Privilege Escalation
Monthly
The Optimizer module in Huawei HarmonyOS and EMUI performs an operation without an adequate permission check, letting a local app with limited privileges reach data or functionality that should be restricted to more privileged callers. Huawei's own scoring is modest (CVSS 3.7) and the published vector assumes network reachability with high attack complexity, while the independent assessment places the flaw as local with low privileges and only low confidentiality impact - the two views differ on attack vector and on which impact dimension is affected (availability in the vendor vector, confidentiality in the description), and that discrepancy is unresolved in the supplied data. No public exploit code or CISA KEV entry is associated with this CVE, and the vendor bulletin is the only remediation reference provided.
Huawei HarmonyOS contains a permission-control weakness in its background task management module that, under the assessed CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N, base score 3.6), requires local access with user interaction and produces only limited confidentiality impact that crosses a scope boundary. No public exploit code has been identified at time of analysis, and the aggregated priority signal is monitor. Huawei's October 2026 consumer, Vision and laptop security bulletins should be consulted for the fixed builds.
A permission-control weakness in the HarmonyOS graphics module lets a locally present attacker read data that should be protected, with high confidentiality impact and no integrity or availability effect. Because the CVSS vector is local-only (AV:L) with no privileges or user interaction required (PR:N/UI:N), the realistic threat is a malicious or compromised app already installed on the device rather than a network-facing attacker. Exploitation status is unconfirmed: no public exploit code is known at time of analysis, CISA KEV does not list this CVE, and it is rated for attention this month rather than immediate action; the exact triggering interface and affected HarmonyOS versions are not described in the available sources.
In Modem, there is a possible escalation of privilege due to a permissions bypass. This could lead to local escalation of privilege (EoP) if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09608864 / ALPS09327759; Issue ID: MSV-2958.
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: MOLY01320076; Issue ID: MSV-6889.
In Modem, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: MOLY01790985; Issue ID: MSV-8148.
In neuropilot, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11263078; Issue ID: MSV-9001.
In GPU pdma, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11365075; Issue ID: MSV-9546.
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01338165; Issue ID: MSV-9660.
In usb, there is a possible memory corruption due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11411916; Issue ID: MSV-9746.
In usb, there is a possible memory corruption due to double free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11411924; Issue ID: MSV-9748.
In usb, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11411985; Issue ID: MSV-9750.
In afe, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431385; Issue ID: MSV-9920.
In afe, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431394; Issue ID: MSV-9921.
In afe, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431400; Issue ID: MSV-9922.
In afe, there is a possible memory corruption due to double free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431412; Issue ID: MSV-9923.
In adsp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431442; Issue ID: MSV-9924.
In afe, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11434319; Issue ID: MSV-9925.
In adsp, there is a possible escalation of privilege due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431474; Issue ID: MSV-9926.
In adsp, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431474; Issue ID: MSV-9927.
In afe, there is a possible system crash due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11439283; Issue ID: MSV-10003.
In afe, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431394; Issue ID: MSV-10004.
In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01778991; Issue ID: MSV-8900.
In GPU pdma, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11365081; Issue ID: MSV-9545.
In GPU pdma, there is a possible escalation of privilege due to use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11365070; Issue ID: MSV-9547.
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01877236; Issue ID: MSV-9804.
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01876662; Issue ID: MSV-9833.
In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: MOLY01911177; Issue ID: MSV-10122.
In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11468968; Issue ID: MSV-10166.
In Modem, there is a possible out of bounds write due to improper input validation. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01775865; Issue ID: MSV-8895.
In Modem, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01872867 / MOLY01774038; Issue ID: MSV-9801.
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01874018 / MOLY01774038; Issue ID: MSV-9802.
In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01876654 / MOLY01774038; Issue ID: MSV-9803.
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01879158 / MOLY01774038; Issue ID: MSV-9811.
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01857954; Issue ID: MSV-8247.
Improper privilege management in the YznCMS Auth Group Handler (app/admin/controller/auth/Group.php) allows a user who already holds a high-privilege backend session to manipulate group handling so that privileges are granted or changed beyond the intended authorization model, affecting confidentiality, integrity and availability at a low level (CVSS 4.0 base 5.1, assessed CVSS 3.1 5.1). All versions up to and including 2.2.0 are affected, and exploitation requires an existing authenticated administrator-level session on the YznCMS admin panel (PR:H), so anonymous or low-privileged users cannot reach the flaw; no public exploit has been identified at time of analysis. Upgrading to version 2.2.1, which contains the fix, resolves the issue.
Unauthenticated attackers can recover the shared password protecting UsersWP's 25 built-in dummy user accounts - in all plugin versions up to and including 1.2.78 - from a single HTTP request, then authenticate as accounts such as antawn, chynna or kiki through wp-login.php. The value is derived as the first 15 characters of a SHA-256 hash of AUTH_KEY concatenated with site_url(), while the full 25-character hash of that same input is rendered into the hidden uwp_register_hash field on every registration form, reachable via the public /register/ page and the wp_ajax_nopriv_uwp_ajax_register_form AJAX handler even when user registration is switched off. Impact is conditional rather than universal: an administrator must previously have created the dummy users from the plugin's Tools page, and meaningful privilege escalation only occurs where one of those accounts was given an elevated role; no public exploit code has been identified at time of analysis.
Authenticated users holding Author-level access or above can raise the role of accounts created through Essential Addons for Elementor's registration form, including accounts registered by unauthenticated visitors via the public form, to a higher role such as Editor. The flaw affects versions 6.6.0 through 6.8.7 and is an incomplete fix of CVE-2026-5193; version 6.8.8 corrects it. No public exploit has been identified at time of analysis, EPSS is 0.18% (7th percentile), and CISA SSVC records no known exploitation, no automatable exploitation, and partial technical impact.
Contributor-level users of the Cozmoslabs Profile Builder plugin for WordPress (versions up to and including 4.0.5) can escalate beyond their assigned role because the plugin mishandles privilege assignment (CWE-266). An attacker who already holds a Contributor account - plausible on sites with open registration or multi-author workflows - can leverage the flawed role-handling logic over the network without any user interaction, with low confidentiality, integrity and availability impact (CVSS 6.3, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). No public exploit code was identified at time of analysis and the issue is not in CISA KEV; the exact trigger path and the specific elevated capability obtained are not described in the available sources.
Privilege escalation in AxonHub through 1.0.0-beta11 lets an authenticated project user who holds the write_api_keys scope mint a service_account API key carrying system-level scopes such as read_channels, then call the /admin/graphql endpoint to read every channel's configuration, including base URLs and model lists. Exploitation requires an authenticated principal with that project-level scope (CVSS PR:L) and no user interaction; the assessed vector rates confidentiality impact as low with no integrity or availability effect, and broader exposure depends on which system-level scopes the attacker chooses to mint because the pre-patch code did not restrict them. A public technical writeup of the scope-grant flaw exists but is not verified as working exploit code, and the vendor has published an upstream fix (PR #2741 / commit e5c904ef); there is no CISA KEV entry and the issue is triaged as this_month rather than an emergency.
Privilege escalation in Cloud Foundry's Cloud Controller API (CAPI) lets an account that holds only the SpaceSupporter role perform start-command and buildpack-action modifications that are supposed to require SpaceDeveloper privileges, and then abuse that capability to read the credentials of services bound to applications in the space. Deployments running the Cloud Foundry Controller (CAPI) and CF-Deployment are in scope per the published CPE data, and exploitation requires a valid account already granted SpaceSupporter on a space containing apps with bound services, plus an app staging or restart so the malicious start command or buildpack executes. No public exploit code has been identified at time of analysis and there is no KEV listing; the reported priority is remediation this month, and the separate assessment classifies this as a genuine but contained privilege-escalation issue rather than a top-tier emergency.
Privilege Defined With Unsafe Actions vulnerability in Drupal Custom Formatters allows Privilege Escalation. This issue affects Custom Formatters versions: from 0.0.0 to 4.2.1.
Incorrect Authorization vulnerability in Drupal Simple User Management allows Forceful Browsing. This issue affects Simple User Management versions: from 0.0.0 to 1.11.0.
Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects S3 File System versions: from 0.0.0 to 3.12.0.
Software installed and run as a non-privileged user may conduct improper GPU system calls to free memory in still in use, replace with another allocation and cause arbitrary memory reads or writes to physical memory pages. A memory buffer managed by a CPU thread of control (driver) and accessed by a GPU thread of control (firmware) can be freed while in use. Software installed and run as a non-privileged user may replace that buffer with another and replace a shared resource (memory page address list) managed by the CPU thread of control (driver) leading to the GPU accessing memory not managed by the CPU thread of control (driver).
Software installed and run as a non-privileged user may conduct improper GPU system calls to cause race condition in hardware performance counters buffer’s destruction path leading to read and/or write UAF. The race condition in the destruction path could lead to reference counter being decremented in non-atomical way allowing other code paths using a freed object to read and/or write kernel heap memory.
Privilege escalation in Elastic Cloud Enterprise lets an attacker who already controls a host in an ECE installation leverage secrets left behind by certificate rotation to gain full control of the ECE control plane and its managed deployments. The retained rotation data includes platform credentials and certificate authority private keys, and lower-privileged platform components can read it; exploitation therefore requires a prior host foothold and prior execution of the rotation procedure. No public exploit identified at time of analysis, and the vendor fixed the issue in ECE 3.8.6 and 4.2.1.
Elastic Cloud Enterprise (ECE) installations on versions prior to the fixed 3.8.6 and 4.2.1 releases allow an attacker who already controls any host in the installation to obtain credentials reserved for other platform roles, escalating from a host foothold to full control of the ECE control plane and every deployment it manages. The flaw is an authorization bypass through a user-controlled key (CWE-639), meaning the platform trusts a caller-supplied identifier when deciding which role's credentials to return. The vendor vector (CVSS:3.1/AV:A/AC:L/PR:H/UI:N) confirms the meaningful limiter: exploitation requires an existing privileged position adjacent to the ECE network, so this is an insider, co-tenant or post-breach lateral-movement risk (medium severity, CVSS 6.8) rather than a mass internet-exploitation event. No public exploit code or CISA KEV entry is associated with this CVE at time of analysis; prioritization is 'this_month'.
In the Linux kernel, the following vulnerability has been resolved: autofs: ignore notification errors from a replaced pipe autofs_notify_daemon() takes a reference to the current notification pipe under wq_mutex, then drops the mutex before writing the request. The write can block while the daemon enters catatonic mode and installs a replacement pipe. If the old pipe's reader is then closed, the delayed write returns -EPIPE and the generic error path enters catatonic mode again. That transition acts on the current superblock state, closes the replacement pipe, and releases the new daemon generation's wait queues. Only enter catatonic mode when the pipe which failed is still the current pipe. Factor the already-locked transition so the identity check and state change are atomic with respect to another replacement. This was reproduced on v7.3-rc5-337-gff47652a4b66c in a local QEMU guest. An unprivileged UID 65534 lookup filled the old packet pipe before a normal CATATONIC/SETPIPEFD restart. On the unmodified kernel, the new pipe received HUP and both a pending victim lookup and a later lookup failed with ENOENT in two out of two fresh-mount runs. With this change, the new pipe remained active, received an intact 304-byte request, and both victim lookups completed in two out of two runs. Normal lookup and restart-without-a-blocked-writer controls passed. No KASAN, oops, refcount, or lock diagnostic was observed. A source reproducer and complete local logs are available privately on request. The demonstrated impact is limited to denial of a shared autofs service during a legitimate daemon restart. No memory corruption, information leak, privilege escalation, or code execution primitive was observed.
Local privilege escalation in Acronis Cyber Protect Cloud Agent (Windows) before build 42569 and Acronis Cyber Protect 17 (Windows) before build 42587 lets an authenticated local user with low privileges abuse improper authentication in the agent to reach high confidentiality and integrity impact. The weakness is CWE-1390 (improper authentication) and requires an existing local foothold on the Windows host - there is no remote vector and no user interaction is needed; availability is not affected. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so this is a moderate, local-only risk rather than an emergency, though the vendor did report it and patched builds are available.
Privilege escalation in the BeyondSEO WordPress plugin through version 1.3.6 allows authenticated users with Contributor-level access or above to create, update and delete site-wide 301/302 redirects, giving them administrator-equivalent control over redirect management and the ability to hijack arbitrary paths such as /checkout or /wp-login. The plugin permanently assigns its rankingcoach_write_* module capabilities to the Contributor role by default, and its REST create/edit/delete callbacks authorize only on that capability, so no administrator rights are needed beyond the Contributor foothold. No public exploit identified at time of analysis and no CISA KEV entry; the issue is a genuine but moderate-priority concern (this_month) rather than an emergency, because the realistic attack surface depends on sites that allow untrusted users to obtain Contributor-level accounts.
Local, low-privileged users on a Windows host running Veeam Backup for Microsoft 365 can steer the installer into writing arbitrary files with SYSTEM privileges, creating a privilege-escalation or denial-of-service risk. Affected builds are 8.0 through 8.6.0.1102, and exploitation is constrained to the installation or upgrade window with administrator-initiated interaction; the assessed severity is low-to-moderate (CVSS 4.3 Medium), and no public exploit was identified at time of analysis.
Nextcloud Server 32.0.0 through 34.0.0 accepts an application-specific app password as sufficient proof for the password-confirmation (re-authentication) gate that protects sensitive endpoints, so anyone holding a valid app-password token can perform integrity-affecting privileged actions that should have required the real account password. The concrete prerequisite is possession of such a token (the flaw is rated PR:L), which typically means a leaked, over-scoped or stale app password rather than an unauthenticated attacker. Severity is moderate (CVSS 5.3 vendor score, 5.3 equivalent under our assessment, which raises AC:H to AC:L because no unusual conditions beyond holding the token are needed); there is no CISA KEV entry and no public exploit code identified at time of analysis, only the original HackerOne report, so this is a this-month priority rather than an emergency.
Privilege escalation due to use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159.
Privilege escalation in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.
Privilege escalation in the Toolkit component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.
Privilege escalation due to use-after-free in the WebRTC: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.
Privilege escalation due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.
Privilege escalation due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.
Improper privilege management in Dell PowerProtect Data Domain allows a high-privileged attacker with local access to the appliance to escalate privileges, with assessed impact to integrity and availability rated High and confidentiality Low (CVSS 6.3). Affected builds are Feature Release 7.7.1.0 through 8.7, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40 and LTS2026 8.6.1.0 through 8.6.1.20; because exploitation requires both an existing high-privileged account and local access, real-world exposure is largely confined to insiders or already-compromised privileged accounts. No public exploit code or confirmed active exploitation was identified at time of analysis, and vendor fixes are available.
Dell PowerProtect Data Domain appliances running Feature Release 7.7.1.0 through 8.7, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, or LTS2026 8.6.1.0 through 8.6.1.20 contain an improper privilege management flaw that lets a remote attacker who already holds a high-privileged account elevate privileges. The CVSS 3.1 score is 6.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H), and Dell has released fixed versions 8.9.0.0, 8.3.1.50, 8.6.1.30, and 7.13.1.90. No public exploit was identified at the time of analysis, and the requirement for high-privileged credentials limits exposure.
Psono Server 5.3.5 through 7.2.3 allows an attacker who already holds an authenticated session derived from a scope-restricted API key to escalate privileges by claiming an attacker-controlled device code, receiving in return a full read-write session valid for up to 365 days that outlives and exceeds the original token's scope and lifetime limits. The flaw is a missing write-scope enforcement in the permission class on the device-code claim path (CWE-269), rated CVSS 6.5 with PR:L, and it does not bypass two-factor authentication nor directly disclose plaintext secrets. It is not confirmed as actively exploited (CISA KEV) and no public exploit code has been identified at time of analysis; EPSS is low at 0.47% (40th percentile), and the vendor has released a fix in 7.2.4.
Missing authorization in OpenPanel's onboarding.project tRPC mutation lets any authenticated organization member - including a read-only one - create unlimited projects and mint plaintext write-type ingestion credentials inside that organization, bypassing the admin-only policy that the sibling procedures project.create and client.create enforce. All releases before 3.0.0 are affected (2.3.0 confirmed vulnerable), and the minted write-type secret cannot read existing data or manage resources, so impact is bounded to injecting fake analytics events, poisoning business metrics and consuming the organization's usage budget. EPSS is low (0.24%, 15th percentile), there is no CISA KEV entry, and the upstream GHSA advisory publishes a working PoC request (a single tRPC call over the dashboard httpLink with a non-admin member session cookie).
An authenticated low-privileged user of BKWLD Decoy through version 5.11.1 can raise their own privileges by manipulating the 'role' argument handled by the Authorization Policy logic in Policy.php. Because the attacker must already hold a valid account (CVSS PR:L), anonymous remote users cannot exploit it, but no user interaction is needed and the attack path is simple. This is a medium-severity integrity-only issue (CVSS 4.0 base 5.3; assessed CVSS 3.1 5.3, C:N/I:L/A:N) that sits below emergency priority; a public PoC reference exists but is not verified as working exploit code, there is no confirmed active exploitation, and the vendor did not respond to the disclosure.
Pyrus Sync for Windows contains a local privilege escalation vulnerability caused by missing authorization controls in its PyrusSyncService Windows service, which allow an attacker with unprivileged access to create files using the ISyncService contract.
Unauthenticated remote manipulation of the 'hash' argument handled by app/del.php in icret EasyImage (EasyImages2.0) through version 2.8.7 permits improper privilege management, letting an attacker perform unauthorized file deletion and manipulation on a network-exposed instance without any credentials or user interaction. Confidentiality is not affected and integrity/availability impact is rated Low, so the practical outcome is destructive file-level tampering rather than data theft or code execution. A public proof-of-concept reference has been published alongside the report; it is a reference only and is not verified as working exploit code, and no confirmed active exploitation has been reported.
SMS multi-factor authentication login-code requests in Parse Server are persisted with master privileges, letting an authenticated user who is enrolled in SMS MFA smuggle extra account fields into that request so they are written to their own record with restrictions bypassed. Successful abuse allows integrity-only changes to self-owned data, such as flipping the email-verification flag or setting values normally protected by beforeSave triggers; other users' records cannot be touched. The flaw affects only deployments using the built-in SMS MFA adapter with enrolled accounts, in versions before 8.6.104 and 9.0.0 through 9.10.5-alpha.5, and no public exploit identified at time of analysis while vendor patches are available.
Expired OAuth 2.0 access tokens continue to be accepted by the camel-keycloak KeycloakSecurityPolicy when token introspection is enabled (useTokenIntrospection=true) and the default introspection result cache is active. Because both shipped caches (ConcurrentMapTokenCache, CaffeineTokenCache) expire entries on a fixed insertion-time TTL rather than being bounded by the token's exp claim, and KeycloakSecurityProcessor only re-checks the introspection response's active flag, a token cached shortly before it expired remains usable for up to introspectionCacheTtl seconds after expiry - 60 seconds by default, or 300-600 seconds where the documentation's internal-services guidance was followed. An authenticated holder of a token that was valid moments earlier can therefore keep exercising exactly the roles and permissions that token already carried; no forgery or privilege escalation is possible, introspection is not enabled by default, and the local JWT verification path is unaffected. No public exploit code or exploitation activity is identified in the available data, and the overall risk is assessed as medium severity with low urgency.
Local privilege escalation in CGM CLININET allows anyone who already holds the low-privileged uhcapache account to rewrite the scripts and configuration files belonging to the root-running HL7 message-processing service and thereby execute arbitrary code as root on the hospital server. The root cause is an incorrect permission assignment (CWE-732) on a critical resource, scored 9.3 under CVSS 4.0 and carrying a vuln.today decision label of act_now, with CERT-PL reporting impact up to version 2026.MS3 and later builds possibly affected. No public exploit code has been identified at time of analysis, and exploitation is constrained to local access plus prior possession of the uhcapache account, but the resulting root-level compromise of a clinical information system is severe.
Remote code execution with root privileges affects CGM CLININET application servers through version 2026.MS3, where HL7 communication processes run as root and parse untrusted data from external systems. An unauthenticated attacker on an adjacent network segment who can deliver data to an exposed HL7 listener can achieve code execution with root privileges; the additional attack requirement encoded as AT:P is not described in the available sources. No public exploit was identified at time of analysis, but the issue is a genuine high-priority item prioritized act_now because of the root-level impact and unauthenticated adjacent-network path.
Unauthenticated attackers positioned on the same adjacent network segment can modify data or configuration on affected HPE networking devices, reflected in a CVSS 3.1 base score of 6.5 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). No description, CWE, or version range was supplied with this record, so the specific component, product line and trigger must be resolved from the referenced HPE advisory (docId hpesbnw05162en_us). No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV; the Layer-2 adjacency prerequisite keeps it off the directly internet-reachable attack surface.
Stored cross-site scripting in OpenCATS before 0.12.0 lets a low-privileged authenticated user plant HTML/JavaScript in the name or title field of a Candidate, Company, Contact, Job Order, or List, which lib/MRU.php's getFormatted() stores unsanitized and renders unescaped in the 'Recent' (MRU) navigation panel present on nearly every page. The script fires only when another user opens or views the poisoned record, so exploitation is a second-order trigger limited by the need for a valid account (PR:L) and by victim interaction (UI:P); meaningful privilege escalation depends on the viewer holding elevated rights such as Site Administrator, in which case session/cookie theft could yield administrative control. Impact is assessed as moderate (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, scope changed) and no public exploit code or active exploitation was identified at time of analysis; the vendor has released 0.12.0 with the escaping fix.
Privilege escalation in the Drupal contributed module Editoria11y Accessibility Checker lets an account that already holds the module-granted permission perform actions beyond what that permission should allow, affecting integrity only. Sites running any release from 0.0.0 through 2.2.23 or from 3.0.0 through 3.0.9 with the module installed and enabled are exposed, but the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) confirms the attacker must first hold an authenticated account carrying that specific permission. Exploitation is not confirmed as active - the issue is not in CISA KEV, no public exploit code is identified at time of analysis, and EPSS is only 0.13% (3rd percentile), which matches the this_month, medium-severity, low-priority rating rather than an emergency.
Local privilege escalation in Checkmk 2.5.0p14 allows a low-privileged local user to execute code as root on monitored hosts where the Checkmk agent runs the 'mk-oracle' plugin, by writing a malicious library into an Oracle client library directory of an Oracle home listed in 'oratab', or by modifying 'oratab' itself. Exploitation requires three simultaneous preconditions - local access to the host, the non-default mk-oracle plugin explicitly enabled, and write permission to those Oracle paths - so opportunistic or remote exploitation is infeasible, and no public exploit code was identified at time of analysis (not listed in CISA KEV). Impact is rated on a scope-changed model because the root-run agent process can affect components beyond the plugin itself.
High-privileged local users on hosts running Oracle Essbase 21.8.3.0.0 can obtain unauthorized read access to critical Essbase data through a flaw in the Java Based Agent component, and because the scope is changed the exposed data may include that of other products on the same host. The CVSS 3.1 score is 6.0 (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N), a confidentiality-only impact that requires an existing interactive logon and administrator-level privileges rather than network reachability. No public exploit code or CISA KEV entry was identified at time of analysis, and patching is available through the referenced Oracle Critical Patch Update.
Oracle GoldenGate exposes critical data to any low-privileged user who can log on to the host running the product, through a weakness in the Vendor Access Module component. Affected builds span three release trains: 19.1.0.0.0 through 19.32.0.0, 21.3 through 21.23, and 23.4 through 23.26.3.0.0; successful exploitation yields high confidentiality impact with no integrity or availability effect (CVSS 3.1 base 5.5). The attack path is strictly local and authenticated (AV:L/PR:L), so external unauthenticated attackers cannot reach it directly, and there is no public exploit identified at time of analysis - a moderate-severity data-exposure issue rather than a mass-exploitable emergency.
Local privilege escalation in the Server Infrastructure component of Oracle Siebel CRM Deployment (supported versions 17.0 through 26.9) lets an attacker who already holds high-privileged logon access on the deployment host take over the Siebel CRM Deployment instance, with full confidentiality, integrity, and availability impact confined to that component. The attack is local (AV:L), requires high privileges (PR:H), and needs no user interaction. No public exploit code or confirmed active exploitation was identified at time of analysis, and the CVSS 3.1 base score of 6.7 reflects a moderate-priority issue whose real-world risk is strongly constrained by the mandatory prior privileged foothold on the server.
Oracle Siebel CRM Deployment (Server Infrastructure component), versions 17.0 through 26.9, can be fully compromised - confidentiality, integrity and availability - by an attacker who already holds a high-privileged logon on the host where the deployment component runs. The flaw is not remotely reachable: exploitation requires local access plus administrative credentials (CVSS 3.1 6.7, AV:L/PR:H/UI:N), but once those prerequisites are met, attack complexity is low and no user interaction is needed, making it a realistic post-compromise or insider escalation path rather than an external entry point. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no EPSS data was supplied.
Information disclosure in Siebel CRM Deployment 17.0 through 26.9 lets a low-privileged attacker who can log on locally to the deployment server read critical data accessible to the Server Infrastructure component. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms local, authenticated access is required and that only confidentiality is affected; there is no remote or unauthenticated path. No public exploit code was identified at time of analysis and CISA KEV does not list this CVE.
Siebel CRM Deployment (Server Infrastructure component) versions 17.0 through 26.9 can be taken over by an attacker who already holds a high-privileged account and has interactive logon access to the infrastructure host where the component executes. The issue is rated CVSS 3.1 base 6.7 with high confidentiality, integrity, and availability impact, but the local attack vector (AV:L) and high-privilege prerequisite (PR:H) sharply constrain the realistic attacker population to insiders or actors who already have a foothold. No public exploit identified at time of analysis; no CISA KEV entry is present in the provided data.
Oracle Siebel CRM Deployment (Server Infrastructure component) versions 17.0 through 26.9 expose confidential data to any low-privileged user who can log on locally to the host where the Siebel server infrastructure runs. No user interaction or elevated privileges are needed, and a successful attack yields read access to critical Siebel CRM Deployment data with no integrity or availability impact (CVSS 3.1 base 5.5, C:H/I:N/A:N). No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical barrier remains that the attacker must already hold a local account on the Siebel server host.
Unauthorized read access in Oracle Java SE's AWT component affects client-side sandboxed Java deployments that execute untrusted code, and it requires victim interaction plus high attack complexity to succeed. Affected releases include Java SE 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27, as well as GraalVM for JDK 17.0.20.1 and 21.0.12.1 and GraalVM Enterprise Edition 21.3.19.1.1; this is a low-priority, low-severity issue despite the network vector, and no public exploit was identified at time of analysis. Real-world exposure is narrow because the Java applet and Web Start sandbox model is deprecated and rarely enabled, and server deployments running only trusted administrator-installed code are explicitly outside the vulnerability's scope.
Low-privileged local users can read critical data from JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 via the Monitoring and Diagnostics SEC component, according to the Oracle October 2026 CPU. The assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) requires an existing interactive logon on the host running the affected Tools, so this is not a remote or unauthenticated authentication bypass despite the supplied 'Authentication Bypass' tag. No public exploit identified at time of analysis, and no CISA KEV entry is present in the provided data.
A local low-privilege user on Oracle Solaris 11.4 can abuse a flaw in the X Window System component to read and modify a subset of system data and cause a partial denial of service. Exploitation requires an interactive logon to the affected host and is gated by high attack complexity, meaning success depends on winning a race or hitting a specific non-deterministic runtime state, and the impact stays capped at partial confidentiality, integrity, and availability loss with no privilege escalation. No public exploit code or confirmed active exploitation was identified at time of analysis, and the CVSS 3.1 base score of 4.5 reflects the significant practical barriers to abuse.
Unauthenticated attackers with HTTP network access to the Content Server component of Oracle WebCenter Content can induce a targeted user to perform an interaction that grants limited unauthorized read and insert/update/delete access to application data, with scope change potentially extending impact to connected products. The issue affects versions 12.2.1.4.0 and 14.1.2.0.0 and carries a CVSS 3.1 base score of 6.1; no public exploit code or CISA KEV confirmation was identified at time of analysis, and the required victim interaction makes automated mass exploitation impractical.
Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allow authenticated low-privilege users to read confidential Content Server data over HTTP, with CVSS 3.1 base score 6.5 reflecting high confidentiality impact and no integrity or availability effect. Exploitation requires a valid low-privilege account plus network access to the Content Server component; no user interaction or special configuration is indicated. No public exploit identified at time of analysis, and no CISA KEV confirmation was provided.
Local privilege escalation in Oracle Communications Billing and Revenue Management can let an attacker who already holds high-privileged host access compromise the Platform component, affecting versions 15.0.0.0.0 through 15.2.0.0.0. The CVSS 3.1 score is 6.7 with AV:L/PR:H, so the main barrier is the requirement for a high-privileged local logon rather than network reachability; no public exploit was identified at time of analysis.
Local privilege escalation in the Nokia 1830 Global Express GX lets an attacker who already holds valid credentials for the device's restricted administrative shell escape that shell's restrictions and obtain root on the appliance. Only G31, G32, G34 and G42 units running releases prior to GX r9.0 are affected, and there is no remote vector - access to the local console or management plane plus an authenticated shell account is a prerequisite. No public exploit code has been identified at time of analysis, EPSS is low at 0.14% (3rd percentile), and the issue has not been added to CISA KEV; the assessed priority is this_month rather than act_now.
Information disclosure in Apple macOS allows an app already installed and running on the host to reach user-sensitive data it should not be able to read, because the app was granted additional entitlements it should not have held. Apple addressed the flaw by removing those entitlements, and the fix ships in macOS Golden Gate 27; all earlier macOS releases in the tracked range (EUVD: 0 < 27) are affected. The assessed vector is local with no privileges required beyond executing a local app (AV:L/PR:N), confidentiality-only impact, and no integrity or availability effect; there is no remote or network-facing path. No public exploit has been identified at time of analysis, EPSS is 0.14% (3rd percentile), the issue is not in CISA KEV, and the priority signal is this_month - a moderate-severity, locally triggered disclosure rather than an emergency.
Local sandbox restrictions in Apple macOS can be bypassed by an app running under a user account to read the user's Contacts data, and Apple fixed the permissions issue in macOS Golden Gate 27. The CVSS 3.3 vector is local, low-complexity, and requires low privileges, with confidentiality impact limited to contact information and no integrity or availability impact. No public exploit code or active exploitation has been identified at time of analysis, and EPSS is 0.14% at the 3rd percentile, making this a low-priority issue across nearly every signal.
The Optimizer module in Huawei HarmonyOS and EMUI performs an operation without an adequate permission check, letting a local app with limited privileges reach data or functionality that should be restricted to more privileged callers. Huawei's own scoring is modest (CVSS 3.7) and the published vector assumes network reachability with high attack complexity, while the independent assessment places the flaw as local with low privileges and only low confidentiality impact - the two views differ on attack vector and on which impact dimension is affected (availability in the vendor vector, confidentiality in the description), and that discrepancy is unresolved in the supplied data. No public exploit code or CISA KEV entry is associated with this CVE, and the vendor bulletin is the only remediation reference provided.
Huawei HarmonyOS contains a permission-control weakness in its background task management module that, under the assessed CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N, base score 3.6), requires local access with user interaction and produces only limited confidentiality impact that crosses a scope boundary. No public exploit code has been identified at time of analysis, and the aggregated priority signal is monitor. Huawei's October 2026 consumer, Vision and laptop security bulletins should be consulted for the fixed builds.
A permission-control weakness in the HarmonyOS graphics module lets a locally present attacker read data that should be protected, with high confidentiality impact and no integrity or availability effect. Because the CVSS vector is local-only (AV:L) with no privileges or user interaction required (PR:N/UI:N), the realistic threat is a malicious or compromised app already installed on the device rather than a network-facing attacker. Exploitation status is unconfirmed: no public exploit code is known at time of analysis, CISA KEV does not list this CVE, and it is rated for attention this month rather than immediate action; the exact triggering interface and affected HarmonyOS versions are not described in the available sources.
In Modem, there is a possible escalation of privilege due to a permissions bypass. This could lead to local escalation of privilege (EoP) if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09608864 / ALPS09327759; Issue ID: MSV-2958.
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: MOLY01320076; Issue ID: MSV-6889.
In Modem, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: MOLY01790985; Issue ID: MSV-8148.
In neuropilot, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11263078; Issue ID: MSV-9001.
In GPU pdma, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11365075; Issue ID: MSV-9546.
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01338165; Issue ID: MSV-9660.
In usb, there is a possible memory corruption due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11411916; Issue ID: MSV-9746.
In usb, there is a possible memory corruption due to double free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11411924; Issue ID: MSV-9748.
In usb, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11411985; Issue ID: MSV-9750.
In afe, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431385; Issue ID: MSV-9920.
In afe, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431394; Issue ID: MSV-9921.
In afe, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431400; Issue ID: MSV-9922.
In afe, there is a possible memory corruption due to double free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431412; Issue ID: MSV-9923.
In adsp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431442; Issue ID: MSV-9924.
In afe, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11434319; Issue ID: MSV-9925.
In adsp, there is a possible escalation of privilege due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431474; Issue ID: MSV-9926.
In adsp, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431474; Issue ID: MSV-9927.
In afe, there is a possible system crash due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11439283; Issue ID: MSV-10003.
In afe, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431394; Issue ID: MSV-10004.
In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01778991; Issue ID: MSV-8900.
In GPU pdma, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11365081; Issue ID: MSV-9545.
In GPU pdma, there is a possible escalation of privilege due to use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11365070; Issue ID: MSV-9547.
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01877236; Issue ID: MSV-9804.
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01876662; Issue ID: MSV-9833.
In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: MOLY01911177; Issue ID: MSV-10122.
In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11468968; Issue ID: MSV-10166.
In Modem, there is a possible out of bounds write due to improper input validation. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01775865; Issue ID: MSV-8895.
In Modem, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01872867 / MOLY01774038; Issue ID: MSV-9801.
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01874018 / MOLY01774038; Issue ID: MSV-9802.
In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01876654 / MOLY01774038; Issue ID: MSV-9803.
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01879158 / MOLY01774038; Issue ID: MSV-9811.
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01857954; Issue ID: MSV-8247.
Improper privilege management in the YznCMS Auth Group Handler (app/admin/controller/auth/Group.php) allows a user who already holds a high-privilege backend session to manipulate group handling so that privileges are granted or changed beyond the intended authorization model, affecting confidentiality, integrity and availability at a low level (CVSS 4.0 base 5.1, assessed CVSS 3.1 5.1). All versions up to and including 2.2.0 are affected, and exploitation requires an existing authenticated administrator-level session on the YznCMS admin panel (PR:H), so anonymous or low-privileged users cannot reach the flaw; no public exploit has been identified at time of analysis. Upgrading to version 2.2.1, which contains the fix, resolves the issue.
Unauthenticated attackers can recover the shared password protecting UsersWP's 25 built-in dummy user accounts - in all plugin versions up to and including 1.2.78 - from a single HTTP request, then authenticate as accounts such as antawn, chynna or kiki through wp-login.php. The value is derived as the first 15 characters of a SHA-256 hash of AUTH_KEY concatenated with site_url(), while the full 25-character hash of that same input is rendered into the hidden uwp_register_hash field on every registration form, reachable via the public /register/ page and the wp_ajax_nopriv_uwp_ajax_register_form AJAX handler even when user registration is switched off. Impact is conditional rather than universal: an administrator must previously have created the dummy users from the plugin's Tools page, and meaningful privilege escalation only occurs where one of those accounts was given an elevated role; no public exploit code has been identified at time of analysis.
Authenticated users holding Author-level access or above can raise the role of accounts created through Essential Addons for Elementor's registration form, including accounts registered by unauthenticated visitors via the public form, to a higher role such as Editor. The flaw affects versions 6.6.0 through 6.8.7 and is an incomplete fix of CVE-2026-5193; version 6.8.8 corrects it. No public exploit has been identified at time of analysis, EPSS is 0.18% (7th percentile), and CISA SSVC records no known exploitation, no automatable exploitation, and partial technical impact.
Contributor-level users of the Cozmoslabs Profile Builder plugin for WordPress (versions up to and including 4.0.5) can escalate beyond their assigned role because the plugin mishandles privilege assignment (CWE-266). An attacker who already holds a Contributor account - plausible on sites with open registration or multi-author workflows - can leverage the flawed role-handling logic over the network without any user interaction, with low confidentiality, integrity and availability impact (CVSS 6.3, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). No public exploit code was identified at time of analysis and the issue is not in CISA KEV; the exact trigger path and the specific elevated capability obtained are not described in the available sources.
Privilege escalation in AxonHub through 1.0.0-beta11 lets an authenticated project user who holds the write_api_keys scope mint a service_account API key carrying system-level scopes such as read_channels, then call the /admin/graphql endpoint to read every channel's configuration, including base URLs and model lists. Exploitation requires an authenticated principal with that project-level scope (CVSS PR:L) and no user interaction; the assessed vector rates confidentiality impact as low with no integrity or availability effect, and broader exposure depends on which system-level scopes the attacker chooses to mint because the pre-patch code did not restrict them. A public technical writeup of the scope-grant flaw exists but is not verified as working exploit code, and the vendor has published an upstream fix (PR #2741 / commit e5c904ef); there is no CISA KEV entry and the issue is triaged as this_month rather than an emergency.
Privilege escalation in Cloud Foundry's Cloud Controller API (CAPI) lets an account that holds only the SpaceSupporter role perform start-command and buildpack-action modifications that are supposed to require SpaceDeveloper privileges, and then abuse that capability to read the credentials of services bound to applications in the space. Deployments running the Cloud Foundry Controller (CAPI) and CF-Deployment are in scope per the published CPE data, and exploitation requires a valid account already granted SpaceSupporter on a space containing apps with bound services, plus an app staging or restart so the malicious start command or buildpack executes. No public exploit code has been identified at time of analysis and there is no KEV listing; the reported priority is remediation this month, and the separate assessment classifies this as a genuine but contained privilege-escalation issue rather than a top-tier emergency.
Privilege Defined With Unsafe Actions vulnerability in Drupal Custom Formatters allows Privilege Escalation. This issue affects Custom Formatters versions: from 0.0.0 to 4.2.1.
Incorrect Authorization vulnerability in Drupal Simple User Management allows Forceful Browsing. This issue affects Simple User Management versions: from 0.0.0 to 1.11.0.
Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects S3 File System versions: from 0.0.0 to 3.12.0.
Software installed and run as a non-privileged user may conduct improper GPU system calls to free memory in still in use, replace with another allocation and cause arbitrary memory reads or writes to physical memory pages. A memory buffer managed by a CPU thread of control (driver) and accessed by a GPU thread of control (firmware) can be freed while in use. Software installed and run as a non-privileged user may replace that buffer with another and replace a shared resource (memory page address list) managed by the CPU thread of control (driver) leading to the GPU accessing memory not managed by the CPU thread of control (driver).
Software installed and run as a non-privileged user may conduct improper GPU system calls to cause race condition in hardware performance counters buffer’s destruction path leading to read and/or write UAF. The race condition in the destruction path could lead to reference counter being decremented in non-atomical way allowing other code paths using a freed object to read and/or write kernel heap memory.
Privilege escalation in Elastic Cloud Enterprise lets an attacker who already controls a host in an ECE installation leverage secrets left behind by certificate rotation to gain full control of the ECE control plane and its managed deployments. The retained rotation data includes platform credentials and certificate authority private keys, and lower-privileged platform components can read it; exploitation therefore requires a prior host foothold and prior execution of the rotation procedure. No public exploit identified at time of analysis, and the vendor fixed the issue in ECE 3.8.6 and 4.2.1.
Elastic Cloud Enterprise (ECE) installations on versions prior to the fixed 3.8.6 and 4.2.1 releases allow an attacker who already controls any host in the installation to obtain credentials reserved for other platform roles, escalating from a host foothold to full control of the ECE control plane and every deployment it manages. The flaw is an authorization bypass through a user-controlled key (CWE-639), meaning the platform trusts a caller-supplied identifier when deciding which role's credentials to return. The vendor vector (CVSS:3.1/AV:A/AC:L/PR:H/UI:N) confirms the meaningful limiter: exploitation requires an existing privileged position adjacent to the ECE network, so this is an insider, co-tenant or post-breach lateral-movement risk (medium severity, CVSS 6.8) rather than a mass internet-exploitation event. No public exploit code or CISA KEV entry is associated with this CVE at time of analysis; prioritization is 'this_month'.
In the Linux kernel, the following vulnerability has been resolved: autofs: ignore notification errors from a replaced pipe autofs_notify_daemon() takes a reference to the current notification pipe under wq_mutex, then drops the mutex before writing the request. The write can block while the daemon enters catatonic mode and installs a replacement pipe. If the old pipe's reader is then closed, the delayed write returns -EPIPE and the generic error path enters catatonic mode again. That transition acts on the current superblock state, closes the replacement pipe, and releases the new daemon generation's wait queues. Only enter catatonic mode when the pipe which failed is still the current pipe. Factor the already-locked transition so the identity check and state change are atomic with respect to another replacement. This was reproduced on v7.3-rc5-337-gff47652a4b66c in a local QEMU guest. An unprivileged UID 65534 lookup filled the old packet pipe before a normal CATATONIC/SETPIPEFD restart. On the unmodified kernel, the new pipe received HUP and both a pending victim lookup and a later lookup failed with ENOENT in two out of two fresh-mount runs. With this change, the new pipe remained active, received an intact 304-byte request, and both victim lookups completed in two out of two runs. Normal lookup and restart-without-a-blocked-writer controls passed. No KASAN, oops, refcount, or lock diagnostic was observed. A source reproducer and complete local logs are available privately on request. The demonstrated impact is limited to denial of a shared autofs service during a legitimate daemon restart. No memory corruption, information leak, privilege escalation, or code execution primitive was observed.
Local privilege escalation in Acronis Cyber Protect Cloud Agent (Windows) before build 42569 and Acronis Cyber Protect 17 (Windows) before build 42587 lets an authenticated local user with low privileges abuse improper authentication in the agent to reach high confidentiality and integrity impact. The weakness is CWE-1390 (improper authentication) and requires an existing local foothold on the Windows host - there is no remote vector and no user interaction is needed; availability is not affected. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so this is a moderate, local-only risk rather than an emergency, though the vendor did report it and patched builds are available.
Privilege escalation in the BeyondSEO WordPress plugin through version 1.3.6 allows authenticated users with Contributor-level access or above to create, update and delete site-wide 301/302 redirects, giving them administrator-equivalent control over redirect management and the ability to hijack arbitrary paths such as /checkout or /wp-login. The plugin permanently assigns its rankingcoach_write_* module capabilities to the Contributor role by default, and its REST create/edit/delete callbacks authorize only on that capability, so no administrator rights are needed beyond the Contributor foothold. No public exploit identified at time of analysis and no CISA KEV entry; the issue is a genuine but moderate-priority concern (this_month) rather than an emergency, because the realistic attack surface depends on sites that allow untrusted users to obtain Contributor-level accounts.
Local, low-privileged users on a Windows host running Veeam Backup for Microsoft 365 can steer the installer into writing arbitrary files with SYSTEM privileges, creating a privilege-escalation or denial-of-service risk. Affected builds are 8.0 through 8.6.0.1102, and exploitation is constrained to the installation or upgrade window with administrator-initiated interaction; the assessed severity is low-to-moderate (CVSS 4.3 Medium), and no public exploit was identified at time of analysis.
Nextcloud Server 32.0.0 through 34.0.0 accepts an application-specific app password as sufficient proof for the password-confirmation (re-authentication) gate that protects sensitive endpoints, so anyone holding a valid app-password token can perform integrity-affecting privileged actions that should have required the real account password. The concrete prerequisite is possession of such a token (the flaw is rated PR:L), which typically means a leaked, over-scoped or stale app password rather than an unauthenticated attacker. Severity is moderate (CVSS 5.3 vendor score, 5.3 equivalent under our assessment, which raises AC:H to AC:L because no unusual conditions beyond holding the token are needed); there is no CISA KEV entry and no public exploit code identified at time of analysis, only the original HackerOne report, so this is a this-month priority rather than an emergency.
Privilege escalation due to use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159.
Privilege escalation in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.
Privilege escalation in the Toolkit component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.
Privilege escalation due to use-after-free in the WebRTC: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.
Privilege escalation due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.
Privilege escalation due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.
Improper privilege management in Dell PowerProtect Data Domain allows a high-privileged attacker with local access to the appliance to escalate privileges, with assessed impact to integrity and availability rated High and confidentiality Low (CVSS 6.3). Affected builds are Feature Release 7.7.1.0 through 8.7, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40 and LTS2026 8.6.1.0 through 8.6.1.20; because exploitation requires both an existing high-privileged account and local access, real-world exposure is largely confined to insiders or already-compromised privileged accounts. No public exploit code or confirmed active exploitation was identified at time of analysis, and vendor fixes are available.
Dell PowerProtect Data Domain appliances running Feature Release 7.7.1.0 through 8.7, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, or LTS2026 8.6.1.0 through 8.6.1.20 contain an improper privilege management flaw that lets a remote attacker who already holds a high-privileged account elevate privileges. The CVSS 3.1 score is 6.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H), and Dell has released fixed versions 8.9.0.0, 8.3.1.50, 8.6.1.30, and 7.13.1.90. No public exploit was identified at the time of analysis, and the requirement for high-privileged credentials limits exposure.
Psono Server 5.3.5 through 7.2.3 allows an attacker who already holds an authenticated session derived from a scope-restricted API key to escalate privileges by claiming an attacker-controlled device code, receiving in return a full read-write session valid for up to 365 days that outlives and exceeds the original token's scope and lifetime limits. The flaw is a missing write-scope enforcement in the permission class on the device-code claim path (CWE-269), rated CVSS 6.5 with PR:L, and it does not bypass two-factor authentication nor directly disclose plaintext secrets. It is not confirmed as actively exploited (CISA KEV) and no public exploit code has been identified at time of analysis; EPSS is low at 0.47% (40th percentile), and the vendor has released a fix in 7.2.4.
Missing authorization in OpenPanel's onboarding.project tRPC mutation lets any authenticated organization member - including a read-only one - create unlimited projects and mint plaintext write-type ingestion credentials inside that organization, bypassing the admin-only policy that the sibling procedures project.create and client.create enforce. All releases before 3.0.0 are affected (2.3.0 confirmed vulnerable), and the minted write-type secret cannot read existing data or manage resources, so impact is bounded to injecting fake analytics events, poisoning business metrics and consuming the organization's usage budget. EPSS is low (0.24%, 15th percentile), there is no CISA KEV entry, and the upstream GHSA advisory publishes a working PoC request (a single tRPC call over the dashboard httpLink with a non-admin member session cookie).
An authenticated low-privileged user of BKWLD Decoy through version 5.11.1 can raise their own privileges by manipulating the 'role' argument handled by the Authorization Policy logic in Policy.php. Because the attacker must already hold a valid account (CVSS PR:L), anonymous remote users cannot exploit it, but no user interaction is needed and the attack path is simple. This is a medium-severity integrity-only issue (CVSS 4.0 base 5.3; assessed CVSS 3.1 5.3, C:N/I:L/A:N) that sits below emergency priority; a public PoC reference exists but is not verified as working exploit code, there is no confirmed active exploitation, and the vendor did not respond to the disclosure.
Pyrus Sync for Windows contains a local privilege escalation vulnerability caused by missing authorization controls in its PyrusSyncService Windows service, which allow an attacker with unprivileged access to create files using the ISyncService contract.
Unauthenticated remote manipulation of the 'hash' argument handled by app/del.php in icret EasyImage (EasyImages2.0) through version 2.8.7 permits improper privilege management, letting an attacker perform unauthorized file deletion and manipulation on a network-exposed instance without any credentials or user interaction. Confidentiality is not affected and integrity/availability impact is rated Low, so the practical outcome is destructive file-level tampering rather than data theft or code execution. A public proof-of-concept reference has been published alongside the report; it is a reference only and is not verified as working exploit code, and no confirmed active exploitation has been reported.
SMS multi-factor authentication login-code requests in Parse Server are persisted with master privileges, letting an authenticated user who is enrolled in SMS MFA smuggle extra account fields into that request so they are written to their own record with restrictions bypassed. Successful abuse allows integrity-only changes to self-owned data, such as flipping the email-verification flag or setting values normally protected by beforeSave triggers; other users' records cannot be touched. The flaw affects only deployments using the built-in SMS MFA adapter with enrolled accounts, in versions before 8.6.104 and 9.0.0 through 9.10.5-alpha.5, and no public exploit identified at time of analysis while vendor patches are available.
Expired OAuth 2.0 access tokens continue to be accepted by the camel-keycloak KeycloakSecurityPolicy when token introspection is enabled (useTokenIntrospection=true) and the default introspection result cache is active. Because both shipped caches (ConcurrentMapTokenCache, CaffeineTokenCache) expire entries on a fixed insertion-time TTL rather than being bounded by the token's exp claim, and KeycloakSecurityProcessor only re-checks the introspection response's active flag, a token cached shortly before it expired remains usable for up to introspectionCacheTtl seconds after expiry - 60 seconds by default, or 300-600 seconds where the documentation's internal-services guidance was followed. An authenticated holder of a token that was valid moments earlier can therefore keep exercising exactly the roles and permissions that token already carried; no forgery or privilege escalation is possible, introspection is not enabled by default, and the local JWT verification path is unaffected. No public exploit code or exploitation activity is identified in the available data, and the overall risk is assessed as medium severity with low urgency.
Local privilege escalation in CGM CLININET allows anyone who already holds the low-privileged uhcapache account to rewrite the scripts and configuration files belonging to the root-running HL7 message-processing service and thereby execute arbitrary code as root on the hospital server. The root cause is an incorrect permission assignment (CWE-732) on a critical resource, scored 9.3 under CVSS 4.0 and carrying a vuln.today decision label of act_now, with CERT-PL reporting impact up to version 2026.MS3 and later builds possibly affected. No public exploit code has been identified at time of analysis, and exploitation is constrained to local access plus prior possession of the uhcapache account, but the resulting root-level compromise of a clinical information system is severe.
Remote code execution with root privileges affects CGM CLININET application servers through version 2026.MS3, where HL7 communication processes run as root and parse untrusted data from external systems. An unauthenticated attacker on an adjacent network segment who can deliver data to an exposed HL7 listener can achieve code execution with root privileges; the additional attack requirement encoded as AT:P is not described in the available sources. No public exploit was identified at time of analysis, but the issue is a genuine high-priority item prioritized act_now because of the root-level impact and unauthenticated adjacent-network path.
Unauthenticated attackers positioned on the same adjacent network segment can modify data or configuration on affected HPE networking devices, reflected in a CVSS 3.1 base score of 6.5 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). No description, CWE, or version range was supplied with this record, so the specific component, product line and trigger must be resolved from the referenced HPE advisory (docId hpesbnw05162en_us). No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV; the Layer-2 adjacency prerequisite keeps it off the directly internet-reachable attack surface.
Stored cross-site scripting in OpenCATS before 0.12.0 lets a low-privileged authenticated user plant HTML/JavaScript in the name or title field of a Candidate, Company, Contact, Job Order, or List, which lib/MRU.php's getFormatted() stores unsanitized and renders unescaped in the 'Recent' (MRU) navigation panel present on nearly every page. The script fires only when another user opens or views the poisoned record, so exploitation is a second-order trigger limited by the need for a valid account (PR:L) and by victim interaction (UI:P); meaningful privilege escalation depends on the viewer holding elevated rights such as Site Administrator, in which case session/cookie theft could yield administrative control. Impact is assessed as moderate (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, scope changed) and no public exploit code or active exploitation was identified at time of analysis; the vendor has released 0.12.0 with the escaping fix.
Privilege escalation in the Drupal contributed module Editoria11y Accessibility Checker lets an account that already holds the module-granted permission perform actions beyond what that permission should allow, affecting integrity only. Sites running any release from 0.0.0 through 2.2.23 or from 3.0.0 through 3.0.9 with the module installed and enabled are exposed, but the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) confirms the attacker must first hold an authenticated account carrying that specific permission. Exploitation is not confirmed as active - the issue is not in CISA KEV, no public exploit code is identified at time of analysis, and EPSS is only 0.13% (3rd percentile), which matches the this_month, medium-severity, low-priority rating rather than an emergency.
Local privilege escalation in Checkmk 2.5.0p14 allows a low-privileged local user to execute code as root on monitored hosts where the Checkmk agent runs the 'mk-oracle' plugin, by writing a malicious library into an Oracle client library directory of an Oracle home listed in 'oratab', or by modifying 'oratab' itself. Exploitation requires three simultaneous preconditions - local access to the host, the non-default mk-oracle plugin explicitly enabled, and write permission to those Oracle paths - so opportunistic or remote exploitation is infeasible, and no public exploit code was identified at time of analysis (not listed in CISA KEV). Impact is rated on a scope-changed model because the root-run agent process can affect components beyond the plugin itself.
High-privileged local users on hosts running Oracle Essbase 21.8.3.0.0 can obtain unauthorized read access to critical Essbase data through a flaw in the Java Based Agent component, and because the scope is changed the exposed data may include that of other products on the same host. The CVSS 3.1 score is 6.0 (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N), a confidentiality-only impact that requires an existing interactive logon and administrator-level privileges rather than network reachability. No public exploit code or CISA KEV entry was identified at time of analysis, and patching is available through the referenced Oracle Critical Patch Update.
Oracle GoldenGate exposes critical data to any low-privileged user who can log on to the host running the product, through a weakness in the Vendor Access Module component. Affected builds span three release trains: 19.1.0.0.0 through 19.32.0.0, 21.3 through 21.23, and 23.4 through 23.26.3.0.0; successful exploitation yields high confidentiality impact with no integrity or availability effect (CVSS 3.1 base 5.5). The attack path is strictly local and authenticated (AV:L/PR:L), so external unauthenticated attackers cannot reach it directly, and there is no public exploit identified at time of analysis - a moderate-severity data-exposure issue rather than a mass-exploitable emergency.
Local privilege escalation in the Server Infrastructure component of Oracle Siebel CRM Deployment (supported versions 17.0 through 26.9) lets an attacker who already holds high-privileged logon access on the deployment host take over the Siebel CRM Deployment instance, with full confidentiality, integrity, and availability impact confined to that component. The attack is local (AV:L), requires high privileges (PR:H), and needs no user interaction. No public exploit code or confirmed active exploitation was identified at time of analysis, and the CVSS 3.1 base score of 6.7 reflects a moderate-priority issue whose real-world risk is strongly constrained by the mandatory prior privileged foothold on the server.
Oracle Siebel CRM Deployment (Server Infrastructure component), versions 17.0 through 26.9, can be fully compromised - confidentiality, integrity and availability - by an attacker who already holds a high-privileged logon on the host where the deployment component runs. The flaw is not remotely reachable: exploitation requires local access plus administrative credentials (CVSS 3.1 6.7, AV:L/PR:H/UI:N), but once those prerequisites are met, attack complexity is low and no user interaction is needed, making it a realistic post-compromise or insider escalation path rather than an external entry point. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no EPSS data was supplied.
Information disclosure in Siebel CRM Deployment 17.0 through 26.9 lets a low-privileged attacker who can log on locally to the deployment server read critical data accessible to the Server Infrastructure component. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms local, authenticated access is required and that only confidentiality is affected; there is no remote or unauthenticated path. No public exploit code was identified at time of analysis and CISA KEV does not list this CVE.
Siebel CRM Deployment (Server Infrastructure component) versions 17.0 through 26.9 can be taken over by an attacker who already holds a high-privileged account and has interactive logon access to the infrastructure host where the component executes. The issue is rated CVSS 3.1 base 6.7 with high confidentiality, integrity, and availability impact, but the local attack vector (AV:L) and high-privilege prerequisite (PR:H) sharply constrain the realistic attacker population to insiders or actors who already have a foothold. No public exploit identified at time of analysis; no CISA KEV entry is present in the provided data.
Oracle Siebel CRM Deployment (Server Infrastructure component) versions 17.0 through 26.9 expose confidential data to any low-privileged user who can log on locally to the host where the Siebel server infrastructure runs. No user interaction or elevated privileges are needed, and a successful attack yields read access to critical Siebel CRM Deployment data with no integrity or availability impact (CVSS 3.1 base 5.5, C:H/I:N/A:N). No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical barrier remains that the attacker must already hold a local account on the Siebel server host.
Unauthorized read access in Oracle Java SE's AWT component affects client-side sandboxed Java deployments that execute untrusted code, and it requires victim interaction plus high attack complexity to succeed. Affected releases include Java SE 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27, as well as GraalVM for JDK 17.0.20.1 and 21.0.12.1 and GraalVM Enterprise Edition 21.3.19.1.1; this is a low-priority, low-severity issue despite the network vector, and no public exploit was identified at time of analysis. Real-world exposure is narrow because the Java applet and Web Start sandbox model is deprecated and rarely enabled, and server deployments running only trusted administrator-installed code are explicitly outside the vulnerability's scope.
Low-privileged local users can read critical data from JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 via the Monitoring and Diagnostics SEC component, according to the Oracle October 2026 CPU. The assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) requires an existing interactive logon on the host running the affected Tools, so this is not a remote or unauthenticated authentication bypass despite the supplied 'Authentication Bypass' tag. No public exploit identified at time of analysis, and no CISA KEV entry is present in the provided data.
A local low-privilege user on Oracle Solaris 11.4 can abuse a flaw in the X Window System component to read and modify a subset of system data and cause a partial denial of service. Exploitation requires an interactive logon to the affected host and is gated by high attack complexity, meaning success depends on winning a race or hitting a specific non-deterministic runtime state, and the impact stays capped at partial confidentiality, integrity, and availability loss with no privilege escalation. No public exploit code or confirmed active exploitation was identified at time of analysis, and the CVSS 3.1 base score of 4.5 reflects the significant practical barriers to abuse.
Unauthenticated attackers with HTTP network access to the Content Server component of Oracle WebCenter Content can induce a targeted user to perform an interaction that grants limited unauthorized read and insert/update/delete access to application data, with scope change potentially extending impact to connected products. The issue affects versions 12.2.1.4.0 and 14.1.2.0.0 and carries a CVSS 3.1 base score of 6.1; no public exploit code or CISA KEV confirmation was identified at time of analysis, and the required victim interaction makes automated mass exploitation impractical.
Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allow authenticated low-privilege users to read confidential Content Server data over HTTP, with CVSS 3.1 base score 6.5 reflecting high confidentiality impact and no integrity or availability effect. Exploitation requires a valid low-privilege account plus network access to the Content Server component; no user interaction or special configuration is indicated. No public exploit identified at time of analysis, and no CISA KEV confirmation was provided.
Local privilege escalation in Oracle Communications Billing and Revenue Management can let an attacker who already holds high-privileged host access compromise the Platform component, affecting versions 15.0.0.0.0 through 15.2.0.0.0. The CVSS 3.1 score is 6.7 with AV:L/PR:H, so the main barrier is the requirement for a high-privileged local logon rather than network reachability; no public exploit was identified at time of analysis.
Local privilege escalation in the Nokia 1830 Global Express GX lets an attacker who already holds valid credentials for the device's restricted administrative shell escape that shell's restrictions and obtain root on the appliance. Only G31, G32, G34 and G42 units running releases prior to GX r9.0 are affected, and there is no remote vector - access to the local console or management plane plus an authenticated shell account is a prerequisite. No public exploit code has been identified at time of analysis, EPSS is low at 0.14% (3rd percentile), and the issue has not been added to CISA KEV; the assessed priority is this_month rather than act_now.
Information disclosure in Apple macOS allows an app already installed and running on the host to reach user-sensitive data it should not be able to read, because the app was granted additional entitlements it should not have held. Apple addressed the flaw by removing those entitlements, and the fix ships in macOS Golden Gate 27; all earlier macOS releases in the tracked range (EUVD: 0 < 27) are affected. The assessed vector is local with no privileges required beyond executing a local app (AV:L/PR:N), confidentiality-only impact, and no integrity or availability effect; there is no remote or network-facing path. No public exploit has been identified at time of analysis, EPSS is 0.14% (3rd percentile), the issue is not in CISA KEV, and the priority signal is this_month - a moderate-severity, locally triggered disclosure rather than an emergency.
Local sandbox restrictions in Apple macOS can be bypassed by an app running under a user account to read the user's Contacts data, and Apple fixed the permissions issue in macOS Golden Gate 27. The CVSS 3.3 vector is local, low-complexity, and requires low privileges, with confidentiality impact limited to contact information and no integrity or availability impact. No public exploit code or active exploitation has been identified at time of analysis, and EPSS is 0.14% at the 3rd percentile, making this a low-priority issue across nearly every signal.