Privilege Escalation
Monthly
A page-level use-after-free in the Linux kernel ALSA PCM subsystem lets a local user with access to a /dev/snd PCM character device turn a race between a concurrent mmap() and a buffer reallocation into a stale, writable mapping of freed DMA buffer pages, which can be reclaimed by the allocator and reused for local privilege escalation. The attacker must issue SNDRV_PCM_IOCTL_HW_PARAMS/HW_FREE from one thread while another thread mmaps the same PCM stream, and must win a narrow timing window (assessed CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H); no public exploit code has been identified at time of analysis, although the upstream commit states a reproducer is available on request, and this CVE is not in CISA KEV. Vendor patches are available in the stable trees (6.12.111, 6.18.53, 7.2.7) and mainline 7.3-rc2, with backports to older long-term branches, so unpatched kernels running ALSA PCM support remain exposed to any local user who can open a PCM device.
Heap corruption in the Linux kernel's IPv6 fragment reassembly logic can be turned into local privilege escalation by a low-privileged local user (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H in our assessment) on systems where unprivileged user/network namespaces are enabled and IPv6 fragment processing is reachable. The flaw stems from a race during network-namespace teardown: fqdir_pre_exit() flushes the skbs held in incomplete fragment queues without marking those queues complete, so a fragment that acquired a reference just before high_thresh was cleared can reuse stale reassembly metadata, and ip6_frag_reasm() then applies an old nhoffset to a new skb, producing an out-of-bounds write (KASAN: slab-out-of-bounds in ipv6_frag_rcv / ip6_protocol_deliver_rcu against skbuff_small_head). Successful exploitation yields kernel heap corruption exploitable for elevation to root; the primary limiting factor is winning the race between fqdir teardown and concurrent reassembly, and no public exploit code or confirmed active exploitation has been identified at time of analysis. A separate side effect is that unflushed fragments can keep conntrack references alive past the per-net conntrack cleanup point.
Privilege escalation in the Knit Pay WordPress plugin through 9.6.1.0 lets an authenticated attacker with Subscriber-level access and above promote their own account to administrator by tampering with the hidden role field of a Gravity Forms submission. The flaw requires the plugin's Gravity Forms integration to be active and a feed configured so that user_role_field_id points at a form field; the plugin then passes that attacker-controlled value directly to WP_User::set_role() with no allowlist validation, and the process is further helped by $0 orders being marked SUCCESS synchronously at submission and by the role-assignment fallback to $lead['created_by'], the submitter's own user ID. At time of analysis no public exploit code or CISA KEV entry was identified, but with CVSS 8.8 and an authenticated low-privilege prerequisite, this is a high-priority issue for any site running the vulnerable plugin together with a configured Gravity Forms feed.
Unauthenticated privilege escalation in the Optima Express IDX plugin for WordPress (all versions up to and including 8.7.5) allows a remote attacker to take control of the plugin's hard-coded `optima-express` integration account and force it to the Author role, gaining `publish_posts`, `upload_files` and `edit_published_posts` capabilities, including access to the plugin's own `/wp-json/optima-express/v1/blog-post` REST endpoint. The exploit path is an AJAX action registered with `wp_ajax_nopriv_ihf_clear_cache` that reaches `provisionBlogCredentials()` with no capability check, nonce verification or ownership validation, but it is only reachable when two conditions are met: open user registration must be enabled on the target site (a non-default WordPress setting), and the attacker must claim the `optima-express` username before the plugin provisions that login for its own integration account - a race that the independent assessment captures with an AC:H adjusted vector despite the published AC:L. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS signal was supplied.
Unauthenticated privilege escalation in the WordPress plugin Automation Web Platform - Notifications and OTP for WooCommerce, Advanced Country Code (all versions up to and including 4.8.6) allows any remote visitor to register a brand-new account holding the WordPress administrator role and take full control of the site. The publicly reachable signup REST route POST /wp-json/wawp/v1/signup/<op> performs no permission check and passes attacker-supplied wawp_custom_fields values straight into update_user_meta(), so keys such as wp_capabilities and wp_user_level can be set by the caller; when signup OTP is enabled, the plugin also leaks the otp_transient token in the HTTP response and marks it verified on any unauthenticated GET, so the OTP step can be skipped without any access to the victim's email or SMS. No public exploit code or active exploitation was identified at time of analysis (not listed in CISA KEV), but with CVSS 9.8, PR:N and no prerequisite beyond a reachable signup feature, this is a top-priority issue for any site running the affected plugin.
Missing authorization in the ServiceNow AI Platform lets unauthenticated remote attackers, under certain vendor-undisclosed instance conditions, read instance data beyond the intended scope and escalate privileges. ServiceNow has remediated the flaw on its hosted instances and distributed the fix to partners and self-hosted customers, but no public exploit code or active exploitation has been reported and no EPSS score was supplied with the source data. The vendor CVSS 4.0 rating is Critical (9.3), while the independent assessment is lower and treats exploitation as conditional, so unpatched self-hosted or partner-managed instances should still be prioritized given the data-exposure and privilege-escalation potential.
Stored cross-site scripting in code16 Sharp before 9.22.5 lets an authenticated user who can edit a rich-text Editor field persist JavaScript via the iframe srcdoc attribute; the payload executes in the browser of any other user - typically a higher-privileged administrator - who later views the stored content, enabling session hijacking, account takeover, privilege escalation or disclosure of administrative data. The vendor confirmed the issue in advisory GHSA-qxg3-46rw-79j8 and shipped a fix in version 9.22.5 (commit ec509a22) that removes srcdoc from the permitted iframe attributes; exploitation requires a valid account with Editor-field edit permission and a second viewing victim (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N, 7.3). There is no indication of active exploitation and no public exploit identified at time of analysis.
Stored cross-site scripting in Snipe-IT versions before 8.7.0 lets an authenticated user holding only the customfields.create permission embed HTML/JavaScript in a CustomField.name value, which is rendered unescaped as an asset-list column header title and executes on page load for any user who opens a list tied to the affected fieldset. Since customfields.create is delegable to non-superusers, the injected script runs in a higher-privileged victim's session - the vendor advisory demonstrates an account with no permissions beyond customfields.create issuing authenticated requests in a superuser's session to grant itself superuser rights. Publicly available exploit code exists (reproduction steps and SSVC exploitation state of 'poc'), CISA's SSVC assessment rates technical impact as total, while EPSS remains low at 0.30% (21st percentile) and there is no KEV listing indicating confirmed actively exploited (CISA KEV) activity at time of analysis.
Privilege escalation in the authentik identity provider allows an account holding delegated group, group-membership, or user management rights to elevate itself to superuser by joining a group whose ancestor groups grant superuser status, or by assigning an existing role to a group without holding the change_role permission. Deployments running authentik before 2026.2.7, before 2026.5.7 on the 2026.5 line, or before 2026.8.2 on the 2026.8 line are affected, but exploitation is confined to installations that delegate those management capabilities to accounts that are not full administrators - single-administrator or non-delegated setups are unaffected. The flaw rates CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), requires the attacker to hold an authenticated delegated account, and no public exploit code has been identified at time of analysis; vendor patches are available and the fix set is documented in advisory GHSA-h6c5-mpvq-j4jc.
Out-of-bounds read in Altera Trusted Firmware for SoCFPGA hard processor systems (all builds through socfpga_v2.14.0) lets an attacker who already holds high privileges in the normal world corrupt or read beyond intended memory bounds inside the secure monitor, enabling escalation from the non-secure HPS environment into the secure world. Exploitation requires local access and pre-existing root-level code execution (CVSS PR:H), so it is not a remote or pre-authentication vector; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV. The independent assessment rates this a genuine but access-limited priority given the privileged local precondition.
Local privilege escalation in Altera Trusted Firmware (TF-A) on socfpga Hard Processor Systems lets an attacker who already holds high privileges on the normal-world OS drive an out-of-bounds read inside the secure monitor, exposing and corrupting secure-world memory and escalating execution context, in all versions through socfpga_v2.14.0. The flaw is reachable only by invoking secure-monitor calls from an already-privileged local context, with no network vector and no user interaction, but because it crosses the normal-world/secure-world boundary it yields high integrity and availability impact beyond the vulnerable component (CVSS 4.0 base 8.3; independent assessment CVSS 3.1 8.3). No public exploit code has been identified and the issue is not listed in CISA KEV, so exposure is confined to devices where an adversary has already achieved privileged local execution.
Local privilege escalation in Evope Collector (all versions before 1.1.7.13) lets an attacker who already has a local foothold with write access to C:\ProgramData\Evope\ plant a file named wtsapi32.dll that Evope.Service.exe, running as NT AUTHORITY\SYSTEM, loads without validating its origin, resulting in arbitrary code execution with SYSTEM privileges. The weakness is an uncontrolled search path element in the service's DLL loading, so exploitation requires no victim interaction, though the service must start or restart before the planted library is loaded (captured as AT:P in the 7.5 CVSS 4.0 vector). No public exploit code or CISA KEV entry was identified at time of analysis, and the vendor has published a fixed version, 1.1.7.13.
Unauthenticated privilege escalation in the Paytium: Mollie payment forms & donations WordPress plugin (all versions up to and including 5.0.3) allows an attacker to create a brand-new WordPress user with the administrator role and take over the site. The flaw lives in the unsigned pt_cf_checkout_meta() filter on the pt_meta_values hook, which copies attacker-supplied $_POST['pt_form_field'] keys, including pt-user-role, straight into payment meta and ultimately into wp_insert_user(); exploitation requires a publicly reachable [paytium] shortcode form and completion of an actual Mollie payment so the malicious role meta is persisted, after which the attacker claims the new admin account via the standard lost-password flow. No public exploit code was identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV), though the vendor-published Wordfence advisory and the 9.8 CVSS rating (AV:N/AC:L/PR:N/UI:N) make this a high-priority unauthenticated issue for any site running the affected versions with a public Paytium form.
Privilege escalation in the WordPress plugin Import and Export Users and Customers (versions up to and including 2.4.17) allows any authenticated user at Subscriber level or above to become an Administrator. The attacker stores crafted values in their own display_name and nickname profile fields and then waits for a site administrator to run the plugin's documented export-then-reimport migration with both 'Update existing users' and 'Update roles for existing users' set to 'yes'; a CSV quoting/escape mismatch between exporter and importer causes the crafted display_name to be consumed as the role field, yielding 'administrator' at the importer's add_role call. Exploitation is not self-contained - it requires the operator to enable those two non-default migration settings - and no public exploit identified at time of analysis. The vendor risk score is 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), while our independent assessment re-rates it as AV:N/AC:H/PR:L/UI:R because the admin-driven, non-default migration workflow materially constrains real-world exploitation.
Any holder of a valid low-privileged cPanel account can escalate to root and execute arbitrary code on the underlying host, because a privileged cPanel operation is executed with unnecessary root privileges (CWE-250). The flaw is remotely reachable over the network with low attack complexity and no user interaction, but it does require an authenticated account (CVSS 4.0 vector PR:L) - a trivial barrier on shared hosting where accounts are commonly sold or self-provisioned, and a meaningful one on locked-down single-tenant deployments. It carries a 9.4 CVSS 4.0 score and is rated a genuine high-priority issue rather than a high-score/low-real-risk case, though no public exploit code and no confirmed active exploitation were identified at time of analysis; no EPSS estimate was available in the supplied intelligence.
Privilege escalation in Red Hat Ansible Automation Platform 2 (built on the AWX upstream project) lets an authenticated AAP platform administrator escape the container-group sandbox and obtain OpenShift namespace-level access, including the ability to read and exfiltrate namespace secrets. The flaw is reachable over the network (AV:N) with no user interaction (UI:N) and changes scope across the container/namespace boundary (S:C), but it is gated on the highest AAP privilege tier (PR:H), so it is an insider or compromised-admin scenario rather than an unauthenticated attack; only deployments that use container groups backed by OpenShift/Kubernetes are exposed. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); no vendor-released patch has been identified at time of analysis, so mitigation depends on restricting the vulnerable field or the administrators who can reach it.
Privilege escalation and remote code execution on managed hosts is possible in Red Hat Ansible Automation Platform 2 because the automation-controller exposes the provisioning-callback secret (host_config_key) to anyone holding only read-level view_jobtemplate permission and accepts a client-supplied X-Forwarded-For header as proof of caller identity when the gateway proxy allow-list is empty. An attacker who reads the secret from the job template API representation or the activity stream and spoofs X-Forwarded-For to match any host in the target job template's inventory can launch that template against arbitrary managed hosts using the template's stored credentials; CVSS 3.1 base score is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), no public exploit code was identified at time of analysis, and the decisive enabler is a non-default deployment condition - an empty proxy allow-list combined with provisioning callbacks actually being in use.
Local privilege escalation to root in Flatpak before 1.18.1 lets an unprivileged user holding an active local session abuse the revokefs writer used by flatpak-system-helper: by opening two concurrent revokefs sessions and planting a symlink from one session directory into the other, the attacker retains a file descriptor into a peer session and keeps modifying its files after the system helper has already validated and imported them. The practical payoff is tampering with ostree commit objects in the system repository after signature verification, which translates into root-controlled writes to attacker-chosen paths. Exploitation requires local access and winning a TOCTOU race against the dual-session setup (CVSS AV:L/AC:H/PR:N), and no public exploit code has been identified at time of analysis; the issue is not confirmed as actively exploited (not in CISA KEV).
Privilege escalation in Zoho ManageEngine OpManager and Firewall Analyzer 12.8.710 and earlier allows an authenticated low-privilege user to gain Administrator privileges by importing a crafted Report Profile. The issue is network-reachable with low attack complexity and requires no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1 High), but the attacker must already hold working low-privilege credentials on the target instance and no non-default configuration is needed. No public exploit identified at time of analysis.
Local privilege escalation in Foxit PDF Editor for macOS allows an attacker with a low-privilege foothold to execute arbitrary commands as root by tampering with a user-modifiable configuration value that the installer trusts during high-privilege upgrades. Exploitation requires local access, write access to the configuration value, and a privileged upgrade operation to be triggered, but no user interaction (UI:N) is needed. No public exploit code or active exploitation has been identified at time of analysis (no KEV, no POC).
A local privilege escalation vulnerability in the auto-update daemon shipped with Foxit PDF Editor and Foxit PDF Reader (CVE-2026-91798, CVSS 3.1 8.8) lets an already-authenticated, low-privileged local user abuse an insecurely permitted configuration file (CWE-732) to have the elevated daemon execute arbitrary script content with SYSTEM/root-level rights. Because the attacker must already hold a session on the host and the impact crosses a privilege boundary, the vector is AV:L/PR:L/UI:N/S:C with full confidentiality, integrity, and availability impact; no remote attack path exists, and no public exploit code was identified at time of analysis. Any host running a vulnerable Foxit build with the update daemon installed and the loosely permissioned configuration file present is exposed, making this most relevant to multi-user workstations, VDI, and terminal-server environments where unprivileged users share a machine with a privileged updater.
Local privilege escalation in Foxit PDF Editor (14.0.7 and earlier, plus 2026.2 and earlier) and Foxit PDF Reader (2026.2 and earlier) allows a locally authenticated low-privileged attacker to plant a crafted DLL in a user-writable directory that the Foxit updater searches, so that when the updater performs a high-privilege operation the malicious library is loaded and code runs with elevated privileges. The flaw is a classic uncontrolled search path condition (CWE-427) with CVSS 3.1 score 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the attacker must already hold a foothold on the Windows host - there is no remote or network vector - and exploitation only succeeds if the privileged updater actually runs and the relevant path is user-writable. Intelligence signals are quiet: no public exploit identified at time of analysis, no CISA KEV listing (SSVC exploitation: none, automatable: no), and a low EPSS of 0.17% (6th percentile), making this a credible but non-urgent post-compromise escalation issue rather than an imminent threat.
Privilege escalation in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets a remote authenticated attacker who already holds a privileged account exceed the permissions assigned to that account, with high impact across confidentiality, integrity and availability. IBM rates it 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), a score driven mainly by the Scope-Change flag; our independent assessment preserves the full CIA impact but treats scope as unchanged, because the high starting-privilege requirement narrows the realistic attacker population to insiders or holders of compromised privileged credentials, and the deployment footprint is limited to organizations running FTM on OpenShift. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; IBM has published a vendor patch advisory.
Improperly scoped role-based access control in IBM Concert 1.0.0 through 3.0.0 lets any authenticated user holding even a low-privileged account read and modify resources outside their granted permissions, because the product's RBAC permission definitions rely on wildcards instead of explicit resource scoping. IBM scores this 9.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N), while our independent assessment rates it 8.8 with Scope:Unchanged, meaning the practical severity is high but below the vendor's critical rating; exploitation still requires a valid account and a reachable Concert instance. No public exploit code has been identified at time of analysis and there is no evidence of active exploitation (not in CISA KEV), but IBM has published a vendor patch at support node 7288830.
Local cross-user code execution with privilege-escalation potential affects the Windows builds of GNU wget distributed by eternallybored.org (releases 0 through 1.21.4 inclusive). The flaw is a hardcoded configuration location, C:\msys64, that unprivileged users can write to: a low-privileged local attacker who plants a wgetrc there can abuse the use_askpass directive so that arbitrary code is executed in the security context of a higher-privileged user who later runs the affected wget build. The attack is not remotely reachable and does not trigger on its own, which is captured by the UI:R component of the CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8), and no public exploit code was identified at time of analysis.
Privilege escalation in the Adobe Premiere Pro desktop application is achievable through a server-side request forgery flaw (CWE-918) that Adobe's own PSIRT self-reported in advisory APSB26-157, carrying a CVSS 3.1 base score of 7.1 (AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N). Because the attack vector is Local, successful exploitation requires the victim's installed copy of Premiere Pro to process attacker-supplied content - in practice a crafted project or media file - and the changed scope (S:C) indicates the forged request reaches a component outside Premiere Pro's own security authority, yielding integrity and privilege-escalation impact with no confidentiality or availability loss. No public exploit code and no CISA KEV entry are associated with this CVE, so no public exploit is identified at time of analysis; note also that the vendor's UI:N claim conflicts with the ordinary desktop file-open workflow, which our assessment scores as UI:R, and this discrepancy is the environment mismatch flagged in the source description and should be verified against APSB26-157 before external publication.
Arbitrary server-side code execution in the Plone process is possible through the Classic portlet shipped in plone.app.portlets 5.0.0 through 7.0.1, where user-supplied template and macro fields are assembled into a TALES path expression and then evaluated by the TAL path() helper, allowing a crafted value to be interpreted as a full expression rather than a constrained path. Any authenticated user who can add or edit a Classic portlet can execute code, and under Plone's default role map that includes ordinary registered users on their personal dashboard, so the issue amounts to a post-authentication privilege escalation across the trust boundary between a web user and the server-side Plone process (CVSS 3.1 9.9, scope changed: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). There is no confirmed active exploitation (no CISA KEV listing) and no public exploit identified at time of analysis, but vendor patches are available in 5.0.8, 6.0.4, and 7.0.2.
Root-level file system access in HPE Analytics and Location Engine (ALE) can be obtained by an authenticated administrator through the product's maintenance restore function, which processes attacker-supplied restore data with root privileges and permits writes to the host file system (CVSS 3.1 base 7.2 High, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Because the vector requires high privileges (PR:H), the practical attack surface is limited to administrators or adversaries who have already compromised an admin account, though the flaw is network-reachable (AV:N) and needs no user interaction (UI:N). No public exploit code was identified and there is no confirmed active exploitation at time of analysis.
Server-side request forgery in Adobe Experience Manager (AEM) 6.5 Forms JEE and AEM 6.5 LTS Forms JEE lets an authenticated low-privilege user coerce the Forms server into making HTTP requests to internal-only resources, which can cross a security boundary (CVSS scope change) and yield elevated access. The flaw is rated 9.6 by the vendor and assessed at 9.6/9.6-class severity with the confidentiality impact confirmed as high, while integrity impact is bounded by what the reachable internal endpoints actually allow. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the EPSS signal was not notable in the supplied data.
Server-side request forgery in Adobe Experience Manager Forms JEE lets an attacker who already holds high-privileged, admin-level application access coerce the AEM Forms JEE server into issuing requests to internal-only resources, achieving privilege escalation and a scope change beyond the original AEM security perimeter. Affected deployments are AEM 6.5 Forms JEE and AEM 6.5 LTS Forms JEE, reachable over the network (AV:N) with no end-user interaction (UI:N) but gated behind the PR:H privileged-authentication requirement, so practical risk concentrates on malicious insiders or attackers who have already compromised an administrative account. Based on the supplied intelligence there is no CISA KEV listing and no public exploit code identified at time of analysis; the high EPSS-style urgency implied by the CVSS 8.7 base score reflects the scope change and confidentiality/integrity impact rather than demonstrated exploitation.
Server-side request forgery in Adobe Campaign Classic (versions up to and including 7.4.4 build 9401) lets remote unauthenticated attackers induce the ACC server to issue arbitrary requests to other systems, which the vendor rates as a privilege-escalation risk with a changed scope and a maximum CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). No authentication or user interaction is required per the vendor vector, so the practical limiting factor is whether the ACC endpoint is reachable by the attacker and whether exploitable internal services sit behind it; Adobe does not document a non-default configuration prerequisite, so default deployments in the affected range appear exposed. Exploitation status at time of analysis is that no public exploit has been identified, and EPSS is a modest 0.69% (51st percentile), though the vendor's high impact rating and the absence of preconditions justify prompt patching. An independent recalibration prefers C:H/I:L/A:N over the vendor's triple-high impact, so the 10.0 figure should be read as Adobe's upper-bound claim rather than a confirmed blast radius.
Server-side request forgery in Adobe Campaign Classic lets an authenticated, low-privileged user force the ACC application server to issue requests to internal or otherwise unreachable resources, turning the account into a foothold for reading confidential internal services (CWE-918; CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N). Adobe scores the issue 9.9 Critical, while our assessment keeps the scope change and high confidentiality impact but rates integrity as Low - the dominant effect is unauthorized reach into internal resources rather than direct tampering with protected data - which places effective risk in High territory (≈8.5) rather than Critical. Exploitation requires valid low-privileged ACC credentials and network reachability to the application, needs no user interaction, and no public exploit code or CISA KEV listing was identified at time of analysis.
Server-side request forgery in Adobe Campaign Classic (Classic v7), affecting builds up to and including 7.4.4 build 9401, lets an authenticated low-privileged user coerce the ACC server into making requests to internal systems the user cannot reach directly, with the trust-boundary crossing reflected as a scope change (S:C) that can escalate that user's effective access. No user interaction is required, and Adobe rates the issue 9.9, while our independent assessment retains high confidentiality impact but lowers integrity and availability to Low (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L) and stresses that a valid low-privileged account is a prerequisite, so this is not remote-unauthenticated. No public exploit code and no CISA KEV entry have been identified at time of analysis, EPSS is low at 0.73% (53rd percentile), and SSVC marks the issue non-automatable with total technical impact - making the realistic risk targeted insider or post-foothold abuse rather than opportunistic internet-wide scanning.
Local privilege escalation in the Netdata Windows Agent (versions 2.0.0 through 2.10.3) lets an authenticated low-privileged local user obtain SYSTEM-level code execution by interacting with or hijacking the elevated interactive process windows that the MSI repair action spawns in that user's own desktop session. Carrying a CVSS 3.1 base score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) and classified as CWE-269 improper privilege management, exploitation is genuinely constrained: it is local-only, requires the ability to trigger an MSI repair under the host's Windows Installer elevation policy, and depends on a timing/UI race against transient elevated windows, so it is a bounded privilege-escalation issue rather than a remotely reachable emergency. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV; the vendor has shipped a fix in stable release 2.10.4.
Local privilege escalation in the Netdata Windows Agent (versions 2.0.0 through 2.10.3) allows an authenticated low-privileged user to execute arbitrary commands with SYSTEM privileges by placing malicious commands in their PowerShell profile and then triggering an MSI repair, which runs powershell.exe as SYSTEM without the -NoProfile flag. The vulnerability (CWE-269) is fixed in Netdata Agent 2.10.4; no public exploit code has been identified at time of analysis.
Local privilege escalation in HP Support Assistant versions prior to 9.55.10.0 allows an authenticated local attacker to gain elevated privileges on affected Windows hosts through insufficient access controls (CWE-269, improper privilege management). The flaw is not remotely reachable and requires the attacker to already hold low-privileged local access plus satisfaction of a specific attack precondition (expressly flagged as AT:P in the CVSS 4.0 vector), which constrains reliable exploitation; no public exploit code and no confirmed active exploitation were identified at time of analysis. Impact is rated high for confidentiality, integrity and availability of the affected host, making patched builds (9.55.10.0 and later) the primary mitigation.
Improper authentication in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9, tracked as EUVD-2026-84409) allows a remote, unauthenticated network attacker to bypass authentication and obtain privilege escalation, information disclosure, and data tampering with full confidentiality, integrity, and availability impact per the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8 critical). No public exploit code has been identified and there is no confirmed active exploitation (CISA KEV does not list this CVE); EPSS is 0.32% (25th percentile), and CISA's SSVC assessment rates exploitation as none, automatable as no, and technical impact as partial, indicating low near-term mass-exploitation likelihood. Practical exposure is further limited because the affected component is a specialized NVIDIA datacenter/GPU-infrastructure management service typically deployed on internal management networks rather than internet-facing hosts; the specific vulnerable endpoint or protocol is not disclosed in the advisory.
Local privilege escalation in Qualcomm Snapdragon platforms allows a low-privilege on-device process or app to cross a trust boundary and gain system-level control by abusing insecurely handled temporary files. The issue is tracked as CVE-2026-25265 with a vendor/assessed CVSS 3.1 score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), meaning exploitation requires local access and low privileges but no user interaction, and results in high confidentiality, integrity, and availability impact. No public exploit code or confirmed active exploitation was identified at time of analysis, and affected Snapdragon chipset/firmware versions are not enumerated in the input; confirm scope via the Qualcomm June 2026 product security bulletin.
Privilege escalation in Qualcomm Snapdragon devices allows a local low-privilege attacker to cross security boundaries and gain full control over confidentiality, integrity, and availability (CVSS 8.8). The flaw stems from a weak configuration during package extraction (CWE-427) that lets an attacker-controlled element be resolved or loaded with higher privilege; exploitation requires prior local code execution but no user interaction. No public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in Qualcomm Snapdragon firmware allows an attacker with low privileges to gain high-impact code execution and control over the device. The flaw resides in an exposed dangerous function within a gRPC server (CWE-749) and affects specific QPM (v3.0.127.2, v3.0.126.7, v3.0.125.4) and QSC (v1.21.0, v1.19.1, v1.17.1) builds. Exploitation requires local access and a pre-existing low-privileged foothold; no public exploit or active exploitation has been identified, and EPSS is only 0.15%.
Privilege escalation in the CMP - Coming Soon & Maintenance plugin by NiteoThemes for WordPress, affecting all versions up to and including 4.1.17, lets authenticated attackers with Editor-level access or above rewrite arbitrary WordPress options through the unprotected 'cmp_ajax_import_settings' AJAX action. By pointing the site's default_role at administrator and switching on users_can_register, the attacker can self-register a brand-new administrative account and take full control of the site; the vendor's CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N, base 7.2) confirms network-reachable, low-complexity exploitation that requires a valid high-privilege session but no user interaction. Remediation status: upstream fix available (WordPress.org plugin repository changeset); released patched version not independently confirmed. Exploitation status: no public exploit identified at time of analysis.
Unauthenticated privilege escalation to WordPress Administrator in the Meta Box AIO plugin (versions up to and including 3.11.0) - and in the standalone Meta Box Frontend Submission (≤4.5.6) and Meta Box User Profile (≤3.11.0) plugins - lets remote attackers rewrite the post_content of any page with an attacker-supplied shortcode and then create a new administrative account. The exploit chains three defects: populate_via_query_string() in mb-frontend-submission unconditionally overrides the form's target object_id from the rwmb_frontend_field_object_id GET parameter, Form::process() omits the user_can_edit() check that render() enforces, and mb-user-profile trusts the role and auto_login attributes of an injected [mb_user_profile_register] shortcode without validating the requested role. The flaw is network-reachable with PR:N/UI:N per the assessed CVSS 3.1 vector (9.8), so no authentication, user interaction, or prior privileges are required; Wordfence disclosed the issue, publicly available exploit code has not been identified at time of analysis, and there is no CISA KEV confirmation of active exploitation. The practical exposure limiter is deployment-specific: the site must expose a Meta Box frontend-submission form and must process the mb-user-profile registration component for the escalation to complete.
Horizontal privilege escalation in the x-ui web panel 0.3.2 allows any authenticated panel user to rewrite another user's inbound proxy configuration - remark, port, protocol, settings, enabled state, expiry time and traffic quota - by submitting an inbound-update request that carries the victim's resource identifier, because the update path never verifies that the referenced inbound belongs to the requesting session user (CWE-284). The flaw is network-reachable and requires no victim interaction, with a CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8); an independent assessment retains High severity and confirms the integrity impact (cross-tenant configuration tampering) while narrowing confidentiality and availability to Low, since the tampering is confined to proxy resource data rather than granting panel or host compromise. Exploitation is limited to multi-tenant deployments where more than one account holds inbound resources; no public exploit code has been identified at time of analysis and EPSS is low (0.20%, ~10th percentile), so mass scanning is unlikely, though the flaw is trivially reachable by any legitimate panel account.
Local privilege escalation in the Moore Threads MTT S80 Driver Package 340.150 allows a low-privileged local user to abuse an improperly secured IOCTL handler and gain high-impact control over the system. The flaw resides in the Windows kernel-mode driver mtdispkm64.sys, specifically function sub_140006F0C, and is classified as CWE-269 improper privilege management; successful abuse yields high confidentiality, integrity and availability impact on both the vulnerable component and the subsequently compromised host. Exploitation requires an existing local foothold on a Windows machine with this specific GPU driver installed, with low privileges and no user interaction needed (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; vendor-published CVSS 4.0 score 9.3). No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, but the low attack complexity and the absence of a vendor patch make the flaw attractive to local attackers already present on a host.
Privilege escalation in jshERP 3.6 allows an authenticated low-privilege tenant user to grant themselves arbitrary roles, including tenant administrator, by sending a crafted POST request to the updateOneValueByKeyIdAndType endpoint with type=UserRole, their own user ID, and a role ID list. The endpoint applies no ownership or privilege validation (CWE-862), and publicly available exploit code exists. Exploitation requires only a valid low-privilege session; no victim interaction or special configuration is needed, and no CISA KEV listing is present in the provided data to confirm active exploitation.
Permanent destruction of an entire group's inventory in HomeBox is possible for any authenticated user who belongs to that group, due to a broken authorization check in the wipe-inventory action handler affecting versions prior to 0.26.0. The flaw lets a self-registered user - who is automatically flagged as a global owner of their own group - select a different group via the X-Tenant header and invoke POST /v1/actions/wipe-inventory against it, deleting data that cannot be recovered without external backups. Exploitation requires an authenticated account on a multi-group instance where the attacker is also a legitimate member of the victim group, so single-user or single-group deployments are not affected; no public exploit identified at time of analysis.
OpenBao versions prior to 2.6.0 fail to reject syntax-significant characters when templated identity data is substituted into ACL, PKI, and SSH policies, allowing an authenticated principal who can write that identity data to broaden path matching, obtain certificates for unauthorized domains, or add unauthorized SSH principals. Exploitation is gated on a non-default configuration: the policy must use templates that substitute attacker-modifiable identity metadata (for example {{identity.entity.metadata.domains}} or {{identity.entity.metadata.sans}}), and the attacker must already hold the capability to update that identity record (such as update on identity/entity), consistent with the assessed CVSS 3.1 vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N. Deployments whose templates rely solely on the randomly generated identity.entity.id value are not affected, there is no user interaction, and no public exploit code was identified at time of analysis.
Privilege escalation in MISP before version 2.5.47 lets an authenticated holder of a read-only API key silently regain the complete permission set of the underlying user account. After authenticating with a view-only key, a single request to the updateLoginTime function causes MISP to re-login the session using the full account record, effectively discarding the API key's read-only restriction so the caller can perform write, delete, or administrative actions the key was meant to block. The flaw requires a valid read-only API key tied to an account that itself holds higher privileges, and escalation is bounded by those existing account permissions; no public exploit code has been identified at the time of analysis, and there is no KEV-listed active exploitation.
Elevated-privilege container restoration in CRI-O 1.34 and later, including downstream Red Hat OpenShift Container Platform 4.17+, lets an authenticated Kubernetes user who can create a pod from a crafted checkpoint image bypass the destination pod's security context. The restored process keeps credentials, Linux capabilities, no_new_privs and seccomp state stored in the checkpoint instead of the destination configuration, allowing execution across the container security boundary. Exploitation requires non-default checkpoint/restore (CRIU) support to be enabled and RBAC permission to create pods from malicious checkpoints; no public exploit code is identified and no vendor-released fix is available at time of analysis, so the vendor CVSS 3.1 score of 8.8 overstates urgency given those prerequisites (our assessment raises attack complexity to High).
Privilege escalation in the Import Export Users WordPress plugin before 2.5.2 allows authenticated users with the create_users capability but not promote_users to change roles of existing users, including promoting them to administrator, via the plugin's front-end import functionality. The flaw is exploitable where create_users is delegated to lower-privileged roles; it does not require administrator access or victim interaction. Publicly available exploit code exists, and this is a genuine privilege-escalation-to-full-takeover issue that merits prompt patching.
Privilege escalation in the Import and export users and customers WordPress plugin (versions 2.4.16 through before 2.5.2) lets an authenticated user who holds only the create_users capability assign administrator roles during a CSV import, enabling creation of new admin accounts or promotion of existing users. Publicly available exploit code exists, though there is no KEV confirmation of active exploitation. Exploitation requires a non-default role configuration where create_users is delegated without promote_users and the attacker can reach the plugin's CSV import function; default WordPress installs are not affected because only administrators hold create_users and already hold promote_users.
Authentication bypass in the SAML Single Sign On WordPress plugin (versions 4.8.43 through <6.0.0) lets a remote, unauthenticated attacker log in as any WordPress user, including an administrator. The plugin ignores whatever account-linking criterion the administrator configured (email, NameID, etc.) and always resolves the SAML identity by login name, so an attacker who can get the site's trusted Identity Provider to assert a login name of their choosing - for example via an IdP that allows self-service registration or user-controlled username attributes, or a compromised or attacker-operated IdP - authenticates as that account without proving ownership of it. Publicly available exploit code exists, and while the CVSS vector scores the flaw at 8.1 with PR:N, the AC:H rating reflects the significant prerequisite of influencing the trusted IdP's assertions; sites whose IdP strictly controls the asserted login-name attribute are much harder to exploit.
Account takeover is possible in the ZTE SmartLife (ZTESW) app on builds ZTE_SL_V2.8.2_ABROAD and earlier, where an attacker can reset the password of any registered user by spoofing the app's dynamically generated authentication parameters against the backend /account/verify.serv interface. After extracting the client-side auth parameters through a one-time reverse-engineering or instrumentation step, an attacker who knows a target's registered email address can resolve the real account ID and then submit a forged password-reset request, giving full control of the victim account without any victim interaction; the independent assessment rates this unauthenticated over the network (AV:N/AC:L/PR:N/UI:N) with high confidentiality, integrity and availability impact. No confirmed active exploitation (CISA KEV) and no publicly available exploit code were identified at time of analysis, but the weak-signal situation does not reduce the severity, and only ZTE_SL_V2.8.2_ABROAD and prior builds are affected.
Account takeover of any user of the UsersWP WordPress plugin - administrators included - is possible on sites running versions before 1.5.10 when social login is enabled, because the plugin resolves an incoming social-login session to an existing local account using the email address asserted by the provider without first confirming that the provider actually verified ownership of that address. The flaw is remotely reachable without authentication (CVSS:3.1/AV:N/AC:H/PR:N/UI:N, 8.1, CWE-269) and publicly available exploit code exists, so an attacker who registers at a lax or attacker-controlled provider can assert a victim's email and be logged into that victim's account. Exploitation carries the elevated complexity reflected in the AC:H rating: social login must be configured and enabled with at least one provider that permits assertion of an unverified address, and the attacker must already know the target's registered email. This is a genuinely high-priority vulnerability, not a high-CVSS-but-low-risk paper cut, since successful exploitation yields full account control including administrative takeover of the site.
Unauthenticated remote attackers can abuse a missing authorization check in a REST route of the Botiga Pro WordPress plugin (versions before 1.6.5) to update arbitrary WordPress options, inject stored web scripts that execute on every front-end page, and move arbitrary posts to the trash. The option-write primitive enables privilege escalation and full site takeover, for example by altering registration or default-role settings, while the stored script injection yields persistent cross-site scripting against all site visitors. The issue is rated CVSS v3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), publicly available exploit code exists, and no CISA KEV listing has been observed; the only deployment prerequisite is that the Pro add-on plugin is installed and active, as the free Botiga theme alone is unaffected.
Privilege escalation in the WordPress plugin WP Import Export Lite before version 3.9.35 lets an authenticated user who holds only the delegated import permission create new administrator accounts and overwrite the credentials and roles of existing accounts, including administrators, because the import routine never verifies user-management capabilities. The flaw is only exploitable on sites that actually delegate the import capability to a non-administrator role; default WordPress installations that restrict imports to administrators gain nothing from it. Publicly available exploit code exists, no confirmed active exploitation (CISA KEV) has been reported, and the vendor has released a fixed version.
Local privilege escalation in IBM Guardium Data Protection 12.2 allows an authenticated, low-privileged user with existing access to the appliance host to raise their privileges to a higher level, affecting confidentiality, integrity and availability of the platform. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation requires a pre-existing local account and low complexity but no user interaction; it is an escalation step rather than a remote entry vector, so risk is concentrated on collector/aggregator hosts where untrusted or lower-tier accounts or shells already exist. No public exploit code was identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was supplied; this is a genuine but moderate-priority local privilege escalation rather than an actively exploited campaign.
Local privilege escalation in IBM Guardium Data Protection 12.2 allows a low-privileged local attacker to execute arbitrary commands as root by exploiting insufficient argument validation in the SUID-root nmap_wrapper binary on the Collector appliance, resulting in full compromise of the Collector. The vulnerability requires existing low-privileged local shell access to the Collector and is not remotely exploitable. No public exploit code or confirmed active exploitation has been identified at the time of analysis; a vendor patch is available.
Local privilege escalation in IBM Guardium Data Protection 12.2 allows an attacker who already holds a low-privileged local account on the appliance - such as a constrained operator role, a compromised low-privileged process, or a malicious insider - to gain elevated privileges, with full compromise of confidentiality, integrity, and availability of the affected system. The flaw (CWE-269, improper privilege management) is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), requiring no user interaction and no network-facing path; the local-access prerequisite makes it a post-compromise escalation step rather than a remote entry point. No public exploit code or confirmed active exploitation has been identified at time of analysis, and IBM has published a vendor patch advisory.
Local privilege escalation in the virtio-win Viosock (vsock) paravirtualized driver, builds mm210 through mm319, lets an attacker who already has low-privilege code execution inside a Windows guest corrupt kernel memory and escalate to SYSTEM. The driver's IOCTL_SELECT handler adds three attacker-controlled descriptor counts with 32-bit arithmetic, so an integer-wrapped total passes the FD_SETSIZE bounds check while an individual fd_count remains far above the expected limit; the subsequent copy routine then walks the unchecked count and writes past the NonPagedPool-allocated pPkt->Fds array. Exploitation is local only (AV:L) and requires a low-privileged foothold (PR:L) with no user interaction; no public exploit code was identified at time of analysis, and the vendor fixed the issue in build mm320 via commit c6bef93d7909584bbda4e5c87603ea175825f342.
Local privilege escalation in Sublime Text for Windows - Sublime Text 4 through Build 4192 and Sublime Text 3 through Build 3207 - lets an authenticated local attacker who already holds an unprivileged account plant a malicious DLL in the user-writable update staging directory under %LOCALAPPDATA%, mark it read-only to defeat the installer's cleanup pass, and have the elevated installer copy the payload into the protected installation directory, where it executes in the context of any higher-privileged user who later launches the editor. The attack is local-only and conditional: it requires a prior foothold on the host, depends on the update staging mechanism being reached, and fires only when an elevated user subsequently opens the application (passive user interaction). Risk is real but situational rather than a mass-exploitation threat, and publicly available exploit code exists in the form of a published gist, so EPSS-style prioritization should focus on multi-user Windows endpoints where a standard user and an administrator both use the same Sublime Text install. No vendor-released patch is identified in the available data at time of analysis.
Privilege escalation in the Booking Calendar plugin for WordPress (wpdevelop, cpe:2.3:a:wpdevelop:booking_calendar) in all versions up to and including 11.8.2 lets an authenticated user holding Editor-level capabilities or higher promote themselves to Administrator and seize control of the site. The wpbc_ajax_option_save AJAX action writes an attacker-supplied option name straight into update_option() because the handler's per-option safeguards only cover names explicitly registered via register_option_policy(), so unregistered options - including core WordPress settings - receive an empty policy and skip every can_save, force_mode, and allowed_keys check; an attacker can therefore set default_role=administrator and users_can_register=1 and then register a new administrative account. The embedded nonce check offers no real barrier since both the nonce value and nonce action are attacker-controlled POST parameters and a valid nonce can be fetched from admin-ajax.php?action=rest-nonce; exploitation requires an authenticated Editor+ account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H per our assessment), no public exploit code has been identified at time of analysis.
Privilege escalation in the All-in-One WP Migration and Backup WordPress plugin before 7.111 allows an authenticated user who has been granted the plugin's export capability - but not its import capability - to obtain an installation-wide secret and replay it against the plugin's import AJAX actions, importing an arbitrary site archive and gaining administrator access. Exploitation is not possible against a default install: it requires a non-default configuration in which an administrator has delegated the plugin's export capability to a role that does not also hold import capability, and the target site must run a version older than 7.111. Publicly available exploit code exists (reported via WPScan), making the flaw attractive to attackers who already hold a low-privileged account on a misconfigured site; the independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (high impact, but with a hard configuration prerequisite).
Local privilege escalation in the Acronis Backup integrations for cPanel & WHM, Plesk, and DirectAdmin on Linux allows an attacker who already holds a low-privileged account or shell on the host to tamper with plugin-installed files and directories left with insecure default permissions, gaining high-privilege code execution on the server. The flaw is confirmed actively exploited (CISA KEV) and carries a CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no user interaction is needed and only low privileges are required, though exploitation is gated to hosts where one of the three control-panel plugins is installed and has not yet been upgraded to its fixed build. Because the vector is strictly local, remote attackers cannot reach it directly - they must first obtain a foothold or credentials on the server.
Arbitrary file write and credential disclosure in pgAdmin 4 (versions before 9.18) let any authenticated user holding the tools_backup permission - which is granted to the default User role - run pg_dump with attacker-controlled arguments and connection parameters. Because the Backup tool appended the client-supplied 'database' field to the pg_dump argument vector unvalidated, a value starting with a dash is parsed by getopt_long as an option (for example --file=/absolute/path) and overrides the storage-confined output path, letting files be created or overwritten anywhere the pgAdmin OS account can write; a value containing an equals sign is expanded by libpq into a full connection string that overrides the intended host and port and redirects pg_dump to an attacker-nominated server while the decrypted stored database password is exported in PGPASSWORD. Exploitation requires valid credentials (PR:L, remote, no user interaction) and no public exploit code or confirmed active exploitation has been identified at time of analysis, but the impact is high severity and a fix is available in 9.18.
Elevation of privilege in Dell OpenManage Server Administrator (OMSA) managed nodes running versions prior to 11.1.0.3 lets a network-positioned attacker who already holds high privileges escalate to full control of the managed node, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.2). The underlying weakness is improper privilege management (CWE-269) reachable over the OMSA network management interface with low complexity and no user interaction, affecting Windows managed-node patch installations as well as managed nodes on RHEL 8.10, RHEL 9.4, SLES 15, and Ubuntu 22.04. No public exploit has been identified at time of analysis; the dominant limiting factor is the PR:H precondition, meaning anonymous or low-privileged remote attackers cannot trigger this issue.
Privilege escalation and information tampering in Dell OpenManage Server Administrator versions prior to 11.1.0.3 allow a low-privileged authenticated remote attacker to modify data and gain unauthorized access through improper privilege management. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, base 8.1) indicates network reachability with low attack complexity, requiring only low privileges and no user interaction, and resulting in high integrity and availability impact with no confidentiality loss. No public exploit identified at time of analysis.
Sandbox escape in vm2 through 3.11.6 lets untrusted JavaScript executing inside a NodeVM bypass the configured builtin-module denylist and reach the host filesystem via require('fs/promises') or require('node:fs/promises'), allowing host file creation and modification (confirmed through fsp.writeFile()) plus cp, mkdir, rename, rm, rmdir, truncate and read operations on the host. Exposure is configuration-dependent: only embedders that combine the builtin wildcard with negative entries (for example require: { builtin: ['*', '-fs', '-child_process'] }) are affected, while default configurations and allowlist-style restrictions are not, and no public exploit identified at time of analysis. The flaw is fixed in vm2 3.11.7. Note that the supplied CVSS 4.0 vector carries PR:L while the independent assessment's CVSS 3.1 vector carries PR:N, so authentication requirements are not unambiguously confirmed from available data; exploitation in practice requires only the pre-existing ability to submit sandboxed code.
Sandbox escape in the vm2 Node.js library through 3.11.6 lets untrusted code running inside a NodeVM instance reach the host's child_process builtin and execute operating-system commands whenever the embedding application configures a wildcard builtin require policy containing a node:-prefixed deny entry. The affected configuration (for example new NodeVM({ require: { builtin: ['*', '-node:child_process'] } })) fails to deny the canonical child_process module, so sandboxed code can obtain execSync and spawn via require('child_process') or require('node:child_process'), giving host command-execution capability to code that was supposed to be isolated (CVSS 4.0 base 9.4; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Exploitation requires PR:L privileges in the sense that the attacker must already be able to run attacker-controlled JavaScript inside the sandbox, and it only works under that specific deny-list form; a correctly spelled '-child_process' entry, a non-wildcard allow-list, or not exposing child_process at all avoids the flaw. No public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in Acer System Monitoring, the privileged service bundled with NitroSense and PredatorSense on Acer Nitro and Predator gaming laptops, allows an authenticated local user to interact with the service and perform unauthorized registry modifications that can elevate privileges to SYSTEM. Exploitation requires an existing low-privileged foothold on the machine (PR:L) with no user interaction, and is limited to Acer gaming hardware running the vulnerable OEM software; there is no remote attack path. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so this represents a post-compromise escalation primitive rather than an actively exploited threat.
Local privilege escalation in Acer System Monitoring, a component bundled with NitroSense and PredatorSense on Acer Nitro and Predator laptops, allows an authenticated local user to abuse a privileged Named Pipe service for unauthorized registry operations. Exploitation requires local access and the vulnerable service running, and the vendor rates the exploit as Unproven with no public exploit code identified at time of analysis. Successful abuse could elevate privileges or compromise the host, but realistic risk is confined to machines with these Acer gaming utilities deployed and an attacker already holding a low-privilege foothold.
Local privilege escalation in the Acer Agent Service bundled with Acer NitroSense and PredatorSense lets an authenticated local user on an affected Windows laptop perform unauthorized registry operations through insufficiently controlled access in the service, potentially obtaining higher privileges and compromising the machine. The issue is rated CVSS 7.4 (CVSS v4.0 AV:L/AC:L/AT:N/PR:L/UI:N with High impact across confidentiality, integrity and availability, including subsequent-system impact), and our assessment aligns with a CVSS v3.1 vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, so the practical prerequisite is that the attacker already holds a low-privilege local account on a host where the OEM utility and its privileged service are installed and running. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV (the v4.0 vector carries E:U, 'Unproven' exploit maturity), so this is a genuine local privilege-escalation issue but not an urgent, mass-exploitable one; no EPSS score was supplied in the source data.
Privilege escalation in the PuppyFW WordPress plugin (all versions through 0.4.4) lets any authenticated user, down to a Subscriber, add, modify, and delete arbitrary blog options, which is enough to grant themselves administrative capabilities. The root cause is a REST route that performs its capability check against a capability value supplied in the request itself, so the caller effectively authorizes itself; no user interaction and no special plugin configuration are required. Publicly available exploit code exists, so sites that allow open self-registration are directly at risk, and this is a genuine high-priority issue rather than a theoretical one.
Privilege escalation in the WordPress plugin "Choose User Role at Registration" before 1.3.3 lets an unauthenticated visitor submit a registration request naming any role - including administrator - because the plugin never validates the requested role against the roles the administrator actually configured to be offered; once the pending request is approved, the attacker receives that elevated role. Exploitation requires both non-default features to be enabled (role selection at registration and public/open account registration), and the escalation only completes after a human administrator approves the account, which is why the assessed vector carries AC:H and UI:R despite the network-delivered, unauthenticated (PR:N) request. Publicly available exploit code exists and the vendor has released a patched version, but no confirmed active exploitation (CISA KEV) is associated with this CVE at time of analysis.
Unsigned client-side view state in the djust Python framework (pip/djust, versions before 1.0.7) is restored as trusted state on WebSocket reconnect, allowing an authenticated low-privileged user to tamper with the embedded state_json snapshot and inject arbitrary view attributes such as is_admin, account_id, or balance, achieving privilege escalation and business-state manipulation. The attack is network-reachable, requires no victim interaction, and yields high confidentiality and integrity impact (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), but only affects views that opt into the non-default state-snapshot feature and that store authorization or ownership data in public view attributes. The vendor released djust 1.0.7, which signs snapshots and rejects unsigned or forged snapshots on the back-navigation restore path; no public exploit code was identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV).
Privilege escalation in the remote diagnostics debugger of Cisco Secure Firewall Management Center (FMC) lets an authenticated, remote user turn a valid low-privileged account into root. The flaw is a faulty privilege-level check (CWE-264) applied when a user invokes remote diagnostics, so an attacker who can log into either the web-based management interface or the REST API can enable the debugger service and have it grant them elevated rights; Cisco rates the exploitation path High complexity because it requires a multi-stage sequence rather than a single crafted request (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, 8.5). Because the attacker must already hold valid credentials on the device (PR:L), this is an access-gated escalation and not an unauthenticated entry point; no public exploit code has been identified and the issue is not confirmed as actively exploited (not in CISA KEV), though the scope-change impact (S:C) means a compromise of the debugger context can affect resources beyond the vulnerable component. Affected releases reported through EUVD are FMC 7.7.0, 7.7.10, 7.7.10.1, 7.7.11, 7.7.12, 10.0.0 and 10.0.1.
Heap-based buffer overflow (CWE-122) in HP's HPLIP - the HP Linux Imaging and Printing Software stack shipped as the default printer/scanner driver on most Linux distributions - can be triggered when attacker-influenced data is processed by a vulnerable component, potentially leading to remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification. This is a bundled advisory covering multiple externally reported flaws across several HPLIP components, so the precise prerequisites vary per sub-vulnerability; the vendor assigns CVSS 4.0 score 9.3 (Critical) with a remote, unauthenticated, low-complexity vector, while the independent assessment is more conservative at CVSS 3.1 AV:N/AC:H/PR:N/UI:N, reflecting that the system must be running HPLIP and actually process malicious input. No public exploit code and no confirmed active exploitation were identified at time of analysis.
HPLIP (HP Linux Imaging and Printing Software) is affected by multiple heap-based buffer overflow vulnerabilities (CWE-122) that can lead to remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification. Exploitation requires user interaction, such as a victim performing a print or scan operation or processing attacker-supplied imaging data, but no authentication is needed, and the attack is network-reachable. HP has remediated the issues; no public exploit code has been identified at the time of analysis.
Heap-based buffer overflow and related memory-safety flaws in HP Linux Imaging and Printing (HPLIP) can allow remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification on Linux hosts where HPLIP is installed and the affected component is active. This is an aggregate HP bulletin (hpsbpi04151) that bundles multiple externally reported issues under one CVE, so the published CVSS 4.0 score of 9.3 (AV:N/AC:L/PR:N/UI:N/VC:H/VI:H/VA:H) represents the worst-case component rather than any single flaw, and the assessed CVSS 3.1 score is lower (AV:N/AC:H) because several sub-issues are more likely local than remote and heap exploitation requires reliable memory grooming. No public exploit code or confirmed active exploitation was identified at time of analysis, and the exposure is limited to Linux systems on which HPLIP is deployed rather than being a universal service.
Command injection weaknesses in HP Linux Imaging and Printing Software (HPLIP) allow a local attacker to execute arbitrary operating-system commands with the privileges of the affected HPLIP component, resulting in high confidentiality, integrity, and availability impact (vendor CVSS 4.0 base 8.4) and spanning remote code execution, privilege escalation, denial of service, information disclosure, and unauthorized file modification. Exploitation is not remote: it requires local access to a Linux host that has HPLIP installed and in use, and it requires active user interaction, typically by inducing a legitimate user to feed attacker-controlled input into a vulnerable HPLIP component that builds an OS command (CWE-78). No authentication or elevated privileges are needed (PR:N), and no public exploit code or confirmed active exploitation was identified at time of analysis; HP has released remediation for the affected components in advisory HPSBPI04151.
Heap-based buffer overflows and related memory-safety flaws in HPLIP (HP Linux Imaging and Printing Software) let remote attackers corrupt memory in the print, scan, and device-discovery stack, potentially yielding remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification. Only Linux hosts with HPLIP installed and actively processing attacker-influenced input - a crafted print job, a rogue printer/scanner response, or a file handled by the HPLIP stack - are affected, and exploitation is gated on active user interaction (initiating or accepting the malicious print/scan operation) rather than being a fully autonomous remote exploit. The flaws are unauthenticated per the vendor CVSS vector (PR:N), impact varies depending on which bundled sub-vulnerability is triggered, and no public exploit identified at time of analysis.
Out-of-bounds write flaws in HPLIP (HP Linux Imaging and Printing Software) can corrupt memory when a user processes attacker-influenced input such as a crafted print job, a malicious device or network response, or a handled file, with the affected product confirmed by HP and documented in advisory HPSBPI04151. No authentication is required to reach the vulnerable components, but exploitation depends on mandatory user interaction and on hosts that actually have HPLIP installed and in active printing or scanning use. Worst-case impact spans remote code execution, privilege escalation, denial of service, information disclosure, and unauthorized file modification; no public exploit code or confirmed active exploitation was identified at time of analysis.
Cross-tenant privilege escalation in Shuffle (self-hosted SOAR platform) through version 2.2.1 lets an administrator who holds org-admin rights in any single organization mint and read valid API keys for arbitrary users in other organizations, resulting in full account takeover across tenant boundaries. The flaw is an IDOR/authz bypass (CWE-639) in the HandleApiGeneration endpoint, which accepts a caller-supplied user ID and returns or resets that user's API key without verifying ownership; it is remotely reachable over the network and requires only an authenticated admin account (CVSS:4.0 8.6, PR:L, UI:N, high confidentiality and integrity impact). There is no CISA KEV listing and no public exploit code identified at time of analysis, but exploitation is trivial once any tenant admin account is obtained, and source-verified fix code exists in the upstream shuffle-shared repository.
Incorrect default permissions in Dell Repository Manager (DRM) versions prior to 3.5.2 let an attacker who already holds a low-privileged account on a Windows host abuse misconfigured files, directories, or service resources to escalate to a higher-privileged context. Dell rates this 8.5 (High) with a remote, scope-changing vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H), but our independent assessment scores it 7.8 as a local privilege-escalation issue (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H): exploitation requires an existing foothold on a machine where DRM is installed, is not a default unauthenticated remote scenario, and is limited to systems running DRM below 3.5.2. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has published a fixed release (3.5.2) via Dell security advisory DSA-2026-419.
Authenticated low-privilege users of FileRise before version 3.28.0 can obtain unauthorized read and write access at administrator level through the WebDAV interface by supplying valid Basic-Auth credentials alongside an active administrator PHPSESSID cookie, because the WebDAV layer inherits the elevated privileges of the ambient web session rather than authenticating each request independently as RFC 4918 requires. Exploitation is not trivial and depends on a co-occurring privileged session: the attacker must already hold valid low-privilege credentials (PR:L) and obtain the session cookie of a live administrator session, which is the basis for the high attack complexity (AC:H) in the CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N, base 7.6) and the assessed CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N); availability is unaffected. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at the time of analysis, and the vendor has released FileRise 3.28.0, whose changelog describes refined, more consistent WebDAV request handling.
Sandbox escape in the Avast/AVG/Norton sandbox minifilter driver (aswSnx.sys) on Windows allows an authenticated, low-privileged process already executing inside the sandbox to break file isolation and escalate to SYSTEM (CVSS 8.8, AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, CWE-281). The driver opens the virtualization target with only GENERIC_WRITE and FILE_WRITE_ATTRIBUTES, omitting WRITE_DAC, so every attempt to reapply the original DACL fails silently and virtualized copies of sensitive files are left with permissive permissions; the IRP_MJ_CREATE handler additionally fails to strip WRITE_DAC for sensitive directories, letting a sandboxed process rewrite the security descriptor of a virtualized object, read the virtualized SAM copy, extract local NTLM hashes and run code as SYSTEM. Publicly available exploit code exists (the PrettyPrague proof of concept), the vendor has released patches for the affected Avast, AVG and Norton products, and no CISA KEV entry indicates confirmed active exploitation.
Authenticated non-guest users of Curiosity Workspace can escalate their privileges to administrator within an existing access group without an invitation or approval, as reported in CVE-2026-88817. The vendor rates this as high severity (CVSS 4.0 score 8.7), and our independent assessment confirms the impact is limited to the targeted access group-it does not grant application-wide administrator rights or root access to the host. No public exploit has been identified at the time of analysis, and a vendor advisory is available with potential remediation guidance.
Kernel crashes or potential privilege escalation can occur in uniprocessor (non-SMP) Linux kernels when a BPF program executing in NMI context reaches the free_pages_nolock() path, due to an unsafe spin_trylock() call. This vulnerability affects only systems built with CONFIG_SMP=n, and while the alloc-side equivalent was already fixed, the free side remained vulnerable. No public exploit has been identified at time of analysis; the vendor did not reproduce the crash but acknowledges a probable privilege escalation impact, though our assessment rates availability impact as high and integrity impact as low.
A local privilege-escalation use-after-free exists in the Linux kernel perf subsystem: an unprivileged local user can win a tight race between perf_mmap_close() and a concurrent perf_mmap_rb() revival so that a freshly revived ring buffer is freed while another process still has it mapped, yielding page-level memory corruption and a path to root. The bug is reachable under the default kernel.perf_event_paranoid=2 setting (authenticated local account per the CVSS vector PR:L, no user interaction), so hardening the setting or restricting perf_event_open is the practical interim control. Vendor-released patches are available (6.18.52, 7.2.5, 7.3-rc2), the EPSS score is low at 0.19% (9th percentile), and no public exploit code has been identified at time of analysis - but exploitation is local-only and probabilistic, requiring repeated attempts to hit the TOCTOU window.
Privilege escalation in the Tutor LMS WordPress plugin (versions 2.7.1 up to but not including 4.0.8) lets the holder of a read-only Tutor LMS REST API key act with the full privileges of the administrator account that issued that key, producing high confidentiality, integrity and availability impact and, in practice, complete takeover of the affected WordPress site. Exploitation is authenticated in the sense that the attacker must already hold a valid API credential provisioned by a site administrator - obtained through grant, leak, or capture - after which no further user interaction is required; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.2 as published with PR:H). Publicly available exploit code exists and WPScan has published the vulnerability record, but there is no indication of confirmed active exploitation (not in CISA KEV); EPSS is low at 0.17% (7th percentile), suggesting limited observed exploitation activity despite the severity of impact once a key is held.
A page-level use-after-free in the Linux kernel ALSA PCM subsystem lets a local user with access to a /dev/snd PCM character device turn a race between a concurrent mmap() and a buffer reallocation into a stale, writable mapping of freed DMA buffer pages, which can be reclaimed by the allocator and reused for local privilege escalation. The attacker must issue SNDRV_PCM_IOCTL_HW_PARAMS/HW_FREE from one thread while another thread mmaps the same PCM stream, and must win a narrow timing window (assessed CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H); no public exploit code has been identified at time of analysis, although the upstream commit states a reproducer is available on request, and this CVE is not in CISA KEV. Vendor patches are available in the stable trees (6.12.111, 6.18.53, 7.2.7) and mainline 7.3-rc2, with backports to older long-term branches, so unpatched kernels running ALSA PCM support remain exposed to any local user who can open a PCM device.
Heap corruption in the Linux kernel's IPv6 fragment reassembly logic can be turned into local privilege escalation by a low-privileged local user (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H in our assessment) on systems where unprivileged user/network namespaces are enabled and IPv6 fragment processing is reachable. The flaw stems from a race during network-namespace teardown: fqdir_pre_exit() flushes the skbs held in incomplete fragment queues without marking those queues complete, so a fragment that acquired a reference just before high_thresh was cleared can reuse stale reassembly metadata, and ip6_frag_reasm() then applies an old nhoffset to a new skb, producing an out-of-bounds write (KASAN: slab-out-of-bounds in ipv6_frag_rcv / ip6_protocol_deliver_rcu against skbuff_small_head). Successful exploitation yields kernel heap corruption exploitable for elevation to root; the primary limiting factor is winning the race between fqdir teardown and concurrent reassembly, and no public exploit code or confirmed active exploitation has been identified at time of analysis. A separate side effect is that unflushed fragments can keep conntrack references alive past the per-net conntrack cleanup point.
Privilege escalation in the Knit Pay WordPress plugin through 9.6.1.0 lets an authenticated attacker with Subscriber-level access and above promote their own account to administrator by tampering with the hidden role field of a Gravity Forms submission. The flaw requires the plugin's Gravity Forms integration to be active and a feed configured so that user_role_field_id points at a form field; the plugin then passes that attacker-controlled value directly to WP_User::set_role() with no allowlist validation, and the process is further helped by $0 orders being marked SUCCESS synchronously at submission and by the role-assignment fallback to $lead['created_by'], the submitter's own user ID. At time of analysis no public exploit code or CISA KEV entry was identified, but with CVSS 8.8 and an authenticated low-privilege prerequisite, this is a high-priority issue for any site running the vulnerable plugin together with a configured Gravity Forms feed.
Unauthenticated privilege escalation in the Optima Express IDX plugin for WordPress (all versions up to and including 8.7.5) allows a remote attacker to take control of the plugin's hard-coded `optima-express` integration account and force it to the Author role, gaining `publish_posts`, `upload_files` and `edit_published_posts` capabilities, including access to the plugin's own `/wp-json/optima-express/v1/blog-post` REST endpoint. The exploit path is an AJAX action registered with `wp_ajax_nopriv_ihf_clear_cache` that reaches `provisionBlogCredentials()` with no capability check, nonce verification or ownership validation, but it is only reachable when two conditions are met: open user registration must be enabled on the target site (a non-default WordPress setting), and the attacker must claim the `optima-express` username before the plugin provisions that login for its own integration account - a race that the independent assessment captures with an AC:H adjusted vector despite the published AC:L. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS signal was supplied.
Unauthenticated privilege escalation in the WordPress plugin Automation Web Platform - Notifications and OTP for WooCommerce, Advanced Country Code (all versions up to and including 4.8.6) allows any remote visitor to register a brand-new account holding the WordPress administrator role and take full control of the site. The publicly reachable signup REST route POST /wp-json/wawp/v1/signup/<op> performs no permission check and passes attacker-supplied wawp_custom_fields values straight into update_user_meta(), so keys such as wp_capabilities and wp_user_level can be set by the caller; when signup OTP is enabled, the plugin also leaks the otp_transient token in the HTTP response and marks it verified on any unauthenticated GET, so the OTP step can be skipped without any access to the victim's email or SMS. No public exploit code or active exploitation was identified at time of analysis (not listed in CISA KEV), but with CVSS 9.8, PR:N and no prerequisite beyond a reachable signup feature, this is a top-priority issue for any site running the affected plugin.
Missing authorization in the ServiceNow AI Platform lets unauthenticated remote attackers, under certain vendor-undisclosed instance conditions, read instance data beyond the intended scope and escalate privileges. ServiceNow has remediated the flaw on its hosted instances and distributed the fix to partners and self-hosted customers, but no public exploit code or active exploitation has been reported and no EPSS score was supplied with the source data. The vendor CVSS 4.0 rating is Critical (9.3), while the independent assessment is lower and treats exploitation as conditional, so unpatched self-hosted or partner-managed instances should still be prioritized given the data-exposure and privilege-escalation potential.
Stored cross-site scripting in code16 Sharp before 9.22.5 lets an authenticated user who can edit a rich-text Editor field persist JavaScript via the iframe srcdoc attribute; the payload executes in the browser of any other user - typically a higher-privileged administrator - who later views the stored content, enabling session hijacking, account takeover, privilege escalation or disclosure of administrative data. The vendor confirmed the issue in advisory GHSA-qxg3-46rw-79j8 and shipped a fix in version 9.22.5 (commit ec509a22) that removes srcdoc from the permitted iframe attributes; exploitation requires a valid account with Editor-field edit permission and a second viewing victim (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N, 7.3). There is no indication of active exploitation and no public exploit identified at time of analysis.
Stored cross-site scripting in Snipe-IT versions before 8.7.0 lets an authenticated user holding only the customfields.create permission embed HTML/JavaScript in a CustomField.name value, which is rendered unescaped as an asset-list column header title and executes on page load for any user who opens a list tied to the affected fieldset. Since customfields.create is delegable to non-superusers, the injected script runs in a higher-privileged victim's session - the vendor advisory demonstrates an account with no permissions beyond customfields.create issuing authenticated requests in a superuser's session to grant itself superuser rights. Publicly available exploit code exists (reproduction steps and SSVC exploitation state of 'poc'), CISA's SSVC assessment rates technical impact as total, while EPSS remains low at 0.30% (21st percentile) and there is no KEV listing indicating confirmed actively exploited (CISA KEV) activity at time of analysis.
Privilege escalation in the authentik identity provider allows an account holding delegated group, group-membership, or user management rights to elevate itself to superuser by joining a group whose ancestor groups grant superuser status, or by assigning an existing role to a group without holding the change_role permission. Deployments running authentik before 2026.2.7, before 2026.5.7 on the 2026.5 line, or before 2026.8.2 on the 2026.8 line are affected, but exploitation is confined to installations that delegate those management capabilities to accounts that are not full administrators - single-administrator or non-delegated setups are unaffected. The flaw rates CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), requires the attacker to hold an authenticated delegated account, and no public exploit code has been identified at time of analysis; vendor patches are available and the fix set is documented in advisory GHSA-h6c5-mpvq-j4jc.
Out-of-bounds read in Altera Trusted Firmware for SoCFPGA hard processor systems (all builds through socfpga_v2.14.0) lets an attacker who already holds high privileges in the normal world corrupt or read beyond intended memory bounds inside the secure monitor, enabling escalation from the non-secure HPS environment into the secure world. Exploitation requires local access and pre-existing root-level code execution (CVSS PR:H), so it is not a remote or pre-authentication vector; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV. The independent assessment rates this a genuine but access-limited priority given the privileged local precondition.
Local privilege escalation in Altera Trusted Firmware (TF-A) on socfpga Hard Processor Systems lets an attacker who already holds high privileges on the normal-world OS drive an out-of-bounds read inside the secure monitor, exposing and corrupting secure-world memory and escalating execution context, in all versions through socfpga_v2.14.0. The flaw is reachable only by invoking secure-monitor calls from an already-privileged local context, with no network vector and no user interaction, but because it crosses the normal-world/secure-world boundary it yields high integrity and availability impact beyond the vulnerable component (CVSS 4.0 base 8.3; independent assessment CVSS 3.1 8.3). No public exploit code has been identified and the issue is not listed in CISA KEV, so exposure is confined to devices where an adversary has already achieved privileged local execution.
Local privilege escalation in Evope Collector (all versions before 1.1.7.13) lets an attacker who already has a local foothold with write access to C:\ProgramData\Evope\ plant a file named wtsapi32.dll that Evope.Service.exe, running as NT AUTHORITY\SYSTEM, loads without validating its origin, resulting in arbitrary code execution with SYSTEM privileges. The weakness is an uncontrolled search path element in the service's DLL loading, so exploitation requires no victim interaction, though the service must start or restart before the planted library is loaded (captured as AT:P in the 7.5 CVSS 4.0 vector). No public exploit code or CISA KEV entry was identified at time of analysis, and the vendor has published a fixed version, 1.1.7.13.
Unauthenticated privilege escalation in the Paytium: Mollie payment forms & donations WordPress plugin (all versions up to and including 5.0.3) allows an attacker to create a brand-new WordPress user with the administrator role and take over the site. The flaw lives in the unsigned pt_cf_checkout_meta() filter on the pt_meta_values hook, which copies attacker-supplied $_POST['pt_form_field'] keys, including pt-user-role, straight into payment meta and ultimately into wp_insert_user(); exploitation requires a publicly reachable [paytium] shortcode form and completion of an actual Mollie payment so the malicious role meta is persisted, after which the attacker claims the new admin account via the standard lost-password flow. No public exploit code was identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV), though the vendor-published Wordfence advisory and the 9.8 CVSS rating (AV:N/AC:L/PR:N/UI:N) make this a high-priority unauthenticated issue for any site running the affected versions with a public Paytium form.
Privilege escalation in the WordPress plugin Import and Export Users and Customers (versions up to and including 2.4.17) allows any authenticated user at Subscriber level or above to become an Administrator. The attacker stores crafted values in their own display_name and nickname profile fields and then waits for a site administrator to run the plugin's documented export-then-reimport migration with both 'Update existing users' and 'Update roles for existing users' set to 'yes'; a CSV quoting/escape mismatch between exporter and importer causes the crafted display_name to be consumed as the role field, yielding 'administrator' at the importer's add_role call. Exploitation is not self-contained - it requires the operator to enable those two non-default migration settings - and no public exploit identified at time of analysis. The vendor risk score is 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), while our independent assessment re-rates it as AV:N/AC:H/PR:L/UI:R because the admin-driven, non-default migration workflow materially constrains real-world exploitation.
Any holder of a valid low-privileged cPanel account can escalate to root and execute arbitrary code on the underlying host, because a privileged cPanel operation is executed with unnecessary root privileges (CWE-250). The flaw is remotely reachable over the network with low attack complexity and no user interaction, but it does require an authenticated account (CVSS 4.0 vector PR:L) - a trivial barrier on shared hosting where accounts are commonly sold or self-provisioned, and a meaningful one on locked-down single-tenant deployments. It carries a 9.4 CVSS 4.0 score and is rated a genuine high-priority issue rather than a high-score/low-real-risk case, though no public exploit code and no confirmed active exploitation were identified at time of analysis; no EPSS estimate was available in the supplied intelligence.
Privilege escalation in Red Hat Ansible Automation Platform 2 (built on the AWX upstream project) lets an authenticated AAP platform administrator escape the container-group sandbox and obtain OpenShift namespace-level access, including the ability to read and exfiltrate namespace secrets. The flaw is reachable over the network (AV:N) with no user interaction (UI:N) and changes scope across the container/namespace boundary (S:C), but it is gated on the highest AAP privilege tier (PR:H), so it is an insider or compromised-admin scenario rather than an unauthenticated attack; only deployments that use container groups backed by OpenShift/Kubernetes are exposed. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); no vendor-released patch has been identified at time of analysis, so mitigation depends on restricting the vulnerable field or the administrators who can reach it.
Privilege escalation and remote code execution on managed hosts is possible in Red Hat Ansible Automation Platform 2 because the automation-controller exposes the provisioning-callback secret (host_config_key) to anyone holding only read-level view_jobtemplate permission and accepts a client-supplied X-Forwarded-For header as proof of caller identity when the gateway proxy allow-list is empty. An attacker who reads the secret from the job template API representation or the activity stream and spoofs X-Forwarded-For to match any host in the target job template's inventory can launch that template against arbitrary managed hosts using the template's stored credentials; CVSS 3.1 base score is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), no public exploit code was identified at time of analysis, and the decisive enabler is a non-default deployment condition - an empty proxy allow-list combined with provisioning callbacks actually being in use.
Local privilege escalation to root in Flatpak before 1.18.1 lets an unprivileged user holding an active local session abuse the revokefs writer used by flatpak-system-helper: by opening two concurrent revokefs sessions and planting a symlink from one session directory into the other, the attacker retains a file descriptor into a peer session and keeps modifying its files after the system helper has already validated and imported them. The practical payoff is tampering with ostree commit objects in the system repository after signature verification, which translates into root-controlled writes to attacker-chosen paths. Exploitation requires local access and winning a TOCTOU race against the dual-session setup (CVSS AV:L/AC:H/PR:N), and no public exploit code has been identified at time of analysis; the issue is not confirmed as actively exploited (not in CISA KEV).
Privilege escalation in Zoho ManageEngine OpManager and Firewall Analyzer 12.8.710 and earlier allows an authenticated low-privilege user to gain Administrator privileges by importing a crafted Report Profile. The issue is network-reachable with low attack complexity and requires no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1 High), but the attacker must already hold working low-privilege credentials on the target instance and no non-default configuration is needed. No public exploit identified at time of analysis.
Local privilege escalation in Foxit PDF Editor for macOS allows an attacker with a low-privilege foothold to execute arbitrary commands as root by tampering with a user-modifiable configuration value that the installer trusts during high-privilege upgrades. Exploitation requires local access, write access to the configuration value, and a privileged upgrade operation to be triggered, but no user interaction (UI:N) is needed. No public exploit code or active exploitation has been identified at time of analysis (no KEV, no POC).
A local privilege escalation vulnerability in the auto-update daemon shipped with Foxit PDF Editor and Foxit PDF Reader (CVE-2026-91798, CVSS 3.1 8.8) lets an already-authenticated, low-privileged local user abuse an insecurely permitted configuration file (CWE-732) to have the elevated daemon execute arbitrary script content with SYSTEM/root-level rights. Because the attacker must already hold a session on the host and the impact crosses a privilege boundary, the vector is AV:L/PR:L/UI:N/S:C with full confidentiality, integrity, and availability impact; no remote attack path exists, and no public exploit code was identified at time of analysis. Any host running a vulnerable Foxit build with the update daemon installed and the loosely permissioned configuration file present is exposed, making this most relevant to multi-user workstations, VDI, and terminal-server environments where unprivileged users share a machine with a privileged updater.
Local privilege escalation in Foxit PDF Editor (14.0.7 and earlier, plus 2026.2 and earlier) and Foxit PDF Reader (2026.2 and earlier) allows a locally authenticated low-privileged attacker to plant a crafted DLL in a user-writable directory that the Foxit updater searches, so that when the updater performs a high-privilege operation the malicious library is loaded and code runs with elevated privileges. The flaw is a classic uncontrolled search path condition (CWE-427) with CVSS 3.1 score 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the attacker must already hold a foothold on the Windows host - there is no remote or network vector - and exploitation only succeeds if the privileged updater actually runs and the relevant path is user-writable. Intelligence signals are quiet: no public exploit identified at time of analysis, no CISA KEV listing (SSVC exploitation: none, automatable: no), and a low EPSS of 0.17% (6th percentile), making this a credible but non-urgent post-compromise escalation issue rather than an imminent threat.
Privilege escalation in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets a remote authenticated attacker who already holds a privileged account exceed the permissions assigned to that account, with high impact across confidentiality, integrity and availability. IBM rates it 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), a score driven mainly by the Scope-Change flag; our independent assessment preserves the full CIA impact but treats scope as unchanged, because the high starting-privilege requirement narrows the realistic attacker population to insiders or holders of compromised privileged credentials, and the deployment footprint is limited to organizations running FTM on OpenShift. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; IBM has published a vendor patch advisory.
Improperly scoped role-based access control in IBM Concert 1.0.0 through 3.0.0 lets any authenticated user holding even a low-privileged account read and modify resources outside their granted permissions, because the product's RBAC permission definitions rely on wildcards instead of explicit resource scoping. IBM scores this 9.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N), while our independent assessment rates it 8.8 with Scope:Unchanged, meaning the practical severity is high but below the vendor's critical rating; exploitation still requires a valid account and a reachable Concert instance. No public exploit code has been identified at time of analysis and there is no evidence of active exploitation (not in CISA KEV), but IBM has published a vendor patch at support node 7288830.
Local cross-user code execution with privilege-escalation potential affects the Windows builds of GNU wget distributed by eternallybored.org (releases 0 through 1.21.4 inclusive). The flaw is a hardcoded configuration location, C:\msys64, that unprivileged users can write to: a low-privileged local attacker who plants a wgetrc there can abuse the use_askpass directive so that arbitrary code is executed in the security context of a higher-privileged user who later runs the affected wget build. The attack is not remotely reachable and does not trigger on its own, which is captured by the UI:R component of the CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8), and no public exploit code was identified at time of analysis.
Privilege escalation in the Adobe Premiere Pro desktop application is achievable through a server-side request forgery flaw (CWE-918) that Adobe's own PSIRT self-reported in advisory APSB26-157, carrying a CVSS 3.1 base score of 7.1 (AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N). Because the attack vector is Local, successful exploitation requires the victim's installed copy of Premiere Pro to process attacker-supplied content - in practice a crafted project or media file - and the changed scope (S:C) indicates the forged request reaches a component outside Premiere Pro's own security authority, yielding integrity and privilege-escalation impact with no confidentiality or availability loss. No public exploit code and no CISA KEV entry are associated with this CVE, so no public exploit is identified at time of analysis; note also that the vendor's UI:N claim conflicts with the ordinary desktop file-open workflow, which our assessment scores as UI:R, and this discrepancy is the environment mismatch flagged in the source description and should be verified against APSB26-157 before external publication.
Arbitrary server-side code execution in the Plone process is possible through the Classic portlet shipped in plone.app.portlets 5.0.0 through 7.0.1, where user-supplied template and macro fields are assembled into a TALES path expression and then evaluated by the TAL path() helper, allowing a crafted value to be interpreted as a full expression rather than a constrained path. Any authenticated user who can add or edit a Classic portlet can execute code, and under Plone's default role map that includes ordinary registered users on their personal dashboard, so the issue amounts to a post-authentication privilege escalation across the trust boundary between a web user and the server-side Plone process (CVSS 3.1 9.9, scope changed: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). There is no confirmed active exploitation (no CISA KEV listing) and no public exploit identified at time of analysis, but vendor patches are available in 5.0.8, 6.0.4, and 7.0.2.
Root-level file system access in HPE Analytics and Location Engine (ALE) can be obtained by an authenticated administrator through the product's maintenance restore function, which processes attacker-supplied restore data with root privileges and permits writes to the host file system (CVSS 3.1 base 7.2 High, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Because the vector requires high privileges (PR:H), the practical attack surface is limited to administrators or adversaries who have already compromised an admin account, though the flaw is network-reachable (AV:N) and needs no user interaction (UI:N). No public exploit code was identified and there is no confirmed active exploitation at time of analysis.
Server-side request forgery in Adobe Experience Manager (AEM) 6.5 Forms JEE and AEM 6.5 LTS Forms JEE lets an authenticated low-privilege user coerce the Forms server into making HTTP requests to internal-only resources, which can cross a security boundary (CVSS scope change) and yield elevated access. The flaw is rated 9.6 by the vendor and assessed at 9.6/9.6-class severity with the confidentiality impact confirmed as high, while integrity impact is bounded by what the reachable internal endpoints actually allow. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the EPSS signal was not notable in the supplied data.
Server-side request forgery in Adobe Experience Manager Forms JEE lets an attacker who already holds high-privileged, admin-level application access coerce the AEM Forms JEE server into issuing requests to internal-only resources, achieving privilege escalation and a scope change beyond the original AEM security perimeter. Affected deployments are AEM 6.5 Forms JEE and AEM 6.5 LTS Forms JEE, reachable over the network (AV:N) with no end-user interaction (UI:N) but gated behind the PR:H privileged-authentication requirement, so practical risk concentrates on malicious insiders or attackers who have already compromised an administrative account. Based on the supplied intelligence there is no CISA KEV listing and no public exploit code identified at time of analysis; the high EPSS-style urgency implied by the CVSS 8.7 base score reflects the scope change and confidentiality/integrity impact rather than demonstrated exploitation.
Server-side request forgery in Adobe Campaign Classic (versions up to and including 7.4.4 build 9401) lets remote unauthenticated attackers induce the ACC server to issue arbitrary requests to other systems, which the vendor rates as a privilege-escalation risk with a changed scope and a maximum CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). No authentication or user interaction is required per the vendor vector, so the practical limiting factor is whether the ACC endpoint is reachable by the attacker and whether exploitable internal services sit behind it; Adobe does not document a non-default configuration prerequisite, so default deployments in the affected range appear exposed. Exploitation status at time of analysis is that no public exploit has been identified, and EPSS is a modest 0.69% (51st percentile), though the vendor's high impact rating and the absence of preconditions justify prompt patching. An independent recalibration prefers C:H/I:L/A:N over the vendor's triple-high impact, so the 10.0 figure should be read as Adobe's upper-bound claim rather than a confirmed blast radius.
Server-side request forgery in Adobe Campaign Classic lets an authenticated, low-privileged user force the ACC application server to issue requests to internal or otherwise unreachable resources, turning the account into a foothold for reading confidential internal services (CWE-918; CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N). Adobe scores the issue 9.9 Critical, while our assessment keeps the scope change and high confidentiality impact but rates integrity as Low - the dominant effect is unauthorized reach into internal resources rather than direct tampering with protected data - which places effective risk in High territory (≈8.5) rather than Critical. Exploitation requires valid low-privileged ACC credentials and network reachability to the application, needs no user interaction, and no public exploit code or CISA KEV listing was identified at time of analysis.
Server-side request forgery in Adobe Campaign Classic (Classic v7), affecting builds up to and including 7.4.4 build 9401, lets an authenticated low-privileged user coerce the ACC server into making requests to internal systems the user cannot reach directly, with the trust-boundary crossing reflected as a scope change (S:C) that can escalate that user's effective access. No user interaction is required, and Adobe rates the issue 9.9, while our independent assessment retains high confidentiality impact but lowers integrity and availability to Low (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L) and stresses that a valid low-privileged account is a prerequisite, so this is not remote-unauthenticated. No public exploit code and no CISA KEV entry have been identified at time of analysis, EPSS is low at 0.73% (53rd percentile), and SSVC marks the issue non-automatable with total technical impact - making the realistic risk targeted insider or post-foothold abuse rather than opportunistic internet-wide scanning.
Local privilege escalation in the Netdata Windows Agent (versions 2.0.0 through 2.10.3) lets an authenticated low-privileged local user obtain SYSTEM-level code execution by interacting with or hijacking the elevated interactive process windows that the MSI repair action spawns in that user's own desktop session. Carrying a CVSS 3.1 base score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) and classified as CWE-269 improper privilege management, exploitation is genuinely constrained: it is local-only, requires the ability to trigger an MSI repair under the host's Windows Installer elevation policy, and depends on a timing/UI race against transient elevated windows, so it is a bounded privilege-escalation issue rather than a remotely reachable emergency. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV; the vendor has shipped a fix in stable release 2.10.4.
Local privilege escalation in the Netdata Windows Agent (versions 2.0.0 through 2.10.3) allows an authenticated low-privileged user to execute arbitrary commands with SYSTEM privileges by placing malicious commands in their PowerShell profile and then triggering an MSI repair, which runs powershell.exe as SYSTEM without the -NoProfile flag. The vulnerability (CWE-269) is fixed in Netdata Agent 2.10.4; no public exploit code has been identified at time of analysis.
Local privilege escalation in HP Support Assistant versions prior to 9.55.10.0 allows an authenticated local attacker to gain elevated privileges on affected Windows hosts through insufficient access controls (CWE-269, improper privilege management). The flaw is not remotely reachable and requires the attacker to already hold low-privileged local access plus satisfaction of a specific attack precondition (expressly flagged as AT:P in the CVSS 4.0 vector), which constrains reliable exploitation; no public exploit code and no confirmed active exploitation were identified at time of analysis. Impact is rated high for confidentiality, integrity and availability of the affected host, making patched builds (9.55.10.0 and later) the primary mitigation.
Improper authentication in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9, tracked as EUVD-2026-84409) allows a remote, unauthenticated network attacker to bypass authentication and obtain privilege escalation, information disclosure, and data tampering with full confidentiality, integrity, and availability impact per the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8 critical). No public exploit code has been identified and there is no confirmed active exploitation (CISA KEV does not list this CVE); EPSS is 0.32% (25th percentile), and CISA's SSVC assessment rates exploitation as none, automatable as no, and technical impact as partial, indicating low near-term mass-exploitation likelihood. Practical exposure is further limited because the affected component is a specialized NVIDIA datacenter/GPU-infrastructure management service typically deployed on internal management networks rather than internet-facing hosts; the specific vulnerable endpoint or protocol is not disclosed in the advisory.
Local privilege escalation in Qualcomm Snapdragon platforms allows a low-privilege on-device process or app to cross a trust boundary and gain system-level control by abusing insecurely handled temporary files. The issue is tracked as CVE-2026-25265 with a vendor/assessed CVSS 3.1 score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), meaning exploitation requires local access and low privileges but no user interaction, and results in high confidentiality, integrity, and availability impact. No public exploit code or confirmed active exploitation was identified at time of analysis, and affected Snapdragon chipset/firmware versions are not enumerated in the input; confirm scope via the Qualcomm June 2026 product security bulletin.
Privilege escalation in Qualcomm Snapdragon devices allows a local low-privilege attacker to cross security boundaries and gain full control over confidentiality, integrity, and availability (CVSS 8.8). The flaw stems from a weak configuration during package extraction (CWE-427) that lets an attacker-controlled element be resolved or loaded with higher privilege; exploitation requires prior local code execution but no user interaction. No public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in Qualcomm Snapdragon firmware allows an attacker with low privileges to gain high-impact code execution and control over the device. The flaw resides in an exposed dangerous function within a gRPC server (CWE-749) and affects specific QPM (v3.0.127.2, v3.0.126.7, v3.0.125.4) and QSC (v1.21.0, v1.19.1, v1.17.1) builds. Exploitation requires local access and a pre-existing low-privileged foothold; no public exploit or active exploitation has been identified, and EPSS is only 0.15%.
Privilege escalation in the CMP - Coming Soon & Maintenance plugin by NiteoThemes for WordPress, affecting all versions up to and including 4.1.17, lets authenticated attackers with Editor-level access or above rewrite arbitrary WordPress options through the unprotected 'cmp_ajax_import_settings' AJAX action. By pointing the site's default_role at administrator and switching on users_can_register, the attacker can self-register a brand-new administrative account and take full control of the site; the vendor's CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N, base 7.2) confirms network-reachable, low-complexity exploitation that requires a valid high-privilege session but no user interaction. Remediation status: upstream fix available (WordPress.org plugin repository changeset); released patched version not independently confirmed. Exploitation status: no public exploit identified at time of analysis.
Unauthenticated privilege escalation to WordPress Administrator in the Meta Box AIO plugin (versions up to and including 3.11.0) - and in the standalone Meta Box Frontend Submission (≤4.5.6) and Meta Box User Profile (≤3.11.0) plugins - lets remote attackers rewrite the post_content of any page with an attacker-supplied shortcode and then create a new administrative account. The exploit chains three defects: populate_via_query_string() in mb-frontend-submission unconditionally overrides the form's target object_id from the rwmb_frontend_field_object_id GET parameter, Form::process() omits the user_can_edit() check that render() enforces, and mb-user-profile trusts the role and auto_login attributes of an injected [mb_user_profile_register] shortcode without validating the requested role. The flaw is network-reachable with PR:N/UI:N per the assessed CVSS 3.1 vector (9.8), so no authentication, user interaction, or prior privileges are required; Wordfence disclosed the issue, publicly available exploit code has not been identified at time of analysis, and there is no CISA KEV confirmation of active exploitation. The practical exposure limiter is deployment-specific: the site must expose a Meta Box frontend-submission form and must process the mb-user-profile registration component for the escalation to complete.
Horizontal privilege escalation in the x-ui web panel 0.3.2 allows any authenticated panel user to rewrite another user's inbound proxy configuration - remark, port, protocol, settings, enabled state, expiry time and traffic quota - by submitting an inbound-update request that carries the victim's resource identifier, because the update path never verifies that the referenced inbound belongs to the requesting session user (CWE-284). The flaw is network-reachable and requires no victim interaction, with a CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8); an independent assessment retains High severity and confirms the integrity impact (cross-tenant configuration tampering) while narrowing confidentiality and availability to Low, since the tampering is confined to proxy resource data rather than granting panel or host compromise. Exploitation is limited to multi-tenant deployments where more than one account holds inbound resources; no public exploit code has been identified at time of analysis and EPSS is low (0.20%, ~10th percentile), so mass scanning is unlikely, though the flaw is trivially reachable by any legitimate panel account.
Local privilege escalation in the Moore Threads MTT S80 Driver Package 340.150 allows a low-privileged local user to abuse an improperly secured IOCTL handler and gain high-impact control over the system. The flaw resides in the Windows kernel-mode driver mtdispkm64.sys, specifically function sub_140006F0C, and is classified as CWE-269 improper privilege management; successful abuse yields high confidentiality, integrity and availability impact on both the vulnerable component and the subsequently compromised host. Exploitation requires an existing local foothold on a Windows machine with this specific GPU driver installed, with low privileges and no user interaction needed (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; vendor-published CVSS 4.0 score 9.3). No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, but the low attack complexity and the absence of a vendor patch make the flaw attractive to local attackers already present on a host.
Privilege escalation in jshERP 3.6 allows an authenticated low-privilege tenant user to grant themselves arbitrary roles, including tenant administrator, by sending a crafted POST request to the updateOneValueByKeyIdAndType endpoint with type=UserRole, their own user ID, and a role ID list. The endpoint applies no ownership or privilege validation (CWE-862), and publicly available exploit code exists. Exploitation requires only a valid low-privilege session; no victim interaction or special configuration is needed, and no CISA KEV listing is present in the provided data to confirm active exploitation.
Permanent destruction of an entire group's inventory in HomeBox is possible for any authenticated user who belongs to that group, due to a broken authorization check in the wipe-inventory action handler affecting versions prior to 0.26.0. The flaw lets a self-registered user - who is automatically flagged as a global owner of their own group - select a different group via the X-Tenant header and invoke POST /v1/actions/wipe-inventory against it, deleting data that cannot be recovered without external backups. Exploitation requires an authenticated account on a multi-group instance where the attacker is also a legitimate member of the victim group, so single-user or single-group deployments are not affected; no public exploit identified at time of analysis.
OpenBao versions prior to 2.6.0 fail to reject syntax-significant characters when templated identity data is substituted into ACL, PKI, and SSH policies, allowing an authenticated principal who can write that identity data to broaden path matching, obtain certificates for unauthorized domains, or add unauthorized SSH principals. Exploitation is gated on a non-default configuration: the policy must use templates that substitute attacker-modifiable identity metadata (for example {{identity.entity.metadata.domains}} or {{identity.entity.metadata.sans}}), and the attacker must already hold the capability to update that identity record (such as update on identity/entity), consistent with the assessed CVSS 3.1 vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N. Deployments whose templates rely solely on the randomly generated identity.entity.id value are not affected, there is no user interaction, and no public exploit code was identified at time of analysis.
Privilege escalation in MISP before version 2.5.47 lets an authenticated holder of a read-only API key silently regain the complete permission set of the underlying user account. After authenticating with a view-only key, a single request to the updateLoginTime function causes MISP to re-login the session using the full account record, effectively discarding the API key's read-only restriction so the caller can perform write, delete, or administrative actions the key was meant to block. The flaw requires a valid read-only API key tied to an account that itself holds higher privileges, and escalation is bounded by those existing account permissions; no public exploit code has been identified at the time of analysis, and there is no KEV-listed active exploitation.
Elevated-privilege container restoration in CRI-O 1.34 and later, including downstream Red Hat OpenShift Container Platform 4.17+, lets an authenticated Kubernetes user who can create a pod from a crafted checkpoint image bypass the destination pod's security context. The restored process keeps credentials, Linux capabilities, no_new_privs and seccomp state stored in the checkpoint instead of the destination configuration, allowing execution across the container security boundary. Exploitation requires non-default checkpoint/restore (CRIU) support to be enabled and RBAC permission to create pods from malicious checkpoints; no public exploit code is identified and no vendor-released fix is available at time of analysis, so the vendor CVSS 3.1 score of 8.8 overstates urgency given those prerequisites (our assessment raises attack complexity to High).
Privilege escalation in the Import Export Users WordPress plugin before 2.5.2 allows authenticated users with the create_users capability but not promote_users to change roles of existing users, including promoting them to administrator, via the plugin's front-end import functionality. The flaw is exploitable where create_users is delegated to lower-privileged roles; it does not require administrator access or victim interaction. Publicly available exploit code exists, and this is a genuine privilege-escalation-to-full-takeover issue that merits prompt patching.
Privilege escalation in the Import and export users and customers WordPress plugin (versions 2.4.16 through before 2.5.2) lets an authenticated user who holds only the create_users capability assign administrator roles during a CSV import, enabling creation of new admin accounts or promotion of existing users. Publicly available exploit code exists, though there is no KEV confirmation of active exploitation. Exploitation requires a non-default role configuration where create_users is delegated without promote_users and the attacker can reach the plugin's CSV import function; default WordPress installs are not affected because only administrators hold create_users and already hold promote_users.
Authentication bypass in the SAML Single Sign On WordPress plugin (versions 4.8.43 through <6.0.0) lets a remote, unauthenticated attacker log in as any WordPress user, including an administrator. The plugin ignores whatever account-linking criterion the administrator configured (email, NameID, etc.) and always resolves the SAML identity by login name, so an attacker who can get the site's trusted Identity Provider to assert a login name of their choosing - for example via an IdP that allows self-service registration or user-controlled username attributes, or a compromised or attacker-operated IdP - authenticates as that account without proving ownership of it. Publicly available exploit code exists, and while the CVSS vector scores the flaw at 8.1 with PR:N, the AC:H rating reflects the significant prerequisite of influencing the trusted IdP's assertions; sites whose IdP strictly controls the asserted login-name attribute are much harder to exploit.
Account takeover is possible in the ZTE SmartLife (ZTESW) app on builds ZTE_SL_V2.8.2_ABROAD and earlier, where an attacker can reset the password of any registered user by spoofing the app's dynamically generated authentication parameters against the backend /account/verify.serv interface. After extracting the client-side auth parameters through a one-time reverse-engineering or instrumentation step, an attacker who knows a target's registered email address can resolve the real account ID and then submit a forged password-reset request, giving full control of the victim account without any victim interaction; the independent assessment rates this unauthenticated over the network (AV:N/AC:L/PR:N/UI:N) with high confidentiality, integrity and availability impact. No confirmed active exploitation (CISA KEV) and no publicly available exploit code were identified at time of analysis, but the weak-signal situation does not reduce the severity, and only ZTE_SL_V2.8.2_ABROAD and prior builds are affected.
Account takeover of any user of the UsersWP WordPress plugin - administrators included - is possible on sites running versions before 1.5.10 when social login is enabled, because the plugin resolves an incoming social-login session to an existing local account using the email address asserted by the provider without first confirming that the provider actually verified ownership of that address. The flaw is remotely reachable without authentication (CVSS:3.1/AV:N/AC:H/PR:N/UI:N, 8.1, CWE-269) and publicly available exploit code exists, so an attacker who registers at a lax or attacker-controlled provider can assert a victim's email and be logged into that victim's account. Exploitation carries the elevated complexity reflected in the AC:H rating: social login must be configured and enabled with at least one provider that permits assertion of an unverified address, and the attacker must already know the target's registered email. This is a genuinely high-priority vulnerability, not a high-CVSS-but-low-risk paper cut, since successful exploitation yields full account control including administrative takeover of the site.
Unauthenticated remote attackers can abuse a missing authorization check in a REST route of the Botiga Pro WordPress plugin (versions before 1.6.5) to update arbitrary WordPress options, inject stored web scripts that execute on every front-end page, and move arbitrary posts to the trash. The option-write primitive enables privilege escalation and full site takeover, for example by altering registration or default-role settings, while the stored script injection yields persistent cross-site scripting against all site visitors. The issue is rated CVSS v3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), publicly available exploit code exists, and no CISA KEV listing has been observed; the only deployment prerequisite is that the Pro add-on plugin is installed and active, as the free Botiga theme alone is unaffected.
Privilege escalation in the WordPress plugin WP Import Export Lite before version 3.9.35 lets an authenticated user who holds only the delegated import permission create new administrator accounts and overwrite the credentials and roles of existing accounts, including administrators, because the import routine never verifies user-management capabilities. The flaw is only exploitable on sites that actually delegate the import capability to a non-administrator role; default WordPress installations that restrict imports to administrators gain nothing from it. Publicly available exploit code exists, no confirmed active exploitation (CISA KEV) has been reported, and the vendor has released a fixed version.
Local privilege escalation in IBM Guardium Data Protection 12.2 allows an authenticated, low-privileged user with existing access to the appliance host to raise their privileges to a higher level, affecting confidentiality, integrity and availability of the platform. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation requires a pre-existing local account and low complexity but no user interaction; it is an escalation step rather than a remote entry vector, so risk is concentrated on collector/aggregator hosts where untrusted or lower-tier accounts or shells already exist. No public exploit code was identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was supplied; this is a genuine but moderate-priority local privilege escalation rather than an actively exploited campaign.
Local privilege escalation in IBM Guardium Data Protection 12.2 allows a low-privileged local attacker to execute arbitrary commands as root by exploiting insufficient argument validation in the SUID-root nmap_wrapper binary on the Collector appliance, resulting in full compromise of the Collector. The vulnerability requires existing low-privileged local shell access to the Collector and is not remotely exploitable. No public exploit code or confirmed active exploitation has been identified at the time of analysis; a vendor patch is available.
Local privilege escalation in IBM Guardium Data Protection 12.2 allows an attacker who already holds a low-privileged local account on the appliance - such as a constrained operator role, a compromised low-privileged process, or a malicious insider - to gain elevated privileges, with full compromise of confidentiality, integrity, and availability of the affected system. The flaw (CWE-269, improper privilege management) is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), requiring no user interaction and no network-facing path; the local-access prerequisite makes it a post-compromise escalation step rather than a remote entry point. No public exploit code or confirmed active exploitation has been identified at time of analysis, and IBM has published a vendor patch advisory.
Local privilege escalation in the virtio-win Viosock (vsock) paravirtualized driver, builds mm210 through mm319, lets an attacker who already has low-privilege code execution inside a Windows guest corrupt kernel memory and escalate to SYSTEM. The driver's IOCTL_SELECT handler adds three attacker-controlled descriptor counts with 32-bit arithmetic, so an integer-wrapped total passes the FD_SETSIZE bounds check while an individual fd_count remains far above the expected limit; the subsequent copy routine then walks the unchecked count and writes past the NonPagedPool-allocated pPkt->Fds array. Exploitation is local only (AV:L) and requires a low-privileged foothold (PR:L) with no user interaction; no public exploit code was identified at time of analysis, and the vendor fixed the issue in build mm320 via commit c6bef93d7909584bbda4e5c87603ea175825f342.
Local privilege escalation in Sublime Text for Windows - Sublime Text 4 through Build 4192 and Sublime Text 3 through Build 3207 - lets an authenticated local attacker who already holds an unprivileged account plant a malicious DLL in the user-writable update staging directory under %LOCALAPPDATA%, mark it read-only to defeat the installer's cleanup pass, and have the elevated installer copy the payload into the protected installation directory, where it executes in the context of any higher-privileged user who later launches the editor. The attack is local-only and conditional: it requires a prior foothold on the host, depends on the update staging mechanism being reached, and fires only when an elevated user subsequently opens the application (passive user interaction). Risk is real but situational rather than a mass-exploitation threat, and publicly available exploit code exists in the form of a published gist, so EPSS-style prioritization should focus on multi-user Windows endpoints where a standard user and an administrator both use the same Sublime Text install. No vendor-released patch is identified in the available data at time of analysis.
Privilege escalation in the Booking Calendar plugin for WordPress (wpdevelop, cpe:2.3:a:wpdevelop:booking_calendar) in all versions up to and including 11.8.2 lets an authenticated user holding Editor-level capabilities or higher promote themselves to Administrator and seize control of the site. The wpbc_ajax_option_save AJAX action writes an attacker-supplied option name straight into update_option() because the handler's per-option safeguards only cover names explicitly registered via register_option_policy(), so unregistered options - including core WordPress settings - receive an empty policy and skip every can_save, force_mode, and allowed_keys check; an attacker can therefore set default_role=administrator and users_can_register=1 and then register a new administrative account. The embedded nonce check offers no real barrier since both the nonce value and nonce action are attacker-controlled POST parameters and a valid nonce can be fetched from admin-ajax.php?action=rest-nonce; exploitation requires an authenticated Editor+ account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H per our assessment), no public exploit code has been identified at time of analysis.
Privilege escalation in the All-in-One WP Migration and Backup WordPress plugin before 7.111 allows an authenticated user who has been granted the plugin's export capability - but not its import capability - to obtain an installation-wide secret and replay it against the plugin's import AJAX actions, importing an arbitrary site archive and gaining administrator access. Exploitation is not possible against a default install: it requires a non-default configuration in which an administrator has delegated the plugin's export capability to a role that does not also hold import capability, and the target site must run a version older than 7.111. Publicly available exploit code exists (reported via WPScan), making the flaw attractive to attackers who already hold a low-privileged account on a misconfigured site; the independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (high impact, but with a hard configuration prerequisite).
Local privilege escalation in the Acronis Backup integrations for cPanel & WHM, Plesk, and DirectAdmin on Linux allows an attacker who already holds a low-privileged account or shell on the host to tamper with plugin-installed files and directories left with insecure default permissions, gaining high-privilege code execution on the server. The flaw is confirmed actively exploited (CISA KEV) and carries a CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no user interaction is needed and only low privileges are required, though exploitation is gated to hosts where one of the three control-panel plugins is installed and has not yet been upgraded to its fixed build. Because the vector is strictly local, remote attackers cannot reach it directly - they must first obtain a foothold or credentials on the server.
Arbitrary file write and credential disclosure in pgAdmin 4 (versions before 9.18) let any authenticated user holding the tools_backup permission - which is granted to the default User role - run pg_dump with attacker-controlled arguments and connection parameters. Because the Backup tool appended the client-supplied 'database' field to the pg_dump argument vector unvalidated, a value starting with a dash is parsed by getopt_long as an option (for example --file=/absolute/path) and overrides the storage-confined output path, letting files be created or overwritten anywhere the pgAdmin OS account can write; a value containing an equals sign is expanded by libpq into a full connection string that overrides the intended host and port and redirects pg_dump to an attacker-nominated server while the decrypted stored database password is exported in PGPASSWORD. Exploitation requires valid credentials (PR:L, remote, no user interaction) and no public exploit code or confirmed active exploitation has been identified at time of analysis, but the impact is high severity and a fix is available in 9.18.
Elevation of privilege in Dell OpenManage Server Administrator (OMSA) managed nodes running versions prior to 11.1.0.3 lets a network-positioned attacker who already holds high privileges escalate to full control of the managed node, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.2). The underlying weakness is improper privilege management (CWE-269) reachable over the OMSA network management interface with low complexity and no user interaction, affecting Windows managed-node patch installations as well as managed nodes on RHEL 8.10, RHEL 9.4, SLES 15, and Ubuntu 22.04. No public exploit has been identified at time of analysis; the dominant limiting factor is the PR:H precondition, meaning anonymous or low-privileged remote attackers cannot trigger this issue.
Privilege escalation and information tampering in Dell OpenManage Server Administrator versions prior to 11.1.0.3 allow a low-privileged authenticated remote attacker to modify data and gain unauthorized access through improper privilege management. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, base 8.1) indicates network reachability with low attack complexity, requiring only low privileges and no user interaction, and resulting in high integrity and availability impact with no confidentiality loss. No public exploit identified at time of analysis.
Sandbox escape in vm2 through 3.11.6 lets untrusted JavaScript executing inside a NodeVM bypass the configured builtin-module denylist and reach the host filesystem via require('fs/promises') or require('node:fs/promises'), allowing host file creation and modification (confirmed through fsp.writeFile()) plus cp, mkdir, rename, rm, rmdir, truncate and read operations on the host. Exposure is configuration-dependent: only embedders that combine the builtin wildcard with negative entries (for example require: { builtin: ['*', '-fs', '-child_process'] }) are affected, while default configurations and allowlist-style restrictions are not, and no public exploit identified at time of analysis. The flaw is fixed in vm2 3.11.7. Note that the supplied CVSS 4.0 vector carries PR:L while the independent assessment's CVSS 3.1 vector carries PR:N, so authentication requirements are not unambiguously confirmed from available data; exploitation in practice requires only the pre-existing ability to submit sandboxed code.
Sandbox escape in the vm2 Node.js library through 3.11.6 lets untrusted code running inside a NodeVM instance reach the host's child_process builtin and execute operating-system commands whenever the embedding application configures a wildcard builtin require policy containing a node:-prefixed deny entry. The affected configuration (for example new NodeVM({ require: { builtin: ['*', '-node:child_process'] } })) fails to deny the canonical child_process module, so sandboxed code can obtain execSync and spawn via require('child_process') or require('node:child_process'), giving host command-execution capability to code that was supposed to be isolated (CVSS 4.0 base 9.4; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Exploitation requires PR:L privileges in the sense that the attacker must already be able to run attacker-controlled JavaScript inside the sandbox, and it only works under that specific deny-list form; a correctly spelled '-child_process' entry, a non-wildcard allow-list, or not exposing child_process at all avoids the flaw. No public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in Acer System Monitoring, the privileged service bundled with NitroSense and PredatorSense on Acer Nitro and Predator gaming laptops, allows an authenticated local user to interact with the service and perform unauthorized registry modifications that can elevate privileges to SYSTEM. Exploitation requires an existing low-privileged foothold on the machine (PR:L) with no user interaction, and is limited to Acer gaming hardware running the vulnerable OEM software; there is no remote attack path. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so this represents a post-compromise escalation primitive rather than an actively exploited threat.
Local privilege escalation in Acer System Monitoring, a component bundled with NitroSense and PredatorSense on Acer Nitro and Predator laptops, allows an authenticated local user to abuse a privileged Named Pipe service for unauthorized registry operations. Exploitation requires local access and the vulnerable service running, and the vendor rates the exploit as Unproven with no public exploit code identified at time of analysis. Successful abuse could elevate privileges or compromise the host, but realistic risk is confined to machines with these Acer gaming utilities deployed and an attacker already holding a low-privilege foothold.
Local privilege escalation in the Acer Agent Service bundled with Acer NitroSense and PredatorSense lets an authenticated local user on an affected Windows laptop perform unauthorized registry operations through insufficiently controlled access in the service, potentially obtaining higher privileges and compromising the machine. The issue is rated CVSS 7.4 (CVSS v4.0 AV:L/AC:L/AT:N/PR:L/UI:N with High impact across confidentiality, integrity and availability, including subsequent-system impact), and our assessment aligns with a CVSS v3.1 vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, so the practical prerequisite is that the attacker already holds a low-privilege local account on a host where the OEM utility and its privileged service are installed and running. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV (the v4.0 vector carries E:U, 'Unproven' exploit maturity), so this is a genuine local privilege-escalation issue but not an urgent, mass-exploitable one; no EPSS score was supplied in the source data.
Privilege escalation in the PuppyFW WordPress plugin (all versions through 0.4.4) lets any authenticated user, down to a Subscriber, add, modify, and delete arbitrary blog options, which is enough to grant themselves administrative capabilities. The root cause is a REST route that performs its capability check against a capability value supplied in the request itself, so the caller effectively authorizes itself; no user interaction and no special plugin configuration are required. Publicly available exploit code exists, so sites that allow open self-registration are directly at risk, and this is a genuine high-priority issue rather than a theoretical one.
Privilege escalation in the WordPress plugin "Choose User Role at Registration" before 1.3.3 lets an unauthenticated visitor submit a registration request naming any role - including administrator - because the plugin never validates the requested role against the roles the administrator actually configured to be offered; once the pending request is approved, the attacker receives that elevated role. Exploitation requires both non-default features to be enabled (role selection at registration and public/open account registration), and the escalation only completes after a human administrator approves the account, which is why the assessed vector carries AC:H and UI:R despite the network-delivered, unauthenticated (PR:N) request. Publicly available exploit code exists and the vendor has released a patched version, but no confirmed active exploitation (CISA KEV) is associated with this CVE at time of analysis.
Unsigned client-side view state in the djust Python framework (pip/djust, versions before 1.0.7) is restored as trusted state on WebSocket reconnect, allowing an authenticated low-privileged user to tamper with the embedded state_json snapshot and inject arbitrary view attributes such as is_admin, account_id, or balance, achieving privilege escalation and business-state manipulation. The attack is network-reachable, requires no victim interaction, and yields high confidentiality and integrity impact (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), but only affects views that opt into the non-default state-snapshot feature and that store authorization or ownership data in public view attributes. The vendor released djust 1.0.7, which signs snapshots and rejects unsigned or forged snapshots on the back-navigation restore path; no public exploit code was identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV).
Privilege escalation in the remote diagnostics debugger of Cisco Secure Firewall Management Center (FMC) lets an authenticated, remote user turn a valid low-privileged account into root. The flaw is a faulty privilege-level check (CWE-264) applied when a user invokes remote diagnostics, so an attacker who can log into either the web-based management interface or the REST API can enable the debugger service and have it grant them elevated rights; Cisco rates the exploitation path High complexity because it requires a multi-stage sequence rather than a single crafted request (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, 8.5). Because the attacker must already hold valid credentials on the device (PR:L), this is an access-gated escalation and not an unauthenticated entry point; no public exploit code has been identified and the issue is not confirmed as actively exploited (not in CISA KEV), though the scope-change impact (S:C) means a compromise of the debugger context can affect resources beyond the vulnerable component. Affected releases reported through EUVD are FMC 7.7.0, 7.7.10, 7.7.10.1, 7.7.11, 7.7.12, 10.0.0 and 10.0.1.
Heap-based buffer overflow (CWE-122) in HP's HPLIP - the HP Linux Imaging and Printing Software stack shipped as the default printer/scanner driver on most Linux distributions - can be triggered when attacker-influenced data is processed by a vulnerable component, potentially leading to remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification. This is a bundled advisory covering multiple externally reported flaws across several HPLIP components, so the precise prerequisites vary per sub-vulnerability; the vendor assigns CVSS 4.0 score 9.3 (Critical) with a remote, unauthenticated, low-complexity vector, while the independent assessment is more conservative at CVSS 3.1 AV:N/AC:H/PR:N/UI:N, reflecting that the system must be running HPLIP and actually process malicious input. No public exploit code and no confirmed active exploitation were identified at time of analysis.
HPLIP (HP Linux Imaging and Printing Software) is affected by multiple heap-based buffer overflow vulnerabilities (CWE-122) that can lead to remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification. Exploitation requires user interaction, such as a victim performing a print or scan operation or processing attacker-supplied imaging data, but no authentication is needed, and the attack is network-reachable. HP has remediated the issues; no public exploit code has been identified at the time of analysis.
Heap-based buffer overflow and related memory-safety flaws in HP Linux Imaging and Printing (HPLIP) can allow remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification on Linux hosts where HPLIP is installed and the affected component is active. This is an aggregate HP bulletin (hpsbpi04151) that bundles multiple externally reported issues under one CVE, so the published CVSS 4.0 score of 9.3 (AV:N/AC:L/PR:N/UI:N/VC:H/VI:H/VA:H) represents the worst-case component rather than any single flaw, and the assessed CVSS 3.1 score is lower (AV:N/AC:H) because several sub-issues are more likely local than remote and heap exploitation requires reliable memory grooming. No public exploit code or confirmed active exploitation was identified at time of analysis, and the exposure is limited to Linux systems on which HPLIP is deployed rather than being a universal service.
Command injection weaknesses in HP Linux Imaging and Printing Software (HPLIP) allow a local attacker to execute arbitrary operating-system commands with the privileges of the affected HPLIP component, resulting in high confidentiality, integrity, and availability impact (vendor CVSS 4.0 base 8.4) and spanning remote code execution, privilege escalation, denial of service, information disclosure, and unauthorized file modification. Exploitation is not remote: it requires local access to a Linux host that has HPLIP installed and in use, and it requires active user interaction, typically by inducing a legitimate user to feed attacker-controlled input into a vulnerable HPLIP component that builds an OS command (CWE-78). No authentication or elevated privileges are needed (PR:N), and no public exploit code or confirmed active exploitation was identified at time of analysis; HP has released remediation for the affected components in advisory HPSBPI04151.
Heap-based buffer overflows and related memory-safety flaws in HPLIP (HP Linux Imaging and Printing Software) let remote attackers corrupt memory in the print, scan, and device-discovery stack, potentially yielding remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification. Only Linux hosts with HPLIP installed and actively processing attacker-influenced input - a crafted print job, a rogue printer/scanner response, or a file handled by the HPLIP stack - are affected, and exploitation is gated on active user interaction (initiating or accepting the malicious print/scan operation) rather than being a fully autonomous remote exploit. The flaws are unauthenticated per the vendor CVSS vector (PR:N), impact varies depending on which bundled sub-vulnerability is triggered, and no public exploit identified at time of analysis.
Out-of-bounds write flaws in HPLIP (HP Linux Imaging and Printing Software) can corrupt memory when a user processes attacker-influenced input such as a crafted print job, a malicious device or network response, or a handled file, with the affected product confirmed by HP and documented in advisory HPSBPI04151. No authentication is required to reach the vulnerable components, but exploitation depends on mandatory user interaction and on hosts that actually have HPLIP installed and in active printing or scanning use. Worst-case impact spans remote code execution, privilege escalation, denial of service, information disclosure, and unauthorized file modification; no public exploit code or confirmed active exploitation was identified at time of analysis.
Cross-tenant privilege escalation in Shuffle (self-hosted SOAR platform) through version 2.2.1 lets an administrator who holds org-admin rights in any single organization mint and read valid API keys for arbitrary users in other organizations, resulting in full account takeover across tenant boundaries. The flaw is an IDOR/authz bypass (CWE-639) in the HandleApiGeneration endpoint, which accepts a caller-supplied user ID and returns or resets that user's API key without verifying ownership; it is remotely reachable over the network and requires only an authenticated admin account (CVSS:4.0 8.6, PR:L, UI:N, high confidentiality and integrity impact). There is no CISA KEV listing and no public exploit code identified at time of analysis, but exploitation is trivial once any tenant admin account is obtained, and source-verified fix code exists in the upstream shuffle-shared repository.
Incorrect default permissions in Dell Repository Manager (DRM) versions prior to 3.5.2 let an attacker who already holds a low-privileged account on a Windows host abuse misconfigured files, directories, or service resources to escalate to a higher-privileged context. Dell rates this 8.5 (High) with a remote, scope-changing vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H), but our independent assessment scores it 7.8 as a local privilege-escalation issue (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H): exploitation requires an existing foothold on a machine where DRM is installed, is not a default unauthenticated remote scenario, and is limited to systems running DRM below 3.5.2. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has published a fixed release (3.5.2) via Dell security advisory DSA-2026-419.
Authenticated low-privilege users of FileRise before version 3.28.0 can obtain unauthorized read and write access at administrator level through the WebDAV interface by supplying valid Basic-Auth credentials alongside an active administrator PHPSESSID cookie, because the WebDAV layer inherits the elevated privileges of the ambient web session rather than authenticating each request independently as RFC 4918 requires. Exploitation is not trivial and depends on a co-occurring privileged session: the attacker must already hold valid low-privilege credentials (PR:L) and obtain the session cookie of a live administrator session, which is the basis for the high attack complexity (AC:H) in the CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N, base 7.6) and the assessed CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N); availability is unaffected. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at the time of analysis, and the vendor has released FileRise 3.28.0, whose changelog describes refined, more consistent WebDAV request handling.
Sandbox escape in the Avast/AVG/Norton sandbox minifilter driver (aswSnx.sys) on Windows allows an authenticated, low-privileged process already executing inside the sandbox to break file isolation and escalate to SYSTEM (CVSS 8.8, AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, CWE-281). The driver opens the virtualization target with only GENERIC_WRITE and FILE_WRITE_ATTRIBUTES, omitting WRITE_DAC, so every attempt to reapply the original DACL fails silently and virtualized copies of sensitive files are left with permissive permissions; the IRP_MJ_CREATE handler additionally fails to strip WRITE_DAC for sensitive directories, letting a sandboxed process rewrite the security descriptor of a virtualized object, read the virtualized SAM copy, extract local NTLM hashes and run code as SYSTEM. Publicly available exploit code exists (the PrettyPrague proof of concept), the vendor has released patches for the affected Avast, AVG and Norton products, and no CISA KEV entry indicates confirmed active exploitation.
Authenticated non-guest users of Curiosity Workspace can escalate their privileges to administrator within an existing access group without an invitation or approval, as reported in CVE-2026-88817. The vendor rates this as high severity (CVSS 4.0 score 8.7), and our independent assessment confirms the impact is limited to the targeted access group-it does not grant application-wide administrator rights or root access to the host. No public exploit has been identified at the time of analysis, and a vendor advisory is available with potential remediation guidance.
Kernel crashes or potential privilege escalation can occur in uniprocessor (non-SMP) Linux kernels when a BPF program executing in NMI context reaches the free_pages_nolock() path, due to an unsafe spin_trylock() call. This vulnerability affects only systems built with CONFIG_SMP=n, and while the alloc-side equivalent was already fixed, the free side remained vulnerable. No public exploit has been identified at time of analysis; the vendor did not reproduce the crash but acknowledges a probable privilege escalation impact, though our assessment rates availability impact as high and integrity impact as low.
A local privilege-escalation use-after-free exists in the Linux kernel perf subsystem: an unprivileged local user can win a tight race between perf_mmap_close() and a concurrent perf_mmap_rb() revival so that a freshly revived ring buffer is freed while another process still has it mapped, yielding page-level memory corruption and a path to root. The bug is reachable under the default kernel.perf_event_paranoid=2 setting (authenticated local account per the CVSS vector PR:L, no user interaction), so hardening the setting or restricting perf_event_open is the practical interim control. Vendor-released patches are available (6.18.52, 7.2.5, 7.3-rc2), the EPSS score is low at 0.19% (9th percentile), and no public exploit code has been identified at time of analysis - but exploitation is local-only and probabilistic, requiring repeated attempts to hit the TOCTOU window.
Privilege escalation in the Tutor LMS WordPress plugin (versions 2.7.1 up to but not including 4.0.8) lets the holder of a read-only Tutor LMS REST API key act with the full privileges of the administrator account that issued that key, producing high confidentiality, integrity and availability impact and, in practice, complete takeover of the affected WordPress site. Exploitation is authenticated in the sense that the attacker must already hold a valid API credential provisioned by a site administrator - obtained through grant, leak, or capture - after which no further user interaction is required; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.2 as published with PR:H). Publicly available exploit code exists and WPScan has published the vulnerability record, but there is no indication of confirmed active exploitation (not in CISA KEV); EPSS is low at 0.17% (7th percentile), suggesting limited observed exploitation activity despite the severity of impact once a key is held.