reflect from the bound database object through database.getClass().getClassLoader().loadClass to classes outside the allowedPackages whitelist, allowing an attacker to read arbitrary host files such as /etc/passwd and configuration files outside the database scope. Process creation remains blocked, so OS command execution is not confirmed; exploitation needs valid credentials and no user interaction, the flaw is fixed in ArcadeDB 26.7.1, and no public exploit code or CISA KEV entry was identified at time of analysis.

CVE-2026-16140 Sep 15, 13:57 HIGH This Week

Privilege escalation in OpenBMC's phosphor-net-ipmid IPMI stack allows an attacker who already holds a valid low-privileged IPMI session to redirect that session's authorization context to a different, higher-privileged account while the original integrity and encryption keys stay in place, so no re-authentication ever occurs. Downstream vendors that package phosphor-net-ipmid — NVIDIA and H3C among them — inherit the flaw in their BMC firmware. Rated CVSS 8.8 with high confidentiality, integrity and availability impact; no public exploit code identified at time of analysis, and the issue is not listed in CISA KEV.

CVE-2026-14805 Sep 15, 13:16 HIGH This Week

Authenticated privilege escalation in the Consulting WordPress theme (versions up to and including 6.7.16) lets any subscriber-level user take over a site as administrator by chaining two coding flaws. The theme's masterstudy_ms_stm_set_discard_transient AJAX action writes an attacker-chosen transient value without any capability check or nonce, and the theme's "developer access" login path trusts a transient value in legacy string mode, so an attacker can seed a known token and then log in as any existing account, including an admin. The CVSS score is 8.8 (network, low privileges, no user interaction, full confidentiality/integrity/availability impact); no EPSS score, KEV listing, or public exploit code was provided at time of analysis.

CVE-2026-92073 Sep 15, 12:34 HIGH This Week

Improper privilege management in Mozilla Firefox's Enterprise Policies component lets a remote attacker escalate privileges inside the browser after convincing a user to interact with malicious content (CVSS 8.8, AV:N/AC:L/PR:N/UI:R). Successful exploitation yields high confidentiality, integrity and availability impact across the browser's security boundary, although CISA's SSVC assessment rates the flaw as not automatable and with no known exploitation. Fixes ship in Firefox 156 and Firefox ESR 153.3; no public exploit code or KEV listing has been identified at time of analysis.

CVE-2026-92062 Sep 15, 12:34 HIGH This Week

Privilege escalation in Mozilla Firefox's Session Restore component (CWE-269) allows an attacker who lures a user into viewing crafted content to escape the normal browser security boundary and obtain elevated privileges inside the browser process. The issue is fixed in Firefox 156 and Firefox ESR 153.3, and the 8.8 rating reflects a network-delivered, unauthenticated attack that nonetheless requires victim interaction. No public exploit code or CISA KEV entry has been identified at time of analysis, so this is currently a patch-now flaw rather than a confirmed in-the-wild campaign.

CVE-2026-92055 Sep 15, 12:34 HIGH This Week

Privilege escalation in the Mozilla Firefox DevTools component allows code running in a lower-privileged context to cross the DevTools/chrome privilege boundary and execute with elevated browser privileges; Firefox 156 and Firefox ESR 153.3 contain the fix. The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and classified CWE-269 (Improper Privilege Management), but CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and no public exploit code or KEV listing was observed at time of analysis. Notably, the network attack vector with user interaction suggests a page-delivered trigger rather than purely local DevTools misuse, though the advisory itself is terse.

CVE-2026-92054 Sep 15, 12:34 HIGH This Week

Memory-corruption privilege escalation in Mozilla Firefox lets a remote attacker achieve arbitrary code execution at elevated privilege when a victim browses attacker-controlled web content — no account or credentials are required, but the CVSS vector (UI:R) confirms the victim must open the page. Mozilla fixed the flaw in Firefox 156 and Firefox ESR 153.3. No public exploit code and no CISA KEV listing were identified at time of analysis, and CISA's SSVC decision points rate exploitation as 'none' and automatable as 'no', so worm-like or mass-scanning abuse is not currently anticipated.

CVE-2026-92053 Sep 15, 12:34 HIGH This Week

A privilege-escalation flaw in Mozilla Firefox's Graphics: CanvasWebGL component lets attacker-supplied web content cross a privilege boundary inside the browser, with high confidentiality, integrity and availability impact. The issue affects Firefox builds prior to 156 and Firefox ESR prior to 153.3, and exploitation requires the victim to load attacker-controlled content (UI:R) but no authentication (PR:N). No public exploit code has been identified and CISA's SSVC assessment records exploitation as 'none', so this is a patch-promptly issue rather than an emergency; the vendor has shipped fixed builds.

CVE-2026-92052 Sep 15, 12:34 HIGH This Week

Privilege escalation in Mozilla Firefox affects all builds prior to Firefox 156 and Firefox ESR 153.3, stemming from use of uninitialized memory inside the Graphics: CanvasWebGL component. A remote attacker who gets a victim to render crafted WebGL canvas content can corrupt memory in the graphics path and potentially escalate privileges or execute arbitrary code in the browser's context — the CVSS vector confirms no authentication is required (PR:N) but user interaction is (UI:R). No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; Mozilla shipped fixes in Firefox 156 and Firefox ESR 153.3 per advisories MFSA2026-90 and MFSA2026-93.

CVE-2026-92047 Sep 15, 12:34 HIGH This Week

A privilege-escalation flaw in Firefox's Crash Reporting component lets an attacker who can influence crash-report handling gain elevated privileges on the affected host, potentially leading to full compromise of confidentiality, integrity and availability. Exploitation is unauthenticated at the network layer (PR:N) but requires victim interaction (UI:R), and affects Firefox builds prior to 156 and Firefox ESR prior to 153.3. There is no public exploit identified at time of analysis, CISA KEV does not list this CVE, and CISA's SSVC framework rates exploitation as 'none' with automatable 'no', indicating a serious but not currently weaponized issue.

CVE-2026-92043 Sep 15, 12:34 HIGH This Week

A memory-safety flaw in Firefox's Audio/Video component - a classic out-of-bounds write/overflow class issue caused by incorrect boundary checking - lets an attacker who convinces a user to open a crafted page or media file corrupt memory and escalate privileges to the level the browser process runs at. The issue affects Firefox branches prior to 156 and Firefox ESR prior to 153.3, and is reachable without authentication but requires user interaction. Mozilla has released fixed builds (Firefox 156, Firefox ESR 153.3) via advisories MFSA2026-90 and MFSA2026-93; there is no public exploit identified at time of analysis and CISA SSVC records exploitation as 'none'.

CVE-2026-92033 Sep 15, 12:33 HIGH This Week

Privilege escalation in Mozilla Firefox for Android allows an attacker who can get a user to open a crafted web page to gain privileges beyond those normally granted to web content, with high impact to confidentiality, integrity, and availability. Mozilla fixed the flaw in Firefox 156; no public exploit code and no active exploitation have been identified, and CISA's SSVC assessment rates exploitation as 'none' with automatable 'no'. The 8.8 CVSS score is driven entirely by a network attack vector plus required user interaction (UI:R), so real-world risk depends on convincing a target to browse attacker-controlled content rather than on mass scanning.

CVE-2026-92020 Sep 15, 12:33 HIGH This Week

An incorrect-bounds condition in Firefox's WebRender graphics component lets crafted web content corrupt memory inside the browser, giving the attacker a path to code execution and privilege escalation on the affected system. All Firefox releases before 156 are affected, along with the ESR branches before 115.41, 140.16, and 153.3; exploitation requires the victim to load attacker-influenced content (CVSS UI:R), and no public exploit code or CISA KEV entry has been recorded at time of analysis. With a CVSS base of 8.8 across full confidentiality, integrity, and availability impact, this is a high-severity browser flaw that should be patched on a normal browser-update cadence.

CVE-2026-92017 Sep 15, 12:33 HIGH This Week

Privilege escalation in Mozilla Firefox's DOM: Service Workers component lets attacker-supplied web content break out of its intended privilege boundary and gain elevated capabilities inside the browser. The flaw affects Firefox before 156 and the ESR branches before 115.41, 140.16, and 153.3, and carries a CVSS base score of 8.8 with a user-interaction requirement (the victim must load attacker-controlled content). No public exploit code has been identified and CISA's SSVC assessment records exploitation as 'none' with 'automatable: no', so this is a high-severity patch-now issue rather than a known exploited threat.

CVE-2026-92015 Sep 15, 12:33 HIGH This Week

Let me synthesize. CVE-2026-92015 — privilege escalation in Firefox WebExtensions. CVSS 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. CWE-269 improper privilege management. Fixed in Firefox 156, ESR 115.41, ESR 140.16, ESR 153.3. SSVC: exploitation none, automatable no, technical impact total. No KEV, no POC mentioned. Product name: "Firefox WebExtensions" — 1-3 words. Maybe "Mozilla Firefox" is safest but the specific component is WebExtensions. Let's use "Firefox WebExtensions". Hmm, guidance says product name 1-3 words, specific product. "Firefox WebExtensions" works. Summary: must not start with "A vulnerability". Start with impact verb + product. "Privilege escalation in Mozilla Firefox's WebExtensions component allows ..." Requires UI:R, so user interaction — a user must visit a page or install an extension? Description is vague. CVSS says AV:N/PR:N/UI:R. So an attacker could get a user to interact (e.g., install malicious extension or visit a page) which then allows privilege escalation from extension context to higher privileges (browser-level / OS-level?). CWE-269 improper privilege management. Be careful: we don't know exact mechanism beyond "privilege escalation in WebExtensions component". Confidence notes should state that the root cause mechanism is not described publicly beyond CWE-269; Bugzilla bug 2060235 is likely restricted. Affected products: Firefox < 156, ESR < 115.41, ESR < 140.16, ESR < 153.3. CPE cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*. Advisories mfsa2026-90 through -93. Remediation: upgrade to Firefox 156, ESR 115.41, ESR 140.16, ESR 153.3. Workarounds: restrict extension installation via enterprise policy (ExtensionSettings / blocked_install_message), disable WebExtensions? Not feasible. Mention that extension installation restrictions reduce exposure; trade-off: blocks all extension installs including legitimate ones. Prevalence: Firefox is widely deployed → high. Maybe "high" — ubiquitous is for OpenSSL/nginx/Linux kernel. Firefox

CVE-2026-92014 Sep 15, 12:33 HIGH This Week

Incorrect boundary conditions in Firefox's Graphics component allow a privilege escalation that was fixed in Firefox ESR 115.41 and Firefox ESR 140.16. An attacker who can get a victim to load crafted content — a web page or similar rendered surface — can trigger a buffer overflow (CWE-120) in the graphics pipeline and potentially cross from the low-privilege content process into a more privileged browser context, yielding high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and CISA SSVC records exploitation status as 'none', though the CVSS base score of 8.8 and the total technical impact rating make patching a priority for any organization running an unpatched ESR branch.

CVE-2026-92013 Sep 15, 12:33 HIGH This Week

Privilege escalation in Mozilla Firefox's Graphics: CanvasWebGL component lets a crafted web page corrupt memory and gain privileges beyond those normally granted to web content. Exploitation requires the victim to open a malicious page in an affected Firefox build (network vector, no authentication, user interaction required), after which an attacker can achieve high confidentiality, integrity and availability impact. Mozilla fixed the flaw in Firefox 156, Firefox ESR 115.41, ESR 140.16 and ESR 153.3; CISA SSVC records no known exploitation and the issue is not considered automatable, and no public exploit code has been identified at time of analysis.

CVE-2026-92012 Sep 15, 12:33 HIGH This Week

A boundary-condition error in Firefox's Graphics: CanvasWebGL component allows an attacker who lures a victim to a crafted web page to corrupt memory and escalate privileges, with a CVSS base score of 8.8 reflecting high confidentiality, integrity, and availability impact. The flaw is a classic buffer overflow (CWE-120) in the WebGL/Canvas rendering path, reachable over the network with no authentication but requiring user interaction (UI:R) in the form of visiting attacker-controlled content. Mozilla has shipped fixes in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3, and no public exploit code or active exploitation has been identified at time of analysis.

CVE-2026-92011 Sep 15, 12:33 HIGH This Week

A memory-corruption flaw in Mozilla Firefox's CanvasWebGL graphics component (incorrect boundary conditions, CWE-120) allows a remote attacker to crash or corrupt the browser's heap and potentially escalate privileges beyond the normal content-process security boundary. Every Firefox release before 156 and every ESR branch before 115.41, 140.16, and 153.3 is affected, and exploitation requires the victim to load attacker-controlled web content (CVSS 8.8, AV:N/AC:L/PR:N/UI:R). No public exploit code and no active exploitation are reported at time of analysis — CISA's SSVC records Exploitation: none and Automatable: no, so this is a patch-priority issue rather than an emergency.

CVE-2026-92010 Sep 15, 12:33 HIGH This Week

Memory corruption in Mozilla Firefox's Graphics: CanvasWebGL component lets a web page that renders attacker-crafted WebGL content corrupt memory and escalate out of the browser's restricted process, yielding code execution at higher privilege. All Firefox builds before 156 are affected, with ESR branches fixed in 115.41, 140.16, and 153.3. No public exploit code exists and CISA SSVC records exploitation as 'none', so this is a high-severity patch-now bug rather than an active campaign.

CVE-2026-92009 Sep 15, 12:33 HIGH This Week

An out-of-bounds write in Firefox's Graphics: CanvasWebGL component lets a malicious web page corrupt memory and gain elevated privileges on the host, affecting Firefox builds prior to 156 and the ESR branches prior to 115.41, 140.16, and 153.3. Exploitation is remote but requires the victim to load attacker-controlled WebGL/Canvas content (CVSS UI:R), so it is not automatable and no public exploit code or active exploitation has been identified at time of analysis. Mozilla rated it High (CVSS 8.8) with total technical impact under CISA's SSVC framework.

CVE-2026-92008 Sep 15, 12:33 HIGH This Week

Incorrect boundary conditions in Firefox's Graphics: CanvasWebGL component allow a remote attacker who convinces a user to open a crafted page to corrupt memory and achieve code execution with the privileges of the browser. The flaw is a classic buffer overflow (CWE-120) rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R), meaning no authentication is needed but the victim must load attacker-controlled content. Mozilla fixed it in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3; no public exploit code has been identified and CISA's SSVC assessment records no active exploitation.

CVE-2026-92007 Sep 15, 12:33 HIGH This Week

Privilege escalation in Mozilla Firefox's Graphics: CanvasWebGL component lets a remote, unauthenticated attacker corrupt memory via malformed WebGL content and gain elevated code execution inside the browser process, provided the victim loads an attacker-controlled page. Mozilla shipped fixes in Firefox 156, Firefox ESR 115.41, ESR 140.16, and ESR 153.3 (mfsa2026-90 through mfsa2026-93). CVSS is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), CISA SSVC records Exploitation: none and Automatable: no, no CISA KEV listing is present, and no public exploit code has been identified at time of analysis.

CVE-2026-92006 Sep 15, 12:33 HIGH This Week

A memory-safety flaw in the Graphics: CanvasWebGL component of Mozilla Firefox allows a crafted web page to corrupt memory and escalate privileges beyond the browser's normal security boundary. Because exploitation only requires the victim to load attacker-controlled WebGL/Canvas content in an unpatched Firefox build, the issue affects all mainstream, ESR 115, ESR 140, and ESR 153 release trains prior to the fixed versions. Mozilla has released Firefox 156, Firefox ESR 115.41, ESR 140.16, and ESR 153.3, and while no public exploit code or CISA KEV entry has been identified at time of analysis, the CWE-120 buffer-condition root cause and CVSS 8.8 rating make prompt patching important.

CVE-2026-76159 Sep 15, 08:49 HIGH This Week

Let me synthesize this. CVE-2026-76159: Duplicati for Windows before v2.4.0.0, incorrect permission assignment (CWE-732) in configuration loader, allows local low-priv attacker to escalate to SYSTEM via attacker-controlled preload.json. Product name: Duplicati. Tags include "Microsoft" which is likely a mislabeled tag — Duplicati is an independent open-source project (duplicati.com), not Microsoft. Though it runs on Windows... The tag "Microsoft" as vendor is wrong. Emit mislabeled_tag with target "Microsoft". Confidence high? Duplicati is an independent open-source backup tool, not Microsoft. Yes, high confidence. Missing tags? Maybe "windows" — since it's Windows-specific. Hmm, missing_tag target "Windows", suggested "windows". That's unambiguously implied ("Duplicati for Windows", MSI installers). Could emit. But careful — is "windows" a valid tag slug in their taxonomy? They said emit only when unambiguously implied. I'll include it with high confidence... Actually risk: their taxonomy may be "Microsoft Windows". Hmm. I'll include it maybe. Let's be a bit conservative but it seems clearly applicable. I'll include "windows" for missing_tag. Hmm, but if the slug doesn't exist it might attach a bad tag. The instructions say suggested is "lowercase hyphenated slug (e.g. target "WordPress", suggested "wordpress")". So "windows" is fine. Also "privilege-escalation" technique tag is already present as "Privilege Escalation". Fine. CVSS given is 4.0 base with E:X etc. Score 7.0. PR:L, AV:L, UI:P. Hmm, why UI:P? Probably because attacker needs to force the app to load the config... The preload.json is attacker-controlled — likely attacker with write access to a directory that gets loaded. Local low-priv attacker writes preload.json, then triggers service restart (UI:P passive — waiting for service restart/admin action). Anyway. My assessed CVSS 3.1: AV:L/AC:L/PR:L/UI:P? Hmm, UI:P isn't valid in 3.1. UI options: N, R. If user interaction required (someone must rest

CVE-2026-75092 Sep 15, 08:23 HIGH This Week

Local privilege escalation in the scan_mysql actor of leapp-repository's leapp-upgrade-el9toel10 package allows code already running as the mysql OS account to obtain root on RHEL hosts during a RHEL 9 to RHEL 10 in-place upgrade. The actor invokes 'mysqld --validate-config' directly as root instead of via the packaged User=mysql systemd unit, so attacker-written persisted state (mysqld-auto.cnf pointing plugin_dir at the mysql-writable /var/lib/mysql) causes a malicious shared object to be dlopen()'d with UID 0 and full capabilities in the unconfined_t SELinux domain. Exploitation is not confirmed in the wild and no public exploit code was identified at time of analysis, but the upstream fix is public (leapp-repository PR 1343 / commit 3e4caff) and the CVSS score is 7.3 with all three impact metrics High.

CVE-2026-75983 Sep 15, 06:07 HIGH This Week

Privilege escalation to full administrator equivalence in the Eventin event management plugin for WordPress allows any authenticated user who controls the user ID 1 account - regardless of their currently assigned role - to bypass every WordPress capability check and achieve remote code execution via the built-in plugin and theme editors. The flaw is rooted in PermissionManager::manage_permissions() unconditionally returning the always-true 'exist' capability primitive for all capability evaluations when the requesting user ID equals 1, granting blanket access to manage_options, edit_plugins, edit_themes, promote_users, and update_core. Exploitation is conditional on user ID 1 having been demoted to a lower-privilege role as a hardening measure; default installations where user ID 1 retains administrator rights are not impacted. No public exploit has been identified at time of analysis.

CVE-2026-19624 Sep 14, 19:19 HIGH PATCH This Week

Local privilege escalation in the NetworkManager-l2tp VPN plugin allows any local user who can create and activate their own L2TP profile to inject a newline into connection properties (vpn.data / vpn.secrets), so the root-running pluto daemon executes an attacker-supplied leftupdown command and yields root on the host. Fedora builds 1.52.0 through 1.52.3 and EPEL builds 1.20.0 through 1.20.23 are affected; fixed versions 1.52.4 and 1.20.24 are published upstream. There is no CISA KEV listing and no public exploit identified at time of analysis, although a public technical writeup of the 'newline to root' technique is referenced and the identical bug class was previously exploited in CVE-2018-10900 (NetworkManager-vpnc).

CVE-2026-73470 Sep 14, 13:18 CRITICAL Act Now

We need answer must be JSON only. Need synthesize. Let's parse CVE. CVE-2026-73470: Apache Syncope improper privilege management. Delegations can be created/updated with Roles not owned by delegating User, or not same Realm subtree under delegation management. Affected versions: 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, 4.1.0-M0 through 4.1.2. Upgrade to 4.0.8 / 4.1.3. CVSS 9.8 network low no priv no user interaction unchanged high all. CWE-269. EPSS 0.48% percentile 40. Tags: Privilege Escalation, Apache. SSVC: exploitation none, automatable yes, technical impact total. EUVD. References Apache list and openwall. Need create fields. product_name: Apache Syncope. summary: start with specific impact verb and product. "Privilege escalation in Apache Syncope 3.0.0-M0 through 4.1.2 allows remote unauthenticated attackers (per CVSS) to create or update delegations with roles outside the delegating user’s ownership or realm subtree, effectively granting unauthorized privileges." Need mention no active exploitation, no POC, EPSS low. But be careful: CVSS PR:N says unauthenticated. Description doesn't mention auth. CVSS vector has PR:N so can state unauthenticated per rule. But is that accurate for Apache Syncope? Delegations likely authenticated? CVSS says unauthenticated. We can mention CVSS indicates no auth required but may conflict? Need risk assessment compare signals. "CVSS vector implies remote unauthenticated exploitation, though delegation creation normally requires an authenticated low-privileged user; verify with vendor." This is important. User says do not present uncertain as confirmed fact. We can state CVSS indicates unauthenticated. Summary: "Privilege escalation in Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 permits creation or modification of delegations with roles that the delegating user does not own or that fall outside the granted realm subtree, allowing unauthorized role assignment. Public CVSS

CVE-2026-21391 Sep 14, 11:18 CRITICAL PATCH Act Now

Authentication bypass via ID Token claim spoofing in Ping Identity PingAM allows a remote attacker to inject or override protected ID Token claims through a well-crafted request. In vulnerable configurations this lets an attacker impersonate other identities or escalate privileges by forging trusted claims that downstream relying parties consume. Ping Identity has released a patch; no public exploit is identified at time of analysis, and CISA SSVC records exploitation status as none.

CVE-2026-12518 Sep 14, 07:27 HIGH POC PATCH This Week

Logitech's Logi Options+ updater service on Windows mishandles service-level privileges (CWE-269), exposing an attack surface that any authenticated local user can abuse to obtain a SYSTEM shell. With a proof-of-concept publicly documented on the amberwolf security blog, the exploitation barrier is minimal for any adversary already present on a Windows endpoint running the software. Organizations with broad Logitech peripheral deployments face meaningful privilege escalation risk if this path is chained with initial access obtained via phishing or credential compromise.

CVE-2026-86406 Sep 13, 06:00 HIGH POC PATCH This Week

Privilege escalation in the User Registration & Membership WordPress plugin (versions 4.4.6 through pre-5.2.8) allows any subscriber-level authenticated user to be granted the WordPress role attached to a paid membership plan without completing payment, by exploiting a missing capability check and absent payment method and plan validation on the purchase endpoint. Where site administrators have configured membership plans mapped to privileged WordPress roles - including administrator - this results in full privilege escalation from subscriber to administrator without financial transaction. A publicly available proof-of-concept exploit from WPScan confirms the attack path is well-documented and reproducible against sites with open user registration.

CVE-2026-80071 Sep 13, 06:00 HIGH POC PATCH This Week

Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.8 allows any authenticated user holding an Author-level role or above to assign themselves an arbitrary WordPress role, including Administrator, resulting in full site takeover. The plugin fails to enforce server-side authorization checks when creating membership plans and when users attach plans to their own accounts, permitting role manipulation that bypasses WordPress's native access-control hierarchy. A publicly available exploit exists via WPScan, and the CVSS 7.2 score understates real-world risk because the provided PR:H metric conflicts with the description's requirement of only Author-level access - a low-privilege role - suggesting a closer real-world base score of approximately 8.8.

CVE-2026-15451 Sep 12, 12:30 HIGH POC This Week

Privilege escalation in the MemberPress Corporate Accounts WordPress plugin (≤1.5.39) allows authenticated subscribers holding a corporate account to create new administrator accounts or hijack existing ones by overwriting their email addresses. The root cause is a mass assignment flaw in the `add_sub_account_user` function, which forwards the raw `userdata` POST array directly to WordPress's `wp_insert_user()` without stripping sensitive keys such as `role` or `ID`. Wordfence reported the vulnerability; a partial patch was released in version 1.5.39, meaning even the latest disclosed version may still be exploitable in some code paths. No public exploit code or CISA KEV listing has been identified at time of analysis.

CVE-2026-87759 Sep 12, 06:16 HIGH PATCH This Week

Privilege escalation in the Add User Autocomplete WordPress plugin before 1.2 allows any authenticated user - including subscribers - to self-assign the administrator role on a WordPress multisite installation by submitting a crafted site-membership invitation request with an attacker-controlled role parameter. The plugin performs no capability check (no `current_user_can()`) and no nonce validation before accepting and creating the invitation, making the attack trivial for any account holder. No public exploit or CISA KEV listing is identified at time of analysis; EPSS sits at 0.13% (3rd percentile), but the low barrier (subscriber-level auth) makes any multisite deployment with this plugin a meaningful lateral escalation risk.

CVE-2026-85681 Sep 12, 06:16 CRITICAL Act Now

Unauthenticated site takeover in the WP Component WordPress plugin through version 2.2.4 stems from an AJAX-style action exposed to logged-out users that performs no capability or nonce validation and blindly writes an attacker-supplied option name and value. Because the handler can overwrite arbitrary wp_options entries, an attacker can flip 'users_can_register' on and set 'default_role' to administrator, then self-register an admin account. Reported by WPScan; carries CVSS 9.8 with EPSS 0.14% (3rd percentile) and no public exploit identified at time of analysis.

CVE-2026-77752 Sep 12, 06:16 HIGH PATCH This Week

Privilege escalation in the Temporary Login Without Password WordPress plugin (versions 1.5 through 1.9.8) allows a site-level administrator on a WordPress multisite network to elevate their own account or grant a newly provisioned temporary login to network super admin status. The missing authorization check in the account-provisioning and account-promotion logic completely bypasses the multisite privilege boundary, enabling a subordinate site admin to seize control of the entire WordPress network without any additional user interaction. Vendor-released patch is available in version 1.9.9; no public exploit identified at time of analysis, and EPSS is low at 0.14%.

CVE-2026-89638 Sep 11, 19:45 HIGH PATCH This Week

Privilege escalation in the Linux kernel CIFS/SMB client allows a local user with write access to a setuid or setgid binary on a CIFS mount to retain those elevated-execution bits on the server after a write operation that should have stripped them. The flaw exists in cifs_setattr_unix() and cifs_setattr_nounix(), which unconditionally dropped the ATTR_MODE flag when ATTR_KILL_SUID/ATTR_KILL_SGID was present, preventing the cleared mode from being propagated to the server when using cifsacl, modefromsid, SMB3.1.1 POSIX extensions, or SMB1 Unix extensions. An attacker who can write to a setuid binary on such a mount can subsequently execute it with unintended elevated privileges. No public exploit has been identified and EPSS is 0.21%, but vendor-confirmed patches are available in kernels 7.2.4, 6.18.51, and 7.3-rc1.

CVE-2026-89610 Sep 11, 19:45 CRITICAL PATCH Act Now

Out-of-bounds memory access in the Linux kernel's NTFS (ntfs3) driver arises because the mapping-pairs runlist decoder confirms that a run's starting LCN falls inside the volume but never checks that the run's end (lcn + length) also stays within nr_clusters. Mounting or parsing a crafted NTFS image can therefore drive the kernel to reference clusters beyond the volume boundary, corrupting memory and potentially escalating privilege. No public exploit has been identified and EPSS is low (0.20%), indicating this is a hardening/DoS-leaning fix rather than an imminent mass-exploitation threat.

CVE-2026-89579 Sep 11, 19:44 HIGH PATCH This Week

Local privilege escalation in the Linux kernel BPF bloom filter implementation (bloom_map_alloc) affects 32-bit x86 kernels via two compounding integer arithmetic bugs: a BITS_TO_BYTES(U32_MAX) wrap at allocation time causes under-allocation of the bitset, and a u32-to-signed-long sign-extension in set_bit/test_bit causes negative bit offsets, enabling out-of-bounds kernel heap reads and writes. Exploitation requires a process holding CAP_BPF on a 32-bit x86 kernel; 64-bit kernels are entirely unaffected. No public exploit identified at time of analysis; EPSS at 0.20% reflects the narrow attack surface imposed by the 32-bit-only constraint.

CVE-2026-62106 Sep 11, 18:12 HIGH This Week

Privilege escalation in the SMS Alert Order Notifications WordPress plugin (versions ≤ 3.9.9) allows any authenticated subscriber - the lowest standard WordPress role - to elevate their account privileges, potentially gaining full administrative control over the affected site. The CVSS 8.8 score with PR:L confirms that only a low-privileged account is required, making exploitation accessible to any registered user on the platform. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.

CVE-2026-62102 Sep 11, 18:12 HIGH This Week

Privilege escalation in the Gato GraphQL WordPress plugin (versions ≤ 19.2.3) allows authenticated subscribers - the lowest registered-user role in WordPress - to elevate their access beyond their assigned privileges. The root cause is CWE-266 (Incorrect Privilege Assignment), where the plugin's GraphQL endpoint handling fails to properly gate privileged operations against low-privilege requestors. No confirmed active exploitation or public POC is identified at time of analysis, but the trivially low access bar of a subscriber account combined with full CIA impact makes this a high-priority finding for any WordPress installation running this plugin.

CVE-2026-38056 Sep 11, 14:50 CRITICAL POC CISA Act Now

Local privilege escalation in the ST Engineering iDirect iQ200 VSAT satellite terminal (firmware 23.0.1.0) allows a holder of the factory-installed low-privilege field-technician account to gain full administrative control of the device. Because the low-privilege account ships pre-configured on every unit, no credentials must be phished, obtained, or brute-forced - the initial foothold is built in. No public exploit has been identified at time of analysis; the flaw was reported through CISA ICS-CERT (advisory ICSA-26-183-01).

CVE-2026-8303 Sep 11, 14:11 HIGH PATCH This Week

Local privilege escalation in Pardus-software (the software center for TUBITAK BILGEM's Pardus Linux distribution) allows a low-privileged local user to gain full system control. The flaw stems from incorrect privilege assignment (CWE-266), where the application grants elevated permissions to processes or objects that should operate with restricted rights, enabling an authenticated local user to escalate to root or equivalent. Versions before 1.0.5 are affected; no public exploit or active exploitation has been identified at time of analysis.

CVE-2026-89259 Sep 11, 11:15 CRITICAL PATCH Act Now

Sandbox/permission-restriction bypass in the Hugo static site generator (versions after v0.43, fixed in v0.165.0) lets a Node tool invoked during a build read and write files outside the project's working directory. Because TailwindCSS ships in the default security.exec.allow list and must be run with highly permissive Node flags (--allow-addons, --allow-child-process, --allow-worker), the Node permission model that was supposed to contain build tools (from the fix for GHSA-x597-9fr4-5857) is effectively neutralized. Reported by VulnCheck; no public exploit identified at time of analysis and it is not listed in CISA KEV.

CVE-2026-74925 Sep 11, 06:00 HIGH POC PATCH This Week

Privilege escalation in MultiVendorX WordPress plugin before 5.0.16 allows authenticated vendor-role users to grant administrator-level WordPress capabilities to the vendor role, enabling full site takeover. The plugin's role and capability settings update mechanism fails to enforce access boundaries, letting any vendor - a legitimately registered but low-privileged marketplace seller - rewrite role permissions without restriction. A publicly available exploit exists via WPScan, and the vendor has released a patch in version 5.0.16.

CVE-2026-16174 Sep 10, 22:51 HIGH PATCH This Week

Privilege escalation and arbitrary code execution affect Netskope Endpoint DLP (EPDLP) on Windows, where a privileged local user can send a crafted message to the EPDLP inter-process communication port to trigger a CWE-190 integer overflow, corrupting process memory. The vulnerability is gated behind two explicit non-default conditions - the EPDLP module must be active in the client configuration, and Windows Memory Integrity (HVCI/VBS) must be disabled on the host. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

CVE-2026-75777 Sep 10, 21:44 HIGH PATCH This Week

Container escape in IBM Aspera Enterprise WebApps 1.0.0-1.0.5 allows a local attacker with low privileges inside the container to break out to the underlying host due to unrestricted system call access. The CVSS vector (S:C/C:H/I:H/A:H) reflects full host compromise as the post-escape impact, not merely container-level damage. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; IBM has released a patch.

CVE-2026-87958 Sep 10, 21:23 HIGH PATCH This Week

Denial of service in IBM Db2 11.5.0-11.5.9 and 12.1.0-12.1.5 allows a low-privileged authenticated network user to disable specific server functionality under certain conditions, producing both availability and integrity impact. The root cause is CWE-269 (Improper Privilege Management): the server fails to enforce correct privilege boundaries around a particular Db2 operation, allowing a user whose authorization should not extend to that action to invoke it. No public exploit has been identified at time of analysis; IBM has released a patch and the vendor advisory is the sole remediation reference.

CVE-2026-11813 Sep 10, 21:17 HIGH PATCH This Week

Privilege escalation in the Lenovo Filez Client application allows a local authenticated user to gain elevated system rights via improper file or directory permissions (CWE-276). The CVSS 4.0 score of 8.5 reflects a meaningful local attack path with low complexity and no special attack requirements, though exploitation is bounded by the requirement for an existing local foothold. No active exploitation or public proof-of-concept has been identified at time of analysis.

CVE-2026-9327 Sep 10, 20:44 HIGH PATCH This Week

Improper privilege management in IBM WebSphere Application Server 8.5 and 9.0 lets an authenticated user who holds a low-privilege administrative role modify security configuration, resulting in information disclosure or denial of service. The flaw is remotely reachable with low complexity (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N) but requires valid administrative credentials, so it is an insider/privileged-abuse issue rather than an unauthenticated attack path. EPSS is only 0.19% (9th percentile), there is no CISA KEV listing and no public exploit identified at time of analysis; IBM has published a fix.

CVE-2026-68488 Sep 10, 16:24 CRITICAL Act Now

Local privilege escalation to root affects the Backup Manager component of WebPros Plesk, where a time-of-check-to-time-of-use race condition during backup restore allows an attacker to abuse insecure symlink following and take ownership of arbitrary files or directories. A low-privileged Plesk account holder who wins the race can redirect a root-executed restore operation onto attacker-chosen paths, gaining full root control of the hosting server. No public exploit is identified at time of analysis, and it is not listed in CISA KEV.

CVE-2026-88924 Sep 10, 14:32 HIGH This Week

Local privilege escalation in gvfs's privileged gvfsd-admin daemon affects Red Hat Enterprise Linux 6 through 10, allowing an authenticated local attacker to obtain root access. The daemon's use of symlink-following chown() on attacker-controlled directory paths creates a TOCTOU window during D-Bus socket setup. By racing the operation and substituting a symlink to a root-owned file such as /etc/pam.d/su, an attacker causes the daemon to transfer ownership of that critical file to the attacker's UID, enabling subsequent modification and full privilege escalation to root.

CVE-2026-81805 Sep 10, 14:23 HIGH This Week

Unauthenticated privilege escalation in the SiteSkite WordPress plugin (versions ≤ 2.1.5) allows a remote attacker to gain elevated privileges within a WordPress installation without any authentication. The vulnerability is classified under CWE-266 (Incorrect Privilege Assignment), meaning the plugin incorrectly grants elevated roles or capabilities during some reachable code path. With full C:H/I:H/A:H impact and PR:N, successful exploitation results in complete compromise of the affected WordPress site, though AC:H signals a non-trivial exploitation condition such as a race condition, specific request sequence, or timing-dependent logic.

CVE-2026-88891 Sep 10, 13:05 HIGH This Week

OpenPanel's server-side mutation resolvers fail to enforce project access levels, allowing read-only project members to execute 26 of 29 write operations that should be restricted to higher-privileged roles. Affected actions include deleting reports and dashboards, scheduling entire projects for deletion, publishing private analytics to public share links, and modifying alerting rules - all achievable by any user with the lowest valid project membership tier. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; organizations should consult GitHub Security Advisory GHSA-f9rx-pxgw-c6rg for patch details.

CVE-2026-88863 Sep 10, 13:05 HIGH This Week

Privilege escalation in capgo.app (npm package `capgo` ≤ 12.207.1) allows an authenticated org_member to promote an external account to org_admin or org_billing_admin by exploiting a missing role-rank comparison in the `validateInvite()` function of the invite-new-user Edge Function. The invitation-acceptance path compounds the issue by using the Supabase service-role key, which bypasses two dedicated database triggers designed to enforce privilege boundaries, resulting in full administrative control over the organization's apps, channels, members, and billing. No public exploit is identified at time of analysis; an upstream fix is available via PR #3096.

CVE-2026-84042 Sep 10, 08:24 HIGH This Week

Container escape in crun >= 1.29, when built with libkrun and started rootful with passt networking (krun.use_passt), allows an attacker who controls the container image to execute arbitrary code with host root privileges. This is a regression introduced in crun 1.29, meaning environments that recently upgraded are at risk while those on earlier versions are not. No public exploit code or CISA KEV listing has been identified at time of analysis, but successful exploitation yields full host compromise via container escape.

CVE-2026-81431 Sep 10, 06:00 HIGH POC PATCH This Week

Privilege escalation in the Registration Form for WooCommerce WordPress plugin (versions before 1.1.3) allows any authenticated Contributor-level user to register new WordPress accounts with arbitrary roles, including Administrator. The plugin fails to verify that the form ID supplied during registration belongs to a legitimate registration form, instead blindly reading the permitted-role allow-list from any post the attacker controls. Exploitation results in full site takeover. A publicly available proof-of-concept exists. This vulnerability is an incomplete fix of a prior privilege escalation issue tracked as CVE-2026-54807.

CVE-2026-14873 Sep 10, 03:40 HIGH This Week

Privilege escalation in the Bulk Password Reset WordPress plugin (all versions ≤1.3.3) allows any authenticated subscriber-level user to perform a full administrative account takeover. The plugin fails to validate the requesting user's identity before permitting bulk password changes and email-address updates, meaning an attacker can redirect an administrator's email to an attacker-controlled address, then invoke the standard WordPress password-reset flow to obtain reset credentials for that admin account. No public exploit code has been identified at time of analysis, but source code references from WordPress Plugin Trac directly expose the vulnerable functions at lines 44, 594, 659, and 679 of bulk_password_reset.php.

Improper privilege management in Open WebUI 0.10.0 through 0.11.0 allows any authenticated low-privilege user with write access to a knowledge base to delete administrator-owned external connection configurations shared across the entire instance. The DELETE /api/v1/knowledge/{id}/delete endpoint in knowledge.py correctly validated the user's write access to their own knowledge base but then cascaded the delete to the underlying shared external connection without verifying admin role or checking whether other knowledge bases depended on that connection. This means a single non-admin user can render all other knowledge bases on the instance that share the same external vector store connection permanently unavailable. No public exploit has been identified at time of analysis; vendor-released patch is available in version 0.11.1.

CVE-2026-77120 Sep 09, 16:31 HIGH This Week

Privilege escalation to root in Schneider Electric PowerLogic T300 (versions 2.9.8-5620 and prior) is achievable by an authenticated SSH user through OS command injection in the device's operating system console. An attacker with high-privilege SSH access can inject shell metacharacters into user-controlled console input that the device fails to properly sanitize, breaking out of the intended command context to execute arbitrary commands as root and perform unauthorized administrative operations. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 score of 8.7 reflects subsequent-system impact rated High, consistent with the device's ICS/energy-metering deployment context.

CVE-2026-86746 Sep 09, 13:32 HIGH PATCH This Week

Privilege escalation in Snipe-IT before 8.7.0 allows any authenticated user to bypass authorization controls by replaying signed Livewire component snapshots directly against the /livewire/update endpoint. Because authorization is enforced only at the HTTP route layer and not within Livewire component lifecycle methods, a low-privilege session holder can invoke protected admin operations including creating OAuth clients, minting personal access tokens, and reading sensitive administrative data. No active exploitation has been confirmed (no CISA KEV listing), but the vendor-confirmed fix is available in version 8.7.0.

CVE-2026-15140 Sep 09, 13:18 HIGH This Week

Privilege escalation in the Portworx Operator on Red Hat OpenShift (OCP) allows a low-privileged, namespace-scoped user to cause the operator to assign cluster-wide permissions beyond what the user was authorized to hold. The flaw (CWE-266, Incorrect Privilege Assignment) is constrained to the initial provisioning phase of a Portworx storage cluster, meaning the exploitation window is finite but deliberate timing by an insider or a compromised account could reliably hit it. No public exploit code has been identified and the vulnerability is absent from CISA KEV; the CVSS 4.0 score of 7.7 reflects high confidentiality, integrity, and availability impact when the specific provisioning condition is met.

CVE-2026-12858 Sep 09, 08:29 HIGH This Week

Local privilege escalation in ESET AV Remover (standalone) enables a low-privileged local user to attain SYSTEM-level control by sending specially crafted RPC messages to the tool's privileged service component. The root cause is CWE-269 (Improper Privilege Management): the RPC handler fails to enforce access controls commensurate with the operations it exposes, allowing an unprivileged caller to invoke functionality that executes at a higher privilege level. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.

CVE-2026-14359 Sep 09, 08:28 HIGH This Week

Privilege escalation in YITH WooCommerce Waitlist Premium for WordPress (versions ≤3.35.0) allows any subscriber-level authenticated user to manufacture a new WordPress administrator account, achieving full site takeover. The vulnerable AJAX handler add_user_in_waiting_list() is exposed to all logged-in users with no nonce or capability check, and applies parse_str() plus extract() to attacker-supplied POST data before passing the injected variables directly to wp_create_user() and $user->set_role(). No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack mechanics are trivially derivable from the Wordfence disclosure.