Privilege Escalation
Monthly
Incorrect privilege assignment in the CICD-toolchain-for-serverless-applications IAM policy (versions 1.0.7 through 1.0.10) lets an authenticated user who can push to the application source repository escalate privileges beyond the application stack inside the same AWS account. Because the CloudFormation deployment role is not scoped to the application's own resources, an attacker-supplied application template processed by the toolchain pipeline can read or modify unrelated IAM role policies, Secrets Manager secrets, and SSM parameters. Exploitation is gated on repository push rights (CVSS PR:L) and on the pipeline actually deploying the crafted template; no public exploit code and no confirmed active exploitation were identified at time of analysis, and AWS has released 1.0.11 to close the path.
Froxlor before 2.3.15 allows an authenticated hosting customer with write access to their document root to escalate to root by replacing the statistics directory with a symlink, so the root-run traffic cron's recursive chown follows the link and changes ownership of arbitrary host directories. Exploitation requires a valid customer account, enabled goaccess/webalizer/awstats statistics, and execution of the scheduled traffic cron; no public exploit identified at time of analysis. Vendor-released patch: 2.3.15.
Cross-tenant privilege escalation in StreamsHub Console for Apache Kafka allows an authenticated Kubernetes tenant that can create or modify Console custom resources to point spec.containers.api.spec.image at an arbitrary container image, which the operator then deploys into a pod running under a ServiceAccount bound by ClusterRoleBinding to cluster-wide Strimzi CRD read access, Kafka/KafkaRebalance patch rights, and cluster-monitoring-view. The attacker-controlled code reads the projected ServiceAccount token and gains read/write control over the Strimzi control plane across tenant boundaries, with high confidentiality and integrity impact (CVSS 9.9, scope changed). Exploitation is gated by the tenant-level RBAC permission rather than being open to the internet, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in Apple macOS Sequoia before 15.8 and Tahoe before 26.7 allows an app already running on the host to gain elevated privileges, rated CVSS 3.1 7.8 (CWE-269, Improper Privilege Management). Exploitation requires local code execution as an unprivileged app (AV:L, PR:L) and no user interaction; it is not remotely reachable and patched systems are unaffected. No public exploit code or CISA KEV entry was identified at time of analysis.
Local privilege escalation in IBM Sterling Connect:Direct for UNIX (6.3.0.0-6.3.0.7 and 6.4.0.0-6.4.0.6) allows an authenticated local attacker with a low-privileged account to gain elevated privileges through improper privilege management. The CVSS 3.1 score is 8.4 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N), reflecting high confidentiality and integrity impact to the host with scope change, but the attack is not remotely reachable. No public exploit was identified at the time of analysis, and exploitation requires an existing local foothold on a host running the affected Connect:Direct components, likely under elevated privileges.
Local privilege escalation in Progressive Robot hMailServer 6.0.0 through 6.3.6 allows any authenticated, non-administrator user on the host to run code as LocalSystem or as the mail server's virtual service account, but only when the installer was pointed at a folder that inherits writable permissions from its parent, such as the root of an NTFS drive. The installer accepts any path without warning and creates neither the program folder nor its Bin subfolder with explicit permissions, so a drive-root install leaves Bin writable to Authenticated Users (Modify on Windows clients) or Users (create files and folders on Windows Server); the default Program Files installation grants ordinary users only read and execute and is explicitly not affected. No public exploit code or active exploitation is confirmed at time of analysis, and the reference to the v6.3.7 release indicates the vendor has shipped a fixed version.
SQL injection in Integratec's pre-authentication login endpoint (/login/ap_Login.aspx/start) allows remote unauthenticated attackers to read database contents-including credentials and user information-by supplying a crafted UNION-based payload in the sInfo POST parameter. The report carries an 8.8 CVSS score, and our independent assessment is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L, with no authentication or user interaction required; exploitation is limited mainly by whether the login interface is reachable from untrusted networks. No public exploit code was identified at time of analysis, but our independent assessment treats this as a credible, actionable priority rather than a paper-tiger high score.
Local privilege escalation in the Linux kernel's RDS Infiniband transport is possible when rds_ib_map_frmr() leaves a stale scatterlist in a memory region returned to the MR pool after a DMA mapping or registration failure; a local user who can open PF_RDS sockets on a kernel built with CONFIG_RDS/CONFIG_RDS_RDMA and the rds_rdma/ib path can later trigger a use-after-free during MR teardown. Exposure is limited to systems using the non-default RDS-over-Infiniband subsystem, and EPSS is 0.22% (12th percentile) with the vuln.today decision label this_week; no public exploit identified at time of analysis, and a vendor patch is available. The assessed CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8), consistent with a local privilege-escalation primitive requiring a local account rather than a remote attack.
Privilege escalation in the Login with phone number WordPress plugin (through version 1.8.77) allows unauthenticated remote attackers to potentially obtain elevated privileges, with high attack complexity reflecting conditions such as timing or a specific registration/login state that the attacker does not fully control. The issue is CWE-266 incorrect privilege assignment and carries a CVSS 8.1 score with high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and no CISA KEV status was provided; defenders should prioritize patching internet-facing WordPress sites running this plugin.
OttoKit (SureTriggers) WordPress plugin through 1.1.40 contains an incorrect privilege assignment flaw that can allow remote attackers to escalate privileges, and the vendor CVSS vector scores it 9.8 with network reachability, low attack complexity, no privileges required, and no user interaction. Successful exploitation could lead to full WordPress site compromise given the high confidentiality, integrity, and availability impact, though the provided data does not clarify whether a specific integration or API must be enabled or whether a pre-existing low-privileged account is required despite the PR:N rating; no public exploit identified at time of analysis.
Privilege escalation in the Salon Booking System WordPress plugin (10.17 through versions before 10.31.11) lets authenticated users who hold the plugin's custom salon staff role assign arbitrary capabilities, including administrator, to other accounts through the customer-editing function, enabling full site takeover. Publicly available exploit code exists, but the flaw is access-gated: it is not reachable by anonymous visitors or ordinary subscribers and requires a provisioned salon staff account, so exposure depends on how widely that role is granted and on the hygiene of those accounts. It is not confirmed actively exploited (no CISA KEV entry) and no EPSS score was provided.
Missing authorization in phpMyFAQ before 4.1.9 allows authenticated non-superadmin accounts that hold the delete_user permission to delete superadmin users and strip administrative accountability from the application. The /admin/api/user/delete endpoint accepts a superadmin userId other than the protected userId 1, so an attacker with a low-privilege admin session can remove higher-privileged administrators; confidentiality is unaffected while integrity and availability impacts are high. No public exploit was identified at time of analysis, and exploitation is gated by the specific delete_user permission rather than being available to every authenticated user.
Privilege escalation in phpMyFAQ 4.2.0-alpha pre-release builds lets a category-restricted delegated administrator escape their assigned scope and grant groups unrestricted category access. The flaw resides in GroupController::saveCategoryRestrictions(), which fails to validate submitted categoryIds against the caller's own scope, so a crafted POST to /admin/api/group/category-restrictions with out-of-scope or empty values elevates the attacker's effective permissions. Exploitation requires valid credentials for a privileged but scope-limited admin role (PR:H), and no public exploit code or confirmed active exploitation has been identified at time of analysis; the affected range is a pre-release train that is unlikely to be widely deployed in production.
Privilege escalation in phpMyFAQ builds from 4.2.0-alpha.2 up to but not including 4.2.0-beta allows a non-superadmin administrator who holds GROUP_EDIT to abuse the group permission API's updatePermissions and updateMembers endpoints, grant a group rights beyond the attacker's language or category scope, and self-join that group to obtain unrestricted FAQ create, edit, and publish access across all languages and categories. The CVSS 4.0 base score is 7.0, but exploitation requires an authenticated scoped administrator account and is only meaningful in deployments that use delegated administration limited by language or category, since a single-superadmin installation offers no scoped boundary to escalate from. No public exploit identified at time of analysis.
Privilege escalation in phpMyFAQ pre-release builds (4.2.0-alpha.2 through versions before 4.2.0-beta) allows an administrator holding the USER_EDIT right to re-grant FAQ rights in a way that silently discards per-right language restrictions, yielding unrestricted create, edit, and publish access across every language. The flaw lives in UserController::updateUserRights and can be triggered against the attacker's own account by submitting a language-scoped rights update to the update-rights API. Exploitation is access-gated: it requires an authenticated operator with USER_EDIT (PR:H) and only affects the 4.2.0 development line, so stable installations outside that range are not exposed; no public exploit code or confirmed active exploitation was identified at time of analysis.
Stored cross-site scripting in the EU VAT Assistant for WooCommerce plugin (all versions up to and including 2.1.30.260413) lets an unauthenticated visitor inject arbitrary script through the customer-supplied 'vat_number' field at checkout, which is persisted and later rendered without escaping inside WooCommerce → Orders → Edit Order. The payload fires in the reviewing administrator's browser session, so a single poisoned order can be leveraged to create a rogue administrator account and take over the entire WordPress site. No public exploit code or confirmed active exploitation was identified at time of analysis, but the low attack complexity, lack of authentication requirements (CVSS PR:N), scope change, and the fact that the trigger is a routine admin workflow make this a genuine, actionable priority for any store running the plugin on default configuration.
Local privilege escalation in IBM i 7.3, 7.4, 7.5, and 7.6 allows an authenticated, low-privileged user to obtain QSECOFR/Root authority, as described in CVE-2026-102917. The vulnerability has a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires prior authentication and local access; it is not remotely exploitable. No public exploit code has been identified at time of analysis, and IBM has released a patch via its support advisory.
Unauthenticated administrative account creation in WhaTicket Community through commit cf04795 allows remote attackers to self-register as administrators via POST /auth/signup by omitting the profile field or setting it to admin. Successful exploitation grants control over user management, settings, and all tickets, contacts, messages, and WhatsApp connections. The flaw is unauthenticated and network-reachable under the assessed CVSS:3.1 vector, but no CISA KEV active exploitation is confirmed and no public exploit is explicitly identified at time of analysis, although a public technical writeup reference exists.
Local privilege escalation in cifs-utils lets an unprivileged local user obtain root on affected hosts by injecting unauthorized options into a privileged CIFS mount. When a root-owned service mounts a Common Internet File System share using a credentials file whose contents the attacker can control or influence - for example a file that is world-writable or lives in an attacker-owned path - cifs-utils assembles those unsanitized values into the mount option string, so the attacker can slip in extra options that bypass permission checks and cause files to be executed with administrative privileges. The flaw is tracked as CWE-88 (argument/option injection) with a CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); exploitation requires an existing low-privilege local account (authenticated, per PR:L) and a deployment where such a privileged, credentials-file-driven CIFS mount workflow exists, so internet-facing hosts that do not mount attacker-influenced CIFS shares are not at risk. No public exploit code or confirmed active exploitation was identified at time of analysis, and Red Hat has published advisory and Bugzilla tracking pages for RHEL 6 through 10 and OpenShift Container Platform 4.
Authenticated attackers with Subscriber-level or higher PilotPress membership on WordPress sites can escalate to full Administrator privileges by exploiting a flawed ONTRAPORT synchronization routine in PilotPress versions up to and including 2.0.43. The defect allows an attacker to rename a remote ONTRAPORT contact to an existing Administrator's WordPress login, then leverage the plugin's authentication hook to cause WordPress core to issue an Administrator authentication cookie. This is a genuine high-priority vulnerability (CVSS 8.8), requiring a valid ONTRAPORT contact and the Customer Center nonce, but no victim interaction. No public exploit code was identified at time of analysis.
Unauthenticated privilege escalation in the Cozmoslabs User Profile Builder WordPress plugin (all versions up to and including 4.0.3) allows an attacker to obtain a fully activated administrator account: they submit role=administrator through the public [wppb-register] registration form, then click the activation link emailed to them, and the activation handler applies that role via WP_User::set_role() without any allow-list check. The attack is conditional rather than trivial - the site must already carry a legacy registration form field with meta-name 'role' from before the 4.0.3 upgrade (the 4.0.3 reserved-name block deliberately exempts pre-existing fields), must have email confirmation enabled so the wp_signups path is used, and must allow open user registration. That combination of stable site-state prerequisites is why CVSS 3.1 scores it 8.1 with AC:H despite PR:N/UI:N, and no public exploit code has been identified at the time of analysis.
Privilege escalation in the Theme My Login plugin for WordPress (versions up to and including 7.2.1) allows unauthenticated attackers to change arbitrary user passwords on multisite installations in certain configurations, leading to account takeover and potential full network compromise. The flaw stems from improper validation of user identity before password updates (CWE-269). Exploitation requires a non-default multisite setup, and no public exploit code is identified at time of analysis; the effective attack complexity is higher than the base CVSS 9.8 score implies due to this configuration dependency.
Unauthenticated privilege escalation in the My Calendar - Accessible Event Manager WordPress plugin (all versions up to and including 3.8.7) allows remote attackers to overwrite the credentials of the default Administrator account (user ID 1) and gain full wp-admin access. The flaw arises from unsanitized reflection of the `mcs` GET parameter into post content, enabling injection of a nested `[my_calendar above=...]` shortcode that is processed by `mc_generate_calendar_nav()`, which calls arbitrary PHP functions via `call_user_func()` without authorization or callable allowlisting. No public exploit code has been identified at time of analysis, but the plugin's auto-generated `/my-calendar/` page is publicly accessible by default, making exploitation trivially reachable by an unauthenticated attacker.
Privilege escalation in the Nexter Extension WordPress plugin (all versions up to and including 4.7.11) allows an authenticated Subscriber-level or higher user to restore a stale stored Administrator role onto their own account, effectively becoming an Administrator. Exploitation is tightly constrained: the attacker's account must previously have held the Administrator role, must have used the plugin's View Admin Role Switcher, and must have been demoted specifically through the wp-admin/users.php?action=promote bulk role-change control rather than the Edit User screen. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV, and the assessed conditions are why the effective risk is lower than the 7.5 (HIGH) base score implies.
Unauthenticated attackers can take over any WordPress user account, including administrators, on sites running the MailOptin plugin up to version 1.2.78.6 that have a 'WordPress User Registration' opt-in form published. The flaw allows manipulation of the optin_data[form_custom_field_mappings] parameter to override saved mappings, enabling injection of arbitrary wp_users column names (e.g., ID, user_pass) into wp_insert_user(), which then updates the target account's password. No authentication, nonce, or capability check is required, and the only prerequisite is the presence of the registration form; sites using MailOptin solely for mailing-list optins without this connection are not affected. No public exploit identified at time of analysis.
Privilege escalation in the InstaWP Connect - 1-click WP Staging & Migration WordPress plugin (all versions up to and including 0.1.4.1) lets any authenticated user at Subscriber level or above read the site's plaintext InstaWP master API key from a plugin settings page and redeem it for a full administrator session. The key is disclosed because the admin page is registered with a role name returned by InstaWP_Setting::get_allowed_role() in place of a real capability, and because generate_section_field() prints the master API key directly into a plain-text HTML input without a manage_options check; the attacker then derives the bearer secret from that key, satisfies the plugin's REST validate_api_request(), and calls POST /wp-json/instawp-connect/v2/auto-login to mint a 30-second single-use login URL that sets an administrator authentication cookie. Exploitation is not default-configured: it additionally requires the site to be actively connected to InstaWP (a valid master API key in instawp_api_options) and an administrator to have added the attacker's role to the plugin's Sync Tab Access list (instawp_sync_tab_roles) while still retaining administrator in that list, so realistic exposure is narrower than the 7.5 base score implies. There is no public exploit code identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); authentication requirements are authenticated (CVSS PR:L) with high attack complexity (AC:H).
Privilege escalation in the Customer Email Verification for WooCommerce WordPress plugin through 3.3.0 allows unauthenticated attackers to gain authentication as any WordPress account that still has an unverified email address, including administrators, by brute-forcing a per-user activation secret that has only about 101 possible values. The weakness is genuine and high impact (full account takeover), but real-world risk is heavily gated by three preconditions: the plugin's 'Encoding method' must be set to the non-default 'hashids' option, the attacker must recover or brute-force the Hashids salt (which defaults to an md5(time()) value fixed at first initialization), and the targeted account's email must remain unverified. An upstream changeset addressing the issue is referenced in the WordPress plugin repository, and no public exploit code was identified at time of analysis; CVSS 3.1 scores it 8.1 (High, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), so despite the High score it should be triaged as lower priority than a default-configuration, unauthenticated account-takeover bug in most deployments.
Privilege escalation to full WordPress site takeover is possible in the Backuply backup/restore plugin (all versions up to and including 1.5.8) via a second-order SQL injection that an authenticated subscriber-level user plants in the profile Biographical Info field and that only fires when an administrator later creates a backup capturing that value and then restores it. During the restore the injected SQL executes blind inside an INSERT into wp_usermeta, allowing the attacker to alter database records - most notably to set the default_role option in wp_options to administrator and enable open registration, so a subsequently registered account is granted Administrator rights. Exploitation cannot be self-triggered by the attacker (UI:R) and requires a valid authenticated account (PR:L, no anonymous path); no public exploit identified at time of analysis.
Privilege escalation to root on Ivanti Connect Secure 22.8R2.4, where the dsinvoked broker improperly trusts DSCache configuration data and can be induced to act on attacker-controlled input. Exploitation is not remote in isolation: the CVSS vector (AV:L/PR:L/AC:H) requires an attacker to already hold a low-privileged foothold on the appliance plus the specific broker/DSCache state needed to satisfy the high attack-complexity constraint. The practical risk is elevated because the CVE description and Volexity reporting tie this flaw to chained exploitation of upstream unauthenticated issues in October 2026, which removes the local-access barrier for a real attacker; no CISA KEV entry is present in the supplied data, and no specific patch version is provided. Treat this as a genuine high-priority hardening item - the exploitation signals are reported but the remediation data is incomplete.
Path traversal in wildfly-core's deployment content handler allows an authenticated JBoss EAP, WildFly, Fuse 7, or Single Sign-On 7 user who holds the Deployer RBAC role to escape the restricted deployment directory and create files with attacker-controlled content or delete arbitrary directories on the server, escalating to full management SuperUser privileges. Exploitation requires that the Deployer role be delegated to the attacker (CVSS vector shows PR:L - authenticated, not anonymous) plus a crafted deployment name containing traversal sequences; environments that reserve the Deployer role for fully trusted administrators face little practical exposure. No public exploit code was identified at time of analysis and the flaw is not listed in CISA KEV, so this is a credible, actionable priority rather than an emergency.
Jinja2 template injection in Ansible Operator Plugins (CWE-1336) lets an authenticated Kubernetes user who can create or modify a custom resource reconciled by an affected Ansible-based operator execute embedded Jinja2 expressions inside the operator pod, achieving remote code execution and escalating to the operator's service account. Because these operators typically hold cluster-wide RBAC, successful exploitation crosses a privilege boundary (CVSS 3.1 base 8.5, AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H), affecting components of Red Hat Ansible Automation Platform 2, Red Hat Advanced Cluster Management for Kubernetes 2, the Migration Toolkit for Applications/Containers/Virtualization, OpenShift Service Mesh 3 and related Red Hat OpenShift and OpenStack streams. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; the high attack complexity reflects the prerequisite that the targeted operator must pass attacker-controllable CR spec values into Jinja2 templating without sanitization. This is a genuinely high-priority flaw rather than a CVSS-inflated one, but with an important authentication caveat: purely anonymous or read-only users cannot trigger it.
Authenticated XPath injection in the OPNsense firewall and routing platform (all versions prior to 26.1.10) lets a user holding CA Manager or Certificate Manager privileges recover values stored in config.xml character by character. The Trust module stores attacker-controlled certificate and CA refid values and interpolates them unescaped into XPath queries in CAsField.php and CertificatesField.php; because the resulting refcount/in_use boolean is returned to the requester, it acts as a blind injection oracle for secrets such as password hashes, API credentials, certificate private keys, VPN key material, and high-availability credentials, which in turn can enable privilege escalation and compromise of other security domains. Exploitation is post-authentication, requires those specific trust-management privileges, and is high-complexity and iterative (roughly one boolean leak per request), so this is a genuine but second-tier information-disclosure issue rather than a drive-by remote compromise; no public exploit code has been identified at time of analysis. Vendor-released patch: 26.1.10.
Boolean-based blind SQL injection in EspoCRM versions 8.1.0 through 9.3.7 allows an authenticated non-administrator to inject crafted expressions through the 'where' parameter of the GET entity streamAttachments endpoint, enabling extraction of arbitrary database contents - including active administrator session tokens - and subsequent full privilege escalation. The flaw requires a valid low-privilege session (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L, 7.6) and is not exploitable anonymously. Public exploit code exists for this issue, though it has not been confirmed as actively exploited (CISA KEV); EspoCRM 9.3.8 is the fixed release.
Cleartext credential disclosure in P4 Search (formerly Helix Search) 2026.4.2 and earlier allows an authenticated administrator on the connected P4 Server to retrieve stored credentials through the product's configuration API, enabling privilege escalation beyond the administrator's intended scope. The defect is rooted in insufficient granularity of access control (CWE-1220): the API exposes secret material that administrators should not be able to read back, and the resulting credential exposure has cross-boundary confidentiality, integrity, and availability consequences per the assessed scope change (S:C). Exploitation is privilege-gated by the PR:H authentication requirement in the CVSS vector, so this is not reachable by anonymous or unprivileged users, and no public exploit code or confirmed active exploitation has been identified at time of analysis. A vendor patch is available in P4 Search 2026.4.3.
Local privilege escalation in TotalAV versions up to 7.1.17 allows an authenticated but unprivileged local user to impersonate the SYSTEM service by forging a gRPC IPC authentication token, leading to arbitrary code execution as NT AUTHORITY\SYSTEM. Publicly available exploit code exists (a proof-of-concept C file is linked in the disclosure), though CISA KEV does not list the vulnerability as actively exploited, and the SSVC assessment rates exploitation as 'poc' with total technical impact. Exploitation requires a local foothold and the vulnerable TotalAV service to be running; it cannot be triggered remotely or against hosts without TotalAV.
Frontend Admin by DynamiApps (the acf-frontend-form-element WordPress plugin) through version 3.29.13 assigns privileges incorrectly, letting a submitted frontend form escalate the submitting user's role - most seriously to administrator - which on WordPress equates to full site compromise. The provided CVSS 3.1 vector scores this 9.8 as network-reachable with no privileges required (PR:N), while our independent assessment scores it 8.8 with PR:L, because the real-world precondition is that a Frontend Admin form capable of affecting roles (for example a user-registration or profile-edit form) is published and reachable by the attacker; sites that expose such a form to anonymous visitors are effectively unauthenticated targets, whereas sites gating it behind login require at least a low-privilege account first. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so there is no confirmation of active exploitation, though the low complexity and high payoff make opportunistic scanning plausible.
Rate-limit bypass in the Eclipse Connected Services Platform api-gateway (affected versions 1.1.1 through 1.7.3) allows any unauthenticated remote client to evade request throttling by rotating the value of the leftmost X-Forwarded-For header element, which the shipped default ClientIpKeyResolver trusts without validation. Because each unique header value produces a fresh rate-limit bucket, an attacker can issue unlimited requests against any route that relies on the default resolver and has rate limiting configured, degrading the availability protections the gateway is meant to enforce. No KEV entry or publicly available exploit code was identified at time of analysis, and EPSS is low (0.15%, 4th percentile); CISA SSVC rates exploitation as 'none' while noting the issue is automatable, so mass scanning should be expected even without a dedicated exploit. The net effect is a moderate-priority security-control bypass (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) rather than a system compromise, with deployments that customize the key resolver or sanitize X-Forwarded-For at a trusted edge proxy unaffected.
Privilege escalation in the Fluent CRM WordPress plugin version 3.2.5 and earlier allows an authenticated low-privileged user - such as a subscriber or self-registered account - to elevate their privileges and gain control over site resources, with a CVSS 3.1 score of 8.8 and high impact to confidentiality, integrity, and availability. Exploitation is not anonymous: it requires a valid low-privilege WordPress account plus an active vulnerable plugin installation, but no user interaction is needed (PR:L, UI:N) and no non-default configuration is named in the advisory. No public exploit identified at time of analysis; this is a genuine priority, not a high-CVSS-but-low-real-risk issue.
Privilege escalation in the Fluent CRM WordPress plugin (all versions through 3.2.5) allows a low-privileged account to elevate itself to higher privileges, including administrator-equivalent capabilities, by abusing an incorrectly assigned privilege (CWE-266). The vendor-supplied vector scores this 9.8 (AV:N/AC:L/PR:N/UI:N), but the independent vector analysis assigns PR:L, meaning the realistic starting point is an authenticated low-privileged WordPress account, and that prerequisite is the one condition that most changes the real-world risk; the exact vulnerable endpoint and required account level are not detailed in the available data. No public exploit code has been identified at time of analysis, and Fluent CRM is not listed in CISA KEV; the sole public reference is the Patchstack advisory. Sites running Fluent CRM 3.2.5 or earlier should treat this as high priority because WordPress administrator takeover typically yields full site compromise, data theft, and persistent backdooring.
Local privilege escalation in the FreeBSD kernel kqueue subsystem affects FreeBSD 15.1-RELEASE before patch level p4, where a race condition in the parent-to-child knote copy path can free a marker knote and cause a use-after-free. A local user with low privileges (PR:L) may leverage this to corrupt kernel memory and potentially escalate privileges, though exploitation requires winning a high-complexity, non-deterministic timing race (AC:H). No public exploit code or confirmed active exploitation was identified at time of analysis; EPSS is low at 0.14% (3rd percentile).
Out-of-bounds access to kernel heap memory in FreeBSD's System V semaphore subsystem allows an unprivileged local user to potentially escalate privileges or crash the kernel. The flaw is a race in semop(2): the invoking thread blocks, releases the per-set lock, and on wake-up re-validates its semaphore set using a 15-bit sequence number embedded in the IPC identifier; if roughly 32,768 sets are created and destroyed in the same table slot during that window, the counter wraps and the kernel falsely treats a freed/reused set as still valid, leading to an out-of-bounds dereference (CWE-787). Exploitation requires local code execution and a timing-dependent counter wrap, so practical risk is limited despite the total technical impact rating - no public exploit code has been identified at time of analysis, EPSS is 0.18% (7th percentile), and CISA SSVC records Exploitation: none, Automatable: no.
Unauthenticated attackers can register an administrator-equivalent account on any WordPress site running the User Rights Access Manager plugin through version 1.1.3, resulting in full site takeover. The plugin leaves one of its AJAX account-registration handlers accessible without any capability or nonce check, and assigns newly self-registered users a role that was created as a direct copy of the administrator role, so a single crafted request yields a fully privileged account. Publicly available exploit code exists, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) confirms the attack is remote, unauthenticated, and requires no user interaction; no CISA KEV entry has been reported, so active exploitation is not confirmed, but the low complexity and public proof-of-concept make this a high-priority patch target wherever the plugin is deployed.
Credential theft in Heym 0.0.55 through 0.0.120 allows a shared collaborator to seize the error_workflow_id execution field and repoint it at an attacker-controlled workflow containing an HTTP node, so that when the owner's parent workflow enters an error state the owner's decrypted credentials are injected into the attacker's workflow and exfiltrated over the network. The attack is remote and low-complexity, requiring only low privileges - an existing collaboration grant on the target workflow (PR:L per both the supplied CVSS 4.0 vector and the assessed CVSS 3.1 vector) - with no user interaction, producing high confidentiality impact and only low integrity impact from the single overwritten field. No public exploit code or CISA KEV entry was identified at time of analysis, and single-owner Heym deployments that do not use shared collaborators are not exposed.
Local privilege escalation in Metalama allows an unprivileged user on a shared Linux or macOS host to plant a malicious .NET assembly in the world-writable system temp directory that will later be loaded and executed by a higher-privileged victim's build process. Metalama cached and extracted compile-time assemblies, auxiliary tools, and embedded helper assemblies under Path.GetTempPath() (/tmp) and trusted existing artifacts solely on a sentinel '.completed' marker file rather than any integrity check, so an attacker can pre-create the deterministic directory layout and rely on the marker to skip regeneration. Exploitation requires a pre-existing local account on the same shared machine or CI/build agent and a victim build initiated afterward; Windows default configurations are not affected because per-user temp ACLs prevent cross-user planting. No public exploit code has been identified at time of analysis and there is no KEV listing, but EPSS-style urgency is moderate given the low attack complexity and the availability of a vendor fix in 2026.1.19 (and 2025.1.18 on the older branch).
A heap-based buffer overflow in the eventd daemon of Juniper Networks Junos OS and Junos OS Evolved allows a local unprivileged attacker to send crafted IPC messages, leading to denial of service or privilege escalation to root. The vulnerability affects all platforms and carries a CVSS 4.0 base score of 8.6 due to high confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis; exploitation requires a pre-existing local account or foothold on the device, and network-based unauthenticated attacks are not possible.
A privilege escalation in KEDA 2.20.2 and earlier lets a namespace administrator who can create TriggerAuthentication and ScaledObject resources point hashiCorpVault.address at an endpoint they control and select Kubernetes authentication without supplying a credential; KEDA then logs in to that endpoint using the operator pod's projected ServiceAccount token, handing the attacker the operator's cluster-wide permissions including broad Secret reads and workload or admission-related operations. The prior CVE-2025-68476 JWT-shape filter does not block this path because the operator token's subject is a Kubernetes ServiceAccount, so it passes the filter. Exploitation is authenticated (CVSS PR:L) and gated by tenant-level RBAC to create those CRDs, but it is most dangerous in multi-tenant clusters where namespace admins are untrusted relative to the cluster-scoped operator; there is no public exploit code identified at time of analysis, and the issue is fixed in 2.21.0 via audience enforcement plus an outbound Vault-address allowlist.
Local privilege escalation in the SUID-root mount(8) utility shipped with util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, where the attacker-controlled LIBMOUNT_FORCE_MOUNT2 environment variable is read with getenv() and can force the legacy, non-atomic multi-step bind-mount path. On hosts whose /etc/fstab contains a bind mount authorized for unprivileged use via the user or users option and hardened with nosuid, noexec, or nodev, a local low-privileged user can win a timing race between the initial bind mount and the follow-up remount that applies those protective flags, briefly exposing an unprotected mount from which a SUID binary can be executed to obtain root. Exploitation is conditional (it requires that specific non-default fstab configuration) and non-deterministic because it depends on a race window; no public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV). Vendor-released patches are available in util-linux 2.41.5 and 2.42.2.
Local privilege escalation in MyReport Updater through 2.1.1 allows authenticated low-privileged local users to gain SYSTEM rights by abusing the updater service's gRPC interface (UpdaterManager.exe) to set a malicious reference server and arbitrary installLocation, then planting a DLL such as HID.dll that is loaded by osk.exe. Publicly available exploit code exists, though no confirmed active exploitation (not in CISA KEV). With a CVSS 4.0 score of 8.5 and assessed CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, this is a genuine, actionable local privilege escalation rather than an inflated high-CVSS score, though it is not a mass-exploitation emergency.
Privilege escalation in the WordPress plugin Frontend Dashboard (M A Vinoth Kumar), affecting versions through 3.0.7, lets remote attackers obtain elevated account capabilities through incorrect privilege assignment (CWE-266). Patchstack scores the flaw 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but the assessed vector is PR:L, meaning exploitation in practice most likely requires an existing low-privileged account (for example a subscriber) to elevate from, which typically presupposes that open user registration is enabled on the target site. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV; exploitation is bounded to WordPress sites actually running this plugin within the affected version range.
Privilege escalation in Red Hat OpenShift Container Platform 4's insights-runtime-extractor DaemonSet lets an authenticated low-privileged tenant who can schedule a pod on a node run attacker-controlled code as root in the host user namespace. The extractor scanner enters the workload's namespaces and executes the workload's argv[0] via exec.Command after only seteuid() has changed, leaving real/saved UID 0 and retaining capabilities; a malicious pod binary matching node, python, python3, MainThread, or any path containing java can call setuid(0) and reach the host CRI-O socket from the inherited cwd. CVSS 8.8 (AV:L/PR:L/S:C) reflects local, non-network exploitation requiring workload scheduling, and no public exploit was identified at time of analysis.
Unauthenticated privilege escalation in the SimpleForm WordPress plugin up to and including version 3.10.0 allows any remote visitor to create an Administrator-level WordPress account by submitting crafted registration data. The vulnerable AJAX action wp_ajax_nopriv_simpleform_wp_register lacks a capability check for role assignment, and related meta-saving logic fails to exclude wp_capabilities, while the required nonce is publicly emitted on every front-end page. No public exploit code is confirmed at time of analysis, but the flaw is trivially exploitable against default configurations; an upstream fix exists via changeset 3726513, though a tagged release is not independently confirmed.
Local privilege escalation in Nix (before 2.35.3) and Lix (before 2.95.4) allows an unprivileged local user to escalate to the privileged nix-daemon account-typically root-by exploiting a repair operation that destroys and replaces a store path before verifying its content. The flaw is a timing-sensitive incorrect behavior order (CWE-696) that only affects multi-user daemon deployments; single-user installs are far less exposed. No public exploit code has been identified at time of analysis.
Privilege escalation in the Membership & User Roles for WooCommerce (Automatic Role Changer) plugin through version 20260828 lets an authenticated subscriber-level user re-acquire a previously revoked Administrator role and take full administrative control of the WordPress site. The flaw is reachable when the plugin is configured in Replace Roles mode and the attacker's account previously legitimately held Administrator while the plugin was active, because that role stays cached in the dfxwcrc_foreign_roles user meta and is re-applied whenever a role-assignment event fires, such as completing a purchase for a role-mapped product. Wordfence reported the issue (CVSS 7.5, CWE-269) and no public exploit code was identified at the time of analysis; the stacked preconditions - former legitimate admin, stale cache, Replace Roles mode - materially limit real-world exploitation, and only former privileged users, not arbitrary subscribers, can abuse it.
Privilege escalation in the Bit Integrations - Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress (all versions up to and including 2.10.6) allows unauthenticated attackers to overwrite an administrator's password and take over the admin account. The plugin stores raw, attacker-controlled field values - including user_pass and user_email - verbatim into wp_btcbi_log.field_data on anonymous front-end requests with no capability check, and when an administrator clicks 'Re-execute' on the resulting failure log row, the stored payload is replayed inside that administrator's session and written to the administrator's own user record. Exploitation is not automatic: it requires a non-default configuration in which an administrator has mapped a user-supplied form field to the user_pass parameter of the WP User Registration 'Update User' action, plus the manual Re-execute click (CVSS 3.1 AV:N/AC:H/PR:N/UI:R), so an anonymous remote attacker can plant the payload but cannot complete the escalation alone; no public exploit code was identified at time of analysis.
Local privilege escalation in Hyland Desktop Host for Windows (all versions before 25.1.1) lets a low-privileged local user gain full administrative control of the host by abusing weak filesystem permissions on the directory from which a privileged service runs. The affected service executes out of %PROGRAMDATA%\Hyland\DesktopHost\bin, a location writable by non-administrative users; an attacker who can drop or replace a binary or library there and trigger a service (re)start causes that code to execute with the service's elevated (typically SYSTEM) context, yielding confidentiality, integrity, and availability impact across the host (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), although the attack is technically straightforward to reproduce on a shared or multi-user machine where an unprivileged account already exists.
Server-side request forgery in Adobe Content Credentials (CAI Content Credentials SDK) allows unauthenticated remote attackers to induce the server to make arbitrary outbound requests, potentially reaching internal services and escalating privileges. The CVSS 3.1 base score is 8.6 (HIGH) with a changed scope, high confidentiality impact, and no integrity or availability impact. Exploitation requires no user interaction; no public exploit code has been identified at time of analysis, and the vendor advisory APSB26-163 should be consulted for fixes.
Server-side request forgery in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) allows an authenticated low-privileged attacker to coerce the application server into issuing requests to internal resources, yielding elevated access and disclosure of data outside the attacker's intended scope. Adobe assigns this a CVSS 3.1 base score of 7.1 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N); exploitation is non-deterministic because the vendor states success depends on conditions beyond the attacker's control, and it requires an existing foothold as a low-privileged account. There is no public exploit identified at time of analysis and no CISA KEV listing, so the practical risk profile is that of a moderate-severity, post-authentication SSRF rather than a remotely exploitable unauthenticated flaw.
Server-side request forgery in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) lets an attacker who already holds a high-privileged ColdFusion account force the server to issue requests to internal or otherwise restricted resources, resulting in privilege escalation and unauthorized access to internal services. The vulnerability is network-reachable (AV:N), needs no user interaction (UI:N), but is gated by the high-privilege precondition (PR:H), so it is not exploitable against default unauthenticated configurations - the practical risk is concentrated on internet-exposed ColdFusion administrative interfaces and insider or post-compromise scenarios. The CVSS vector changes scope (S:C), meaning the attacker can leverage the vulnerable ColdFusion component to affect resources outside its own security authority, and no public exploit code has been identified at time of analysis. This is a solid-priority-but-not-emergency issue rather than an emergency, driven mainly by the privileged access required to trigger it.
Server-side request forgery in Adobe ColdFusion 2023 (≤2023.0.25) and ColdFusion 2025 (≤2025.0.13) lets unauthenticated, network-reachable attackers coerce the server into issuing arbitrary outbound requests, with the changed scope (S:C) allowing those requests to pivot into back-end or cloud services that can confer elevated privileges. Rated CVSS 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, CWE-918), the flaw requires no authentication and no user interaction per the vector, but real-world data exposure depends on the ColdFusion instance having reachable internal targets such as cloud metadata endpoints or internal APIs. No CISA KEV listing and no public exploit code were identified at time of analysis, yet the default-configuration exposure of affected versions makes prompt patching advisable.
Server-side request forgery in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) allows a low-privileged authenticated attacker to make the ColdFusion server issue requests to internal or otherwise restricted resources, potentially escalating access and reading sensitive data. The vulnerability is rated CVSS 3.1 7.7 with scope changed and high confidentiality impact only; authentication as a low-privileged user is required (PR:L), no user interaction is needed, and no public exploit code was identified at time of analysis.
Server-side request forgery in Adobe ColdFusion 2025 (up to and including 2025.0.13) and ColdFusion 2023 (up to and including 2023.0.25) allows unauthenticated remote attackers to cause the server to make arbitrary requests, resulting in privilege escalation with the scope changed. This critical vulnerability has a CVSS score of 10.0 and requires no user interaction. No public exploit has been identified at the time of analysis.
Server-side request forgery in Adobe ColdFusion lets remote unauthenticated attackers force the server to issue requests to internal or otherwise protected endpoints, which Adobe flags as potentially escalating privileges across a security boundary. The affected builds are ColdFusion 2023 up to and including 2023.0.25 and ColdFusion 2025 up to and including 2025.0.13; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, base 8.6) confirms no user interaction and no authentication prerequisite, with confidentiality being the only impact dimension assessed. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, so risk derives from high internet/network exposure of affected builds rather than confirmed active exploitation. Real-world severity hinges on what the ColdFusion host can reach internally, since a scope-changed SSRF that touches cloud metadata services or internal admin APIs can yield credential material even without an integrity or availability impact.
Privilege escalation in Adobe Experience Manager (AEM) allows an authenticated, low-privileged user - an author or contributor-level account - to abuse an Improper Restriction of XML External Entity Reference (XXE, CWE-611) in XML parsing and thereby read local files and reach internal resources well beyond their intended permissions, crossing a security boundary as reflected by the scope-changed CVSS 9.6 rating. The vector is network-reachable with no user interaction required (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N), so the only real precondition is obtaining valid low-tier credentials, which makes author instances and deployments with broadly provisioned low-privilege accounts the highest-risk exposure. No public exploit code has been identified at time of analysis, and builds updated past the affected ranges are not exploitable.
Authenticated privilege escalation in Omnispace's Agora Project before 26.10.0 allows any regular, non-administrative member to create new user accounts by directly invoking the user-edit action actionVueEditUser, which is missing the editRight() function-level authorization check that guards comparable administrative actions. The flaw is reachable over the network by an attacker who already holds a valid member login (CVSS vector PR:L, no user interaction required) and results in high integrity impact and limited confidentiality exposure, with the practical risk concentrated in self-registration-enabled, shared or multi-tenant deployments where member accounts are easy to obtain. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; a vendor patch is available in version 26.10.0, and the VulnCheck advisory classifies the weakness as broken function-level authorization (Authentication Bypass / Privilege Escalation).
Heap-based buffer overflow in the Windows WebDAV implementation lets a locally authenticated attacker with only low privileges corrupt heap memory and elevate privileges on the same host, yielding high confidentiality, integrity and availability impact (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U). Exploitation requires a pre-existing foothold - code execution as a normal user on the target and reachable WebDAV/WebClient functionality - so this is a post-compromise privilege-escalation primitive rather than a remote entry point, and CISA's SSVC assessment marks it non-automatable, i.e. not suited to wormable mass exploitation. No public exploit code and no active exploitation have been identified at time of analysis, but Microsoft has shipped patches and real-world risk is concentrated on multi-user hosts such as RDS/terminal servers and shared workstations where several low-privileged users can run code.
Privilege escalation in Microsoft SharePoint Server Subscription Edition lets an authenticated attacker who holds only a low-privileged account escalate to full control over the affected farm, with high impact to confidentiality, integrity, and availability (CVSS 8.8, vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is reachable over the network with low complexity and no user interaction, but it is not pre-authentication - an attacker must first obtain or already possess valid SharePoint credentials. Affected are deployments of SharePoint Server Subscription Edition 16.0.0 prior to build 16.0.20326.20190; patched builds are not exploitable. No public exploit code has been identified at time of analysis, CISA SSVC rates exploitation as none, and Microsoft has released a vendor fix, so this is a high-priority but not emergency patch.
Privilege escalation in upKeeper Instant Privilege Access through version 1.7.1 lets a local, authenticated low-privileged user gain elevated privileges by triggering improper handling of undefined values during input processing, with user interaction required for the escalation to succeed. The flaw carries a CVSS 4.0 base score of 8.6 (High) driven by total confidentiality, integrity and availability impact across both the vulnerable component and subsequent systems, although local access (AV:L), a valid low-privileged account (PR:L) and mandatory user interaction (UI:A) materially constrain real-world exploitability. There is no public exploit identified at time of analysis, and CISA SSVC assessment records Exploitation: none with Automatable: no, meaning scripted or fully autonomous attacks are not expected.
Heap-based buffer overflow in the Windows SMB Client lets remote attackers elevate privileges on affected Windows hosts by compelling the target's SMB client to connect to an attacker-controlled server. The vulnerability carries a 9.8 CVSS score (AV:N/AC:L/PR:N/UI:N), though it is a client-side direction flaw: the attacker must induce an outbound SMB connection rather than reach a listening service, and the sources do not describe the trigger, so the true degree of coercion or user interaction is unverified. CISA SSVC rates exploitation as 'none' with Automatable 'no' and total technical impact, EPSS is modest at 0.77% (55th percentile), and no public exploit code has been identified at time of analysis; Microsoft has released fixes.
Lenve vhr through commit 03abbd3 exposes BCrypt password hashes, phone numbers, and addresses for all operators to any authenticated user who requests GET /chat/hrs. A low-privileged operator account (CVSS PR:L) is sufficient, making this a confidentiality-only privilege-escalation enabler if weak hashes are cracked offline; the assessed impact is CVSS 7.1 with no integrity or availability impact. No CISA KEV confirmation or public exploit code was identified at time of analysis.
Privilege escalation in Dockhand before 1.0.50 allows an attacker who holds administrative rights in a different tenant of a shared OIDC provider such as Microsoft Entra ID to obtain Dockhand administrator access by recreating the group Dockhand maps to its admin role and signing in, because the application fails to validate the OIDC iss, aud, nonce, and exp claims. The issue is rated CVSS 4.0 9.2 (critical) on network reach, no privileges required on Dockhand itself, no user interaction, and full confidentiality, integrity, and availability impact once admin access is obtained, though exploitation requires a shared multi-tenant IdP deployment and knowledge of the mapped group name, so single-tenant or isolated IdP deployments are not affected. No public exploit identified at time of analysis and the vulnerability is not in CISA KEV; a vendor patch is available in 1.0.50.
Local privilege escalation in WSUS (Windows Server Update Services) allows an authenticated low-privileged attacker with local access to elevate privileges by exploiting incorrect default permissions (CWE-276). The vulnerability has a Microsoft-assigned CVSS 3.1 score of 7.5 (AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H), indicating high attack complexity and required user interaction, but it can lead to full compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, and a patch is available per the Microsoft advisory.
Privilege escalation in Leantime prior to 3.10.0 allows an authenticated low-privilege user to create a full administrator account, or to install, enable, disable and remove plugins, by calling methods exposed through the application's JSON-RPC dispatcher. Any user holding a valid ordinary browser session can trigger this by sending the required X-Requested-With: XMLHttpRequest header and invoking leantime.rpc.api.api.createApiKeyWithProjects with an attacker-chosen role, because PermissionEnforcer::enforce treats API service methods that lack a RequiresPermission attribute as public; exposure widens significantly on installations where open or self-service registration is enabled, since obtaining the prerequisite low-privilege session becomes trivial. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects complete compromise of confidentiality, integrity and availability once the privilege boundary is crossed, and the vendor has shipped a fix in version 3.10.0.
Zoom Workplace clients with the Zoom Phone feature contain a network-reachable buffer overflow (CWE-120) that can lead to privilege escalation and full compromise of confidentiality, integrity, and availability on the targeted client. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H, base 8.0) requires user interaction and high attack complexity, and it indicates low privileges are needed even though the vendor description claims unauthenticated access-this authentication prerequisite is unverified. No public exploit identified at time of analysis.
Privilege escalation in the custom URL scheme handler of Zoom Workplace for Android before version 7.2.1 allows an attacker who can get the device to process a crafted link or invoke the handler (for example via a co-resident malicious app) to gain capabilities beyond those the invoking context should hold, with high confidentiality and integrity impact per the assessed CVSS of 8.1. Only the Android client is indicated; iOS and desktop builds are not referenced in the affected CPE, and installations at 7.2.1 or later are not affected. There is no CISA KEV listing and no public exploit code identified at time of analysis, and the authentication prerequisite is genuinely ambiguous: the description suggests an unauthenticated network attacker while the published CVSS vector (PR:L) and the independent assessment differ on whether any session is required, so treat the exploitability preconditions as unresolved pending confirmation from Zoom. Note that the vendor vector (PR:L/UI:N) and the assessed vector (PR:N/UI:R) diverge, meaning it is not settled whether success needs a low-privileged session or user interaction with a crafted link.
Newline injection in the Ftps.add API of Froxlor 0.10.0 through versions prior to 2.3.14 lets an authenticated customer account insert arbitrary entries into the root-owned NSS group database, ultimately enabling local privilege escalation on affected hosts. The unvalidated additional_members parameter accepts embedded newline characters, and the REBUILD_NSSUSERS cron job later writes those values without sanitization into /var/lib/extrausers/group, so an attacker with a valid customer login can seed privileged group memberships that are cashed in only once they obtain local access to the machine. Exploitation is gated by customer-level authentication (CVSS vector PR:L) and by the host being deployed with the libnss-extrausers backend with the rebuild cron active; no public exploit code identified at time of analysis, and there is no confirmed actively exploited (CISA KEV) status.
Unauthenticated remote attackers can achieve code execution and privilege escalation against NVIDIA AIStore for Linux by injecting arbitrary Kubernetes host-namespace and container security settings into the legacy ETL Kubernetes PodSpec initialization API, rated CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) because the impact escapes the AIStore workload and extends to the underlying Kubernetes node and cluster. The vector confirms the attack is network-reachable with no privileges or user interaction required, though practical exploitation depends on the legacy ETL/transformation feature being enabled and the ETL API being exposed, and on Kubernetes RBAC and PodSecurity admission being permissive enough for AIStore to actually schedule host-namespaced or privileged pods. At time of analysis there is no confirmed active exploitation (CISA KEV) and no public exploit code identified, but the vendor-reported severity, the scope-changed impact, and CWE-250 (execution with unnecessary privileges) place this in top-priority territory for any cluster running an exposed AIStore ETL endpoint.
Privilege escalation in Mozilla Firefox's WebExtensions component allows remote attackers to reach high confidentiality, integrity, and availability impact inside the browser's privileged context, provided the victim performs an interaction such as visiting attacker-controlled content (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8). Unauthenticated attackers can reach the flaw over the network against default installations, but the required user interaction rules out a zero-click drive-by path. All Firefox builds before 158 and Firefox ESR builds before 153.5 are affected; upgrading to 158 or ESR 153.5 removes the condition. There is no public exploit identified at time of analysis and CISA's SSVC decision framework rates exploitation as 'none' and automatable as 'no', making this a genuine high-priority patch item rather than an emergency.
Privilege escalation in the DOM: Navigation component of Mozilla Firefox (prior to 158) and Firefox ESR (prior to 153.5) lets an unauthenticated attacker gain elevated privileges inside the browser when a victim loads attacker-controlled web content, producing high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.8, CWE-269). The sole gate on exploitation is user interaction (UI:R, PR:N): the victim simply has to render a hostile or compromised page in an unpatched build, with no authentication, special configuration, or local access required. No public exploit code has been identified at time of analysis, and CISA's SSVC triage records exploitation as "none" with technical impact "total" and automatable as "no"; combined with the absence of KEV listing and EPSS data, this reads as a genuinely high-severity but not yet demonstrably exploited issue whose urgency depends on future exploit development. Vendor-released patches are available in Firefox 158 and Firefox ESR 153.5, and upgrading fully removes the exposure.
Privilege escalation in Mozilla Firefox's Panning and Zooming component lets an attacker who gets a target to render crafted content cross a privilege boundary inside the browser, with high impact to confidentiality, integrity and availability (CVSS 8.8). Affected builds are Firefox before 158 and Firefox ESR before 153.5, which Mozilla fixed via advisories mfsa2026-106, mfsa2026-108, mfsa2026-109 and mfsa2026-110. Exploitation status: no public exploit identified at time of analysis, and EPSS is low at 0.19% (8th percentile), but the input vector and our independent assessment disagree on the exploit preconditions (PR:L/UI:N versus PR:N/UI:R), so reconcile those signals before prioritization; authentication requirements are not confirmed from available data.
Privilege escalation in Mozilla Firefox's WebExtensions component allows an extension-level actor to gain capabilities beyond those it was granted, yielding high confidentiality and integrity impact; all Firefox builds prior to version 158 are affected, with the fix delivered in Firefox 158 via Mozilla security advisories mfsa2026-106 and mfsa2026-109. Exploitation requires a low-privileged foothold - in practice an already-installed malicious or compromised browser extension reaching the vulnerable privilege-management code path (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-269) - and no public exploit code has been identified at time of analysis. EPSS is low at 0.16% (4th percentile) and the flaw is not listed in CISA KEV; signals are mixed and point to a moderate, not emergency, priority, with the AV:N rating questionable for an extension-context escalation and worth verifying with Mozilla.
Privilege escalation and information disclosure in Mozilla's Process Sandboxing component let attacker-controlled web content break out of the Firefox content-process sandbox on unpatched installations - Firefox before 158 and Firefox ESR before 153.5 - with high confidentiality, integrity and availability impact (CVSS 3.1 base 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Exploitation is remote and requires no attacker authentication, but it is user-driven: the victim must actively load the malicious page, and CISA's SSVC assessment records Exploitation: none and Automatable: no, so this is a targeted client-side risk rather than a mass-exploitation candidate. There is no public exploit identified at time of analysis, and vendor-released fixes ship in Firefox 158 and Firefox ESR 153.5 (MFSA 2026-106 and MFSA 2026-108).
Privilege escalation in Mozilla Firefox's Application Update component allows a locally present, low-privileged attacker to elevate their privileges on the affected host, with the input CVSS 3.1 score of 8.8 (High) reflecting complete confidentiality, integrity, and availability impact. Exploitation requires only low privileges with no user interaction and is limited to unpatched builds prior to Firefox 158 and Firefox ESR 153.5; systems updated to those versions are not affected. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV) signal, with the EPSS score remaining low at 0.19% (8th percentile).
Authenticated, low-privilege users of Siemens RUGGEDCOM CROSSBOW running any version earlier than V6.0 can bypass access controls on sensitive configuration records and retrieve administrative credentials for various internal systems, yielding unauthorized information disclosure and follow-on privilege escalation. The defect is an authorization bypass through a user-controlled key (CWE-639) that is network-reachable with low attack complexity but requires a valid session, consistent with the CVSS 4.0 vector's PR:L and high confidentiality, integrity and availability impact confined to the CROSSBOW system itself. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Siemens has released V6.0 to correct the condition.
Authenticated database users can escalate privileges and execute arbitrary operating-system commands on hosts running SIMATIC WinCC V7.5 (all versions), V8.0 before Update 11, and V8.1 before Update 7 because the application assigns excessive permissions to a database role (CWE-266). Exploitation requires a remote attacker to already hold valid database credentials and network reachability to the WinCC database service, but no user interaction is needed; no public exploit code has been identified at time of analysis. Siemens rates the issue 8.7, and while the impact is high, our independent assessment classifies it as a credible operational-technology priority rather than an emergency because the prerequisite of authenticated database access and network segmentation limits the realistic attack surface.
Local capability escalation in the macOS build of the DigiD app (Logius) lets an attacker who already holds user-level code execution on the same Mac inject an arbitrary dynamic library into the DigiD process and run code under the app's identity, reaching DigiD data and cryptographic operations the process would not normally expose - CVSS 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). The root cause is that the app binary is not signed with the Hardened Runtime flag, so the loader still honours DYLD_INSERT_LIBRARIES; this is a post-compromise escalation primitive, not a remote or initial-access bug, and it grants no privilege beyond the app's own context (S:U) and no availability impact. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV); a Hardened-Runtime-signed build blocks the injection path and is available per the vendor advisory pointing at the Mac App Store listing.
Privilege escalation in HTMLy 3.1.1 allows a remote attacker to elevate from a low-privileged account or session to administrative control by abusing the get_feed function in the admin.php component. The supplied CVSS 3.1 score is 9.8 with PR:N, but the independent assessment applies PR:L because CWE-269 privilege-escalation issues realistically require some existing access; no CISA KEV or confirmed active exploitation is provided, and no public exploit was identified at time of analysis. Exposure is limited to HTMLy 3.1.1 installations where the admin interface is reachable, and keeping admin.php off the public internet substantially reduces risk.
Privilege escalation in Frappe ERPNext lets any authenticated user - including one holding no operational role - create privileged records such as user accounts and role assignments, ultimately taking full control of the site. The flaw affects releases before 15.111.0 and 16.x before 16.22.0, and stems from a record-creation endpoint that derives the record type from the request and inserts it with permission checks disabled; the only prerequisite is a valid login (CVSS 4.0 vector PR:L, i.e. authenticated, no user interaction, no non-default configuration). Rated 8.7 with high confidentiality, integrity and availability impact across the vulnerable site, and no public exploit code has been identified at time of analysis.
Authenticated low-privilege users of Open WebUI versions 0.8.6 up to but not including 0.11.4 can escalate privileges through the terminal proxy endpoint /api/v1/terminals/{server_id}/{path}, which forwards requests to the backend Terminals administrator API with the shared key attached; by targeting admin paths directly, an attacker can enumerate and stop other users' terminals, modify terminal policies, and inject environment variables into other users' sessions. The flaw is a missing-authorization (CWE-862) path-confusion issue reachable by any account with PR:L and no user interaction, and it only matters where the terminals feature is enabled against configured terminal servers in a multi-user deployment. No public exploit code has been identified at time of analysis and the issue is not tied to any confirmed active exploitation, but the vendor has shipped a fix and the independent assessment rates this as a genuine, moderate-priority risk rather than an emergency.
Improper access control in the Location Service for Esri component of IBM Maximo Application Suite 9.0, 9.1, and 9.2 allows an attacker who already holds high privileges on the underlying Kubernetes/OpenShift platform to abuse a schema-less Custom Resource Definition (CRD) and escalate to full read and write control over affected resources, since the CRD enforces no input validation and the component applies insufficient authorization checks. Exploitation requires authenticated high-privilege access (CVSS vector PR:H), no user interaction, and the optional Esri Location Service add-on to be deployed, so the barrier to entry is significant; the assessed vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H for a base score of 7.2. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), making this a moderate-priority, high-barrier issue rather than an urgent widespread threat - though successful abuse yields high confidentiality and integrity impact on the Maximo environment.
Improper privilege management in Rapyd Admin (the open-source Rapyd Admin scaffolding package for Laravel) versions 9.0.0 through 9.19.x lets an authenticated user who already holds the 'edit users' permission - the shipped 'operator' role is sufficient - promote their own account to the 'admin' role by submitting the admin role ID through the UsersEdit Livewire component, which prior to 9.20.0 synced browser-supplied roles without validating them against a server-side allow-list. Successful exploitation lifts tenant scoping, bypasses per-record authorization and enables impersonation of other users, including higher-privileged accounts, giving high confidentiality, integrity and availability impact within the affected installation. The flaw is fixed in v9.20.0, which computes assignable roles server-side and prevents a non-super-admin from granting a role to itself; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the prerequisite of an already-delegated privileged account makes this an insider or compromised-account escalation rather than a default-configuration, unauthenticated issue.
Incorrect privilege assignment in the CICD-toolchain-for-serverless-applications IAM policy (versions 1.0.7 through 1.0.10) lets an authenticated user who can push to the application source repository escalate privileges beyond the application stack inside the same AWS account. Because the CloudFormation deployment role is not scoped to the application's own resources, an attacker-supplied application template processed by the toolchain pipeline can read or modify unrelated IAM role policies, Secrets Manager secrets, and SSM parameters. Exploitation is gated on repository push rights (CVSS PR:L) and on the pipeline actually deploying the crafted template; no public exploit code and no confirmed active exploitation were identified at time of analysis, and AWS has released 1.0.11 to close the path.
Froxlor before 2.3.15 allows an authenticated hosting customer with write access to their document root to escalate to root by replacing the statistics directory with a symlink, so the root-run traffic cron's recursive chown follows the link and changes ownership of arbitrary host directories. Exploitation requires a valid customer account, enabled goaccess/webalizer/awstats statistics, and execution of the scheduled traffic cron; no public exploit identified at time of analysis. Vendor-released patch: 2.3.15.
Cross-tenant privilege escalation in StreamsHub Console for Apache Kafka allows an authenticated Kubernetes tenant that can create or modify Console custom resources to point spec.containers.api.spec.image at an arbitrary container image, which the operator then deploys into a pod running under a ServiceAccount bound by ClusterRoleBinding to cluster-wide Strimzi CRD read access, Kafka/KafkaRebalance patch rights, and cluster-monitoring-view. The attacker-controlled code reads the projected ServiceAccount token and gains read/write control over the Strimzi control plane across tenant boundaries, with high confidentiality and integrity impact (CVSS 9.9, scope changed). Exploitation is gated by the tenant-level RBAC permission rather than being open to the internet, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in Apple macOS Sequoia before 15.8 and Tahoe before 26.7 allows an app already running on the host to gain elevated privileges, rated CVSS 3.1 7.8 (CWE-269, Improper Privilege Management). Exploitation requires local code execution as an unprivileged app (AV:L, PR:L) and no user interaction; it is not remotely reachable and patched systems are unaffected. No public exploit code or CISA KEV entry was identified at time of analysis.
Local privilege escalation in IBM Sterling Connect:Direct for UNIX (6.3.0.0-6.3.0.7 and 6.4.0.0-6.4.0.6) allows an authenticated local attacker with a low-privileged account to gain elevated privileges through improper privilege management. The CVSS 3.1 score is 8.4 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N), reflecting high confidentiality and integrity impact to the host with scope change, but the attack is not remotely reachable. No public exploit was identified at the time of analysis, and exploitation requires an existing local foothold on a host running the affected Connect:Direct components, likely under elevated privileges.
Local privilege escalation in Progressive Robot hMailServer 6.0.0 through 6.3.6 allows any authenticated, non-administrator user on the host to run code as LocalSystem or as the mail server's virtual service account, but only when the installer was pointed at a folder that inherits writable permissions from its parent, such as the root of an NTFS drive. The installer accepts any path without warning and creates neither the program folder nor its Bin subfolder with explicit permissions, so a drive-root install leaves Bin writable to Authenticated Users (Modify on Windows clients) or Users (create files and folders on Windows Server); the default Program Files installation grants ordinary users only read and execute and is explicitly not affected. No public exploit code or active exploitation is confirmed at time of analysis, and the reference to the v6.3.7 release indicates the vendor has shipped a fixed version.
SQL injection in Integratec's pre-authentication login endpoint (/login/ap_Login.aspx/start) allows remote unauthenticated attackers to read database contents-including credentials and user information-by supplying a crafted UNION-based payload in the sInfo POST parameter. The report carries an 8.8 CVSS score, and our independent assessment is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L, with no authentication or user interaction required; exploitation is limited mainly by whether the login interface is reachable from untrusted networks. No public exploit code was identified at time of analysis, but our independent assessment treats this as a credible, actionable priority rather than a paper-tiger high score.
Local privilege escalation in the Linux kernel's RDS Infiniband transport is possible when rds_ib_map_frmr() leaves a stale scatterlist in a memory region returned to the MR pool after a DMA mapping or registration failure; a local user who can open PF_RDS sockets on a kernel built with CONFIG_RDS/CONFIG_RDS_RDMA and the rds_rdma/ib path can later trigger a use-after-free during MR teardown. Exposure is limited to systems using the non-default RDS-over-Infiniband subsystem, and EPSS is 0.22% (12th percentile) with the vuln.today decision label this_week; no public exploit identified at time of analysis, and a vendor patch is available. The assessed CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8), consistent with a local privilege-escalation primitive requiring a local account rather than a remote attack.
Privilege escalation in the Login with phone number WordPress plugin (through version 1.8.77) allows unauthenticated remote attackers to potentially obtain elevated privileges, with high attack complexity reflecting conditions such as timing or a specific registration/login state that the attacker does not fully control. The issue is CWE-266 incorrect privilege assignment and carries a CVSS 8.1 score with high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and no CISA KEV status was provided; defenders should prioritize patching internet-facing WordPress sites running this plugin.
OttoKit (SureTriggers) WordPress plugin through 1.1.40 contains an incorrect privilege assignment flaw that can allow remote attackers to escalate privileges, and the vendor CVSS vector scores it 9.8 with network reachability, low attack complexity, no privileges required, and no user interaction. Successful exploitation could lead to full WordPress site compromise given the high confidentiality, integrity, and availability impact, though the provided data does not clarify whether a specific integration or API must be enabled or whether a pre-existing low-privileged account is required despite the PR:N rating; no public exploit identified at time of analysis.
Privilege escalation in the Salon Booking System WordPress plugin (10.17 through versions before 10.31.11) lets authenticated users who hold the plugin's custom salon staff role assign arbitrary capabilities, including administrator, to other accounts through the customer-editing function, enabling full site takeover. Publicly available exploit code exists, but the flaw is access-gated: it is not reachable by anonymous visitors or ordinary subscribers and requires a provisioned salon staff account, so exposure depends on how widely that role is granted and on the hygiene of those accounts. It is not confirmed actively exploited (no CISA KEV entry) and no EPSS score was provided.
Missing authorization in phpMyFAQ before 4.1.9 allows authenticated non-superadmin accounts that hold the delete_user permission to delete superadmin users and strip administrative accountability from the application. The /admin/api/user/delete endpoint accepts a superadmin userId other than the protected userId 1, so an attacker with a low-privilege admin session can remove higher-privileged administrators; confidentiality is unaffected while integrity and availability impacts are high. No public exploit was identified at time of analysis, and exploitation is gated by the specific delete_user permission rather than being available to every authenticated user.
Privilege escalation in phpMyFAQ 4.2.0-alpha pre-release builds lets a category-restricted delegated administrator escape their assigned scope and grant groups unrestricted category access. The flaw resides in GroupController::saveCategoryRestrictions(), which fails to validate submitted categoryIds against the caller's own scope, so a crafted POST to /admin/api/group/category-restrictions with out-of-scope or empty values elevates the attacker's effective permissions. Exploitation requires valid credentials for a privileged but scope-limited admin role (PR:H), and no public exploit code or confirmed active exploitation has been identified at time of analysis; the affected range is a pre-release train that is unlikely to be widely deployed in production.
Privilege escalation in phpMyFAQ builds from 4.2.0-alpha.2 up to but not including 4.2.0-beta allows a non-superadmin administrator who holds GROUP_EDIT to abuse the group permission API's updatePermissions and updateMembers endpoints, grant a group rights beyond the attacker's language or category scope, and self-join that group to obtain unrestricted FAQ create, edit, and publish access across all languages and categories. The CVSS 4.0 base score is 7.0, but exploitation requires an authenticated scoped administrator account and is only meaningful in deployments that use delegated administration limited by language or category, since a single-superadmin installation offers no scoped boundary to escalate from. No public exploit identified at time of analysis.
Privilege escalation in phpMyFAQ pre-release builds (4.2.0-alpha.2 through versions before 4.2.0-beta) allows an administrator holding the USER_EDIT right to re-grant FAQ rights in a way that silently discards per-right language restrictions, yielding unrestricted create, edit, and publish access across every language. The flaw lives in UserController::updateUserRights and can be triggered against the attacker's own account by submitting a language-scoped rights update to the update-rights API. Exploitation is access-gated: it requires an authenticated operator with USER_EDIT (PR:H) and only affects the 4.2.0 development line, so stable installations outside that range are not exposed; no public exploit code or confirmed active exploitation was identified at time of analysis.
Stored cross-site scripting in the EU VAT Assistant for WooCommerce plugin (all versions up to and including 2.1.30.260413) lets an unauthenticated visitor inject arbitrary script through the customer-supplied 'vat_number' field at checkout, which is persisted and later rendered without escaping inside WooCommerce → Orders → Edit Order. The payload fires in the reviewing administrator's browser session, so a single poisoned order can be leveraged to create a rogue administrator account and take over the entire WordPress site. No public exploit code or confirmed active exploitation was identified at time of analysis, but the low attack complexity, lack of authentication requirements (CVSS PR:N), scope change, and the fact that the trigger is a routine admin workflow make this a genuine, actionable priority for any store running the plugin on default configuration.
Local privilege escalation in IBM i 7.3, 7.4, 7.5, and 7.6 allows an authenticated, low-privileged user to obtain QSECOFR/Root authority, as described in CVE-2026-102917. The vulnerability has a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires prior authentication and local access; it is not remotely exploitable. No public exploit code has been identified at time of analysis, and IBM has released a patch via its support advisory.
Unauthenticated administrative account creation in WhaTicket Community through commit cf04795 allows remote attackers to self-register as administrators via POST /auth/signup by omitting the profile field or setting it to admin. Successful exploitation grants control over user management, settings, and all tickets, contacts, messages, and WhatsApp connections. The flaw is unauthenticated and network-reachable under the assessed CVSS:3.1 vector, but no CISA KEV active exploitation is confirmed and no public exploit is explicitly identified at time of analysis, although a public technical writeup reference exists.
Local privilege escalation in cifs-utils lets an unprivileged local user obtain root on affected hosts by injecting unauthorized options into a privileged CIFS mount. When a root-owned service mounts a Common Internet File System share using a credentials file whose contents the attacker can control or influence - for example a file that is world-writable or lives in an attacker-owned path - cifs-utils assembles those unsanitized values into the mount option string, so the attacker can slip in extra options that bypass permission checks and cause files to be executed with administrative privileges. The flaw is tracked as CWE-88 (argument/option injection) with a CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); exploitation requires an existing low-privilege local account (authenticated, per PR:L) and a deployment where such a privileged, credentials-file-driven CIFS mount workflow exists, so internet-facing hosts that do not mount attacker-influenced CIFS shares are not at risk. No public exploit code or confirmed active exploitation was identified at time of analysis, and Red Hat has published advisory and Bugzilla tracking pages for RHEL 6 through 10 and OpenShift Container Platform 4.
Authenticated attackers with Subscriber-level or higher PilotPress membership on WordPress sites can escalate to full Administrator privileges by exploiting a flawed ONTRAPORT synchronization routine in PilotPress versions up to and including 2.0.43. The defect allows an attacker to rename a remote ONTRAPORT contact to an existing Administrator's WordPress login, then leverage the plugin's authentication hook to cause WordPress core to issue an Administrator authentication cookie. This is a genuine high-priority vulnerability (CVSS 8.8), requiring a valid ONTRAPORT contact and the Customer Center nonce, but no victim interaction. No public exploit code was identified at time of analysis.
Unauthenticated privilege escalation in the Cozmoslabs User Profile Builder WordPress plugin (all versions up to and including 4.0.3) allows an attacker to obtain a fully activated administrator account: they submit role=administrator through the public [wppb-register] registration form, then click the activation link emailed to them, and the activation handler applies that role via WP_User::set_role() without any allow-list check. The attack is conditional rather than trivial - the site must already carry a legacy registration form field with meta-name 'role' from before the 4.0.3 upgrade (the 4.0.3 reserved-name block deliberately exempts pre-existing fields), must have email confirmation enabled so the wp_signups path is used, and must allow open user registration. That combination of stable site-state prerequisites is why CVSS 3.1 scores it 8.1 with AC:H despite PR:N/UI:N, and no public exploit code has been identified at the time of analysis.
Privilege escalation in the Theme My Login plugin for WordPress (versions up to and including 7.2.1) allows unauthenticated attackers to change arbitrary user passwords on multisite installations in certain configurations, leading to account takeover and potential full network compromise. The flaw stems from improper validation of user identity before password updates (CWE-269). Exploitation requires a non-default multisite setup, and no public exploit code is identified at time of analysis; the effective attack complexity is higher than the base CVSS 9.8 score implies due to this configuration dependency.
Unauthenticated privilege escalation in the My Calendar - Accessible Event Manager WordPress plugin (all versions up to and including 3.8.7) allows remote attackers to overwrite the credentials of the default Administrator account (user ID 1) and gain full wp-admin access. The flaw arises from unsanitized reflection of the `mcs` GET parameter into post content, enabling injection of a nested `[my_calendar above=...]` shortcode that is processed by `mc_generate_calendar_nav()`, which calls arbitrary PHP functions via `call_user_func()` without authorization or callable allowlisting. No public exploit code has been identified at time of analysis, but the plugin's auto-generated `/my-calendar/` page is publicly accessible by default, making exploitation trivially reachable by an unauthenticated attacker.
Privilege escalation in the Nexter Extension WordPress plugin (all versions up to and including 4.7.11) allows an authenticated Subscriber-level or higher user to restore a stale stored Administrator role onto their own account, effectively becoming an Administrator. Exploitation is tightly constrained: the attacker's account must previously have held the Administrator role, must have used the plugin's View Admin Role Switcher, and must have been demoted specifically through the wp-admin/users.php?action=promote bulk role-change control rather than the Edit User screen. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV, and the assessed conditions are why the effective risk is lower than the 7.5 (HIGH) base score implies.
Unauthenticated attackers can take over any WordPress user account, including administrators, on sites running the MailOptin plugin up to version 1.2.78.6 that have a 'WordPress User Registration' opt-in form published. The flaw allows manipulation of the optin_data[form_custom_field_mappings] parameter to override saved mappings, enabling injection of arbitrary wp_users column names (e.g., ID, user_pass) into wp_insert_user(), which then updates the target account's password. No authentication, nonce, or capability check is required, and the only prerequisite is the presence of the registration form; sites using MailOptin solely for mailing-list optins without this connection are not affected. No public exploit identified at time of analysis.
Privilege escalation in the InstaWP Connect - 1-click WP Staging & Migration WordPress plugin (all versions up to and including 0.1.4.1) lets any authenticated user at Subscriber level or above read the site's plaintext InstaWP master API key from a plugin settings page and redeem it for a full administrator session. The key is disclosed because the admin page is registered with a role name returned by InstaWP_Setting::get_allowed_role() in place of a real capability, and because generate_section_field() prints the master API key directly into a plain-text HTML input without a manage_options check; the attacker then derives the bearer secret from that key, satisfies the plugin's REST validate_api_request(), and calls POST /wp-json/instawp-connect/v2/auto-login to mint a 30-second single-use login URL that sets an administrator authentication cookie. Exploitation is not default-configured: it additionally requires the site to be actively connected to InstaWP (a valid master API key in instawp_api_options) and an administrator to have added the attacker's role to the plugin's Sync Tab Access list (instawp_sync_tab_roles) while still retaining administrator in that list, so realistic exposure is narrower than the 7.5 base score implies. There is no public exploit code identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); authentication requirements are authenticated (CVSS PR:L) with high attack complexity (AC:H).
Privilege escalation in the Customer Email Verification for WooCommerce WordPress plugin through 3.3.0 allows unauthenticated attackers to gain authentication as any WordPress account that still has an unverified email address, including administrators, by brute-forcing a per-user activation secret that has only about 101 possible values. The weakness is genuine and high impact (full account takeover), but real-world risk is heavily gated by three preconditions: the plugin's 'Encoding method' must be set to the non-default 'hashids' option, the attacker must recover or brute-force the Hashids salt (which defaults to an md5(time()) value fixed at first initialization), and the targeted account's email must remain unverified. An upstream changeset addressing the issue is referenced in the WordPress plugin repository, and no public exploit code was identified at time of analysis; CVSS 3.1 scores it 8.1 (High, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), so despite the High score it should be triaged as lower priority than a default-configuration, unauthenticated account-takeover bug in most deployments.
Privilege escalation to full WordPress site takeover is possible in the Backuply backup/restore plugin (all versions up to and including 1.5.8) via a second-order SQL injection that an authenticated subscriber-level user plants in the profile Biographical Info field and that only fires when an administrator later creates a backup capturing that value and then restores it. During the restore the injected SQL executes blind inside an INSERT into wp_usermeta, allowing the attacker to alter database records - most notably to set the default_role option in wp_options to administrator and enable open registration, so a subsequently registered account is granted Administrator rights. Exploitation cannot be self-triggered by the attacker (UI:R) and requires a valid authenticated account (PR:L, no anonymous path); no public exploit identified at time of analysis.
Privilege escalation to root on Ivanti Connect Secure 22.8R2.4, where the dsinvoked broker improperly trusts DSCache configuration data and can be induced to act on attacker-controlled input. Exploitation is not remote in isolation: the CVSS vector (AV:L/PR:L/AC:H) requires an attacker to already hold a low-privileged foothold on the appliance plus the specific broker/DSCache state needed to satisfy the high attack-complexity constraint. The practical risk is elevated because the CVE description and Volexity reporting tie this flaw to chained exploitation of upstream unauthenticated issues in October 2026, which removes the local-access barrier for a real attacker; no CISA KEV entry is present in the supplied data, and no specific patch version is provided. Treat this as a genuine high-priority hardening item - the exploitation signals are reported but the remediation data is incomplete.
Path traversal in wildfly-core's deployment content handler allows an authenticated JBoss EAP, WildFly, Fuse 7, or Single Sign-On 7 user who holds the Deployer RBAC role to escape the restricted deployment directory and create files with attacker-controlled content or delete arbitrary directories on the server, escalating to full management SuperUser privileges. Exploitation requires that the Deployer role be delegated to the attacker (CVSS vector shows PR:L - authenticated, not anonymous) plus a crafted deployment name containing traversal sequences; environments that reserve the Deployer role for fully trusted administrators face little practical exposure. No public exploit code was identified at time of analysis and the flaw is not listed in CISA KEV, so this is a credible, actionable priority rather than an emergency.
Jinja2 template injection in Ansible Operator Plugins (CWE-1336) lets an authenticated Kubernetes user who can create or modify a custom resource reconciled by an affected Ansible-based operator execute embedded Jinja2 expressions inside the operator pod, achieving remote code execution and escalating to the operator's service account. Because these operators typically hold cluster-wide RBAC, successful exploitation crosses a privilege boundary (CVSS 3.1 base 8.5, AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H), affecting components of Red Hat Ansible Automation Platform 2, Red Hat Advanced Cluster Management for Kubernetes 2, the Migration Toolkit for Applications/Containers/Virtualization, OpenShift Service Mesh 3 and related Red Hat OpenShift and OpenStack streams. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; the high attack complexity reflects the prerequisite that the targeted operator must pass attacker-controllable CR spec values into Jinja2 templating without sanitization. This is a genuinely high-priority flaw rather than a CVSS-inflated one, but with an important authentication caveat: purely anonymous or read-only users cannot trigger it.
Authenticated XPath injection in the OPNsense firewall and routing platform (all versions prior to 26.1.10) lets a user holding CA Manager or Certificate Manager privileges recover values stored in config.xml character by character. The Trust module stores attacker-controlled certificate and CA refid values and interpolates them unescaped into XPath queries in CAsField.php and CertificatesField.php; because the resulting refcount/in_use boolean is returned to the requester, it acts as a blind injection oracle for secrets such as password hashes, API credentials, certificate private keys, VPN key material, and high-availability credentials, which in turn can enable privilege escalation and compromise of other security domains. Exploitation is post-authentication, requires those specific trust-management privileges, and is high-complexity and iterative (roughly one boolean leak per request), so this is a genuine but second-tier information-disclosure issue rather than a drive-by remote compromise; no public exploit code has been identified at time of analysis. Vendor-released patch: 26.1.10.
Boolean-based blind SQL injection in EspoCRM versions 8.1.0 through 9.3.7 allows an authenticated non-administrator to inject crafted expressions through the 'where' parameter of the GET entity streamAttachments endpoint, enabling extraction of arbitrary database contents - including active administrator session tokens - and subsequent full privilege escalation. The flaw requires a valid low-privilege session (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L, 7.6) and is not exploitable anonymously. Public exploit code exists for this issue, though it has not been confirmed as actively exploited (CISA KEV); EspoCRM 9.3.8 is the fixed release.
Cleartext credential disclosure in P4 Search (formerly Helix Search) 2026.4.2 and earlier allows an authenticated administrator on the connected P4 Server to retrieve stored credentials through the product's configuration API, enabling privilege escalation beyond the administrator's intended scope. The defect is rooted in insufficient granularity of access control (CWE-1220): the API exposes secret material that administrators should not be able to read back, and the resulting credential exposure has cross-boundary confidentiality, integrity, and availability consequences per the assessed scope change (S:C). Exploitation is privilege-gated by the PR:H authentication requirement in the CVSS vector, so this is not reachable by anonymous or unprivileged users, and no public exploit code or confirmed active exploitation has been identified at time of analysis. A vendor patch is available in P4 Search 2026.4.3.
Local privilege escalation in TotalAV versions up to 7.1.17 allows an authenticated but unprivileged local user to impersonate the SYSTEM service by forging a gRPC IPC authentication token, leading to arbitrary code execution as NT AUTHORITY\SYSTEM. Publicly available exploit code exists (a proof-of-concept C file is linked in the disclosure), though CISA KEV does not list the vulnerability as actively exploited, and the SSVC assessment rates exploitation as 'poc' with total technical impact. Exploitation requires a local foothold and the vulnerable TotalAV service to be running; it cannot be triggered remotely or against hosts without TotalAV.
Frontend Admin by DynamiApps (the acf-frontend-form-element WordPress plugin) through version 3.29.13 assigns privileges incorrectly, letting a submitted frontend form escalate the submitting user's role - most seriously to administrator - which on WordPress equates to full site compromise. The provided CVSS 3.1 vector scores this 9.8 as network-reachable with no privileges required (PR:N), while our independent assessment scores it 8.8 with PR:L, because the real-world precondition is that a Frontend Admin form capable of affecting roles (for example a user-registration or profile-edit form) is published and reachable by the attacker; sites that expose such a form to anonymous visitors are effectively unauthenticated targets, whereas sites gating it behind login require at least a low-privilege account first. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so there is no confirmation of active exploitation, though the low complexity and high payoff make opportunistic scanning plausible.
Rate-limit bypass in the Eclipse Connected Services Platform api-gateway (affected versions 1.1.1 through 1.7.3) allows any unauthenticated remote client to evade request throttling by rotating the value of the leftmost X-Forwarded-For header element, which the shipped default ClientIpKeyResolver trusts without validation. Because each unique header value produces a fresh rate-limit bucket, an attacker can issue unlimited requests against any route that relies on the default resolver and has rate limiting configured, degrading the availability protections the gateway is meant to enforce. No KEV entry or publicly available exploit code was identified at time of analysis, and EPSS is low (0.15%, 4th percentile); CISA SSVC rates exploitation as 'none' while noting the issue is automatable, so mass scanning should be expected even without a dedicated exploit. The net effect is a moderate-priority security-control bypass (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) rather than a system compromise, with deployments that customize the key resolver or sanitize X-Forwarded-For at a trusted edge proxy unaffected.
Privilege escalation in the Fluent CRM WordPress plugin version 3.2.5 and earlier allows an authenticated low-privileged user - such as a subscriber or self-registered account - to elevate their privileges and gain control over site resources, with a CVSS 3.1 score of 8.8 and high impact to confidentiality, integrity, and availability. Exploitation is not anonymous: it requires a valid low-privilege WordPress account plus an active vulnerable plugin installation, but no user interaction is needed (PR:L, UI:N) and no non-default configuration is named in the advisory. No public exploit identified at time of analysis; this is a genuine priority, not a high-CVSS-but-low-real-risk issue.
Privilege escalation in the Fluent CRM WordPress plugin (all versions through 3.2.5) allows a low-privileged account to elevate itself to higher privileges, including administrator-equivalent capabilities, by abusing an incorrectly assigned privilege (CWE-266). The vendor-supplied vector scores this 9.8 (AV:N/AC:L/PR:N/UI:N), but the independent vector analysis assigns PR:L, meaning the realistic starting point is an authenticated low-privileged WordPress account, and that prerequisite is the one condition that most changes the real-world risk; the exact vulnerable endpoint and required account level are not detailed in the available data. No public exploit code has been identified at time of analysis, and Fluent CRM is not listed in CISA KEV; the sole public reference is the Patchstack advisory. Sites running Fluent CRM 3.2.5 or earlier should treat this as high priority because WordPress administrator takeover typically yields full site compromise, data theft, and persistent backdooring.
Local privilege escalation in the FreeBSD kernel kqueue subsystem affects FreeBSD 15.1-RELEASE before patch level p4, where a race condition in the parent-to-child knote copy path can free a marker knote and cause a use-after-free. A local user with low privileges (PR:L) may leverage this to corrupt kernel memory and potentially escalate privileges, though exploitation requires winning a high-complexity, non-deterministic timing race (AC:H). No public exploit code or confirmed active exploitation was identified at time of analysis; EPSS is low at 0.14% (3rd percentile).
Out-of-bounds access to kernel heap memory in FreeBSD's System V semaphore subsystem allows an unprivileged local user to potentially escalate privileges or crash the kernel. The flaw is a race in semop(2): the invoking thread blocks, releases the per-set lock, and on wake-up re-validates its semaphore set using a 15-bit sequence number embedded in the IPC identifier; if roughly 32,768 sets are created and destroyed in the same table slot during that window, the counter wraps and the kernel falsely treats a freed/reused set as still valid, leading to an out-of-bounds dereference (CWE-787). Exploitation requires local code execution and a timing-dependent counter wrap, so practical risk is limited despite the total technical impact rating - no public exploit code has been identified at time of analysis, EPSS is 0.18% (7th percentile), and CISA SSVC records Exploitation: none, Automatable: no.
Unauthenticated attackers can register an administrator-equivalent account on any WordPress site running the User Rights Access Manager plugin through version 1.1.3, resulting in full site takeover. The plugin leaves one of its AJAX account-registration handlers accessible without any capability or nonce check, and assigns newly self-registered users a role that was created as a direct copy of the administrator role, so a single crafted request yields a fully privileged account. Publicly available exploit code exists, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) confirms the attack is remote, unauthenticated, and requires no user interaction; no CISA KEV entry has been reported, so active exploitation is not confirmed, but the low complexity and public proof-of-concept make this a high-priority patch target wherever the plugin is deployed.
Credential theft in Heym 0.0.55 through 0.0.120 allows a shared collaborator to seize the error_workflow_id execution field and repoint it at an attacker-controlled workflow containing an HTTP node, so that when the owner's parent workflow enters an error state the owner's decrypted credentials are injected into the attacker's workflow and exfiltrated over the network. The attack is remote and low-complexity, requiring only low privileges - an existing collaboration grant on the target workflow (PR:L per both the supplied CVSS 4.0 vector and the assessed CVSS 3.1 vector) - with no user interaction, producing high confidentiality impact and only low integrity impact from the single overwritten field. No public exploit code or CISA KEV entry was identified at time of analysis, and single-owner Heym deployments that do not use shared collaborators are not exposed.
Local privilege escalation in Metalama allows an unprivileged user on a shared Linux or macOS host to plant a malicious .NET assembly in the world-writable system temp directory that will later be loaded and executed by a higher-privileged victim's build process. Metalama cached and extracted compile-time assemblies, auxiliary tools, and embedded helper assemblies under Path.GetTempPath() (/tmp) and trusted existing artifacts solely on a sentinel '.completed' marker file rather than any integrity check, so an attacker can pre-create the deterministic directory layout and rely on the marker to skip regeneration. Exploitation requires a pre-existing local account on the same shared machine or CI/build agent and a victim build initiated afterward; Windows default configurations are not affected because per-user temp ACLs prevent cross-user planting. No public exploit code has been identified at time of analysis and there is no KEV listing, but EPSS-style urgency is moderate given the low attack complexity and the availability of a vendor fix in 2026.1.19 (and 2025.1.18 on the older branch).
A heap-based buffer overflow in the eventd daemon of Juniper Networks Junos OS and Junos OS Evolved allows a local unprivileged attacker to send crafted IPC messages, leading to denial of service or privilege escalation to root. The vulnerability affects all platforms and carries a CVSS 4.0 base score of 8.6 due to high confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis; exploitation requires a pre-existing local account or foothold on the device, and network-based unauthenticated attacks are not possible.
A privilege escalation in KEDA 2.20.2 and earlier lets a namespace administrator who can create TriggerAuthentication and ScaledObject resources point hashiCorpVault.address at an endpoint they control and select Kubernetes authentication without supplying a credential; KEDA then logs in to that endpoint using the operator pod's projected ServiceAccount token, handing the attacker the operator's cluster-wide permissions including broad Secret reads and workload or admission-related operations. The prior CVE-2025-68476 JWT-shape filter does not block this path because the operator token's subject is a Kubernetes ServiceAccount, so it passes the filter. Exploitation is authenticated (CVSS PR:L) and gated by tenant-level RBAC to create those CRDs, but it is most dangerous in multi-tenant clusters where namespace admins are untrusted relative to the cluster-scoped operator; there is no public exploit code identified at time of analysis, and the issue is fixed in 2.21.0 via audience enforcement plus an outbound Vault-address allowlist.
Local privilege escalation in the SUID-root mount(8) utility shipped with util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, where the attacker-controlled LIBMOUNT_FORCE_MOUNT2 environment variable is read with getenv() and can force the legacy, non-atomic multi-step bind-mount path. On hosts whose /etc/fstab contains a bind mount authorized for unprivileged use via the user or users option and hardened with nosuid, noexec, or nodev, a local low-privileged user can win a timing race between the initial bind mount and the follow-up remount that applies those protective flags, briefly exposing an unprotected mount from which a SUID binary can be executed to obtain root. Exploitation is conditional (it requires that specific non-default fstab configuration) and non-deterministic because it depends on a race window; no public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV). Vendor-released patches are available in util-linux 2.41.5 and 2.42.2.
Local privilege escalation in MyReport Updater through 2.1.1 allows authenticated low-privileged local users to gain SYSTEM rights by abusing the updater service's gRPC interface (UpdaterManager.exe) to set a malicious reference server and arbitrary installLocation, then planting a DLL such as HID.dll that is loaded by osk.exe. Publicly available exploit code exists, though no confirmed active exploitation (not in CISA KEV). With a CVSS 4.0 score of 8.5 and assessed CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, this is a genuine, actionable local privilege escalation rather than an inflated high-CVSS score, though it is not a mass-exploitation emergency.
Privilege escalation in the WordPress plugin Frontend Dashboard (M A Vinoth Kumar), affecting versions through 3.0.7, lets remote attackers obtain elevated account capabilities through incorrect privilege assignment (CWE-266). Patchstack scores the flaw 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but the assessed vector is PR:L, meaning exploitation in practice most likely requires an existing low-privileged account (for example a subscriber) to elevate from, which typically presupposes that open user registration is enabled on the target site. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV; exploitation is bounded to WordPress sites actually running this plugin within the affected version range.
Privilege escalation in Red Hat OpenShift Container Platform 4's insights-runtime-extractor DaemonSet lets an authenticated low-privileged tenant who can schedule a pod on a node run attacker-controlled code as root in the host user namespace. The extractor scanner enters the workload's namespaces and executes the workload's argv[0] via exec.Command after only seteuid() has changed, leaving real/saved UID 0 and retaining capabilities; a malicious pod binary matching node, python, python3, MainThread, or any path containing java can call setuid(0) and reach the host CRI-O socket from the inherited cwd. CVSS 8.8 (AV:L/PR:L/S:C) reflects local, non-network exploitation requiring workload scheduling, and no public exploit was identified at time of analysis.
Unauthenticated privilege escalation in the SimpleForm WordPress plugin up to and including version 3.10.0 allows any remote visitor to create an Administrator-level WordPress account by submitting crafted registration data. The vulnerable AJAX action wp_ajax_nopriv_simpleform_wp_register lacks a capability check for role assignment, and related meta-saving logic fails to exclude wp_capabilities, while the required nonce is publicly emitted on every front-end page. No public exploit code is confirmed at time of analysis, but the flaw is trivially exploitable against default configurations; an upstream fix exists via changeset 3726513, though a tagged release is not independently confirmed.
Local privilege escalation in Nix (before 2.35.3) and Lix (before 2.95.4) allows an unprivileged local user to escalate to the privileged nix-daemon account-typically root-by exploiting a repair operation that destroys and replaces a store path before verifying its content. The flaw is a timing-sensitive incorrect behavior order (CWE-696) that only affects multi-user daemon deployments; single-user installs are far less exposed. No public exploit code has been identified at time of analysis.
Privilege escalation in the Membership & User Roles for WooCommerce (Automatic Role Changer) plugin through version 20260828 lets an authenticated subscriber-level user re-acquire a previously revoked Administrator role and take full administrative control of the WordPress site. The flaw is reachable when the plugin is configured in Replace Roles mode and the attacker's account previously legitimately held Administrator while the plugin was active, because that role stays cached in the dfxwcrc_foreign_roles user meta and is re-applied whenever a role-assignment event fires, such as completing a purchase for a role-mapped product. Wordfence reported the issue (CVSS 7.5, CWE-269) and no public exploit code was identified at the time of analysis; the stacked preconditions - former legitimate admin, stale cache, Replace Roles mode - materially limit real-world exploitation, and only former privileged users, not arbitrary subscribers, can abuse it.
Privilege escalation in the Bit Integrations - Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress (all versions up to and including 2.10.6) allows unauthenticated attackers to overwrite an administrator's password and take over the admin account. The plugin stores raw, attacker-controlled field values - including user_pass and user_email - verbatim into wp_btcbi_log.field_data on anonymous front-end requests with no capability check, and when an administrator clicks 'Re-execute' on the resulting failure log row, the stored payload is replayed inside that administrator's session and written to the administrator's own user record. Exploitation is not automatic: it requires a non-default configuration in which an administrator has mapped a user-supplied form field to the user_pass parameter of the WP User Registration 'Update User' action, plus the manual Re-execute click (CVSS 3.1 AV:N/AC:H/PR:N/UI:R), so an anonymous remote attacker can plant the payload but cannot complete the escalation alone; no public exploit code was identified at time of analysis.
Local privilege escalation in Hyland Desktop Host for Windows (all versions before 25.1.1) lets a low-privileged local user gain full administrative control of the host by abusing weak filesystem permissions on the directory from which a privileged service runs. The affected service executes out of %PROGRAMDATA%\Hyland\DesktopHost\bin, a location writable by non-administrative users; an attacker who can drop or replace a binary or library there and trigger a service (re)start causes that code to execute with the service's elevated (typically SYSTEM) context, yielding confidentiality, integrity, and availability impact across the host (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), although the attack is technically straightforward to reproduce on a shared or multi-user machine where an unprivileged account already exists.
Server-side request forgery in Adobe Content Credentials (CAI Content Credentials SDK) allows unauthenticated remote attackers to induce the server to make arbitrary outbound requests, potentially reaching internal services and escalating privileges. The CVSS 3.1 base score is 8.6 (HIGH) with a changed scope, high confidentiality impact, and no integrity or availability impact. Exploitation requires no user interaction; no public exploit code has been identified at time of analysis, and the vendor advisory APSB26-163 should be consulted for fixes.
Server-side request forgery in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) allows an authenticated low-privileged attacker to coerce the application server into issuing requests to internal resources, yielding elevated access and disclosure of data outside the attacker's intended scope. Adobe assigns this a CVSS 3.1 base score of 7.1 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N); exploitation is non-deterministic because the vendor states success depends on conditions beyond the attacker's control, and it requires an existing foothold as a low-privileged account. There is no public exploit identified at time of analysis and no CISA KEV listing, so the practical risk profile is that of a moderate-severity, post-authentication SSRF rather than a remotely exploitable unauthenticated flaw.
Server-side request forgery in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) lets an attacker who already holds a high-privileged ColdFusion account force the server to issue requests to internal or otherwise restricted resources, resulting in privilege escalation and unauthorized access to internal services. The vulnerability is network-reachable (AV:N), needs no user interaction (UI:N), but is gated by the high-privilege precondition (PR:H), so it is not exploitable against default unauthenticated configurations - the practical risk is concentrated on internet-exposed ColdFusion administrative interfaces and insider or post-compromise scenarios. The CVSS vector changes scope (S:C), meaning the attacker can leverage the vulnerable ColdFusion component to affect resources outside its own security authority, and no public exploit code has been identified at time of analysis. This is a solid-priority-but-not-emergency issue rather than an emergency, driven mainly by the privileged access required to trigger it.
Server-side request forgery in Adobe ColdFusion 2023 (≤2023.0.25) and ColdFusion 2025 (≤2025.0.13) lets unauthenticated, network-reachable attackers coerce the server into issuing arbitrary outbound requests, with the changed scope (S:C) allowing those requests to pivot into back-end or cloud services that can confer elevated privileges. Rated CVSS 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, CWE-918), the flaw requires no authentication and no user interaction per the vector, but real-world data exposure depends on the ColdFusion instance having reachable internal targets such as cloud metadata endpoints or internal APIs. No CISA KEV listing and no public exploit code were identified at time of analysis, yet the default-configuration exposure of affected versions makes prompt patching advisable.
Server-side request forgery in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) allows a low-privileged authenticated attacker to make the ColdFusion server issue requests to internal or otherwise restricted resources, potentially escalating access and reading sensitive data. The vulnerability is rated CVSS 3.1 7.7 with scope changed and high confidentiality impact only; authentication as a low-privileged user is required (PR:L), no user interaction is needed, and no public exploit code was identified at time of analysis.
Server-side request forgery in Adobe ColdFusion 2025 (up to and including 2025.0.13) and ColdFusion 2023 (up to and including 2023.0.25) allows unauthenticated remote attackers to cause the server to make arbitrary requests, resulting in privilege escalation with the scope changed. This critical vulnerability has a CVSS score of 10.0 and requires no user interaction. No public exploit has been identified at the time of analysis.
Server-side request forgery in Adobe ColdFusion lets remote unauthenticated attackers force the server to issue requests to internal or otherwise protected endpoints, which Adobe flags as potentially escalating privileges across a security boundary. The affected builds are ColdFusion 2023 up to and including 2023.0.25 and ColdFusion 2025 up to and including 2025.0.13; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, base 8.6) confirms no user interaction and no authentication prerequisite, with confidentiality being the only impact dimension assessed. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, so risk derives from high internet/network exposure of affected builds rather than confirmed active exploitation. Real-world severity hinges on what the ColdFusion host can reach internally, since a scope-changed SSRF that touches cloud metadata services or internal admin APIs can yield credential material even without an integrity or availability impact.
Privilege escalation in Adobe Experience Manager (AEM) allows an authenticated, low-privileged user - an author or contributor-level account - to abuse an Improper Restriction of XML External Entity Reference (XXE, CWE-611) in XML parsing and thereby read local files and reach internal resources well beyond their intended permissions, crossing a security boundary as reflected by the scope-changed CVSS 9.6 rating. The vector is network-reachable with no user interaction required (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N), so the only real precondition is obtaining valid low-tier credentials, which makes author instances and deployments with broadly provisioned low-privilege accounts the highest-risk exposure. No public exploit code has been identified at time of analysis, and builds updated past the affected ranges are not exploitable.
Authenticated privilege escalation in Omnispace's Agora Project before 26.10.0 allows any regular, non-administrative member to create new user accounts by directly invoking the user-edit action actionVueEditUser, which is missing the editRight() function-level authorization check that guards comparable administrative actions. The flaw is reachable over the network by an attacker who already holds a valid member login (CVSS vector PR:L, no user interaction required) and results in high integrity impact and limited confidentiality exposure, with the practical risk concentrated in self-registration-enabled, shared or multi-tenant deployments where member accounts are easy to obtain. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; a vendor patch is available in version 26.10.0, and the VulnCheck advisory classifies the weakness as broken function-level authorization (Authentication Bypass / Privilege Escalation).
Heap-based buffer overflow in the Windows WebDAV implementation lets a locally authenticated attacker with only low privileges corrupt heap memory and elevate privileges on the same host, yielding high confidentiality, integrity and availability impact (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U). Exploitation requires a pre-existing foothold - code execution as a normal user on the target and reachable WebDAV/WebClient functionality - so this is a post-compromise privilege-escalation primitive rather than a remote entry point, and CISA's SSVC assessment marks it non-automatable, i.e. not suited to wormable mass exploitation. No public exploit code and no active exploitation have been identified at time of analysis, but Microsoft has shipped patches and real-world risk is concentrated on multi-user hosts such as RDS/terminal servers and shared workstations where several low-privileged users can run code.
Privilege escalation in Microsoft SharePoint Server Subscription Edition lets an authenticated attacker who holds only a low-privileged account escalate to full control over the affected farm, with high impact to confidentiality, integrity, and availability (CVSS 8.8, vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is reachable over the network with low complexity and no user interaction, but it is not pre-authentication - an attacker must first obtain or already possess valid SharePoint credentials. Affected are deployments of SharePoint Server Subscription Edition 16.0.0 prior to build 16.0.20326.20190; patched builds are not exploitable. No public exploit code has been identified at time of analysis, CISA SSVC rates exploitation as none, and Microsoft has released a vendor fix, so this is a high-priority but not emergency patch.
Privilege escalation in upKeeper Instant Privilege Access through version 1.7.1 lets a local, authenticated low-privileged user gain elevated privileges by triggering improper handling of undefined values during input processing, with user interaction required for the escalation to succeed. The flaw carries a CVSS 4.0 base score of 8.6 (High) driven by total confidentiality, integrity and availability impact across both the vulnerable component and subsequent systems, although local access (AV:L), a valid low-privileged account (PR:L) and mandatory user interaction (UI:A) materially constrain real-world exploitability. There is no public exploit identified at time of analysis, and CISA SSVC assessment records Exploitation: none with Automatable: no, meaning scripted or fully autonomous attacks are not expected.
Heap-based buffer overflow in the Windows SMB Client lets remote attackers elevate privileges on affected Windows hosts by compelling the target's SMB client to connect to an attacker-controlled server. The vulnerability carries a 9.8 CVSS score (AV:N/AC:L/PR:N/UI:N), though it is a client-side direction flaw: the attacker must induce an outbound SMB connection rather than reach a listening service, and the sources do not describe the trigger, so the true degree of coercion or user interaction is unverified. CISA SSVC rates exploitation as 'none' with Automatable 'no' and total technical impact, EPSS is modest at 0.77% (55th percentile), and no public exploit code has been identified at time of analysis; Microsoft has released fixes.
Lenve vhr through commit 03abbd3 exposes BCrypt password hashes, phone numbers, and addresses for all operators to any authenticated user who requests GET /chat/hrs. A low-privileged operator account (CVSS PR:L) is sufficient, making this a confidentiality-only privilege-escalation enabler if weak hashes are cracked offline; the assessed impact is CVSS 7.1 with no integrity or availability impact. No CISA KEV confirmation or public exploit code was identified at time of analysis.
Privilege escalation in Dockhand before 1.0.50 allows an attacker who holds administrative rights in a different tenant of a shared OIDC provider such as Microsoft Entra ID to obtain Dockhand administrator access by recreating the group Dockhand maps to its admin role and signing in, because the application fails to validate the OIDC iss, aud, nonce, and exp claims. The issue is rated CVSS 4.0 9.2 (critical) on network reach, no privileges required on Dockhand itself, no user interaction, and full confidentiality, integrity, and availability impact once admin access is obtained, though exploitation requires a shared multi-tenant IdP deployment and knowledge of the mapped group name, so single-tenant or isolated IdP deployments are not affected. No public exploit identified at time of analysis and the vulnerability is not in CISA KEV; a vendor patch is available in 1.0.50.
Local privilege escalation in WSUS (Windows Server Update Services) allows an authenticated low-privileged attacker with local access to elevate privileges by exploiting incorrect default permissions (CWE-276). The vulnerability has a Microsoft-assigned CVSS 3.1 score of 7.5 (AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H), indicating high attack complexity and required user interaction, but it can lead to full compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, and a patch is available per the Microsoft advisory.
Privilege escalation in Leantime prior to 3.10.0 allows an authenticated low-privilege user to create a full administrator account, or to install, enable, disable and remove plugins, by calling methods exposed through the application's JSON-RPC dispatcher. Any user holding a valid ordinary browser session can trigger this by sending the required X-Requested-With: XMLHttpRequest header and invoking leantime.rpc.api.api.createApiKeyWithProjects with an attacker-chosen role, because PermissionEnforcer::enforce treats API service methods that lack a RequiresPermission attribute as public; exposure widens significantly on installations where open or self-service registration is enabled, since obtaining the prerequisite low-privilege session becomes trivial. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects complete compromise of confidentiality, integrity and availability once the privilege boundary is crossed, and the vendor has shipped a fix in version 3.10.0.
Zoom Workplace clients with the Zoom Phone feature contain a network-reachable buffer overflow (CWE-120) that can lead to privilege escalation and full compromise of confidentiality, integrity, and availability on the targeted client. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H, base 8.0) requires user interaction and high attack complexity, and it indicates low privileges are needed even though the vendor description claims unauthenticated access-this authentication prerequisite is unverified. No public exploit identified at time of analysis.
Privilege escalation in the custom URL scheme handler of Zoom Workplace for Android before version 7.2.1 allows an attacker who can get the device to process a crafted link or invoke the handler (for example via a co-resident malicious app) to gain capabilities beyond those the invoking context should hold, with high confidentiality and integrity impact per the assessed CVSS of 8.1. Only the Android client is indicated; iOS and desktop builds are not referenced in the affected CPE, and installations at 7.2.1 or later are not affected. There is no CISA KEV listing and no public exploit code identified at time of analysis, and the authentication prerequisite is genuinely ambiguous: the description suggests an unauthenticated network attacker while the published CVSS vector (PR:L) and the independent assessment differ on whether any session is required, so treat the exploitability preconditions as unresolved pending confirmation from Zoom. Note that the vendor vector (PR:L/UI:N) and the assessed vector (PR:N/UI:R) diverge, meaning it is not settled whether success needs a low-privileged session or user interaction with a crafted link.
Newline injection in the Ftps.add API of Froxlor 0.10.0 through versions prior to 2.3.14 lets an authenticated customer account insert arbitrary entries into the root-owned NSS group database, ultimately enabling local privilege escalation on affected hosts. The unvalidated additional_members parameter accepts embedded newline characters, and the REBUILD_NSSUSERS cron job later writes those values without sanitization into /var/lib/extrausers/group, so an attacker with a valid customer login can seed privileged group memberships that are cashed in only once they obtain local access to the machine. Exploitation is gated by customer-level authentication (CVSS vector PR:L) and by the host being deployed with the libnss-extrausers backend with the rebuild cron active; no public exploit code identified at time of analysis, and there is no confirmed actively exploited (CISA KEV) status.
Unauthenticated remote attackers can achieve code execution and privilege escalation against NVIDIA AIStore for Linux by injecting arbitrary Kubernetes host-namespace and container security settings into the legacy ETL Kubernetes PodSpec initialization API, rated CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) because the impact escapes the AIStore workload and extends to the underlying Kubernetes node and cluster. The vector confirms the attack is network-reachable with no privileges or user interaction required, though practical exploitation depends on the legacy ETL/transformation feature being enabled and the ETL API being exposed, and on Kubernetes RBAC and PodSecurity admission being permissive enough for AIStore to actually schedule host-namespaced or privileged pods. At time of analysis there is no confirmed active exploitation (CISA KEV) and no public exploit code identified, but the vendor-reported severity, the scope-changed impact, and CWE-250 (execution with unnecessary privileges) place this in top-priority territory for any cluster running an exposed AIStore ETL endpoint.
Privilege escalation in Mozilla Firefox's WebExtensions component allows remote attackers to reach high confidentiality, integrity, and availability impact inside the browser's privileged context, provided the victim performs an interaction such as visiting attacker-controlled content (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8). Unauthenticated attackers can reach the flaw over the network against default installations, but the required user interaction rules out a zero-click drive-by path. All Firefox builds before 158 and Firefox ESR builds before 153.5 are affected; upgrading to 158 or ESR 153.5 removes the condition. There is no public exploit identified at time of analysis and CISA's SSVC decision framework rates exploitation as 'none' and automatable as 'no', making this a genuine high-priority patch item rather than an emergency.
Privilege escalation in the DOM: Navigation component of Mozilla Firefox (prior to 158) and Firefox ESR (prior to 153.5) lets an unauthenticated attacker gain elevated privileges inside the browser when a victim loads attacker-controlled web content, producing high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.8, CWE-269). The sole gate on exploitation is user interaction (UI:R, PR:N): the victim simply has to render a hostile or compromised page in an unpatched build, with no authentication, special configuration, or local access required. No public exploit code has been identified at time of analysis, and CISA's SSVC triage records exploitation as "none" with technical impact "total" and automatable as "no"; combined with the absence of KEV listing and EPSS data, this reads as a genuinely high-severity but not yet demonstrably exploited issue whose urgency depends on future exploit development. Vendor-released patches are available in Firefox 158 and Firefox ESR 153.5, and upgrading fully removes the exposure.
Privilege escalation in Mozilla Firefox's Panning and Zooming component lets an attacker who gets a target to render crafted content cross a privilege boundary inside the browser, with high impact to confidentiality, integrity and availability (CVSS 8.8). Affected builds are Firefox before 158 and Firefox ESR before 153.5, which Mozilla fixed via advisories mfsa2026-106, mfsa2026-108, mfsa2026-109 and mfsa2026-110. Exploitation status: no public exploit identified at time of analysis, and EPSS is low at 0.19% (8th percentile), but the input vector and our independent assessment disagree on the exploit preconditions (PR:L/UI:N versus PR:N/UI:R), so reconcile those signals before prioritization; authentication requirements are not confirmed from available data.
Privilege escalation in Mozilla Firefox's WebExtensions component allows an extension-level actor to gain capabilities beyond those it was granted, yielding high confidentiality and integrity impact; all Firefox builds prior to version 158 are affected, with the fix delivered in Firefox 158 via Mozilla security advisories mfsa2026-106 and mfsa2026-109. Exploitation requires a low-privileged foothold - in practice an already-installed malicious or compromised browser extension reaching the vulnerable privilege-management code path (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-269) - and no public exploit code has been identified at time of analysis. EPSS is low at 0.16% (4th percentile) and the flaw is not listed in CISA KEV; signals are mixed and point to a moderate, not emergency, priority, with the AV:N rating questionable for an extension-context escalation and worth verifying with Mozilla.
Privilege escalation and information disclosure in Mozilla's Process Sandboxing component let attacker-controlled web content break out of the Firefox content-process sandbox on unpatched installations - Firefox before 158 and Firefox ESR before 153.5 - with high confidentiality, integrity and availability impact (CVSS 3.1 base 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Exploitation is remote and requires no attacker authentication, but it is user-driven: the victim must actively load the malicious page, and CISA's SSVC assessment records Exploitation: none and Automatable: no, so this is a targeted client-side risk rather than a mass-exploitation candidate. There is no public exploit identified at time of analysis, and vendor-released fixes ship in Firefox 158 and Firefox ESR 153.5 (MFSA 2026-106 and MFSA 2026-108).
Privilege escalation in Mozilla Firefox's Application Update component allows a locally present, low-privileged attacker to elevate their privileges on the affected host, with the input CVSS 3.1 score of 8.8 (High) reflecting complete confidentiality, integrity, and availability impact. Exploitation requires only low privileges with no user interaction and is limited to unpatched builds prior to Firefox 158 and Firefox ESR 153.5; systems updated to those versions are not affected. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV) signal, with the EPSS score remaining low at 0.19% (8th percentile).
Authenticated, low-privilege users of Siemens RUGGEDCOM CROSSBOW running any version earlier than V6.0 can bypass access controls on sensitive configuration records and retrieve administrative credentials for various internal systems, yielding unauthorized information disclosure and follow-on privilege escalation. The defect is an authorization bypass through a user-controlled key (CWE-639) that is network-reachable with low attack complexity but requires a valid session, consistent with the CVSS 4.0 vector's PR:L and high confidentiality, integrity and availability impact confined to the CROSSBOW system itself. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Siemens has released V6.0 to correct the condition.
Authenticated database users can escalate privileges and execute arbitrary operating-system commands on hosts running SIMATIC WinCC V7.5 (all versions), V8.0 before Update 11, and V8.1 before Update 7 because the application assigns excessive permissions to a database role (CWE-266). Exploitation requires a remote attacker to already hold valid database credentials and network reachability to the WinCC database service, but no user interaction is needed; no public exploit code has been identified at time of analysis. Siemens rates the issue 8.7, and while the impact is high, our independent assessment classifies it as a credible operational-technology priority rather than an emergency because the prerequisite of authenticated database access and network segmentation limits the realistic attack surface.
Local capability escalation in the macOS build of the DigiD app (Logius) lets an attacker who already holds user-level code execution on the same Mac inject an arbitrary dynamic library into the DigiD process and run code under the app's identity, reaching DigiD data and cryptographic operations the process would not normally expose - CVSS 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). The root cause is that the app binary is not signed with the Hardened Runtime flag, so the loader still honours DYLD_INSERT_LIBRARIES; this is a post-compromise escalation primitive, not a remote or initial-access bug, and it grants no privilege beyond the app's own context (S:U) and no availability impact. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV); a Hardened-Runtime-signed build blocks the injection path and is available per the vendor advisory pointing at the Mac App Store listing.
Privilege escalation in HTMLy 3.1.1 allows a remote attacker to elevate from a low-privileged account or session to administrative control by abusing the get_feed function in the admin.php component. The supplied CVSS 3.1 score is 9.8 with PR:N, but the independent assessment applies PR:L because CWE-269 privilege-escalation issues realistically require some existing access; no CISA KEV or confirmed active exploitation is provided, and no public exploit was identified at time of analysis. Exposure is limited to HTMLy 3.1.1 installations where the admin interface is reachable, and keeping admin.php off the public internet substantially reduces risk.
Privilege escalation in Frappe ERPNext lets any authenticated user - including one holding no operational role - create privileged records such as user accounts and role assignments, ultimately taking full control of the site. The flaw affects releases before 15.111.0 and 16.x before 16.22.0, and stems from a record-creation endpoint that derives the record type from the request and inserts it with permission checks disabled; the only prerequisite is a valid login (CVSS 4.0 vector PR:L, i.e. authenticated, no user interaction, no non-default configuration). Rated 8.7 with high confidentiality, integrity and availability impact across the vulnerable site, and no public exploit code has been identified at time of analysis.
Authenticated low-privilege users of Open WebUI versions 0.8.6 up to but not including 0.11.4 can escalate privileges through the terminal proxy endpoint /api/v1/terminals/{server_id}/{path}, which forwards requests to the backend Terminals administrator API with the shared key attached; by targeting admin paths directly, an attacker can enumerate and stop other users' terminals, modify terminal policies, and inject environment variables into other users' sessions. The flaw is a missing-authorization (CWE-862) path-confusion issue reachable by any account with PR:L and no user interaction, and it only matters where the terminals feature is enabled against configured terminal servers in a multi-user deployment. No public exploit code has been identified at time of analysis and the issue is not tied to any confirmed active exploitation, but the vendor has shipped a fix and the independent assessment rates this as a genuine, moderate-priority risk rather than an emergency.
Improper access control in the Location Service for Esri component of IBM Maximo Application Suite 9.0, 9.1, and 9.2 allows an attacker who already holds high privileges on the underlying Kubernetes/OpenShift platform to abuse a schema-less Custom Resource Definition (CRD) and escalate to full read and write control over affected resources, since the CRD enforces no input validation and the component applies insufficient authorization checks. Exploitation requires authenticated high-privilege access (CVSS vector PR:H), no user interaction, and the optional Esri Location Service add-on to be deployed, so the barrier to entry is significant; the assessed vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H for a base score of 7.2. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), making this a moderate-priority, high-barrier issue rather than an urgent widespread threat - though successful abuse yields high confidentiality and integrity impact on the Maximo environment.
Improper privilege management in Rapyd Admin (the open-source Rapyd Admin scaffolding package for Laravel) versions 9.0.0 through 9.19.x lets an authenticated user who already holds the 'edit users' permission - the shipped 'operator' role is sufficient - promote their own account to the 'admin' role by submitting the admin role ID through the UsersEdit Livewire component, which prior to 9.20.0 synced browser-supplied roles without validating them against a server-side allow-list. Successful exploitation lifts tenant scoping, bypasses per-record authorization and enables impersonation of other users, including higher-privileged accounts, giving high confidentiality, integrity and availability impact within the affected installation. The flaw is fixed in v9.20.0, which computes assignable roles server-side and prevents a non-super-admin from granting a role to itself; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the prerequisite of an already-delegated privileged account makes this an insider or compromised-account escalation rather than a default-configuration, unauthenticated issue.