Privilege Escalation
Monthly
Local privilege escalation in MediaTek's Power HAL component allows a process operating with System-level privileges to escalate further - potentially to root or kernel - via a stack-based out-of-bounds write caused by a missing bounds check. The vulnerability affects approximately 40 distinct MediaTek SoC models spanning multiple Android device generations. No public exploit has been identified at time of analysis, and SSVC assessment indicates exploitation is currently none, though technical impact is rated total given full C/I/A compromise post-exploitation.
Privilege escalation in MediaTek's Power Hardware Abstraction Layer (Power HAL) allows an attacker who has already obtained System-level privilege on an Android device to further escalate to higher privilege through a type confusion vulnerability (CWE-843). The flaw spans a broad range of MediaTek chipsets - over 40 SoC variants - meaning it affects a wide swath of Android smartphones, tablets, and embedded devices. No public exploit has been identified and SSVC exploitation status is confirmed as 'none' at time of analysis, though the technical impact is rated 'total' by CISA's decision framework.
Local privilege escalation in the MediaTek Audio Hardware Abstraction Layer (HAL) allows an attacker who has already obtained System-level privilege to further escalate to higher privileges via a use-after-free condition (CWE-416). The vulnerability affects over 65 MediaTek chipset models spanning Android smartphones, tablets, IoT, and connected-device SoCs. No public exploit code or CISA KEV listing exists at time of analysis; however, the broad chipset surface across Android device families makes this relevant for any organization managing large Android fleets.
Privilege escalation via use-after-free in MediaTek's Android Audio Hardware Abstraction Layer (Audio HAL) affects over 65 distinct chipset families spanning mobile, tablet, and IoT SoCs. An attacker who has already obtained System-level privilege on a device running an affected MediaTek chipset can trigger the UAF condition to escalate further - gaining full control over confidentiality, integrity, and availability without any user interaction. No public exploit or active exploitation has been identified at time of analysis; the patch is available through MediaTek's September 2026 product security bulletin.
MiracastService on MediaTek Smart TV and DTV chipsets exposes a confused deputy condition (CWE-926) that allows a local app running with user-level privileges to trigger a denial-of-service against the Wi-Fi Display subsystem. The flaw stems from an improperly exported Android application component that lets an unprivileged caller invoke MiracastService capabilities without holding the necessary permissions, crashing or disabling the service. No public exploit code exists and SSVC rates exploitation as none, placing this firmly in the routine patch tier with a vendor-confirmed CVSS 5.5.
Privilege escalation in PostgreSQL Anonymizer (Dalibo) prior to 3.2.0 allows a table owner to execute arbitrary code with full superuser privileges via the `anon.anonymize_database_parallel()` function. The vulnerability (CWE-250, Execution with Unnecessary Privileges) enables a low-to-high privilege escalation within the database server, granting complete C:H/I:H/A:H impact. No public exploit has been identified and the issue is not listed in CISA KEV; a vendor-released patch is available in version 3.2.0.
Unauthorized role self-assignment in the B2BKing WooCommerce plugin before version 5.2.40 allows unauthenticated registrants to claim restricted B2B customer group memberships without admin approval by supplying arbitrary role parameters not bounded by server-side validation. The plugin fails to verify that a role submitted during account registration is actually one offered on the public registration form, enabling any user to bypass the manual account-approval workflow and gain access to wholesale pricing tiers or restricted catalogs. A publicly available proof-of-concept exists via WPScan, though no confirmed active exploitation has been identified in CISA KEV at time of analysis.
Privilege escalation through the DirectIo64.sys kernel driver affects three PassMark products - PerformanceTest before build 1012, BurnInTest before build 1000, and OSForensics before build 1016 - allowing any local Windows user with low privileges to issue arbitrary x86 IN/OUT instructions to hardware I/O ports via exposed IOCTLs that lack allowlist or port-range validation. From a standard user account an attacker can write to PS/2 controller, CPU reset, CMOS configuration, and interrupt controller ports, triggering an immediate forced system reset or persistent hardware-level manipulation. A public technical disclosure repository (github.com/floppywiggler/directio64-disclosure) and accompanying blog post exist; no CISA KEV listing is present and no EPSS score was provided.
Privilege escalation and kernel DoS in PassMark's shared DirectIo64.sys kernel driver affect PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016), allowing a local low-privileged attacker to read arbitrary Model-Specific Registers or write zero to any MSR via IOCTLs with an insufficient blocklist. Writing zero to the system call handler MSR (e.g., IA32_LSTAR) causes an immediate unrecoverable kernel panic on the next system call, while reading security-sensitive MSRs (such as those storing kernel base addresses) enables KASLR bypass to support privilege escalation chains. A public proof-of-concept is available via GitHub, and vendor patches have been released; no KEV listing at time of analysis.
Local privilege escalation to kernel in PassMark PerformanceTest, BurnInTest, and OSForensics allows a low-privileged local user to achieve arbitrary physical memory bit-clearing via an exposed, unvalidated IOCTL in the shared DirectIo64.sys kernel driver. By supplying a crafted 64-bit physical address and bit index to the driver, an attacker can invoke MmMapIoSpace to map and modify kernel code pages or page table entries, yielding full system compromise. A public proof-of-concept is available and patches have been released by PassMark across all three affected product lines.
Improper privilege management in StackStorm st2's API Key Handler allows authenticated remote attackers to manipulate the `api_key_api.user` argument in `st2api/st2api/controllers/v1/auth.py`, enabling unauthorized privilege escalation within the automation platform. All versions through 3.9.0 are affected per the CPE data, and a publicly available proof-of-concept exploit exists (GitHub issue #6380). No vendor patch has been released; the StackStorm project has not responded to the responsible disclosure report.
Improper privilege management in StackStorm st2 up to 3.9.0 allows authenticated low-privilege users to bypass user-scoping restrictions on the action executions API by manipulating the `user` query parameter. The root cause is that `assert_user_is_admin_if_user_query_param_is_provided` in `st2api/st2api/controllers/v1/actionexecutions.py` performs no enforcement when the default NoOp RBAC backend is active - meaning every default StackStorm installation without explicit RBAC configuration is vulnerable. A public proof-of-concept exists via GitHub issue #6379, and the vendor has not yet responded to the disclosure; no patch is available at time of analysis.
Privilege escalation in an Ubuntu-packaged application allows an operator-level authenticated user to modify Administrator accounts by exploiting insufficient authorization controls in the accounting database layer. The exact affected product is not determinable from available data - the description appears to be a commit-message-style changelog entry rather than a formal CVE description. No patch version, CPE string, CVSS score, or CWE identifier has been assigned, severely limiting independent verification. No public exploit has been identified at time of analysis.
Stored cross-site scripting in the SEOWriting WordPress plugin (through version 1.12.5) allows authenticated Contributor-level users to inject arbitrary JavaScript that executes in the browser session of higher-privileged users - Editors or Administrators - who view or preview the affected post. The root cause is a misconfigured KSES allowlist that explicitly whitelists the `onload` event attribute on `iframe` elements, bypassing WordPress's built-in content sanitization. A publicly available proof-of-concept confirms the attack path is reproducible; the vulnerability is not currently listed in the CISA KEV catalog, suggesting active exploitation has not been widely observed at time of analysis.
Privilege escalation in Drupal's External Authentication contributed module (versions 0.0.0 through <2.0.13) allows low-privileged network users to gain elevated Drupal permissions by exploiting improper case-sensitivity handling during identity resolution. The module fails to normalize case in username or identity attribute comparisons against existing Drupal accounts, meaning an attacker can present a case-variant identity (e.g., 'Admin' for a privileged 'admin' account) and be mapped to a higher-privileged user. A vendor-released patch is available at version 2.0.13 per Drupal security advisory SA-CONTRIB-2026-098, and no public exploit code has been identified at time of analysis.
Privilege escalation in Drupal's Content Moderation Notifications module (all versions before 3.9.0) stems from unsafe privilege definitions (CWE-267) embedded in the module's moderation workflow handling. An already-highly-privileged Drupal user can exploit improperly scoped permissions granted by the module to perform actions or access content beyond their intended role boundary within Drupal's RBAC model. No active exploitation (CISA KEV) or public proof-of-concept has been identified; a vendor patch at version 3.9.0 is available per Drupal security advisory SA-CONTRIB-2026-107.
Privilege escalation in the Theme My Login WordPress plugin (versions before 7.2.0) allows low-privileged users to silently bypass the network's site-creation restrictions on multisite WordPress installations, gaining administrator-level control over a newly created site. Subscriber-level authenticated users - and on some networks, unauthenticated users - can invoke the site-signup flow to create sites even when the network's registration setting prohibits it. A publicly available proof-of-concept exploit exists, raising the urgency for patching. The vendor has released a fix in version 7.2.0.
Address bar spoofing in Google Chrome's Downloads component (versions prior to 152.0.7977.75) is reachable only after an attacker has already achieved code execution within the renderer process, enabling display of a falsified URL via a crafted HTML page. The flaw stems from improper privilege management (CWE-269) in the Downloads subsystem, which fails to enforce the privilege boundary between the sandboxed renderer and the trusted browser UI. No public exploit identified at time of analysis; a vendor-released patch is available in Chrome 152.0.7977.75.
Stored XSS in the Apache Spark History Server (versions 3.0.0 through 3.5.7) allows a user with Spark job submission rights to inject unsanitized HTML/JavaScript into the History Server web UI via the application name field (spark.app.name), which executes in the browser of any higher-privileged user who subsequently views that job's history page. Apache rates this low severity due to layered prerequisites - the attacker must hold job submission rights and socially engineer an administrator into visiting the History Server. No public exploit has been identified at time of analysis; the vendor-released fix is Spark 3.5.8.
Privilege escalation in the HPE AOS-CX management API allows authenticated low-privilege operator-level users to modify system settings that should require higher authorization. Reported by HPE under advisory hpesbnw05134en_us - the same bulletin covering CVE-2026-73749, 73766, 73778, and 73782 - the flaw carries a CVSS 3.1 score of 6.5 with network attack vector, low complexity, and high integrity impact. No public exploit code or active exploitation has been identified at time of analysis.
Privilege escalation in HPE AOS-CX's API endpoint allows an authenticated low-privilege operator to access sensitive system information that should be restricted to higher-privilege roles, provided a required user action is completed. The CVSS vector (PR:L/UI:R/C:H/I:N/A:N) confirms this manifests as an information disclosure escalation rather than full privilege takeover - a low-privilege operator reads confidential data normally gated behind elevated roles. This CVE is part of the same HPE advisory (hpesbnw05134) as CVE-2026-73749 (unauthenticated RCE, CVSS 9.8), CVE-2026-73766 (admin command injection, CVSS 7.2), CVE-2026-73778 (default-credential auth bypass, CVSS 8.1), and CVE-2026-73782 (adjacent format-string RCE, CVSS 8.8); no public exploit has been identified at time of analysis.
Local privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator with physical or shell access to elevate user privileges and make limited modifications to the affected system. The CVSS vector (AV:L/AC:H/PR:L) confirms this requires both local system access and a low-privilege operator account, and the high attack complexity suggests non-trivial preconditions must be met. Impact is strictly bounded: the CVSS registers no confidentiality or availability impact, only limited integrity modification (I:L), meaning full administrative compromise is not achieved. No public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in HPE Networking Fabric Composer enables an authenticated, highly privileged operator on the underlying host to elevate their role within the Fabric Composer management hierarchy, gaining access to higher-privileged administrative functions. The impact is bounded to integrity - specifically the ability to alter certain system configuration settings - with no confidentiality or availability consequence reported. No public exploit code and no CISA KEV listing exist at time of analysis, consistent with the low CVSS score of 4.4 and the stringent local, high-privilege prerequisite.
Privilege escalation in HPE Networking Fabric Composer allows an authenticated operator-level user to modify system settings that the API is intended to restrict to higher-privilege roles. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) confirms network-exploitable with low attack complexity, requiring only a valid operator credential and no user interaction. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Sensitive information exposure in HPE Networking Fabric Composer allows an authenticated low-privilege operator user with local access to upstream AFC dependencies to read data outside their authorized scope. The CVSS vector (S:C/C:H) reflects that the confidentiality breach crosses authorization boundaries within the underlying OS layer, not merely within the user's own privilege tier. No public exploit code exists and the vulnerability has not been added to CISA KEV at time of analysis, but the high confidentiality impact and scope change elevate real-world concern for multi-tenant or shared-operator deployments.
Privilege abuse in Kibana's machine learning feature allows any user holding read-only ML access to retrieve data from Elasticsearch indices they are not authorized to see. The flaw (CWE-250) occurs because Kibana executes certain ML read operations under an internal service identity rather than forwarding the requesting user's credentials to Elasticsearch, effectively bypassing Elasticsearch's index-level access controls. Elastic self-disclosed the issue in ESA-2026-135 and released fixes across three active release lines; no public exploit code has been identified.
Improper privilege management in IObit Unlocker 1.3.0.12's kernel driver (IObitUnlocker.sys) allows a locally authenticated high-privileged user to invoke ZwTerminateProcess through the IRP_MJ_DEVICE_CONTROL handler without adequate authorization checks, enabling termination of processes outside the caller's normal authority. The vulnerability is limited to systems with IObit Unlocker installed and the driver loaded, and requires existing administrator-level access to exploit. No public exploit has been identified at time of analysis, the vulnerability is not in the CISA KEV catalog, and the vendor did not respond to disclosure.
Privilege management failure in IObit Uninstaller 15.5.0.11's kernel driver IUForceDelete.sys allows a local low-privileged user to send crafted IOCTL requests to the IRP_MJ_DEVICE_CONTROL handler and trigger improper privilege operations, resulting in limited integrity and availability impact on the local Windows system. The vendor did not respond to coordinated disclosure, leaving no vendor-issued patch or official mitigation guidance available. No public exploit code has been identified and the vulnerability has not been added to the CISA KEV catalog at time of analysis.
Privilege escalation in XueZhiSi Open Source Exam System (xzs) 3.9.0 and earlier allows authenticated teacher-level users to retrieve user listings across roles they are not authorized to view by freely controlling the role parameter in POST /api/teacher/user/page/list requests. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the server trusts the client-supplied role field in UserPageRequestVM without enforcing server-side role binding, exposing potentially sensitive user data. No public exploit code or active exploitation has been identified, and EPSS places this at the 4th percentile.
Improper privilege management in the Really Simple Security WordPress plugin before 9.8.0 permits a subsite administrator on a WordPress multisite network to install an arbitrary plugin from a user-supplied URL, placing attacker-controlled PHP code into the network-shared plugin directory normally reserved for network (super) administrators. Successful exploitation achieves remote code execution with full confidentiality, integrity, and availability impact across the entire multisite network. A public proof-of-concept is available via WPScan, though EPSS remains low (0.15%) consistent with the high-privilege, non-default-configuration prerequisites; no confirmed active exploitation (CISA KEV) is recorded at time of analysis.
Missing authorization checks on three IAM REST API endpoints in Yamcs allow any authenticated low-privilege user to enumerate the server's complete privilege taxonomy and role-to-privilege mappings, directly enabling targeted privilege escalation reconnaissance. Affected are yamcs-core versions up to 5.12.7 and 5.13.0 through 5.13.1, used in production spacecraft operations and ground station environments. A proof-of-concept is confirmed in the GHSA advisory; no active exploitation (CISA KEV) has been identified, but the leaked data (including the ControlAccess and ChangeMissionDatabase privilege names) provides a precise roadmap for chained attacks including, per the advisory, algorithm-level remote code execution.
Incomplete authorization fix in Vikunja v2.3.0 allows Write-level collaborators to detach a shared child project from its parent hierarchy by supplying parent_project_id: 0, bypassing the Admin permission gate introduced by the CVE-2026-35595 fix. The flaw exists in versions v2.3.0 through the latest unstable builds and is fixed in v2.4.0. A detailed, independently reproducible proof-of-concept with curl commands is publicly documented in the GHSA advisory, though no CISA KEV listing has been identified at time of analysis.
Archive symlink traversal in aquaproj/aqua prior to v2.60.1 enables an attacker who controls a tool archive to write arbitrary files outside the extraction directory with the privileges of the user running aqua. The vulnerable combination in `pkg/unarchive/archives.go` - creating a symlink without destination validation, then following it with a regular file write - allows a malicious tar.gz to overwrite files such as shell startup scripts or PATH entries, resulting in user-level code execution. A working PoC is confirmed in GHSA-mf5c-hw34-4hpp; no CISA KEV listing is present and EPSS data is unavailable for this CVE.
SQL injection in ZTE SCP allows authenticated, adjacent-network users to craft malicious database queries that bypass authorization logic and access data outside their permitted scope. The flaw requires valid low-privileged credentials and adjacency to the management network but achieves high confidentiality impact by exposing arbitrary database contents - particularly sensitive in telecom infrastructure contexts. No public exploit code or CISA KEV listing has been identified; ZTE classifies this as high-priority and has published a security bulletin.
Privilege escalation in the Forminator Forms WordPress plugin (all versions before 1.57.1) allows unauthenticated remote attackers to register new sites on WordPress multisite networks regardless of whether the network administrator has enabled site registration, granting the attacker administrator-level privileges over each newly created sub-site. This flaw is scoped exclusively to WordPress multisite deployments; standard single-site WordPress installations are completely unaffected regardless of plugin version. No active exploitation has been confirmed by CISA KEV, though WPScan has published a public proof-of-concept and a vendor patch is available at version 1.57.1.
Broken access control in ThingsBoard Professional Edition 4.21 and below allows authenticated customer-tier users to manipulate API parameters in the Alarms comments endpoint to forge or overwrite system-generated alarm comments. Because customer accounts are low-privileged by design, the ability to impersonate system messages and overwrite system-owned data constitutes vertical privilege escalation with direct integrity impact on alarm audit trails. No public exploit code exists and the EPSS score of 0.15% (5th percentile) indicates low exploitation probability, but the flaw is easily reproducible by any valid customer credential on an unpatched instance.
Privilege escalation in Doorkeeper OpenID Connect prior to 1.10.4 allows self-registered OAuth clients to obtain scopes beyond what the server intends to grant. The Dynamic Client Registration endpoint directly assigns client-supplied scope values to the application record without intersecting them against the server's configured `default_scopes` and `optional_scopes`, and because `enforce_configured_scopes` is disabled by default, Doorkeeper's ScopeChecker subsequently honors those persisted application-level scopes over server-level restrictions. No public exploit has been identified at time of analysis; a vendor patch was released July 2, 2026.
Improper privilege management in Google Chrome's FileSystem subsystem (all versions prior to 152.0.7977.65) allows a remote attacker to bypass system access restrictions by tricking a user into loading a specially crafted HTML page. The flaw is rated CVSS 4.3 (Medium) with impact limited to low integrity bypass - no confidentiality or availability impact - and carries an EPSS of 0.23% (13th percentile), indicating minimal observed exploitation interest. Vendor patch is available in stable channel 152.0.7977.65; no public exploit code or CISA KEV listing has been identified at time of analysis.
Insufficient permissions restrictions in iOS and iPadOS (all versions prior to 26.5) allow a malicious locally-installed app to enumerate other applications installed on the device. The flaw, rooted in improper privilege management (CWE-269), exposes app inventory data that Apple's sandbox model is designed to protect. No public exploit identified at time of analysis, EPSS is extremely low at 0.09%, and SSVC exploitation status is confirmed none - placing this squarely as a low-urgency privacy concern rather than an active threat.
Stack buffer overflow in Zephyr RTOS's virtio PCI driver (drivers/virtio/virtio_pci.c) allows a malicious virtio device to corrupt the kernel stack with up to ~228 bytes of device-controlled data, or trigger a near-unbounded write via unsigned underflow, during boot-time device probe. All Zephyr versions are potentially affected (CPE: cpe:2.3:a:zephyrproject:zephyr:*:*:*:*:*:*:*:*) when compiled with CONFIG_ASSERT disabled, which is the production default. Exploitable scenarios are limited to bare-metal systems with untrusted physical or passthrough virtio PCIe devices, or confidential computing deployments where the Zephyr guest must be defended against a potentially malicious hypervisor. No public exploit identified at time of analysis; upstream patch is available at commit d98dacee.
Privilege escalation in rclone before 1.74.4 allows an attacker who controls a source remote to plant a setuid binary on the destination filesystem when the victim uses the --metadata flag during a copy or sync operation. The local backend passes source-supplied mode, uid, and gid metadata verbatim to os.Chmod and os.Chown without masking ModeSetuid or ModeSetgid bits, enabling an attacker to store a crafted binary with mode=40000755 and uid=0 on a remote they control. If rclone runs as root - common in automated backup/restore workflows - any local user on the destination system can execute the planted binary to gain root access. A proof-of-concept is documented in the upstream advisory; no confirmed active exploitation (CISA KEV) is recorded at time of analysis.
Self-service privilege escalation in the TYPO3 femanager (Frontend User Manager) extension allows any authenticated frontend user to assign themselves to arbitrary frontend usergroups via the profile edit plugin when operating under its default field configuration. The root cause is CWE-862 (Missing Authorization): the extension does not validate whether the requesting user is permitted to join the target group before processing the self-update. No public exploit has been identified at time of analysis, but the exploit path is straightforward for any logged-in frontend user on an affected TYPO3 installation. The CVSS 4.0 score of 6.0 reflects the prerequisite of an authenticated session and a specific configuration context.
Privilege escalation from userspace to kernel level is possible in Google's Fuchsia OS via a Use-After-Free condition in the Zircon kernel pager proxy component, affecting Android F30.1.1. An attacker with low-privileged code execution on the device can exploit the memory corruption flaw to gain kernel-level control, achieving full compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and SSVC assessment indicates no current active exploitation.
Incorrect default permissions in HCL Hive 1.0 expose containerized deployments to unauthorized lateral movement, container breakout, and interception of sensitive inter-service communications by network-accessible attackers requiring no authentication. The flaw (CWE-276) means the platform ships with overly permissive defaults - not a misconfiguration by the operator - making any default deployment potentially vulnerable without additional hardening. No public exploit code exists at time of analysis, and the vulnerability has not been added to the CISA KEV catalog, but the combination of a network-accessible vector, no authentication requirement, and high confidentiality impact warrants prompt remediation.
Privilege escalation in the Content Mask WordPress plugin (before 1.8.5.5) allows any authenticated Contributor to publish posts and pages without holding the publish capability, bypassing WordPress's role-based access control. The root cause is a missing capability check (CWE-269) when the plugin registers and handles its custom post type publishing workflow. No public exploit identified at time of analysis; EPSS is 0.18% (8th percentile), and the flaw is not listed in CISA KEV, reflecting negligible observed exploitation interest.
Privilege escalation in Forminator Forms WordPress plugin (versions before 1.57.0.7) allows any user with form-builder permissions to create a registration form that grants the WordPress administrator role to every visitor who self-registers through it. The role-restriction enforcement applied to registration forms is inconsistently applied, meaning the control exists in the codebase but can be bypassed at the configuration layer by a sufficiently privileged form author. No public exploit code has been identified at time of analysis, and EPSS sits at 0.14% (4th percentile), indicating low observed exploitation activity; however, a successful exploitation chain yields full WordPress site compromise.
Unscoped GitHub App installation token exposure in Tekton Pipelines-as-Code (openshift-pipelines/pipelines-as-code) allows any authenticated user with push access to one repository in a multi-repo GitHub App installation to read the Tekton task definitions from other private repositories in the same installation. By crafting a PipelineRun with a remote task annotation pointing at a private repository URL, the attacker causes Pipelines-as-Code to fetch and inline that repository's task YAML using the over-privileged installation token during webhook processing, producing a read-only confidentiality breach. No public exploit or CISA KEV listing exists at time of analysis; the EPSS signal is absent from provided data, but the low-complexity attack path and confirmed fix make this a prioritization candidate for any organization running multi-repository PAC installations.
Improper access control in Lighthouse - the cross-cluster service-discovery component of Submariner shipped with Red Hat Advanced Cluster Management for Kubernetes 2 - lets an attacker who has compromised a spoke cluster inject unauthorized EndpointSlices and ServiceImports into arbitrary namespaces on peer clusters. Because the destination namespace is taken from an attacker-controlled label/annotation on the broker object, resources can be planted into privileged namespaces such as kube-system and openshift-*, enabling privilege escalation and lateral cluster compromise. Rated CVSS 9.9 with a scope change; no public exploit identified at time of analysis.
Privilege escalation to root on the Kenwood DNR1007XR car navigation/dashcam device is possible for physically present attackers who already hold low-privileged code execution on the device. The USB filesystem mount point is configured with incorrect default permissions (CWE-276), allowing a low-privileged process to write to or manipulate that directory and escalate to root with full code execution capability. No public exploit code or active exploitation has been identified at time of analysis; the attack surface is inherently constrained by the physical access prerequisite and the embedded nature of the device.
Privilege escalation in the ThemeGoods Capella WordPress theme (versions up to and including 2.5.5) allows unauthenticated remote attackers to gain elevated privileges within a WordPress site, per a CVSS 3.1 base score of 9.8. Because the flaw requires no authentication and no user interaction, an attacker can leverage it directly over the network to compromise site integrity, confidentiality, and availability. There is no public exploit identified at time of analysis and no CISA KEV listing, but the maximal CVSS and unauthenticated nature make it a high-priority patching target.
Broken cryptography in Ceph's CephX authentication subsystem enables credential scope escalation and plaintext inference for any network-adjacent attacker holding a compromised Ceph account. CephX employed AES-CBC with a hardcoded initialization vector and no message authentication code, making encrypted authentication traffic both deterministic (identical plaintexts yield identical ciphertexts) and malleable (bit-flip attacks alter decrypted credential payloads undetected). Fixed in Ceph Tentacle 20.2.4 and Squid 19.2.6 by replacing the scheme with AES-256-CTS-HMAC-SHA384-192; no public exploit has been identified at time of analysis.
Elevation of privilege in Dell PowerPath for Windows (versions 7.2 through 8.0 SP1) allows a low-privileged local attacker to gain elevated system privileges through improper privilege management (CWE-269). Dell has published security advisory DSA-2026-167 confirming the flaw and releasing a fix; the CVSS 3.1 base score is 5.3 (Medium), reflecting the local-only attack vector and limited scope. No public exploit code or active exploitation has been identified at time of analysis.
Arbitrary root file read in Linuxfabrik monitoring plugins allows a local attacker controlling the nagios or icinga account to exfiltrate any root-readable file by exploiting the hidden but permanently live --test argument accepted by all sudoers-whitelisted check plugins. Invoking the deb-updates plugin via sudo with --test=/etc/shadow,,0 causes lftest.py to read the supplied path as root with no path confinement and echo its full contents to stdout; approximately 22 additional whitelisted plugins yield filtered leaks or file-existence oracles through the same mechanism. No active exploitation has been confirmed by CISA KEV, but a fully functional proof-of-concept command is publicly disclosed in the vendor's own GitHub security advisory GHSA-rh9c-rqvg-f7pr, and patches are available in linuxfabrik-lib v6.1.0 and monitoring-plugins v7.0.0.
Unauthorized data access and modification in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by unauthenticated remote attackers via HTTP, contingent on human interaction from a victim. The vulnerability resides in the Security component and is tagged as an Authentication Bypass, enabling partial confidentiality and integrity compromise without attacker credentials. No active exploitation (CISA KEV) or public exploit code has been identified at time of analysis, but the low attack complexity and zero privilege requirement make social-engineering-assisted attacks practical against exposed instances.
Unauthorized access to all data in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a high-privileged remote attacker exploiting a flaw in the Security component over HTTP. The vulnerability results in complete confidentiality compromise - an attacker can read all data accessible to the application, including sensitive financial consolidation records. No public exploit has been identified at time of analysis, and exploitation is bounded by the requirement for high-privilege credentials, though the 'Authentication Bypass' tag suggests established access may allow security control circumvention beyond the attacker's normal authorization scope.
Local access exploitation in Oracle Hyperion Financial Management 11.2.25.0.000 enables authenticated low-privileged users with host logon rights to bypass Security component access controls and gain unauthorized read access to all HFM-accessible financial data, plus limited write capability. The vulnerability is tagged as an Authentication Bypass within the Security component itself - not a peripheral feature - meaning the core authorization enforcement mechanism is circumvented. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and realistic insider-threat scenario make this actionable for organizations running HFM on-premises.
Unauthorized data disclosure in Oracle Hyperion Financial Management version 11.2.25.0.000 allows low-privileged, network-based attackers to access critical or complete application data via HTTP. The vulnerability resides in the Security component and is tagged as an authentication bypass, indicating that existing authorization controls can be circumvented by an attacker holding any low-privilege account, exposing all financial data accessible within the application. No public exploit code has been identified at time of analysis, and Oracle has addressed the issue in its Critical Patch Update for August 2026.
Unauthorized data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 allows low-privileged authenticated network attackers to access all data accessible to the application via HTTP, targeting the Security component. The 'Authentication Bypass' tag suggests an authorization control failure permitting privilege escalation within an authenticated session, enabling full confidentiality compromise of sensitive financial consolidation data. No public exploit or active exploitation has been identified; this was disclosed as part of Oracle's Critical Security Patch Update for August 2026.
Unauthorized data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 allows a network-accessible low-privileged attacker to read all data the application can access via a flaw in its Security component over HTTP. The vulnerability is tagged as an authentication bypass, suggesting that while a low-privilege session is sufficient to initiate the attack, the Security component fails to enforce authorization boundaries that should restrict access to higher-privilege data. No public exploit code has been identified and no active exploitation is confirmed by CISA KEV at the time of analysis.
JWT signature validation is entirely absent in Otalio Ship Property Management System before version 2.22.0, allowing any authenticated user to forge arbitrary token claims and escalate to higher privilege levels. Because the server accepts tampered JWT payloads without verifying the cryptographic signature, a low-privileged account holder can self-promote to administrator or other elevated roles by modifying their own token. Mandiant disclosed this flaw; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the MasterStudy LMS WordPress plugin (versions up to and including 3.7.41) enables authenticated subscriber-level users to exceed their intended permissions through incorrect privilege assignment (CWE-266). Discovered and disclosed by Patchstack and tracked as ENISA EUVD-2026-60936, the flaw affects deployments by Stylemix on the WordPress platform worldwide. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Authorization bypass in ArcadeDB's MCP server-level set_server_setting tool allows authenticated read-only users to modify global server configuration in versions 26.4.2 through 26.7.3. SetServerSettingTool.execute() validates only the global allowAdmin flag and omits any role-level check, meaning any user with valid credentials - regardless of their assigned role - can invoke the tool when the MCP deployment is configured with allowAdmin=true and a non-root allowedUsers list. Successful exploitation enables configuration tampering of GlobalConfiguration or deliberate denial of service. No public exploit identified at time of analysis and this vulnerability is not listed in CISA KEV; the issue is fixed in 26.8.1.
Remote image blocking bypass in Roundcube Webmail (all versions before 1.6.18 and 1.7.x before 1.7.3) allows network-based attackers to defeat content security filters through crafted SVG animate elements, with potential for user metadata disclosure and privilege escalation. The sanitizer's failure to validate the SVG animate `by` attribute permits malicious email content to trigger outbound resource loads that the webmail's blocking controls were designed to prevent. Vendor-released patches 1.6.18 and 1.7.3 are confirmed available; no public exploit code or active exploitation has been identified at time of analysis.
Improper permission enforcement in the notification module of Huawei HarmonyOS and EMUI permits a local, unprivileged process to interfere with notification handling, resulting in limited integrity and availability impact. Affected versions span HarmonyOS 4.0.0 through 4.3.1 and EMUI 14.0.0 through 15.0.0 across Huawei consumer devices. No public exploit code or active exploitation has been identified at time of analysis; Huawei disclosed this via its August 2026 security bulletin.
Improper permission controls in the HarmonyOS 6.1.0 clipboard module expose confidential data to local attackers. The flaw, classified under CWE-264 (Permissions, Privileges, and Access Controls), allows a local actor who can induce user interaction to read clipboard contents without appropriate authorization, impacting confidentiality only. No active exploitation is confirmed by CISA KEV, and SSVC rates exploitation status as none with no automation potential.
Permission control failure in HarmonyOS 6.1.0's device key management module allows a local, unprivileged actor to cause a complete availability loss on the vulnerable system. The flaw is classified under CWE-264 (Permissions, Privileges, and Access Controls), indicating improper enforcement of access restrictions within the key management subsystem. SSVC assessment confirms no known exploitation and non-automatable attack, but the local-no-privilege vector lowers the bar for any co-located attacker or malicious app on the device.
Improper privilege management in Bagisto's backend customer management endpoint allows authenticated low-privileged users to access customer behavior data beyond their authorization scope. The vulnerability affects all Bagisto releases from 2.4.0 through 2.4.4 at the /admin/customers endpoint via manipulation of the ID parameter. A publicly available proof-of-concept exploit exists on GitHub; the vendor has acknowledged the issue and confirmed partial internal remediation with remaining fixes planned for upcoming releases.
Improper privilege management in OpenBoxes up to 0.9.7 allows authenticated low-privileged users to escalate their roles by injecting unsanitized role parameters into the UserController's GORM data binding layer. The RoleInterceptor's needManager function additionally failed to enforce manager-level access on the user/show and user/edit endpoints, compounding the access control gap. A public proof-of-concept exploit is available; patched releases 0.9.8-hotfix1 and 0.9.8 are confirmed available from the vendor.
Memory corruption and denial of service in Zephyr RTOS's second-generation delayable work queue (kernel/work.c) arise because the documented safe-cancellation APIs-k_work_cancel_delayable_sync() and k_work_flush_delayable()-fail to block until an in-flight timeout handler completes before returning, allowing callers to free a k_work_delayable object that work_timeout() subsequently dereferences. The race exists exclusively in SMP builds; work_timeout() performs a use-after-free read of the freed object's flags and, if the memory slot has been reused so the bail check passes, a use-after-free write to wp->flags and a submit against a stale dw->queue pointer. No public exploit has been identified and the vulnerability is absent from the CISA KEV catalog; exploitation is probabilistic and gated on kernel-mode code execution with influence over subsystem work-item teardown timing.
Incorrect default file permissions on /etc/vsftpd.conf in TrendNet TEW-813DRU firmware 1.01b01 allow a remote low-privileged attacker to manipulate FTP server configuration, resulting in low-severity integrity compromise. The affected product is end-of-life and will receive no vendor patch. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 4.0 score of 2.3 reflects the high attack complexity and minimal impact scope.
Improper privilege management in IBM i 7.3, 7.4, 7.5, and 7.6 enables a locally authenticated low-privileged attacker to read sensitive information or alter data beyond their authorized scope. The flaw is rooted in CWE-269 and carries a CVSS 3.1 score of 4.4 (Medium), reflecting its local-only attack vector and limited impact. No public exploit code and no confirmed active exploitation have been identified at time of analysis; a vendor-released patch is available.
Privilege management bypass in IBM i 7.3 through 7.6 permits remote low-privilege authenticated attackers to circumvent security restrictions and achieve limited unauthorized integrity modifications. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) confirms network reachability but imposes high attack complexity and mandatory prior authentication, significantly constraining the realistic attack surface. No public exploit code and no CISA KEV listing were identified at time of analysis, consistent with the low base score and high complexity requirement.
Privilege escalation in Kibana Fleet allows authenticated low-privileged users to expand the write scope of Elasticsearch API keys issued to Elastic Agents beyond intended boundaries. By declaring extra data streams in an integration policy, an attacker causes Fleet to over-provision the API key given to enrolled agents, granting write-insert and index-mapping-extension privileges on indices outside the legitimate scope of that integration. No public exploit has been identified at time of analysis, and the flaw has not been listed in the CISA KEV catalog, but the network-accessible attack vector and low privilege requirement make this a meaningful integrity risk in multi-tenant or shared Elastic Stack deployments.
Privilege escalation in Gitea Open Source Git Server before 1.25.5 allows an attacker holding a leaked read-only API token to mint a runner registration token and register a malicious Actions runner against the instance. The root cause is that the runner registration-token endpoints - at the user, organization, repository, and admin levels - are classified as read-only by the API scope middleware solely because they use the HTTP GET method, despite creating a token if none exists. With a valid registration token, the attacker can register a self-hosted runner that executes CI/CD workflow jobs, gaining access to repository secrets and source code. No public exploit code has been identified at time of analysis, and the EPSS score of 0.16% (6th percentile) indicates low observed exploitation probability.
Insufficient access separation in HCL AION's shared storage architecture allows processes within the platform to access or modify files outside their intended scope. The CVSS vector (AV:L/AC:H/PR:H/UI:R/S:C) confirms exploitation requires local access with high privileges, high complexity conditions, and user interaction - all of which must align simultaneously. No public exploit code exists, and CISA has not added this to the Known Exploited Vulnerabilities catalog, placing this firmly in the medium-severity tier despite the scope change flag.
Privilege escalation in Teltonika Networks RUTOS (versions 7.07.1-7.24.1) and TSWOS (versions 1.03-1.10) allows an adjacent-network attacker with a low-privileged account to gain full administrative control of the device by exploiting unsafe argument handling in an execl() system call. The vulnerability enables complete integrity compromise of the affected router or switch operating system without requiring elevated privileges at entry. No public exploit code has been identified at time of analysis, and the flaw is not currently listed in the CISA KEV catalog.
Local privilege escalation in Palo Alto Networks GlobalProtect app (Windows, macOS, and Linux) allows any local non-administrative user to gain NT AUTHORITY\SYSTEM on Windows or root on macOS and Linux via CWE-426 (Untrusted Search Path), enabling arbitrary command execution at the highest OS privilege level. The vulnerability is confirmed by Palo Alto Networks in their own advisory and affects desktop platforms only - iOS, Android, and Chrome OS are explicitly excluded. No public exploit code or active exploitation is confirmed at time of analysis; the CVSS 4.0 score of 5.9 Medium reflects the local-only attack vector requirement.
Privilege escalation to root in Palo Alto Networks GlobalProtect App on macOS is enabled by a race condition exploitable by a locally authenticated, low-privileged user. The vulnerability is strictly macOS-specific - GlobalProtect on Linux, Windows, iOS, Android, and Chrome OS is explicitly not affected per vendor advisory. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 4.1 reflects the local, timing-dependent, and low-privilege-required nature of this attack.
Privilege escalation via an uncontrolled search path (CWE-427) in Palo Alto Networks Prisma Access Agent on Windows and macOS allows a local user to execute arbitrary code with elevated privileges. The vulnerability is platform-specific and explicitly does not affect the Linux, iOS, Android, or ChromeOS versions of the agent. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; the CVSS 4.0 base score of 6.0 reflects the local-only attack vector, though the high confidentiality and integrity impact to the vulnerable system is significant for enterprise endpoint deployments.
Excessive Kubernetes RBAC privileges in the insights-client ServiceAccount within Red Hat Advanced Cluster Management for Kubernetes 2 expose all cluster Secrets to any attacker who compromises the pod or obtains its token. The ServiceAccount is bound to a ClusterRole granting cluster-wide get, list, and watch on all Secrets, far exceeding the single Secret the component actually requires. If the insights-client pod is breached, an attacker can read every Secret across the hub cluster - including managed-cluster kubeconfigs - enabling lateral movement to downstream managed clusters. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Security restriction bypass in IBM i 7.3 through 7.6 allows remote authenticated attackers to circumvent access controls by supplying a crafted user profile name that passes improper validation logic. The vulnerability is tagged as a privilege escalation path, meaning successful exploitation likely enables access to resources or operations beyond the attacker's authorized scope. No public exploit code or CISA KEV listing is present at time of analysis, but a vendor patch is available and should be prioritized given the high confidentiality impact indicated by CVSS.
In the Linux kernel, the following vulnerability has been resolved: ovl: check access to copy_file_range source with src mounter creds Commit 5dae222a5ff0c ("vfs: allow copy_file_range to copy across devices") allowed filesystems that implement the copy_file_range() f_op to decide if they want to access cross-sb copy from/to the same fs type. The same commit added checks to verify same sb copy for filesystems that implement ->copy_file_range() and do not support cross-sb copy at the time, namely, to ceph, fuse and nfs. The two remaining fs which implement ->copy_file_range(), cifs and overlayfs started to support cross-sb copy from this time. While overlayfs does support cross-sb copy when the two underlying files are on the same base fs, the copy operation on the two real files from two different overalyfs filesystems is performed with the mounter creds of the destination overlayfs and the read permission access hook for the source file was called with the wrong creds. This could cause either deny of access to copy which would otherwise be allowed (e.g. with splice) or allow read access to file which would otherwise be denied. Fix the latter case by explicitly verifying read access to source file with the source overlayfs mounter creds. The former case remains a quirk of cross-sb overlayfs copy, but userspace could fall back to regular copy so no harm done.
Privilege boundary enforcement failure in MongoDB Server allows an authenticated user holding only database-scoped privileges to modify diagnostic logging parameters at the server-wide level. Affected versions span MongoDB 7.0 (before 7.0.40), 8.0 (before 8.0.29), and 8.3 (before 8.3.8). An attacker with low-privilege credentials can either suppress server-wide diagnostic logging to obscure unauthorized activity or flood logs to degrade operational monitoring - effectively undermining the integrity of the audit and observability layer. No public exploit code exists and CISA has not added this to the KEV catalog.
Privilege escalation in Adobe Commerce and Magento Open Source exposes restricted resources to authenticated high-privilege users through a flawed authorization check (CWE-863). Affected products span the full 2.4.x series of Adobe Commerce and Magento Open Source, plus the 1.3.x-1.5.x Adobe Commerce B2B extension. No public exploits are known, CISA SSVC rates exploitation as none, and vendor-released August 2026 patches are available across all affected release lines per advisory APSB26-92.
Firmware improper input validation in Intel Xeon processors enables a highly privileged local adversary operating within System Management Mode (SMM) or startup code context to alter the integrity of subsequent system components. The CVSS 4.0 vector confirms local-only access (AV:L), high complexity (AC:H), presence-required attack conditions (AT:P), and a high-privilege prerequisite (PR:H), with zero confidentiality or availability impact - only downstream integrity degradation (SI:H). No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, placing real-world exploitation risk firmly in the advanced persistent threat category rather than opportunistic attack.
SSRF with privilege escalation affects Adobe's Content Credentials SDK and CLI toolchain, enabling a network-based attacker to induce the victim's client to issue server-side requests to unintended internal or external targets. Exploitation requires user interaction - a victim must visit a crafted URL or engage with a compromised web page - but the CVSS scope change (S:C) indicates the vulnerability can reach beyond the directly vulnerable component to affect other systems or services. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Binary hijacking is possible on Windows machines running AMD Vitis Unified due to weak filesystem permissions on the installation directory. A low-privileged local user can write arbitrary executables into paths traversed by higher-privileged processes, causing those processes to load attacker-controlled code when triggered by an interactive user. The CVSS 4.0 score of 1.0 reflects significant limiting prerequisites: local access, low-privilege credentials, specific attack preconditions, and required user interaction are all mandatory for exploitation. No public exploit has been identified at time of analysis.
Privilege escalation in AMD Vitis Unified on Windows enables a low-privileged local user to plant malicious code in the installation directory due to misconfigured filesystem permissions, potentially leading to arbitrary code execution under a more privileged context. Affected installations are the Vitis Unified Installer for FPGAs and Adaptive SoCs on Windows, patched in release 2026.1. No public exploit code and no active exploitation have been identified at time of analysis; CISA SSVC rates exploitation as none and the attack as non-automatable.
Privilege escalation in Intel(R) Transfer Learning Tool before version v0.7 stems from a protection mechanism failure (CWE-693) within the Ring 3 user application layer, enabling unauthenticated remote attackers to elevate privileges under specific attack conditions. The flaw affects confidentiality, integrity, and availability at a low severity each, with no subsequent system-level impact confirmed. No public exploit code or CISA KEV listing exists at time of analysis, and Intel has published advisory INTEL-SA-01499 addressing this issue.
Privilege escalation in Intel Processors operating within Ring 0 environments - kernel, hypervisor, and bare-metal OS - allows an authorized attacker already holding high-privilege access to cross isolation boundaries and achieve high confidentiality and integrity impact on subsequent systems such as hypervisors or co-located virtual machines. The CVSS 4.0 vector (AV:L/AC:H/AT:P/PR:H/SC:H/SI:H) confirms the attack is local, high-complexity, and gated behind existing privileged access plus special internal knowledge of processor internals, significantly limiting the exploitable population. No public exploit code and no CISA KEV listing exist at time of analysis, making current real-world risk primarily theoretical but relevant to hardened multi-tenant and virtualized datacenter environments.
Local privilege escalation in MediaTek's Power HAL component allows a process operating with System-level privileges to escalate further - potentially to root or kernel - via a stack-based out-of-bounds write caused by a missing bounds check. The vulnerability affects approximately 40 distinct MediaTek SoC models spanning multiple Android device generations. No public exploit has been identified at time of analysis, and SSVC assessment indicates exploitation is currently none, though technical impact is rated total given full C/I/A compromise post-exploitation.
Privilege escalation in MediaTek's Power Hardware Abstraction Layer (Power HAL) allows an attacker who has already obtained System-level privilege on an Android device to further escalate to higher privilege through a type confusion vulnerability (CWE-843). The flaw spans a broad range of MediaTek chipsets - over 40 SoC variants - meaning it affects a wide swath of Android smartphones, tablets, and embedded devices. No public exploit has been identified and SSVC exploitation status is confirmed as 'none' at time of analysis, though the technical impact is rated 'total' by CISA's decision framework.
Local privilege escalation in the MediaTek Audio Hardware Abstraction Layer (HAL) allows an attacker who has already obtained System-level privilege to further escalate to higher privileges via a use-after-free condition (CWE-416). The vulnerability affects over 65 MediaTek chipset models spanning Android smartphones, tablets, IoT, and connected-device SoCs. No public exploit code or CISA KEV listing exists at time of analysis; however, the broad chipset surface across Android device families makes this relevant for any organization managing large Android fleets.
Privilege escalation via use-after-free in MediaTek's Android Audio Hardware Abstraction Layer (Audio HAL) affects over 65 distinct chipset families spanning mobile, tablet, and IoT SoCs. An attacker who has already obtained System-level privilege on a device running an affected MediaTek chipset can trigger the UAF condition to escalate further - gaining full control over confidentiality, integrity, and availability without any user interaction. No public exploit or active exploitation has been identified at time of analysis; the patch is available through MediaTek's September 2026 product security bulletin.
MiracastService on MediaTek Smart TV and DTV chipsets exposes a confused deputy condition (CWE-926) that allows a local app running with user-level privileges to trigger a denial-of-service against the Wi-Fi Display subsystem. The flaw stems from an improperly exported Android application component that lets an unprivileged caller invoke MiracastService capabilities without holding the necessary permissions, crashing or disabling the service. No public exploit code exists and SSVC rates exploitation as none, placing this firmly in the routine patch tier with a vendor-confirmed CVSS 5.5.
Privilege escalation in PostgreSQL Anonymizer (Dalibo) prior to 3.2.0 allows a table owner to execute arbitrary code with full superuser privileges via the `anon.anonymize_database_parallel()` function. The vulnerability (CWE-250, Execution with Unnecessary Privileges) enables a low-to-high privilege escalation within the database server, granting complete C:H/I:H/A:H impact. No public exploit has been identified and the issue is not listed in CISA KEV; a vendor-released patch is available in version 3.2.0.
Unauthorized role self-assignment in the B2BKing WooCommerce plugin before version 5.2.40 allows unauthenticated registrants to claim restricted B2B customer group memberships without admin approval by supplying arbitrary role parameters not bounded by server-side validation. The plugin fails to verify that a role submitted during account registration is actually one offered on the public registration form, enabling any user to bypass the manual account-approval workflow and gain access to wholesale pricing tiers or restricted catalogs. A publicly available proof-of-concept exists via WPScan, though no confirmed active exploitation has been identified in CISA KEV at time of analysis.
Privilege escalation through the DirectIo64.sys kernel driver affects three PassMark products - PerformanceTest before build 1012, BurnInTest before build 1000, and OSForensics before build 1016 - allowing any local Windows user with low privileges to issue arbitrary x86 IN/OUT instructions to hardware I/O ports via exposed IOCTLs that lack allowlist or port-range validation. From a standard user account an attacker can write to PS/2 controller, CPU reset, CMOS configuration, and interrupt controller ports, triggering an immediate forced system reset or persistent hardware-level manipulation. A public technical disclosure repository (github.com/floppywiggler/directio64-disclosure) and accompanying blog post exist; no CISA KEV listing is present and no EPSS score was provided.
Privilege escalation and kernel DoS in PassMark's shared DirectIo64.sys kernel driver affect PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016), allowing a local low-privileged attacker to read arbitrary Model-Specific Registers or write zero to any MSR via IOCTLs with an insufficient blocklist. Writing zero to the system call handler MSR (e.g., IA32_LSTAR) causes an immediate unrecoverable kernel panic on the next system call, while reading security-sensitive MSRs (such as those storing kernel base addresses) enables KASLR bypass to support privilege escalation chains. A public proof-of-concept is available via GitHub, and vendor patches have been released; no KEV listing at time of analysis.
Local privilege escalation to kernel in PassMark PerformanceTest, BurnInTest, and OSForensics allows a low-privileged local user to achieve arbitrary physical memory bit-clearing via an exposed, unvalidated IOCTL in the shared DirectIo64.sys kernel driver. By supplying a crafted 64-bit physical address and bit index to the driver, an attacker can invoke MmMapIoSpace to map and modify kernel code pages or page table entries, yielding full system compromise. A public proof-of-concept is available and patches have been released by PassMark across all three affected product lines.
Improper privilege management in StackStorm st2's API Key Handler allows authenticated remote attackers to manipulate the `api_key_api.user` argument in `st2api/st2api/controllers/v1/auth.py`, enabling unauthorized privilege escalation within the automation platform. All versions through 3.9.0 are affected per the CPE data, and a publicly available proof-of-concept exploit exists (GitHub issue #6380). No vendor patch has been released; the StackStorm project has not responded to the responsible disclosure report.
Improper privilege management in StackStorm st2 up to 3.9.0 allows authenticated low-privilege users to bypass user-scoping restrictions on the action executions API by manipulating the `user` query parameter. The root cause is that `assert_user_is_admin_if_user_query_param_is_provided` in `st2api/st2api/controllers/v1/actionexecutions.py` performs no enforcement when the default NoOp RBAC backend is active - meaning every default StackStorm installation without explicit RBAC configuration is vulnerable. A public proof-of-concept exists via GitHub issue #6379, and the vendor has not yet responded to the disclosure; no patch is available at time of analysis.
Privilege escalation in an Ubuntu-packaged application allows an operator-level authenticated user to modify Administrator accounts by exploiting insufficient authorization controls in the accounting database layer. The exact affected product is not determinable from available data - the description appears to be a commit-message-style changelog entry rather than a formal CVE description. No patch version, CPE string, CVSS score, or CWE identifier has been assigned, severely limiting independent verification. No public exploit has been identified at time of analysis.
Stored cross-site scripting in the SEOWriting WordPress plugin (through version 1.12.5) allows authenticated Contributor-level users to inject arbitrary JavaScript that executes in the browser session of higher-privileged users - Editors or Administrators - who view or preview the affected post. The root cause is a misconfigured KSES allowlist that explicitly whitelists the `onload` event attribute on `iframe` elements, bypassing WordPress's built-in content sanitization. A publicly available proof-of-concept confirms the attack path is reproducible; the vulnerability is not currently listed in the CISA KEV catalog, suggesting active exploitation has not been widely observed at time of analysis.
Privilege escalation in Drupal's External Authentication contributed module (versions 0.0.0 through <2.0.13) allows low-privileged network users to gain elevated Drupal permissions by exploiting improper case-sensitivity handling during identity resolution. The module fails to normalize case in username or identity attribute comparisons against existing Drupal accounts, meaning an attacker can present a case-variant identity (e.g., 'Admin' for a privileged 'admin' account) and be mapped to a higher-privileged user. A vendor-released patch is available at version 2.0.13 per Drupal security advisory SA-CONTRIB-2026-098, and no public exploit code has been identified at time of analysis.
Privilege escalation in Drupal's Content Moderation Notifications module (all versions before 3.9.0) stems from unsafe privilege definitions (CWE-267) embedded in the module's moderation workflow handling. An already-highly-privileged Drupal user can exploit improperly scoped permissions granted by the module to perform actions or access content beyond their intended role boundary within Drupal's RBAC model. No active exploitation (CISA KEV) or public proof-of-concept has been identified; a vendor patch at version 3.9.0 is available per Drupal security advisory SA-CONTRIB-2026-107.
Privilege escalation in the Theme My Login WordPress plugin (versions before 7.2.0) allows low-privileged users to silently bypass the network's site-creation restrictions on multisite WordPress installations, gaining administrator-level control over a newly created site. Subscriber-level authenticated users - and on some networks, unauthenticated users - can invoke the site-signup flow to create sites even when the network's registration setting prohibits it. A publicly available proof-of-concept exploit exists, raising the urgency for patching. The vendor has released a fix in version 7.2.0.
Address bar spoofing in Google Chrome's Downloads component (versions prior to 152.0.7977.75) is reachable only after an attacker has already achieved code execution within the renderer process, enabling display of a falsified URL via a crafted HTML page. The flaw stems from improper privilege management (CWE-269) in the Downloads subsystem, which fails to enforce the privilege boundary between the sandboxed renderer and the trusted browser UI. No public exploit identified at time of analysis; a vendor-released patch is available in Chrome 152.0.7977.75.
Stored XSS in the Apache Spark History Server (versions 3.0.0 through 3.5.7) allows a user with Spark job submission rights to inject unsanitized HTML/JavaScript into the History Server web UI via the application name field (spark.app.name), which executes in the browser of any higher-privileged user who subsequently views that job's history page. Apache rates this low severity due to layered prerequisites - the attacker must hold job submission rights and socially engineer an administrator into visiting the History Server. No public exploit has been identified at time of analysis; the vendor-released fix is Spark 3.5.8.
Privilege escalation in the HPE AOS-CX management API allows authenticated low-privilege operator-level users to modify system settings that should require higher authorization. Reported by HPE under advisory hpesbnw05134en_us - the same bulletin covering CVE-2026-73749, 73766, 73778, and 73782 - the flaw carries a CVSS 3.1 score of 6.5 with network attack vector, low complexity, and high integrity impact. No public exploit code or active exploitation has been identified at time of analysis.
Privilege escalation in HPE AOS-CX's API endpoint allows an authenticated low-privilege operator to access sensitive system information that should be restricted to higher-privilege roles, provided a required user action is completed. The CVSS vector (PR:L/UI:R/C:H/I:N/A:N) confirms this manifests as an information disclosure escalation rather than full privilege takeover - a low-privilege operator reads confidential data normally gated behind elevated roles. This CVE is part of the same HPE advisory (hpesbnw05134) as CVE-2026-73749 (unauthenticated RCE, CVSS 9.8), CVE-2026-73766 (admin command injection, CVSS 7.2), CVE-2026-73778 (default-credential auth bypass, CVSS 8.1), and CVE-2026-73782 (adjacent format-string RCE, CVSS 8.8); no public exploit has been identified at time of analysis.
Local privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator with physical or shell access to elevate user privileges and make limited modifications to the affected system. The CVSS vector (AV:L/AC:H/PR:L) confirms this requires both local system access and a low-privilege operator account, and the high attack complexity suggests non-trivial preconditions must be met. Impact is strictly bounded: the CVSS registers no confidentiality or availability impact, only limited integrity modification (I:L), meaning full administrative compromise is not achieved. No public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in HPE Networking Fabric Composer enables an authenticated, highly privileged operator on the underlying host to elevate their role within the Fabric Composer management hierarchy, gaining access to higher-privileged administrative functions. The impact is bounded to integrity - specifically the ability to alter certain system configuration settings - with no confidentiality or availability consequence reported. No public exploit code and no CISA KEV listing exist at time of analysis, consistent with the low CVSS score of 4.4 and the stringent local, high-privilege prerequisite.
Privilege escalation in HPE Networking Fabric Composer allows an authenticated operator-level user to modify system settings that the API is intended to restrict to higher-privilege roles. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) confirms network-exploitable with low attack complexity, requiring only a valid operator credential and no user interaction. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Sensitive information exposure in HPE Networking Fabric Composer allows an authenticated low-privilege operator user with local access to upstream AFC dependencies to read data outside their authorized scope. The CVSS vector (S:C/C:H) reflects that the confidentiality breach crosses authorization boundaries within the underlying OS layer, not merely within the user's own privilege tier. No public exploit code exists and the vulnerability has not been added to CISA KEV at time of analysis, but the high confidentiality impact and scope change elevate real-world concern for multi-tenant or shared-operator deployments.
Privilege abuse in Kibana's machine learning feature allows any user holding read-only ML access to retrieve data from Elasticsearch indices they are not authorized to see. The flaw (CWE-250) occurs because Kibana executes certain ML read operations under an internal service identity rather than forwarding the requesting user's credentials to Elasticsearch, effectively bypassing Elasticsearch's index-level access controls. Elastic self-disclosed the issue in ESA-2026-135 and released fixes across three active release lines; no public exploit code has been identified.
Improper privilege management in IObit Unlocker 1.3.0.12's kernel driver (IObitUnlocker.sys) allows a locally authenticated high-privileged user to invoke ZwTerminateProcess through the IRP_MJ_DEVICE_CONTROL handler without adequate authorization checks, enabling termination of processes outside the caller's normal authority. The vulnerability is limited to systems with IObit Unlocker installed and the driver loaded, and requires existing administrator-level access to exploit. No public exploit has been identified at time of analysis, the vulnerability is not in the CISA KEV catalog, and the vendor did not respond to disclosure.
Privilege management failure in IObit Uninstaller 15.5.0.11's kernel driver IUForceDelete.sys allows a local low-privileged user to send crafted IOCTL requests to the IRP_MJ_DEVICE_CONTROL handler and trigger improper privilege operations, resulting in limited integrity and availability impact on the local Windows system. The vendor did not respond to coordinated disclosure, leaving no vendor-issued patch or official mitigation guidance available. No public exploit code has been identified and the vulnerability has not been added to the CISA KEV catalog at time of analysis.
Privilege escalation in XueZhiSi Open Source Exam System (xzs) 3.9.0 and earlier allows authenticated teacher-level users to retrieve user listings across roles they are not authorized to view by freely controlling the role parameter in POST /api/teacher/user/page/list requests. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the server trusts the client-supplied role field in UserPageRequestVM without enforcing server-side role binding, exposing potentially sensitive user data. No public exploit code or active exploitation has been identified, and EPSS places this at the 4th percentile.
Improper privilege management in the Really Simple Security WordPress plugin before 9.8.0 permits a subsite administrator on a WordPress multisite network to install an arbitrary plugin from a user-supplied URL, placing attacker-controlled PHP code into the network-shared plugin directory normally reserved for network (super) administrators. Successful exploitation achieves remote code execution with full confidentiality, integrity, and availability impact across the entire multisite network. A public proof-of-concept is available via WPScan, though EPSS remains low (0.15%) consistent with the high-privilege, non-default-configuration prerequisites; no confirmed active exploitation (CISA KEV) is recorded at time of analysis.
Missing authorization checks on three IAM REST API endpoints in Yamcs allow any authenticated low-privilege user to enumerate the server's complete privilege taxonomy and role-to-privilege mappings, directly enabling targeted privilege escalation reconnaissance. Affected are yamcs-core versions up to 5.12.7 and 5.13.0 through 5.13.1, used in production spacecraft operations and ground station environments. A proof-of-concept is confirmed in the GHSA advisory; no active exploitation (CISA KEV) has been identified, but the leaked data (including the ControlAccess and ChangeMissionDatabase privilege names) provides a precise roadmap for chained attacks including, per the advisory, algorithm-level remote code execution.
Incomplete authorization fix in Vikunja v2.3.0 allows Write-level collaborators to detach a shared child project from its parent hierarchy by supplying parent_project_id: 0, bypassing the Admin permission gate introduced by the CVE-2026-35595 fix. The flaw exists in versions v2.3.0 through the latest unstable builds and is fixed in v2.4.0. A detailed, independently reproducible proof-of-concept with curl commands is publicly documented in the GHSA advisory, though no CISA KEV listing has been identified at time of analysis.
Archive symlink traversal in aquaproj/aqua prior to v2.60.1 enables an attacker who controls a tool archive to write arbitrary files outside the extraction directory with the privileges of the user running aqua. The vulnerable combination in `pkg/unarchive/archives.go` - creating a symlink without destination validation, then following it with a regular file write - allows a malicious tar.gz to overwrite files such as shell startup scripts or PATH entries, resulting in user-level code execution. A working PoC is confirmed in GHSA-mf5c-hw34-4hpp; no CISA KEV listing is present and EPSS data is unavailable for this CVE.
SQL injection in ZTE SCP allows authenticated, adjacent-network users to craft malicious database queries that bypass authorization logic and access data outside their permitted scope. The flaw requires valid low-privileged credentials and adjacency to the management network but achieves high confidentiality impact by exposing arbitrary database contents - particularly sensitive in telecom infrastructure contexts. No public exploit code or CISA KEV listing has been identified; ZTE classifies this as high-priority and has published a security bulletin.
Privilege escalation in the Forminator Forms WordPress plugin (all versions before 1.57.1) allows unauthenticated remote attackers to register new sites on WordPress multisite networks regardless of whether the network administrator has enabled site registration, granting the attacker administrator-level privileges over each newly created sub-site. This flaw is scoped exclusively to WordPress multisite deployments; standard single-site WordPress installations are completely unaffected regardless of plugin version. No active exploitation has been confirmed by CISA KEV, though WPScan has published a public proof-of-concept and a vendor patch is available at version 1.57.1.
Broken access control in ThingsBoard Professional Edition 4.21 and below allows authenticated customer-tier users to manipulate API parameters in the Alarms comments endpoint to forge or overwrite system-generated alarm comments. Because customer accounts are low-privileged by design, the ability to impersonate system messages and overwrite system-owned data constitutes vertical privilege escalation with direct integrity impact on alarm audit trails. No public exploit code exists and the EPSS score of 0.15% (5th percentile) indicates low exploitation probability, but the flaw is easily reproducible by any valid customer credential on an unpatched instance.
Privilege escalation in Doorkeeper OpenID Connect prior to 1.10.4 allows self-registered OAuth clients to obtain scopes beyond what the server intends to grant. The Dynamic Client Registration endpoint directly assigns client-supplied scope values to the application record without intersecting them against the server's configured `default_scopes` and `optional_scopes`, and because `enforce_configured_scopes` is disabled by default, Doorkeeper's ScopeChecker subsequently honors those persisted application-level scopes over server-level restrictions. No public exploit has been identified at time of analysis; a vendor patch was released July 2, 2026.
Improper privilege management in Google Chrome's FileSystem subsystem (all versions prior to 152.0.7977.65) allows a remote attacker to bypass system access restrictions by tricking a user into loading a specially crafted HTML page. The flaw is rated CVSS 4.3 (Medium) with impact limited to low integrity bypass - no confidentiality or availability impact - and carries an EPSS of 0.23% (13th percentile), indicating minimal observed exploitation interest. Vendor patch is available in stable channel 152.0.7977.65; no public exploit code or CISA KEV listing has been identified at time of analysis.
Insufficient permissions restrictions in iOS and iPadOS (all versions prior to 26.5) allow a malicious locally-installed app to enumerate other applications installed on the device. The flaw, rooted in improper privilege management (CWE-269), exposes app inventory data that Apple's sandbox model is designed to protect. No public exploit identified at time of analysis, EPSS is extremely low at 0.09%, and SSVC exploitation status is confirmed none - placing this squarely as a low-urgency privacy concern rather than an active threat.
Stack buffer overflow in Zephyr RTOS's virtio PCI driver (drivers/virtio/virtio_pci.c) allows a malicious virtio device to corrupt the kernel stack with up to ~228 bytes of device-controlled data, or trigger a near-unbounded write via unsigned underflow, during boot-time device probe. All Zephyr versions are potentially affected (CPE: cpe:2.3:a:zephyrproject:zephyr:*:*:*:*:*:*:*:*) when compiled with CONFIG_ASSERT disabled, which is the production default. Exploitable scenarios are limited to bare-metal systems with untrusted physical or passthrough virtio PCIe devices, or confidential computing deployments where the Zephyr guest must be defended against a potentially malicious hypervisor. No public exploit identified at time of analysis; upstream patch is available at commit d98dacee.
Privilege escalation in rclone before 1.74.4 allows an attacker who controls a source remote to plant a setuid binary on the destination filesystem when the victim uses the --metadata flag during a copy or sync operation. The local backend passes source-supplied mode, uid, and gid metadata verbatim to os.Chmod and os.Chown without masking ModeSetuid or ModeSetgid bits, enabling an attacker to store a crafted binary with mode=40000755 and uid=0 on a remote they control. If rclone runs as root - common in automated backup/restore workflows - any local user on the destination system can execute the planted binary to gain root access. A proof-of-concept is documented in the upstream advisory; no confirmed active exploitation (CISA KEV) is recorded at time of analysis.
Self-service privilege escalation in the TYPO3 femanager (Frontend User Manager) extension allows any authenticated frontend user to assign themselves to arbitrary frontend usergroups via the profile edit plugin when operating under its default field configuration. The root cause is CWE-862 (Missing Authorization): the extension does not validate whether the requesting user is permitted to join the target group before processing the self-update. No public exploit has been identified at time of analysis, but the exploit path is straightforward for any logged-in frontend user on an affected TYPO3 installation. The CVSS 4.0 score of 6.0 reflects the prerequisite of an authenticated session and a specific configuration context.
Privilege escalation from userspace to kernel level is possible in Google's Fuchsia OS via a Use-After-Free condition in the Zircon kernel pager proxy component, affecting Android F30.1.1. An attacker with low-privileged code execution on the device can exploit the memory corruption flaw to gain kernel-level control, achieving full compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and SSVC assessment indicates no current active exploitation.
Incorrect default permissions in HCL Hive 1.0 expose containerized deployments to unauthorized lateral movement, container breakout, and interception of sensitive inter-service communications by network-accessible attackers requiring no authentication. The flaw (CWE-276) means the platform ships with overly permissive defaults - not a misconfiguration by the operator - making any default deployment potentially vulnerable without additional hardening. No public exploit code exists at time of analysis, and the vulnerability has not been added to the CISA KEV catalog, but the combination of a network-accessible vector, no authentication requirement, and high confidentiality impact warrants prompt remediation.
Privilege escalation in the Content Mask WordPress plugin (before 1.8.5.5) allows any authenticated Contributor to publish posts and pages without holding the publish capability, bypassing WordPress's role-based access control. The root cause is a missing capability check (CWE-269) when the plugin registers and handles its custom post type publishing workflow. No public exploit identified at time of analysis; EPSS is 0.18% (8th percentile), and the flaw is not listed in CISA KEV, reflecting negligible observed exploitation interest.
Privilege escalation in Forminator Forms WordPress plugin (versions before 1.57.0.7) allows any user with form-builder permissions to create a registration form that grants the WordPress administrator role to every visitor who self-registers through it. The role-restriction enforcement applied to registration forms is inconsistently applied, meaning the control exists in the codebase but can be bypassed at the configuration layer by a sufficiently privileged form author. No public exploit code has been identified at time of analysis, and EPSS sits at 0.14% (4th percentile), indicating low observed exploitation activity; however, a successful exploitation chain yields full WordPress site compromise.
Unscoped GitHub App installation token exposure in Tekton Pipelines-as-Code (openshift-pipelines/pipelines-as-code) allows any authenticated user with push access to one repository in a multi-repo GitHub App installation to read the Tekton task definitions from other private repositories in the same installation. By crafting a PipelineRun with a remote task annotation pointing at a private repository URL, the attacker causes Pipelines-as-Code to fetch and inline that repository's task YAML using the over-privileged installation token during webhook processing, producing a read-only confidentiality breach. No public exploit or CISA KEV listing exists at time of analysis; the EPSS signal is absent from provided data, but the low-complexity attack path and confirmed fix make this a prioritization candidate for any organization running multi-repository PAC installations.
Improper access control in Lighthouse - the cross-cluster service-discovery component of Submariner shipped with Red Hat Advanced Cluster Management for Kubernetes 2 - lets an attacker who has compromised a spoke cluster inject unauthorized EndpointSlices and ServiceImports into arbitrary namespaces on peer clusters. Because the destination namespace is taken from an attacker-controlled label/annotation on the broker object, resources can be planted into privileged namespaces such as kube-system and openshift-*, enabling privilege escalation and lateral cluster compromise. Rated CVSS 9.9 with a scope change; no public exploit identified at time of analysis.
Privilege escalation to root on the Kenwood DNR1007XR car navigation/dashcam device is possible for physically present attackers who already hold low-privileged code execution on the device. The USB filesystem mount point is configured with incorrect default permissions (CWE-276), allowing a low-privileged process to write to or manipulate that directory and escalate to root with full code execution capability. No public exploit code or active exploitation has been identified at time of analysis; the attack surface is inherently constrained by the physical access prerequisite and the embedded nature of the device.
Privilege escalation in the ThemeGoods Capella WordPress theme (versions up to and including 2.5.5) allows unauthenticated remote attackers to gain elevated privileges within a WordPress site, per a CVSS 3.1 base score of 9.8. Because the flaw requires no authentication and no user interaction, an attacker can leverage it directly over the network to compromise site integrity, confidentiality, and availability. There is no public exploit identified at time of analysis and no CISA KEV listing, but the maximal CVSS and unauthenticated nature make it a high-priority patching target.
Broken cryptography in Ceph's CephX authentication subsystem enables credential scope escalation and plaintext inference for any network-adjacent attacker holding a compromised Ceph account. CephX employed AES-CBC with a hardcoded initialization vector and no message authentication code, making encrypted authentication traffic both deterministic (identical plaintexts yield identical ciphertexts) and malleable (bit-flip attacks alter decrypted credential payloads undetected). Fixed in Ceph Tentacle 20.2.4 and Squid 19.2.6 by replacing the scheme with AES-256-CTS-HMAC-SHA384-192; no public exploit has been identified at time of analysis.
Elevation of privilege in Dell PowerPath for Windows (versions 7.2 through 8.0 SP1) allows a low-privileged local attacker to gain elevated system privileges through improper privilege management (CWE-269). Dell has published security advisory DSA-2026-167 confirming the flaw and releasing a fix; the CVSS 3.1 base score is 5.3 (Medium), reflecting the local-only attack vector and limited scope. No public exploit code or active exploitation has been identified at time of analysis.
Arbitrary root file read in Linuxfabrik monitoring plugins allows a local attacker controlling the nagios or icinga account to exfiltrate any root-readable file by exploiting the hidden but permanently live --test argument accepted by all sudoers-whitelisted check plugins. Invoking the deb-updates plugin via sudo with --test=/etc/shadow,,0 causes lftest.py to read the supplied path as root with no path confinement and echo its full contents to stdout; approximately 22 additional whitelisted plugins yield filtered leaks or file-existence oracles through the same mechanism. No active exploitation has been confirmed by CISA KEV, but a fully functional proof-of-concept command is publicly disclosed in the vendor's own GitHub security advisory GHSA-rh9c-rqvg-f7pr, and patches are available in linuxfabrik-lib v6.1.0 and monitoring-plugins v7.0.0.
Unauthorized data access and modification in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by unauthenticated remote attackers via HTTP, contingent on human interaction from a victim. The vulnerability resides in the Security component and is tagged as an Authentication Bypass, enabling partial confidentiality and integrity compromise without attacker credentials. No active exploitation (CISA KEV) or public exploit code has been identified at time of analysis, but the low attack complexity and zero privilege requirement make social-engineering-assisted attacks practical against exposed instances.
Unauthorized access to all data in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a high-privileged remote attacker exploiting a flaw in the Security component over HTTP. The vulnerability results in complete confidentiality compromise - an attacker can read all data accessible to the application, including sensitive financial consolidation records. No public exploit has been identified at time of analysis, and exploitation is bounded by the requirement for high-privilege credentials, though the 'Authentication Bypass' tag suggests established access may allow security control circumvention beyond the attacker's normal authorization scope.
Local access exploitation in Oracle Hyperion Financial Management 11.2.25.0.000 enables authenticated low-privileged users with host logon rights to bypass Security component access controls and gain unauthorized read access to all HFM-accessible financial data, plus limited write capability. The vulnerability is tagged as an Authentication Bypass within the Security component itself - not a peripheral feature - meaning the core authorization enforcement mechanism is circumvented. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and realistic insider-threat scenario make this actionable for organizations running HFM on-premises.
Unauthorized data disclosure in Oracle Hyperion Financial Management version 11.2.25.0.000 allows low-privileged, network-based attackers to access critical or complete application data via HTTP. The vulnerability resides in the Security component and is tagged as an authentication bypass, indicating that existing authorization controls can be circumvented by an attacker holding any low-privilege account, exposing all financial data accessible within the application. No public exploit code has been identified at time of analysis, and Oracle has addressed the issue in its Critical Patch Update for August 2026.
Unauthorized data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 allows low-privileged authenticated network attackers to access all data accessible to the application via HTTP, targeting the Security component. The 'Authentication Bypass' tag suggests an authorization control failure permitting privilege escalation within an authenticated session, enabling full confidentiality compromise of sensitive financial consolidation data. No public exploit or active exploitation has been identified; this was disclosed as part of Oracle's Critical Security Patch Update for August 2026.
Unauthorized data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 allows a network-accessible low-privileged attacker to read all data the application can access via a flaw in its Security component over HTTP. The vulnerability is tagged as an authentication bypass, suggesting that while a low-privilege session is sufficient to initiate the attack, the Security component fails to enforce authorization boundaries that should restrict access to higher-privilege data. No public exploit code has been identified and no active exploitation is confirmed by CISA KEV at the time of analysis.
JWT signature validation is entirely absent in Otalio Ship Property Management System before version 2.22.0, allowing any authenticated user to forge arbitrary token claims and escalate to higher privilege levels. Because the server accepts tampered JWT payloads without verifying the cryptographic signature, a low-privileged account holder can self-promote to administrator or other elevated roles by modifying their own token. Mandiant disclosed this flaw; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the MasterStudy LMS WordPress plugin (versions up to and including 3.7.41) enables authenticated subscriber-level users to exceed their intended permissions through incorrect privilege assignment (CWE-266). Discovered and disclosed by Patchstack and tracked as ENISA EUVD-2026-60936, the flaw affects deployments by Stylemix on the WordPress platform worldwide. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Authorization bypass in ArcadeDB's MCP server-level set_server_setting tool allows authenticated read-only users to modify global server configuration in versions 26.4.2 through 26.7.3. SetServerSettingTool.execute() validates only the global allowAdmin flag and omits any role-level check, meaning any user with valid credentials - regardless of their assigned role - can invoke the tool when the MCP deployment is configured with allowAdmin=true and a non-root allowedUsers list. Successful exploitation enables configuration tampering of GlobalConfiguration or deliberate denial of service. No public exploit identified at time of analysis and this vulnerability is not listed in CISA KEV; the issue is fixed in 26.8.1.
Remote image blocking bypass in Roundcube Webmail (all versions before 1.6.18 and 1.7.x before 1.7.3) allows network-based attackers to defeat content security filters through crafted SVG animate elements, with potential for user metadata disclosure and privilege escalation. The sanitizer's failure to validate the SVG animate `by` attribute permits malicious email content to trigger outbound resource loads that the webmail's blocking controls were designed to prevent. Vendor-released patches 1.6.18 and 1.7.3 are confirmed available; no public exploit code or active exploitation has been identified at time of analysis.
Improper permission enforcement in the notification module of Huawei HarmonyOS and EMUI permits a local, unprivileged process to interfere with notification handling, resulting in limited integrity and availability impact. Affected versions span HarmonyOS 4.0.0 through 4.3.1 and EMUI 14.0.0 through 15.0.0 across Huawei consumer devices. No public exploit code or active exploitation has been identified at time of analysis; Huawei disclosed this via its August 2026 security bulletin.
Improper permission controls in the HarmonyOS 6.1.0 clipboard module expose confidential data to local attackers. The flaw, classified under CWE-264 (Permissions, Privileges, and Access Controls), allows a local actor who can induce user interaction to read clipboard contents without appropriate authorization, impacting confidentiality only. No active exploitation is confirmed by CISA KEV, and SSVC rates exploitation status as none with no automation potential.
Permission control failure in HarmonyOS 6.1.0's device key management module allows a local, unprivileged actor to cause a complete availability loss on the vulnerable system. The flaw is classified under CWE-264 (Permissions, Privileges, and Access Controls), indicating improper enforcement of access restrictions within the key management subsystem. SSVC assessment confirms no known exploitation and non-automatable attack, but the local-no-privilege vector lowers the bar for any co-located attacker or malicious app on the device.
Improper privilege management in Bagisto's backend customer management endpoint allows authenticated low-privileged users to access customer behavior data beyond their authorization scope. The vulnerability affects all Bagisto releases from 2.4.0 through 2.4.4 at the /admin/customers endpoint via manipulation of the ID parameter. A publicly available proof-of-concept exploit exists on GitHub; the vendor has acknowledged the issue and confirmed partial internal remediation with remaining fixes planned for upcoming releases.
Improper privilege management in OpenBoxes up to 0.9.7 allows authenticated low-privileged users to escalate their roles by injecting unsanitized role parameters into the UserController's GORM data binding layer. The RoleInterceptor's needManager function additionally failed to enforce manager-level access on the user/show and user/edit endpoints, compounding the access control gap. A public proof-of-concept exploit is available; patched releases 0.9.8-hotfix1 and 0.9.8 are confirmed available from the vendor.
Memory corruption and denial of service in Zephyr RTOS's second-generation delayable work queue (kernel/work.c) arise because the documented safe-cancellation APIs-k_work_cancel_delayable_sync() and k_work_flush_delayable()-fail to block until an in-flight timeout handler completes before returning, allowing callers to free a k_work_delayable object that work_timeout() subsequently dereferences. The race exists exclusively in SMP builds; work_timeout() performs a use-after-free read of the freed object's flags and, if the memory slot has been reused so the bail check passes, a use-after-free write to wp->flags and a submit against a stale dw->queue pointer. No public exploit has been identified and the vulnerability is absent from the CISA KEV catalog; exploitation is probabilistic and gated on kernel-mode code execution with influence over subsystem work-item teardown timing.
Incorrect default file permissions on /etc/vsftpd.conf in TrendNet TEW-813DRU firmware 1.01b01 allow a remote low-privileged attacker to manipulate FTP server configuration, resulting in low-severity integrity compromise. The affected product is end-of-life and will receive no vendor patch. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 4.0 score of 2.3 reflects the high attack complexity and minimal impact scope.
Improper privilege management in IBM i 7.3, 7.4, 7.5, and 7.6 enables a locally authenticated low-privileged attacker to read sensitive information or alter data beyond their authorized scope. The flaw is rooted in CWE-269 and carries a CVSS 3.1 score of 4.4 (Medium), reflecting its local-only attack vector and limited impact. No public exploit code and no confirmed active exploitation have been identified at time of analysis; a vendor-released patch is available.
Privilege management bypass in IBM i 7.3 through 7.6 permits remote low-privilege authenticated attackers to circumvent security restrictions and achieve limited unauthorized integrity modifications. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) confirms network reachability but imposes high attack complexity and mandatory prior authentication, significantly constraining the realistic attack surface. No public exploit code and no CISA KEV listing were identified at time of analysis, consistent with the low base score and high complexity requirement.
Privilege escalation in Kibana Fleet allows authenticated low-privileged users to expand the write scope of Elasticsearch API keys issued to Elastic Agents beyond intended boundaries. By declaring extra data streams in an integration policy, an attacker causes Fleet to over-provision the API key given to enrolled agents, granting write-insert and index-mapping-extension privileges on indices outside the legitimate scope of that integration. No public exploit has been identified at time of analysis, and the flaw has not been listed in the CISA KEV catalog, but the network-accessible attack vector and low privilege requirement make this a meaningful integrity risk in multi-tenant or shared Elastic Stack deployments.
Privilege escalation in Gitea Open Source Git Server before 1.25.5 allows an attacker holding a leaked read-only API token to mint a runner registration token and register a malicious Actions runner against the instance. The root cause is that the runner registration-token endpoints - at the user, organization, repository, and admin levels - are classified as read-only by the API scope middleware solely because they use the HTTP GET method, despite creating a token if none exists. With a valid registration token, the attacker can register a self-hosted runner that executes CI/CD workflow jobs, gaining access to repository secrets and source code. No public exploit code has been identified at time of analysis, and the EPSS score of 0.16% (6th percentile) indicates low observed exploitation probability.
Insufficient access separation in HCL AION's shared storage architecture allows processes within the platform to access or modify files outside their intended scope. The CVSS vector (AV:L/AC:H/PR:H/UI:R/S:C) confirms exploitation requires local access with high privileges, high complexity conditions, and user interaction - all of which must align simultaneously. No public exploit code exists, and CISA has not added this to the Known Exploited Vulnerabilities catalog, placing this firmly in the medium-severity tier despite the scope change flag.
Privilege escalation in Teltonika Networks RUTOS (versions 7.07.1-7.24.1) and TSWOS (versions 1.03-1.10) allows an adjacent-network attacker with a low-privileged account to gain full administrative control of the device by exploiting unsafe argument handling in an execl() system call. The vulnerability enables complete integrity compromise of the affected router or switch operating system without requiring elevated privileges at entry. No public exploit code has been identified at time of analysis, and the flaw is not currently listed in the CISA KEV catalog.
Local privilege escalation in Palo Alto Networks GlobalProtect app (Windows, macOS, and Linux) allows any local non-administrative user to gain NT AUTHORITY\SYSTEM on Windows or root on macOS and Linux via CWE-426 (Untrusted Search Path), enabling arbitrary command execution at the highest OS privilege level. The vulnerability is confirmed by Palo Alto Networks in their own advisory and affects desktop platforms only - iOS, Android, and Chrome OS are explicitly excluded. No public exploit code or active exploitation is confirmed at time of analysis; the CVSS 4.0 score of 5.9 Medium reflects the local-only attack vector requirement.
Privilege escalation to root in Palo Alto Networks GlobalProtect App on macOS is enabled by a race condition exploitable by a locally authenticated, low-privileged user. The vulnerability is strictly macOS-specific - GlobalProtect on Linux, Windows, iOS, Android, and Chrome OS is explicitly not affected per vendor advisory. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 4.1 reflects the local, timing-dependent, and low-privilege-required nature of this attack.
Privilege escalation via an uncontrolled search path (CWE-427) in Palo Alto Networks Prisma Access Agent on Windows and macOS allows a local user to execute arbitrary code with elevated privileges. The vulnerability is platform-specific and explicitly does not affect the Linux, iOS, Android, or ChromeOS versions of the agent. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; the CVSS 4.0 base score of 6.0 reflects the local-only attack vector, though the high confidentiality and integrity impact to the vulnerable system is significant for enterprise endpoint deployments.
Excessive Kubernetes RBAC privileges in the insights-client ServiceAccount within Red Hat Advanced Cluster Management for Kubernetes 2 expose all cluster Secrets to any attacker who compromises the pod or obtains its token. The ServiceAccount is bound to a ClusterRole granting cluster-wide get, list, and watch on all Secrets, far exceeding the single Secret the component actually requires. If the insights-client pod is breached, an attacker can read every Secret across the hub cluster - including managed-cluster kubeconfigs - enabling lateral movement to downstream managed clusters. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Security restriction bypass in IBM i 7.3 through 7.6 allows remote authenticated attackers to circumvent access controls by supplying a crafted user profile name that passes improper validation logic. The vulnerability is tagged as a privilege escalation path, meaning successful exploitation likely enables access to resources or operations beyond the attacker's authorized scope. No public exploit code or CISA KEV listing is present at time of analysis, but a vendor patch is available and should be prioritized given the high confidentiality impact indicated by CVSS.
In the Linux kernel, the following vulnerability has been resolved: ovl: check access to copy_file_range source with src mounter creds Commit 5dae222a5ff0c ("vfs: allow copy_file_range to copy across devices") allowed filesystems that implement the copy_file_range() f_op to decide if they want to access cross-sb copy from/to the same fs type. The same commit added checks to verify same sb copy for filesystems that implement ->copy_file_range() and do not support cross-sb copy at the time, namely, to ceph, fuse and nfs. The two remaining fs which implement ->copy_file_range(), cifs and overlayfs started to support cross-sb copy from this time. While overlayfs does support cross-sb copy when the two underlying files are on the same base fs, the copy operation on the two real files from two different overalyfs filesystems is performed with the mounter creds of the destination overlayfs and the read permission access hook for the source file was called with the wrong creds. This could cause either deny of access to copy which would otherwise be allowed (e.g. with splice) or allow read access to file which would otherwise be denied. Fix the latter case by explicitly verifying read access to source file with the source overlayfs mounter creds. The former case remains a quirk of cross-sb overlayfs copy, but userspace could fall back to regular copy so no harm done.
Privilege boundary enforcement failure in MongoDB Server allows an authenticated user holding only database-scoped privileges to modify diagnostic logging parameters at the server-wide level. Affected versions span MongoDB 7.0 (before 7.0.40), 8.0 (before 8.0.29), and 8.3 (before 8.3.8). An attacker with low-privilege credentials can either suppress server-wide diagnostic logging to obscure unauthorized activity or flood logs to degrade operational monitoring - effectively undermining the integrity of the audit and observability layer. No public exploit code exists and CISA has not added this to the KEV catalog.
Privilege escalation in Adobe Commerce and Magento Open Source exposes restricted resources to authenticated high-privilege users through a flawed authorization check (CWE-863). Affected products span the full 2.4.x series of Adobe Commerce and Magento Open Source, plus the 1.3.x-1.5.x Adobe Commerce B2B extension. No public exploits are known, CISA SSVC rates exploitation as none, and vendor-released August 2026 patches are available across all affected release lines per advisory APSB26-92.
Firmware improper input validation in Intel Xeon processors enables a highly privileged local adversary operating within System Management Mode (SMM) or startup code context to alter the integrity of subsequent system components. The CVSS 4.0 vector confirms local-only access (AV:L), high complexity (AC:H), presence-required attack conditions (AT:P), and a high-privilege prerequisite (PR:H), with zero confidentiality or availability impact - only downstream integrity degradation (SI:H). No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, placing real-world exploitation risk firmly in the advanced persistent threat category rather than opportunistic attack.
SSRF with privilege escalation affects Adobe's Content Credentials SDK and CLI toolchain, enabling a network-based attacker to induce the victim's client to issue server-side requests to unintended internal or external targets. Exploitation requires user interaction - a victim must visit a crafted URL or engage with a compromised web page - but the CVSS scope change (S:C) indicates the vulnerability can reach beyond the directly vulnerable component to affect other systems or services. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Binary hijacking is possible on Windows machines running AMD Vitis Unified due to weak filesystem permissions on the installation directory. A low-privileged local user can write arbitrary executables into paths traversed by higher-privileged processes, causing those processes to load attacker-controlled code when triggered by an interactive user. The CVSS 4.0 score of 1.0 reflects significant limiting prerequisites: local access, low-privilege credentials, specific attack preconditions, and required user interaction are all mandatory for exploitation. No public exploit has been identified at time of analysis.
Privilege escalation in AMD Vitis Unified on Windows enables a low-privileged local user to plant malicious code in the installation directory due to misconfigured filesystem permissions, potentially leading to arbitrary code execution under a more privileged context. Affected installations are the Vitis Unified Installer for FPGAs and Adaptive SoCs on Windows, patched in release 2026.1. No public exploit code and no active exploitation have been identified at time of analysis; CISA SSVC rates exploitation as none and the attack as non-automatable.
Privilege escalation in Intel(R) Transfer Learning Tool before version v0.7 stems from a protection mechanism failure (CWE-693) within the Ring 3 user application layer, enabling unauthenticated remote attackers to elevate privileges under specific attack conditions. The flaw affects confidentiality, integrity, and availability at a low severity each, with no subsequent system-level impact confirmed. No public exploit code or CISA KEV listing exists at time of analysis, and Intel has published advisory INTEL-SA-01499 addressing this issue.
Privilege escalation in Intel Processors operating within Ring 0 environments - kernel, hypervisor, and bare-metal OS - allows an authorized attacker already holding high-privilege access to cross isolation boundaries and achieve high confidentiality and integrity impact on subsequent systems such as hypervisors or co-located virtual machines. The CVSS 4.0 vector (AV:L/AC:H/AT:P/PR:H/SC:H/SI:H) confirms the attack is local, high-complexity, and gated behind existing privileged access plus special internal knowledge of processor internals, significantly limiting the exploitable population. No public exploit code and no CISA KEV listing exist at time of analysis, making current real-world risk primarily theoretical but relevant to hardened multi-tenant and virtualized datacenter environments.