Privilege Escalation
Monthly
Privilege escalation in IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 allows an authenticated low-privileged user to gain unauthorized access to protected data and functionality when the Liberty collectives feature is in use. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms network-exploitable, low-complexity exploitation requiring only low-level authentication with no user interaction - resulting in high confidentiality and integrity impact. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available.
Privilege escalation in Semaphore UI allows an authenticated project manager to gain owner-level project control by exploiting a role-shadowing flaw in the custom role creation API. Affected versions prior to 2.18.19 and between 2.19.0-alpha3 and 2.19.5-beta5 permit a project manager to POST a custom role with a slug matching a built-in role name and bitmask 15, causing the middleware to resolve the database-backed custom role instead of the protected built-in, thereby granting CanUpdateProject and CanManageProjectUsers capabilities reserved for owners. No public exploit code has been identified at time of analysis and this CVE is not listed in CISA KEV, but the low exploitation complexity (AC:L, single API call, no special configuration) and high CVSS impact (8.8) make upgrading urgent for any deployment with untrusted project managers.
Path traversal in SSH.NET's ScpClient.Download() enables a malicious, compromised, or man-in-the-middle SCP server to write arbitrary files anywhere the client process has write access during recursive directory downloads. All SSH.NET NuGet package versions up to and including 2025.1.0 are affected; the vulnerability is analogous to CVE-2019-6111 in OpenSSH but extends to directory traversal. No public exploit code or CISA KEV listing has been identified at time of analysis, though the integrity impact is high given the file-write primitive can overwrite SSH authorized keys, shell rc files, or application binaries.
Privilege escalation in JFrog Artifactory enables an authenticated Project Resource Manager to acquire broader administrative privileges under unspecified triggering conditions. The flaw, rooted in CWE-269 (Improper Privilege Management), violates role boundary enforcement within Artifactory's access control system, potentially granting full control over repositories, artifacts, and platform configuration. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at the time of analysis, though the CVSS 7.2 High score with full confidentiality, integrity, and availability impact underscores the post-exploitation risk.
Privilege escalation in RustFS prior to version 1.0.0-beta.11 allows any authenticated user holding CreateServiceAccountAdminAction to create a root-parented service account by supplying an arbitrary target_user to the AddServiceAccount API, because the handler validates only the permission and never enforces scope - and prepare_service_account_auth automatically grants is_owner status to root-parented accounts. The resulting credential provides full owner-level access to all objects in the distributed storage cluster. No active exploitation has been confirmed (no CISA KEV listing), but the complete attack path is publicly documented in the fix PR, substantially lowering the exploitation barrier.
Local kernel privilege escalation and denial of service in NetBSD's hdaudio(4) driver arise from two compounding flaws: the /dev/hdaudioN device nodes enforce no access control, allowing any unprivileged local user to invoke HDAUDIO_FGRP_SETCONFIG, and the detach path in hdafg_detach() is not race-safe against concurrent DMA activity. A two-thread attack - one repeatedly reconfiguring the audio function group, one keeping DMA and IRQs live - wins a use-after-free race where a latched DMA interrupt dereferences a freed callback pointer, producing outcomes from audio-subsystem crashes and kernel panics to potential kernel-level privilege escalation. A public proof-of-concept is available, and no specific patched release version has been confirmed, leaving remediation dependent on source-level kernel rebuilds.
Privilege escalation and account takeover in the Events Manager WordPress plugin before 7.4.1 lets unauthenticated attackers reset passwords, promote accounts to Administrator, or delete accounts whose user ID collides with the ID of one of the plugin's own posts. The flaw stems from the plugin overriding WordPress's own capability decisions for unrelated privileged user actions. Publicly available exploit code exists (WPScan), EPSS is a notable 15%, and SSVC rates it automatable with total technical impact, though it is not currently listed in CISA KEV.
Confused-deputy privilege escalation in snowflake.core (Snowflake Python API) prior to version 1.13.0 enables attackers with low-privileged access to a downstream application to perform unauthorized Snowflake operations under the application's higher-privileged session. Two related input-sanitization weaknesses make this possible: path traversal via unencoded `..` segments in REST URL paths (CWE-22), and HTTP parameter pollution via injected `&`, `#`, or `=` characters in query strings (CWE-141), either of which can subvert swap, clone, or rename operations against unintended resources. No public exploit code has been identified at time of analysis and no CISA KEV listing is confirmed; the vendor-released fix is snowflake.core 1.13.0, available on PyPI and requiring manual upgrade.
Unauthorized cross-tenant Secret and ConfigMap access in the multicloud-operators-channel component of Red Hat Advanced Cluster Management for Kubernetes 2 allows a compromised managed-cluster agent to read all Secrets and ConfigMaps within any Channel namespace on the hub cluster. The Changed scope (S:C) in the CVSS vector confirms that exploitation pivots from a managed cluster context into the hub, exposing Git and Helm repository credentials belonging to other tenants. No public exploit has been identified at time of analysis, but the network-reachable, low-privilege vector makes this a high-priority finding in any multi-tenant RHACM deployment.
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (multicloud-integrations / ArgoCD pull-model integration) lets a low-privileged hub tenant who can create Application CRs redirect propagation to arbitrary managed spoke clusters. Because the Application propagation controller trusts the attacker-supplied `ocm-managed-cluster` annotation without validation, an attacker forces ArgoCD on targeted spokes to sync attacker-controlled manifests, yielding code execution or privilege escalation there. CVSS 9.9 with scope change; no public exploit identified at time of analysis and it is not listed in CISA KEV.
AcyMailing WordPress plugin (all versions through 10.11.1) allows authenticated attackers with subscriber-level access to exploit an authorization bypass and silently overwrite the BCC field of the plugin's core notification template, redirecting all subsequent WordPress password-reset emails - including those for administrator accounts - to an attacker-controlled address. By then triggering the standard WordPress lost-password flow for any account, the attacker intercepts the one-time reset token and achieves full site administrator compromise without any victim interaction. No public exploit code or CISA KEV listing exists at time of analysis; exploitation is gated by a non-default plugin configuration that partially narrows the real-world attack surface below what the CVSS 8.8 score implies.
Sandbox escape in Cursor IDE for macOS (versions prior to 3.0.0) allows a malicious or prompt-injected AI agent operating in Auto-Run Sandbox mode to break container isolation by invoking the Dev Containers CLI to launch a privileged Docker container that mounts the host's virtiofs0 virtual filesystem. This grants the agent unrestricted read and write access to the user's entire home directory and enables arbitrary command execution at the user's privilege level - all without any additional permission prompt to the user. No public exploit code has been identified at time of analysis; a vendor-released patch is available as version 3.0.0.
Privilege escalation in Adobe Commerce and Magento Open Source (including Adobe Commerce B2B) lets a remote attacker gain elevated access to sensitive resources through an incorrect authorization flaw, with no user interaction required. All supported branches from 2.4.4 through 2.4.9 (and B2B 1.3.3-1.5.3) prior to the August 2026 patch set are affected, and the CVSS 9.1 rating reflects high confidentiality and integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but as an unauthenticated, low-complexity authorization bypass in a widely deployed storefront platform it warrants urgent patching.
Privilege escalation in Windows App Installer (the App Installer component of Windows Package Manager, aka winget) allows an authenticated local attacker with standard user privileges to fully compromise confidentiality, integrity, and availability of the affected system. The flaw stems from improper privilege management (CWE-269), meaning the application fails to correctly enforce privilege boundaries during its operations. No active exploitation is confirmed - CISA KEV does not list this CVE, SSVC rates exploitation as 'none', and EPSS sits at only 0.33% (26th percentile) - but the SSVC technical impact rating of 'total' reflects the severity of a successful local privilege escalation to full system control.
Privilege escalation in Microsoft High Performance Computing (HPC) Pack allows a network-authenticated attacker with low-privilege access to elevate privileges to a higher level, potentially achieving full system compromise. The flaw stems from CWE-250 (Execution with Unnecessary Privileges), meaning a component within HPC Pack runs with more rights than its function requires, providing a lever for a legitimately authenticated user to abuse. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, but the CVSS 8.8 score and full C/I/A impact triad indicate a serious risk in any environment where untrusted low-privilege users have network access to HPC Pack services.
Privilege escalation in Microsoft PowerShell 7.4.x, 7.5.x, and 7.6.x stems from incorrect default permissions (CWE-276), enabling a locally authenticated low-privilege attacker to gain full system control. Exploitation requires local shell access and a user interaction trigger - an already-privileged user or process must execute PowerShell after the attacker has tampered with an incorrectly permissioned file or directory. No public exploit code and no active exploitation have been identified; SSVC confirms exploitation status as none and the attack is not automatable. Microsoft has released patched versions across all three affected branches.
Privilege escalation in Adobe ColdFusion 2023 and 2025 allows a low-privileged local user to gain unauthorized read and write access through an Incorrect Authorization flaw (CWE-863). Exploitation requires only a low-privileged local account and no user interaction, yielding full confidentiality, integrity, and availability impact on the affected system. Adobe has published advisory APSB26-90; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Adobe ColdFusion 2023 and 2025 allows a low-privileged authenticated attacker to gain unauthorized read and write access beyond their authorized security scope by exploiting improper input validation in file processing. The attack requires social engineering - a victim with higher privileges must open a specially crafted malicious file - after which the attacker's effective permissions cross security boundaries (scope change, S:C) to reach resources outside the original ColdFusion component. No public exploit or CISA KEV listing has been identified at time of analysis, though the high CVSS score of 8.7 and scope-change impact warrant prompt remediation per Adobe advisory APSB26-90.
Privilege escalation in the Alias Checking Trusted Module (ACTM) firmware for certain Intel Xeon processors allows a local privileged attacker to escalate to System Management Mode (SMM) execution, achieving high confidentiality and integrity impact across both the directly compromised system and subsequent systems such as co-hosted hypervisors or tenant workloads. The attack requires high-complexity local technique combined with pre-existing privileged user access, placing it firmly in the advanced persistent threat actor category. No public exploit has been identified at time of analysis, and Intel has published advisory INTEL-SA-01439 to address this firmware flaw.
Privilege escalation in Intel PROSet/Wireless WiFi Software for Windows allows local unprivileged code operating within the Ring 2 privileged process boundary to elevate access rights due to improper privilege management (CWE-269), yielding high availability impact and limited confidentiality and integrity exposure on both the vulnerable and subsequent systems. The attack is constrained to local access and requires high complexity, but no prior authentication or user interaction is needed from the attacker. Intel has published advisory INTEL-SA-01468 to address this flaw; no public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Improper authentication (CWE-287) in Intel's Trust Domain Extensions (TDX) module allows a Ring-0 system software adversary with high privileges to breach Trust Domain isolation boundaries, enabling information disclosure and privilege escalation. Affects select Intel platforms running TDX with a high-complexity, locally-executed attack path - no user interaction required. No public exploit identified at time of analysis, but the confidential-computing trust model is fundamentally undermined if exploited: an adversary with hypervisor-level access could read or modify memory intended to be protected from exactly that privilege tier.
Privilege escalation in Intel PROSet/Wireless WiFi Software for Windows exposes local systems to code execution by unprivileged attackers via a Ring 2 (device driver layer) improper access control flaw. Any local process with no privileges required and no user interaction can leverage the driver's failure to enforce access boundaries to achieve local code execution, with follow-on high confidentiality impact on the broader system - consistent with a kernel-level scope change. No public exploit identified at time of analysis, and no CISA KEV listing; however, the low complexity and zero-privilege requirement make this a credible post-compromise escalation vector for threat actors with any form of local code execution already established.
Out-of-bounds read in Intel PROSet/Wireless WiFi Software at the Ring 2 device driver layer allows adjacent network attackers without authentication to escalate privileges on affected Windows systems. The flaw, tracked under CWE-125, can be triggered by a low-complexity attack from the same WiFi segment or Layer 2 broadcast domain, requiring no user interaction, and yields High availability impact alongside Low confidentiality and integrity exposure. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV, but the unauthenticated adjacent attack surface is meaningful for enterprise mobile workforces on untrusted networks.
Improper access control within Ring 3 (user application space) of Intel processors permits privilege escalation from authenticated local user-level access to higher system privilege levels, with high confidentiality and integrity impact on the vulnerable system. Exploitation demands local access, low-privilege authentication, high attack complexity, and specialized internal knowledge of Intel processor microarchitecture internals - substantially narrowing the realistic attacker population. No public exploit code has been identified and no CISA KEV listing exists at time of analysis, consistent with a threat relevant primarily to sophisticated, targeted adversaries.
Privilege escalation in CamaleonCMS 2.9.2 and earlier allows any authenticated low-privileged user to overwrite administrator passwords and achieve full site takeover via a parameter confusion flaw in the UsersController's updated_ajax endpoint. The authorization filter and the action body each resolve the target user from a different parameter key, enabling an attacker to pass their own ID to satisfy the self-authorization check while simultaneously directing the mutation at any victim account. No public exploit tool has been identified at time of analysis, but the upstream fix commit is available on GitHub (PR #1185, commit 2634503), with a formally tagged patched release not yet independently confirmed.
Local privilege escalation in Siemens License Server (SLS) versions prior to V5.1 allows a local attacker with elevated operating system privileges to execute arbitrary commands and write malicious files as root, resulting in full system compromise. The root cause is an insecure sudoers policy (CWE-732) that grants overly permissive command execution rights, enabling abuse of sudo rules to break out of intended privilege boundaries. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high-integrity and high-confidentiality impact on the vulnerable system underscores urgency for organizations running SLS in multi-user or shared infrastructure environments.
Server-Side Request Forgery in the OpenShift Console Helm catalog proxy allows low-privileged namespace tenants to plant a malicious ProjectHelmChartRepository resource pointing to an attacker-controlled URL, causing the console pod to issue server-side fetches that bypass tenant egress restrictions. Combined with Helm catalog metadata poisoning and subsequent admin-mediated chart installation, this multi-stage attack chain enables privilege escalation within the cluster. No CISA KEV listing or public exploit code has been identified at time of analysis, though the CVSS Scope:Changed rating correctly reflects that the console pod's cross-boundary requests extend impact beyond the originating namespace.
Privilege escalation in Authentik Security authentik through version 2026.5.6 allows an attacker holding a source-scoped SCIM provisioning token to take over any local account, including superuser accounts, by provisioning a SCIM user whose username matches an existing account. The SCIM user ingest function adopts pre-existing local accounts by username without enforcing scope boundaries, meaning a limited-privilege provisioning credential can rewrite or delete accounts entirely outside its intended scope. No public exploit has been identified at time of analysis, but the attack requires only network access and a valid SCIM token, making the exploitation bar low for any attacker who has obtained such a credential.
Privilege escalation in Authentik Security authentik through 2026.5.6 allows any holder of a source-scoped SCIM provisioning token to seize superuser control over the entire Identity Provider and permanently lock out all legitimate administrators. The root cause is the SCIM group ingest function's failure to validate whether the requesting token's source scope has authority over the target group - when an attacker provisions a SCIM group whose name matches an existing administrator group, authentik silently adopts and replaces that group's membership without authorization checks. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but the high CVSS score of 8.8 and the total-takeover impact warrant immediate remediation.
Privilege escalation in the `openvt -u` utility allows a local low-privileged attacker to obtain passwordless root login on Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. The flaw lies in `authenticate_user()`, which resolves VT ownership via `stat("/proc/<pid>/fd/0")` - a call that follows the symlink to the underlying TTY device node rather than inspecting the owning process, causing the check to read the device node's UID rather than the process owner's UID. When a privileged user logs out and TTY device node ownership reverts to root or the getty owner while an attacker's process still holds fd 0 on that TTY, the check incorrectly authorizes a passwordless `login -f root` execution. No public exploit is identified at time of analysis and there is no CISA KEV listing, but the root-level impact makes this a high priority for environments using the affected `kbrequest`/init deployment pattern.
Privilege escalation in MRTG (Multi Router Traffic Grapher) allows a local low-privileged attacker to gain elevated file ownership on the host system. When the MRTG daemon is launched as root and then drops privileges, a CWE-59 symlink-following flaw in PID file handling lets an attacker pre-place or manipulate a symlink at the expected PID file path, causing the root process to change ownership of an arbitrary existing file to the daemon user. Affected platforms include Red Hat Enterprise Linux 6 through 10; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution via improper input validation in a VAPIX API parameter on Axis OS affects Axis network camera and edge device deployments. An attacker holding administrator-privileged service account credentials can send a crafted API parameter to trigger the flaw, execute arbitrary code on the device, and potentially escalate to higher privileges. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the full-impact CVSS score of 7.2 with network attack vector and high C/I/A ratings reflects the severity of a successful post-authentication compromise.
Privilege escalation via untrusted pointer dereference in ASUS GPU Tweak III, GPU Tweak II, AI Suite 3, and VGAdll exposes local attackers to arbitrary kernel memory writes through vulnerable IOCTL handlers in the associated kernel-mode drivers. The flaw (CWE-822) permits a caller supplying an attacker-controlled pointer to force the driver to write a specific value to an arbitrary memory address, enabling elevation of privileges. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the high CVSS 4.0 score of 8.4 and confirmed arbitrary-write primitive make this a meaningful local privilege escalation risk on affected systems.
Privilege escalation in libvirt's `virFileChownFiles()` function allows a process confined to the `swtpm` system user to coerce the root-level libvirtd daemon into reassigning ownership of any arbitrary file on the host to the `swtpm` user. The attack exploits a symlink-following flaw (CWE-59) in directory traversal logic that runs with root privileges, affecting libvirt as packaged across Red Hat Enterprise Linux 6 through 10 and RHEL for Nvidia 26. No public exploit has been identified at time of analysis, but the attack complexity is low once `swtpm`-user execution is obtained.
Privilege escalation in Red Hat OpenShift AI's training-operator enables any user holding a standard Kubernetes edit or admin role in any cluster namespace to break out of namespace isolation, impersonate service accounts, access the host filesystem, and achieve remote code execution. The root cause is a design flaw: the operator aggregates training job permissions onto native Kubernetes built-in ClusterRoles, and allows unrestricted PodTemplateSpec passthrough - meaning users can submit training jobs containing arbitrary pod configurations such as hostPath mounts or elevated service account tokens. No public exploit code or CISA KEV listing was identified at time of analysis, but the low access complexity and the broad availability of edit/admin roles in typical ML platform deployments make this an urgent remediation priority.
Privilege escalation in odh-dashboard, the web interface for Red Hat OpenShift AI (RHOAI), allows any authenticated dashboard user to gain cluster-admin or other highly privileged roles by manipulating the roleRef field when creating RoleBindings. The system performs no server-side validation on the roleRef value supplied through the dashboard, enabling an attacker holding only a standard user account to bind themselves to arbitrary Kubernetes ClusterRoles. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the CVSS 8.8 score and the direct, low-complexity path to cluster-admin access make this a high-priority remediation target for any RHOAI deployment.
Privilege escalation in odh-dashboard (Red Hat OpenShift AI) allows an attacker who has obtained the dashboard's Service Account token to abuse overly broad SA permissions and elevate to cluster-administrator level. Exploitation grants full access to secrets, credentials, and keys across the entire OpenShift cluster, while also breaking multi-tenant isolation between workloads. No public exploit code has been identified at time of analysis, and this CVE is not in CISA KEV, but the CVSS score of 8.8 and cluster-wide blast radius make it a high-priority remediation target for RHOAI deployments.
MySQL DSN parameter injection in Red Hat OpenShift AI's Data Science Pipelines Operator (DSPO) allows a namespace editor to enable the MySQL LOCAL INFILE feature via the unvalidated spec.database.customExtraParams field, enabling exfiltration of sensitive files - including Kubernetes service account tokens - from the operator pod. An attacker who exploits this can leverage the stolen token to impersonate the operator's service account and escalate privileges to cluster-admin level within the OpenShift cluster. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Overprivileged ClusterRole assignments in Red Hat OpenShift AI's Data Science Pipelines Operator (DSPO) create a cluster-wide privilege escalation path if the operator pod is compromised. The DSPO ClusterRole grants capabilities well beyond operational necessity - including pod exec and cluster-wide RBAC management - directly violating the principle of least privilege (CWE-250). Successful exploitation of a compromised DSPO pod would allow an attacker to assume full administrative control over the entire Kubernetes cluster; no public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS scope-change flag (S:C) confirms the blast radius extends far beyond the initial compromise boundary.
Privilege escalation to root in Dokploy (self-hosted PaaS) versions 0.29.2 through 0.29.12 lets a low-privilege organization member who has access to a single application escalate to full host command execution. Because schedule.create/schedule.update derive the internal serviceId from applicationId or composeId but only enforce the owner/admin host-schedule gate in the alternate branch, a member can bind their applicationId to a 'dokploy-server' (host-level) schedule and execute an arbitrary supplied script as root via schedule.runManually. No public exploit identified at time of analysis; fixed in 0.29.13.
Privilege escalation to host root in Dokploy self-hosted PaaS versions prior to 0.29.13 allows any authenticated organization member to hijack WebSocket terminal and log-streaming handlers that authenticate the session but never check the role/permission model enforced elsewhere. Because these handlers can open an interactive shell into any container - including the Dokploy container that mounts the Docker socket - a low-privileged tenant can obtain root on the host and cross every tenant boundary. No public exploit identified at time of analysis, though the upstream fix commit and a regression test are public. The CVSS is 9.9 driven by scope change and full CIA impact.
Privilege escalation in Apache Ranger versions 2.8.0 and earlier allows an attacker to elevate their effective permissions by manipulating a URL parameter, undermining the very access-control layer Ranger is meant to enforce across Hadoop-ecosystem services. Apache rates it CVSS 9.8 with a network, low-complexity, no-privilege vector, though the 'privilege escalation' framing implies a pre-existing foothold that is worth verifying. There is no public exploit identified at time of analysis, and the EPSS score is low (0.19%, 9th percentile), indicating no observed mass-exploitation activity yet.
Incorrect default permissions in Samsung Bixby prior to version 4.0.86.0 allow a local attacker with low privileges to execute arbitrary commands within the Bixby process context. The flaw exists in the out-of-box permission configuration - no special user-triggered setup is required to be vulnerable. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the local privilege escalation to Bixby's execution context presents meaningful risk for shared-device and enterprise fleet environments.
Privilege escalation in the Vitepos WordPress point-of-sale plugin allows any user holding the custom Outlet Manager role to reset the password of any WordPress account - including site administrators - and achieve full account takeover. The flaw stems from a missing per-target authorization check in the password-reset API endpoint, combined with the plugin granting the Outlet Manager role overly broad reset capabilities by default. A publicly available proof-of-concept exists per WPScan, though EPSS remains low (0.13%, 3rd percentile), suggesting exploitation has not yet been observed at scale.
Unauthenticated account takeover in the FoodBoxBooker WordPress plugin (versions before 1.0.7) lets remote attackers reset the password of any user - administrators included - because the plugin fails to properly validate password-reset requests. Successful exploitation yields full administrative control and effective site takeover. Publicly available exploit code exists; the flaw is not listed in CISA KEV and EPSS is low (0.15%, 4th percentile), indicating no confirmed mass exploitation yet.
Local privilege escalation in Kingston FURY CTRL RGB Control Software 2.0.65.0 allows a low-privileged local user to gain full system-level access through the NTIOLib_KSFX.sys kernel driver component. The driver's privilege management is improperly implemented (CWE-269), enabling manipulation that elevates attacker control without requiring user interaction or elevated starting privileges. A public proof-of-concept exploit has been released via Google Drive, and the vendor did not respond to disclosure - meaning no patch exists and the exploit is freely usable against unmitigated systems.
Unauthenticated privilege escalation to full site takeover in the AI Copilot - Content Generator plugin for WordPress (all versions through 1.5.6) lets remote attackers create an administrator account by saving and executing a malicious workflow whose wp_create_user action node specifies role=administrator. The plugin's only authorization barrier is a waic-nonce that is publicly emitted into frontend JavaScript (WAIC_DATA.waicNonce) on any page rendering the [aiwu-form] shortcode or public chatbot, so the nonce check provides no real protection. Reported by Wordfence with CVSS 9.8; no public exploit identified at time of analysis, but exploitation is trivial once the shortcode or chatbot is on a public page.
Privilege escalation in the XML-RPC API of Plesk before 18.0.80 allows an authenticated reseller-level account to obtain a fully administrative session for the root user, effectively taking over the entire hosting server. The flaw is a CWE-269 improper privilege management issue reported through HackerOne; no public exploit has been identified at time of analysis and it is not listed in CISA KEV. Because a reseller can cross the privilege boundary to root with low attack complexity, this is a high-impact server-takeover vector in multi-tenant hosting environments.
Privilege escalation in Sonatype Nexus Repository 3 allows an authenticated user holding privilege-management rights to elevate their own access to full administrator by exploiting a type-confusion flaw (CWE-843) in the REST privilege update endpoint. Exploitation is constrained to specific role configurations, but the network-accessible attack surface and high confidentiality and integrity impact (VC:H/VI:H per the CVSS 4.0 vector) make this a meaningful insider or compromised-account risk in enterprise DevOps environments. A vendor-released patch is available in the Nexus Repository 3.95.0 release; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Subscriptions for WooCommerce WordPress plugin (before 2.0.1) is reachable by any authenticated Shop Manager through a missing capability check on a nonce-protected AJAX action that installs and activates arbitrary plugins from user-supplied slugs. Shop Managers, who by WordPress design are not granted plugin management capabilities, can exploit this gap to install a malicious plugin and achieve full server-side code execution. A publicly available proof-of-concept exists; however, EPSS is low (0.18%, 8th percentile) and the vulnerability is absent from CISA KEV, indicating exploitation remains opportunistic rather than widespread.
Local privilege escalation in PowerISO 9.3.0.0 on Windows exposes low-privileged local users to full system compromise via the scdemu.sys kernel driver's improper privilege management (CWE-269). The exploit - publicly detailed as arbitrary registry write or deletion through the driver's IOCTL interface - allows elevation to SYSTEM-level control with high confidentiality, integrity, and availability impact on the vulnerable host. No vendor patch exists; the vendor did not respond to responsible disclosure, and a public proof-of-concept has been released, lowering the skill threshold for exploitation.
Local privilege escalation in udisks2 exploits insufficient polkit authorization on the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method, allowing a low-privileged user with an active console session to spoof the 'as-user' parameter and mount filesystems on behalf of arbitrary users, including root. The attack specifically leverages fstab entries carrying 'user' or 'users' mount options, which are common on desktop Linux installations, to bypass the authorization check entirely. A vendor-released patch exists in udisks 2.11.2; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in OpenReception's appointment booking platform (versions prior to 1.0.2) lets any TENANT_ADMIN promote an account to platform-wide GLOBAL_ADMIN with a single PUT request to the staff role-update endpoint. Because no policy check enforces that only an existing GLOBAL_ADMIN may grant that role, schema validation alone acts as the authorization gate, and after re-login the attacker's JWT carries platform-wide control over every tenant. No public exploit identified at time of analysis, but the fix is a one-line authorization guard, making the flaw trivially reproducible for anyone reading the GHSA advisory or patch commit.
Privilege escalation in Google Chrome's Contextual Tasks feature (prior to 151.0.7922.109) allows a remote attacker to escalate privileges by luring a victim to a crafted HTML page that delivers insufficiently validated untrusted input. The vulnerability carries a CVSS 8.8 score, reflecting high confidentiality, integrity, and availability impact with no prior authentication required from the attacker. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the low attack complexity and Chrome's ubiquitous deployment surface make prompt patching a priority.
OS-level privilege escalation in Google Chrome's Windows CredentialProvider component allows a local attacker to gain elevated system privileges by winning a race condition triggered via a malicious file. Affected are all Chrome for Windows builds prior to 151.0.7922.109. No public exploit code has been identified and CISA has not added this to the Known Exploited Vulnerabilities catalog, but the SSVC assessment rates technical impact as total, meaning successful exploitation yields full system compromise.
Local privilege escalation in Sophos Endpoint for macOS (before 2026.1.1) and Sophos Home for macOS (before 10.11.6) allows any local user to execute arbitrary code with root privileges. The flaw stems from improper authorization (CWE-285) in the security agent's privileged components, so a low-privileged or unprivileged local account can fully compromise the host. No public exploit identified at time of analysis, but the CVSS 9.3 rating and scope change to root make this a high-priority patch for macOS fleets.
Privilege escalation in the Frontend Admin by DynamiApps WordPress plugin (versions up to and including 3.29.10) lets remote unauthenticated attackers elevate their privileges, per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H vector rated 9.8 Critical. The flaw (CWE-266, Incorrect Privilege Assignment) stems from the plugin's frontend user-management forms exposing role/capability assignment without proper authorization, enabling an attacker to gain administrator-level access to the WordPress site. No public exploit identified at time of analysis and the CVE is not on CISA KEV, but the CVSS profile indicates trivially weaponizable network-based abuse.
Privilege escalation in Order Delivery Date for WooCommerce (versions ≤ 4.6.0) allows authenticated shop managers to exceed their intended role boundaries and gain elevated administrative access to the WordPress installation. Exploitation requires an existing shop manager account, confirmed by the CVSS:3.1 PR:H metric, limiting the attack surface to environments where untrusted or compromised accounts hold that role. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Unauthenticated privilege escalation in the AIWU (AI Copilot Content Generator) WordPress plugin versions 1.5.6 and earlier allows remote attackers with no authentication to gain elevated privileges within the WordPress site. Reported by Patchstack and tracked as EUVD-2026-53963, the flaw carries a CVSS 9.8 rating driven by network-reachable, no-interaction exploitation with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Editor-level privilege escalation in the PublishPress Capabilities WordPress plugin (versions ≤ 2.45.0) enables authenticated users holding an Editor role to exceed their intended permission boundary and gain unauthorized elevated capabilities. The root cause is incorrect privilege assignment (CWE-266) within the plugin's capability management logic, and with a CVSS base score of 7.2 (High) reflecting high impact across confidentiality, integrity, and availability, the flaw is most dangerous on multi-tenant or agency WordPress sites where Editor accounts are distributed to semi-trusted users. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the Forminator WordPress plugin (≤1.56.0) allows authenticated Contributor-level users to elevate their privileges to a higher role, potentially achieving administrative control over the WordPress installation. The flaw, rooted in CWE-266 (Incorrect Privilege Assignment), carries a CVSS score of 8.8 and a full High C/I/A impact rating, indicating that successful exploitation can result in complete compromise of confidentiality, integrity, and availability of the affected site. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-privilege entry bar and network accessibility make this an elevated priority for WordPress deployments using this plugin.
Privilege escalation in the Kadence WooCommerce Email Designer WordPress plugin (all versions up to and including 1.5.19) lets unauthenticated remote attackers gain elevated privileges due to a missing authorization check (CWE-862). Reported by Patchstack and tracked as EUVD-2026-53939, the flaw carries a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) rating, so no login or user interaction is required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is not confirmed in the wild.
Privilege escalation in WSO2 API Manager and related Carbon-based products allows a low-privileged user, using a validly issued token, to invoke product-level Admin REST APIs that should be restricted, potentially resulting in full administrative account takeover. The flaw stems from insufficient scope/privilege restriction on issued tokens (CWE-269) and affects API Manager, API Control Plane, Universal Gateway, Traffic Manager, and the Carbon REST API common/utility components. No public exploit identified at time of analysis; exploitation requires the attacker to already hold a low-privileged account and obtain a token for it.
Local privilege escalation in the NI-PAL kernel driver allows a low-privileged authenticated Windows user to escalate to SYSTEM-level and execute arbitrary code, as confirmed by the NI vendor advisory. Affected deployments include NI-PAL versions 26.3.1 and all prior releases running exclusively on Microsoft Windows. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog, but the low access complexity (AC:L, AT:N in CVSS 4.0) means exploitation requires no special conditions beyond a local user session.
Privilege escalation in Progress MarkLogic Server (versions before 11.3.6 and 12.0.3) lets an authenticated user holding only a low-privileged Hadoop integration role break out of that role and perform privileged operations against the internal Security database, effectively enabling full control over authentication and authorization data. Rated CVSS 9.9 with a changed scope, the flaw turns a minimal Hadoop-connector account into an administrative foothold. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation in Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user holding only a low-privileged REST role to abuse the REST API document patch operation, gaining the ability to run privileged operations against the internal Security database and effectively take over authorization data. Rated CVSS 9.9 with a changed scope, it is exploitable by any low-privileged REST account over the network. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and minimal privilege requirement make it a high-priority patch.
Privilege escalation in Progress MarkLogic Server before 11.3.6 and 12.0.3 lets an authenticated user holding only a low-privileged REST role elevate to administrator through the SQL, SPARQL, and Optic REST query interfaces, after which they can run privileged operations and read data they were never authorized to see. The flaw is remotely reachable and requires only valid low-tier credentials, driving a critical 9.9 CVSS score. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation in Progress MarkLogic Server's REST API document processing pipeline allows an authenticated user holding an administrative REST role to elevate their access to a higher privilege level, resulting in unauthorized disclosure of sensitive server-side data. Affected versions span both the 11.x and 12.x release trains, patched in 11.3.6 and 12.0.3 respectively per the vendor's August 2026 critical security bulletin. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, though the scope change (S:C) and high confidentiality and integrity impact in the CVSS vector underscore meaningful post-exploitation consequence within the MarkLogic environment.
Privilege escalation in Google SecOps (Chronicle SOAR) versions prior to 6.3.85 on Google Cloud Platform allows an authenticated attacker to forge a crafted internal authentication header and elevate from a low-privileged account to system-level administrative access. The flaw stems from improper validation of the origin/trust of an internal auth header (CWE-346), and carries a critical CVSS 4.0 base score of 9.4 driven by high confidentiality, integrity, and availability impact plus a scope change onto subsequent systems. There is no public exploit identified at time of analysis; Google patched the cloud-hosted service transparently and states no customer action is needed.
Privilege escalation in CCleaner's Uninstaller component on Windows allows a local low-privileged attacker to gain SYSTEM-level access by planting an NTFS symlink or directory junction before or during application uninstallation. The uninstaller executes file deletion with elevated (SYSTEM) integrity and follows the attacker-controlled link without validation, redirecting destructive operations to arbitrary system paths. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; Gen Digital has released a fix in CCleaner 7.10.1464.
Privilege escalation in Rancher's authorization (SAR) impersonation middleware lets an authenticated user holding only the default 'user' global role forge Impersonate-User and Impersonate-Group HTTP headers (e.g. impersonating cluster-admin or the system:masters group) to obtain full administrative control of the Rancher control plane and, transitively, every downstream cluster it manages. The flaw stems from the middleware trusting client-supplied impersonation headers instead of the authenticated identity in the request context. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the upstream fix in rancher/rancher PR #55983 and advisory GHSA-v584-7w32-jwpq confirm the root cause and remediation.
Privilege escalation to cluster-admin in Red Hat Advanced Cluster Management for Kubernetes (ACM) lets a user holding only namespace-scoped 'edit' rights on an ACM hub namespace take over the entire cluster. By creating a Channel pointing to an attacker-controlled Helm repository and a Subscription referencing it, the app-subscription controller (multicluster-operators-subscription) applies the chart with its own elevated authority and without enforcing the subscription-admin role or namespace confinement, letting the chart install cluster-scoped objects such as a ClusterRoleBinding to cluster-admin. No public exploit identified at time of analysis, and EPSS is low (0.25%), but the technical impact is total and the flaw directly contradicts ACM's documented namespace-confinement guarantee.
Privilege escalation in Red Hat's Multicluster Engine (MCE) for Kubernetes ClusterCurator controller allows a namespace-scoped tenant administrator to obtain cluster-wide administrative control. By creating a namespaced ClusterCurator resource, the tenant can cause the controller to mint an authentication token for a ServiceAccount holding cluster-admin authority, breaking tenant isolation. Rated CVSS 9.1 (scope-changed) by Red Hat; no public exploit identified at time of analysis and not listed in CISA KEV.
Privilege escalation in the Smart Popup by Supsystic WordPress plugin (all versions through 1.12.0) enables unauthenticated remote attackers to create persistent WordPress Administrator accounts with attacker-controlled credentials. Three compounding flaws are chained: a PHP `array_merge()` collision silently removes the `save` action from the popup module's permission blocklist, the subscription confirmation email leaks a reusable `pps_nonce` that the `wp_ajax_nopriv_save` endpoint accepts, and `createWpSubscriber()` applies no server-side role allowlist - allowing an attacker to freely set `params[tpl][sub_wp_create_user_role]=administrator`. No public exploit or CISA KEV listing is confirmed at time of analysis, but the attack chain is fully described in the CVE and the low complexity makes independent weaponization likely.
Privilege escalation in Dokan (WordPress multivendor marketplace plugin) versions up to and including 5.0.1 enables any authenticated vendor or seller to read, modify, or delete any WordPress user account - including site administrators - via REST API calls to `/wp-json/dokan/v1/customers/{id}`. The plugin's `CustomersController` re-registers WooCommerce's customer CRUD routes but replaces the native `manage_woocommerce` capability gate with a flawed check that inspects only the requesting user's role and never validates authorization against the target user. Setting the `password` parameter on an administrator's record via a PUT request yields full site takeover. No public exploit identified at time of analysis, though the attack is mechanically trivial for any Vendor-role account holder.
Missing authorization middleware on the PUT /api/v1/executions/:id endpoint in Flowise prior to 3.1.3 allows any authenticated workspace member, regardless of assigned RBAC role, to overwrite execution state, data, and metadata for any workflow execution in their workspace. The flaw is a straightforward RBAC enforcement gap - the checkAnyPermission() middleware present on all sibling GET and DELETE routes was omitted from the PUT handler - making privilege escalation trivially reproducible with a single authenticated API call. No confirmed active exploitation (not in CISA KEV), but a working proof-of-concept curl command is published in the vendor's GitHub security advisory, and a vendor-released patch is available in version 3.1.3.
Privilege escalation in the Android kernel VPU (Video Processing Unit) driver stems from a use-after-free in vpu_ioctl.c, allowing an attacker to elevate to kernel-level privileges without any additional execution privileges or user interaction. It affects Google Android devices (per the Pixel security bulletin for 2026-08-01), and Android's advisory states no user interaction is required; SSVC rates the technical impact as total and the flaw as automatable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the total-impact, no-interaction profile makes it a high-priority patch target.
Veeam ONE's Reporter service exposes an improper privilege management flaw (CWE-269) that enables a locally authenticated, high-privileged user to escalate into the Reporter service's security context, achieving full confidentiality, integrity, and availability impact on the vulnerable system. All versions of the product appear affected per the wildcard CPE string, and the vulnerability was responsibly disclosed via HackerOne. No public exploit code or active exploitation has been identified at time of analysis.
Privilege escalation in Liman MYS (HAVELSAN Inc.) versions 2.2.3 through pre-2.3.1 enables authenticated low-privilege users to gain administrator-level access via missing server-side authorization checks (CWE-862). The platform, a centralized Linux server management system used primarily in Turkish government and enterprise environments, fails to verify whether the requesting user has rights to perform privileged operations before executing them. No public exploit identified at time of analysis, but the CVSS 8.8 score with network vector and low privilege requirement makes this a high-priority patch target for any organization running the affected versions.
ASUSTOR Backup Plan (ABP) and EZSync (AES) background services run as NT AUTHORITY\SYSTEM and expose a file-based IPC channel whose AES encryption key is readable by standard users and recoverable via Windows DPAPI, allowing any authenticated local account to forge valid service requests. The services further fail to verify the identity of the requesting process and validate filesystem paths using an insufficient substring check, enabling directory traversal sequences to bypass path restrictions. A local attacker can chain these weaknesses to perform arbitrary file reads and writes as SYSTEM, achieving full local privilege escalation. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Privilege escalation in Adobe Campaign Classic (ACC) stems from an incorrect authorization flaw (CWE-863) that lets an attacker gain elevated privileges without any user interaction. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scores it 9.8 Critical, implying a network-reachable, low-complexity path to full compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so exploitation is currently theoretical based on the vendor advisory.
Server-Side Request Forgery in Adobe Campaign Classic (ACC) enables remote attackers to coerce the server into issuing crafted internal requests, resulting in privilege escalation without any user interaction. Adobe rates the flaw at the maximum CVSS 10.0 with a changed scope, indicating the SSRF pivots beyond the vulnerable component to compromise other systems or trust boundaries. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated, network-reachable nature makes it a top-priority patch.
Privilege escalation in Razer RzUpdateService 1.10.14.0 allows a local low-privileged user to gain SYSTEM-level access by manipulating the lpThreadParameter argument processed by the service's Named Pipe Handler. The service, which runs at elevated Windows privilege, fails to enforce proper privilege boundaries when handling named pipe input (CWE-269), enabling a local user to leverage the service's execution context against the underlying system. A public proof-of-concept is confirmed available; the vulnerability is not currently listed in CISA KEV, though the low attack complexity combined with the published POC elevates real-world risk in environments with Razer hardware deployed.
Authentication and authorization bypass in @fastify/aws-lambda 6.4.0 lets an unauthenticated remote attacker forge the entire AWS Lambda proxy event by setting a single client-controlled HTTP header. Because the request.awsLambda.event/context decoration reads the untrusted x-apigateway-event and x-apigateway-context headers before falling back to the trusted internal invocation token, any application that consults these values for identity or API Gateway authorizer claims can be tricked into granting attacker-chosen access, enabling full privilege escalation. Rated CVSS 9.1; no public exploit identified at time of analysis, but the attack is trivial and documented in the vendor advisory.
Privilege escalation in Telenia Software TVox allows any process running as the apache OS user to obtain full root-level command execution without a password, by exploiting a misconfigured vendor-supplied sudoers entry in /etc/sudoers.d/telenia that grants NOPASSWD execution of /bin/nice. Affected branches are 26.x up to and including 26.5.3, and 24.x up to and including 24.9.21. A public exploit is available via KarmaInsecurity advisory KIS-2026-16; no CISA KEV listing has been confirmed, though the trivial exploitation complexity and available proof-of-concept materially elevate real-world risk for any environment where the TVox web tier is reachable.
Incorrect default permissions in Synology Assistant before version 7.0.7-50095 expose locally created installation artifacts to unauthorized access, enabling low-privileged local users to read or write arbitrary files and trigger denial-of-service conditions during the installation window. The CVSS score of 7.3 (High) with C:H/I:H/A:H reflects the breadth of potential file system impact, though an EPSS of 0.13% (3rd percentile) and SSVC exploitation status of 'none' confirm no public exploitation activity at time of analysis. A vendor-released patch exists at version 7.0.7-50095, and no public exploit code has been identified.
Privilege escalation in the "Import and export users and customers" WordPress plugin before 2.4.2 lets a user who holds only the user-creation capability create a full administrator account and overwrite an existing administrator's password or email via the CSV import routine. The plugin fails to re-check WordPress role-assignment and per-user edit permissions on imported rows, so a low-tier account can seize total control of the site. Publicly available exploit code exists (reported by WPScan) and a vendor patch is available; EPSS is low (0.13%), indicating limited widescale exploitation so far despite the high CVSS of 9.1.
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT7921, MT7922, MT7925, MT7927) due to a missing permission check (CWE-862) that allows a standard user-level process to invoke restricted driver operations. An attacker with low-privilege local access can fully compromise confidentiality, integrity, and availability of the affected system without any user interaction. No public exploit identified at time of analysis; EPSS at 0.15% (5th percentile) and SSVC exploitation status of 'none' confirm negligible current exploitation activity.
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of its declared Android permissions - to invoke protected telephony operations by exploiting a missing authorization check (CWE-862). The flaw affects 35 MediaTek chipsets spanning the Helio and Dimensity families and yields high confidentiality and integrity impact over telephony functions such as call management and SMS routing. No public exploit has been identified and EPSS of 0.15% (5th percentile) indicates negligible current exploitation activity, though the zero-privilege-required nature of local exploitation lowers the attacker bar once device access is established.
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges without credentials or user interaction on chipsets MT7986, MT7916, MT7915, MT7981, and MT6890. The missing bounds check in the driver's AP-mode frame processing allows memory corruption that yields high confidentiality and integrity impact on the affected device. No public exploit has been identified and EPSS remains very low at 0.17%, though SSVC rates technical impact as total - underscoring the severity if a capable, range-proximate attacker develops working exploit code.
Privilege escalation in IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 allows an authenticated low-privileged user to gain unauthorized access to protected data and functionality when the Liberty collectives feature is in use. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms network-exploitable, low-complexity exploitation requiring only low-level authentication with no user interaction - resulting in high confidentiality and integrity impact. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available.
Privilege escalation in Semaphore UI allows an authenticated project manager to gain owner-level project control by exploiting a role-shadowing flaw in the custom role creation API. Affected versions prior to 2.18.19 and between 2.19.0-alpha3 and 2.19.5-beta5 permit a project manager to POST a custom role with a slug matching a built-in role name and bitmask 15, causing the middleware to resolve the database-backed custom role instead of the protected built-in, thereby granting CanUpdateProject and CanManageProjectUsers capabilities reserved for owners. No public exploit code has been identified at time of analysis and this CVE is not listed in CISA KEV, but the low exploitation complexity (AC:L, single API call, no special configuration) and high CVSS impact (8.8) make upgrading urgent for any deployment with untrusted project managers.
Path traversal in SSH.NET's ScpClient.Download() enables a malicious, compromised, or man-in-the-middle SCP server to write arbitrary files anywhere the client process has write access during recursive directory downloads. All SSH.NET NuGet package versions up to and including 2025.1.0 are affected; the vulnerability is analogous to CVE-2019-6111 in OpenSSH but extends to directory traversal. No public exploit code or CISA KEV listing has been identified at time of analysis, though the integrity impact is high given the file-write primitive can overwrite SSH authorized keys, shell rc files, or application binaries.
Privilege escalation in JFrog Artifactory enables an authenticated Project Resource Manager to acquire broader administrative privileges under unspecified triggering conditions. The flaw, rooted in CWE-269 (Improper Privilege Management), violates role boundary enforcement within Artifactory's access control system, potentially granting full control over repositories, artifacts, and platform configuration. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at the time of analysis, though the CVSS 7.2 High score with full confidentiality, integrity, and availability impact underscores the post-exploitation risk.
Privilege escalation in RustFS prior to version 1.0.0-beta.11 allows any authenticated user holding CreateServiceAccountAdminAction to create a root-parented service account by supplying an arbitrary target_user to the AddServiceAccount API, because the handler validates only the permission and never enforces scope - and prepare_service_account_auth automatically grants is_owner status to root-parented accounts. The resulting credential provides full owner-level access to all objects in the distributed storage cluster. No active exploitation has been confirmed (no CISA KEV listing), but the complete attack path is publicly documented in the fix PR, substantially lowering the exploitation barrier.
Local kernel privilege escalation and denial of service in NetBSD's hdaudio(4) driver arise from two compounding flaws: the /dev/hdaudioN device nodes enforce no access control, allowing any unprivileged local user to invoke HDAUDIO_FGRP_SETCONFIG, and the detach path in hdafg_detach() is not race-safe against concurrent DMA activity. A two-thread attack - one repeatedly reconfiguring the audio function group, one keeping DMA and IRQs live - wins a use-after-free race where a latched DMA interrupt dereferences a freed callback pointer, producing outcomes from audio-subsystem crashes and kernel panics to potential kernel-level privilege escalation. A public proof-of-concept is available, and no specific patched release version has been confirmed, leaving remediation dependent on source-level kernel rebuilds.
Privilege escalation and account takeover in the Events Manager WordPress plugin before 7.4.1 lets unauthenticated attackers reset passwords, promote accounts to Administrator, or delete accounts whose user ID collides with the ID of one of the plugin's own posts. The flaw stems from the plugin overriding WordPress's own capability decisions for unrelated privileged user actions. Publicly available exploit code exists (WPScan), EPSS is a notable 15%, and SSVC rates it automatable with total technical impact, though it is not currently listed in CISA KEV.
Confused-deputy privilege escalation in snowflake.core (Snowflake Python API) prior to version 1.13.0 enables attackers with low-privileged access to a downstream application to perform unauthorized Snowflake operations under the application's higher-privileged session. Two related input-sanitization weaknesses make this possible: path traversal via unencoded `..` segments in REST URL paths (CWE-22), and HTTP parameter pollution via injected `&`, `#`, or `=` characters in query strings (CWE-141), either of which can subvert swap, clone, or rename operations against unintended resources. No public exploit code has been identified at time of analysis and no CISA KEV listing is confirmed; the vendor-released fix is snowflake.core 1.13.0, available on PyPI and requiring manual upgrade.
Unauthorized cross-tenant Secret and ConfigMap access in the multicloud-operators-channel component of Red Hat Advanced Cluster Management for Kubernetes 2 allows a compromised managed-cluster agent to read all Secrets and ConfigMaps within any Channel namespace on the hub cluster. The Changed scope (S:C) in the CVSS vector confirms that exploitation pivots from a managed cluster context into the hub, exposing Git and Helm repository credentials belonging to other tenants. No public exploit has been identified at time of analysis, but the network-reachable, low-privilege vector makes this a high-priority finding in any multi-tenant RHACM deployment.
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (multicloud-integrations / ArgoCD pull-model integration) lets a low-privileged hub tenant who can create Application CRs redirect propagation to arbitrary managed spoke clusters. Because the Application propagation controller trusts the attacker-supplied `ocm-managed-cluster` annotation without validation, an attacker forces ArgoCD on targeted spokes to sync attacker-controlled manifests, yielding code execution or privilege escalation there. CVSS 9.9 with scope change; no public exploit identified at time of analysis and it is not listed in CISA KEV.
AcyMailing WordPress plugin (all versions through 10.11.1) allows authenticated attackers with subscriber-level access to exploit an authorization bypass and silently overwrite the BCC field of the plugin's core notification template, redirecting all subsequent WordPress password-reset emails - including those for administrator accounts - to an attacker-controlled address. By then triggering the standard WordPress lost-password flow for any account, the attacker intercepts the one-time reset token and achieves full site administrator compromise without any victim interaction. No public exploit code or CISA KEV listing exists at time of analysis; exploitation is gated by a non-default plugin configuration that partially narrows the real-world attack surface below what the CVSS 8.8 score implies.
Sandbox escape in Cursor IDE for macOS (versions prior to 3.0.0) allows a malicious or prompt-injected AI agent operating in Auto-Run Sandbox mode to break container isolation by invoking the Dev Containers CLI to launch a privileged Docker container that mounts the host's virtiofs0 virtual filesystem. This grants the agent unrestricted read and write access to the user's entire home directory and enables arbitrary command execution at the user's privilege level - all without any additional permission prompt to the user. No public exploit code has been identified at time of analysis; a vendor-released patch is available as version 3.0.0.
Privilege escalation in Adobe Commerce and Magento Open Source (including Adobe Commerce B2B) lets a remote attacker gain elevated access to sensitive resources through an incorrect authorization flaw, with no user interaction required. All supported branches from 2.4.4 through 2.4.9 (and B2B 1.3.3-1.5.3) prior to the August 2026 patch set are affected, and the CVSS 9.1 rating reflects high confidentiality and integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but as an unauthenticated, low-complexity authorization bypass in a widely deployed storefront platform it warrants urgent patching.
Privilege escalation in Windows App Installer (the App Installer component of Windows Package Manager, aka winget) allows an authenticated local attacker with standard user privileges to fully compromise confidentiality, integrity, and availability of the affected system. The flaw stems from improper privilege management (CWE-269), meaning the application fails to correctly enforce privilege boundaries during its operations. No active exploitation is confirmed - CISA KEV does not list this CVE, SSVC rates exploitation as 'none', and EPSS sits at only 0.33% (26th percentile) - but the SSVC technical impact rating of 'total' reflects the severity of a successful local privilege escalation to full system control.
Privilege escalation in Microsoft High Performance Computing (HPC) Pack allows a network-authenticated attacker with low-privilege access to elevate privileges to a higher level, potentially achieving full system compromise. The flaw stems from CWE-250 (Execution with Unnecessary Privileges), meaning a component within HPC Pack runs with more rights than its function requires, providing a lever for a legitimately authenticated user to abuse. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, but the CVSS 8.8 score and full C/I/A impact triad indicate a serious risk in any environment where untrusted low-privilege users have network access to HPC Pack services.
Privilege escalation in Microsoft PowerShell 7.4.x, 7.5.x, and 7.6.x stems from incorrect default permissions (CWE-276), enabling a locally authenticated low-privilege attacker to gain full system control. Exploitation requires local shell access and a user interaction trigger - an already-privileged user or process must execute PowerShell after the attacker has tampered with an incorrectly permissioned file or directory. No public exploit code and no active exploitation have been identified; SSVC confirms exploitation status as none and the attack is not automatable. Microsoft has released patched versions across all three affected branches.
Privilege escalation in Adobe ColdFusion 2023 and 2025 allows a low-privileged local user to gain unauthorized read and write access through an Incorrect Authorization flaw (CWE-863). Exploitation requires only a low-privileged local account and no user interaction, yielding full confidentiality, integrity, and availability impact on the affected system. Adobe has published advisory APSB26-90; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Adobe ColdFusion 2023 and 2025 allows a low-privileged authenticated attacker to gain unauthorized read and write access beyond their authorized security scope by exploiting improper input validation in file processing. The attack requires social engineering - a victim with higher privileges must open a specially crafted malicious file - after which the attacker's effective permissions cross security boundaries (scope change, S:C) to reach resources outside the original ColdFusion component. No public exploit or CISA KEV listing has been identified at time of analysis, though the high CVSS score of 8.7 and scope-change impact warrant prompt remediation per Adobe advisory APSB26-90.
Privilege escalation in the Alias Checking Trusted Module (ACTM) firmware for certain Intel Xeon processors allows a local privileged attacker to escalate to System Management Mode (SMM) execution, achieving high confidentiality and integrity impact across both the directly compromised system and subsequent systems such as co-hosted hypervisors or tenant workloads. The attack requires high-complexity local technique combined with pre-existing privileged user access, placing it firmly in the advanced persistent threat actor category. No public exploit has been identified at time of analysis, and Intel has published advisory INTEL-SA-01439 to address this firmware flaw.
Privilege escalation in Intel PROSet/Wireless WiFi Software for Windows allows local unprivileged code operating within the Ring 2 privileged process boundary to elevate access rights due to improper privilege management (CWE-269), yielding high availability impact and limited confidentiality and integrity exposure on both the vulnerable and subsequent systems. The attack is constrained to local access and requires high complexity, but no prior authentication or user interaction is needed from the attacker. Intel has published advisory INTEL-SA-01468 to address this flaw; no public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Improper authentication (CWE-287) in Intel's Trust Domain Extensions (TDX) module allows a Ring-0 system software adversary with high privileges to breach Trust Domain isolation boundaries, enabling information disclosure and privilege escalation. Affects select Intel platforms running TDX with a high-complexity, locally-executed attack path - no user interaction required. No public exploit identified at time of analysis, but the confidential-computing trust model is fundamentally undermined if exploited: an adversary with hypervisor-level access could read or modify memory intended to be protected from exactly that privilege tier.
Privilege escalation in Intel PROSet/Wireless WiFi Software for Windows exposes local systems to code execution by unprivileged attackers via a Ring 2 (device driver layer) improper access control flaw. Any local process with no privileges required and no user interaction can leverage the driver's failure to enforce access boundaries to achieve local code execution, with follow-on high confidentiality impact on the broader system - consistent with a kernel-level scope change. No public exploit identified at time of analysis, and no CISA KEV listing; however, the low complexity and zero-privilege requirement make this a credible post-compromise escalation vector for threat actors with any form of local code execution already established.
Out-of-bounds read in Intel PROSet/Wireless WiFi Software at the Ring 2 device driver layer allows adjacent network attackers without authentication to escalate privileges on affected Windows systems. The flaw, tracked under CWE-125, can be triggered by a low-complexity attack from the same WiFi segment or Layer 2 broadcast domain, requiring no user interaction, and yields High availability impact alongside Low confidentiality and integrity exposure. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV, but the unauthenticated adjacent attack surface is meaningful for enterprise mobile workforces on untrusted networks.
Improper access control within Ring 3 (user application space) of Intel processors permits privilege escalation from authenticated local user-level access to higher system privilege levels, with high confidentiality and integrity impact on the vulnerable system. Exploitation demands local access, low-privilege authentication, high attack complexity, and specialized internal knowledge of Intel processor microarchitecture internals - substantially narrowing the realistic attacker population. No public exploit code has been identified and no CISA KEV listing exists at time of analysis, consistent with a threat relevant primarily to sophisticated, targeted adversaries.
Privilege escalation in CamaleonCMS 2.9.2 and earlier allows any authenticated low-privileged user to overwrite administrator passwords and achieve full site takeover via a parameter confusion flaw in the UsersController's updated_ajax endpoint. The authorization filter and the action body each resolve the target user from a different parameter key, enabling an attacker to pass their own ID to satisfy the self-authorization check while simultaneously directing the mutation at any victim account. No public exploit tool has been identified at time of analysis, but the upstream fix commit is available on GitHub (PR #1185, commit 2634503), with a formally tagged patched release not yet independently confirmed.
Local privilege escalation in Siemens License Server (SLS) versions prior to V5.1 allows a local attacker with elevated operating system privileges to execute arbitrary commands and write malicious files as root, resulting in full system compromise. The root cause is an insecure sudoers policy (CWE-732) that grants overly permissive command execution rights, enabling abuse of sudo rules to break out of intended privilege boundaries. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high-integrity and high-confidentiality impact on the vulnerable system underscores urgency for organizations running SLS in multi-user or shared infrastructure environments.
Server-Side Request Forgery in the OpenShift Console Helm catalog proxy allows low-privileged namespace tenants to plant a malicious ProjectHelmChartRepository resource pointing to an attacker-controlled URL, causing the console pod to issue server-side fetches that bypass tenant egress restrictions. Combined with Helm catalog metadata poisoning and subsequent admin-mediated chart installation, this multi-stage attack chain enables privilege escalation within the cluster. No CISA KEV listing or public exploit code has been identified at time of analysis, though the CVSS Scope:Changed rating correctly reflects that the console pod's cross-boundary requests extend impact beyond the originating namespace.
Privilege escalation in Authentik Security authentik through version 2026.5.6 allows an attacker holding a source-scoped SCIM provisioning token to take over any local account, including superuser accounts, by provisioning a SCIM user whose username matches an existing account. The SCIM user ingest function adopts pre-existing local accounts by username without enforcing scope boundaries, meaning a limited-privilege provisioning credential can rewrite or delete accounts entirely outside its intended scope. No public exploit has been identified at time of analysis, but the attack requires only network access and a valid SCIM token, making the exploitation bar low for any attacker who has obtained such a credential.
Privilege escalation in Authentik Security authentik through 2026.5.6 allows any holder of a source-scoped SCIM provisioning token to seize superuser control over the entire Identity Provider and permanently lock out all legitimate administrators. The root cause is the SCIM group ingest function's failure to validate whether the requesting token's source scope has authority over the target group - when an attacker provisions a SCIM group whose name matches an existing administrator group, authentik silently adopts and replaces that group's membership without authorization checks. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but the high CVSS score of 8.8 and the total-takeover impact warrant immediate remediation.
Privilege escalation in the `openvt -u` utility allows a local low-privileged attacker to obtain passwordless root login on Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. The flaw lies in `authenticate_user()`, which resolves VT ownership via `stat("/proc/<pid>/fd/0")` - a call that follows the symlink to the underlying TTY device node rather than inspecting the owning process, causing the check to read the device node's UID rather than the process owner's UID. When a privileged user logs out and TTY device node ownership reverts to root or the getty owner while an attacker's process still holds fd 0 on that TTY, the check incorrectly authorizes a passwordless `login -f root` execution. No public exploit is identified at time of analysis and there is no CISA KEV listing, but the root-level impact makes this a high priority for environments using the affected `kbrequest`/init deployment pattern.
Privilege escalation in MRTG (Multi Router Traffic Grapher) allows a local low-privileged attacker to gain elevated file ownership on the host system. When the MRTG daemon is launched as root and then drops privileges, a CWE-59 symlink-following flaw in PID file handling lets an attacker pre-place or manipulate a symlink at the expected PID file path, causing the root process to change ownership of an arbitrary existing file to the daemon user. Affected platforms include Red Hat Enterprise Linux 6 through 10; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution via improper input validation in a VAPIX API parameter on Axis OS affects Axis network camera and edge device deployments. An attacker holding administrator-privileged service account credentials can send a crafted API parameter to trigger the flaw, execute arbitrary code on the device, and potentially escalate to higher privileges. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the full-impact CVSS score of 7.2 with network attack vector and high C/I/A ratings reflects the severity of a successful post-authentication compromise.
Privilege escalation via untrusted pointer dereference in ASUS GPU Tweak III, GPU Tweak II, AI Suite 3, and VGAdll exposes local attackers to arbitrary kernel memory writes through vulnerable IOCTL handlers in the associated kernel-mode drivers. The flaw (CWE-822) permits a caller supplying an attacker-controlled pointer to force the driver to write a specific value to an arbitrary memory address, enabling elevation of privileges. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the high CVSS 4.0 score of 8.4 and confirmed arbitrary-write primitive make this a meaningful local privilege escalation risk on affected systems.
Privilege escalation in libvirt's `virFileChownFiles()` function allows a process confined to the `swtpm` system user to coerce the root-level libvirtd daemon into reassigning ownership of any arbitrary file on the host to the `swtpm` user. The attack exploits a symlink-following flaw (CWE-59) in directory traversal logic that runs with root privileges, affecting libvirt as packaged across Red Hat Enterprise Linux 6 through 10 and RHEL for Nvidia 26. No public exploit has been identified at time of analysis, but the attack complexity is low once `swtpm`-user execution is obtained.
Privilege escalation in Red Hat OpenShift AI's training-operator enables any user holding a standard Kubernetes edit or admin role in any cluster namespace to break out of namespace isolation, impersonate service accounts, access the host filesystem, and achieve remote code execution. The root cause is a design flaw: the operator aggregates training job permissions onto native Kubernetes built-in ClusterRoles, and allows unrestricted PodTemplateSpec passthrough - meaning users can submit training jobs containing arbitrary pod configurations such as hostPath mounts or elevated service account tokens. No public exploit code or CISA KEV listing was identified at time of analysis, but the low access complexity and the broad availability of edit/admin roles in typical ML platform deployments make this an urgent remediation priority.
Privilege escalation in odh-dashboard, the web interface for Red Hat OpenShift AI (RHOAI), allows any authenticated dashboard user to gain cluster-admin or other highly privileged roles by manipulating the roleRef field when creating RoleBindings. The system performs no server-side validation on the roleRef value supplied through the dashboard, enabling an attacker holding only a standard user account to bind themselves to arbitrary Kubernetes ClusterRoles. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the CVSS 8.8 score and the direct, low-complexity path to cluster-admin access make this a high-priority remediation target for any RHOAI deployment.
Privilege escalation in odh-dashboard (Red Hat OpenShift AI) allows an attacker who has obtained the dashboard's Service Account token to abuse overly broad SA permissions and elevate to cluster-administrator level. Exploitation grants full access to secrets, credentials, and keys across the entire OpenShift cluster, while also breaking multi-tenant isolation between workloads. No public exploit code has been identified at time of analysis, and this CVE is not in CISA KEV, but the CVSS score of 8.8 and cluster-wide blast radius make it a high-priority remediation target for RHOAI deployments.
MySQL DSN parameter injection in Red Hat OpenShift AI's Data Science Pipelines Operator (DSPO) allows a namespace editor to enable the MySQL LOCAL INFILE feature via the unvalidated spec.database.customExtraParams field, enabling exfiltration of sensitive files - including Kubernetes service account tokens - from the operator pod. An attacker who exploits this can leverage the stolen token to impersonate the operator's service account and escalate privileges to cluster-admin level within the OpenShift cluster. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Overprivileged ClusterRole assignments in Red Hat OpenShift AI's Data Science Pipelines Operator (DSPO) create a cluster-wide privilege escalation path if the operator pod is compromised. The DSPO ClusterRole grants capabilities well beyond operational necessity - including pod exec and cluster-wide RBAC management - directly violating the principle of least privilege (CWE-250). Successful exploitation of a compromised DSPO pod would allow an attacker to assume full administrative control over the entire Kubernetes cluster; no public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS scope-change flag (S:C) confirms the blast radius extends far beyond the initial compromise boundary.
Privilege escalation to root in Dokploy (self-hosted PaaS) versions 0.29.2 through 0.29.12 lets a low-privilege organization member who has access to a single application escalate to full host command execution. Because schedule.create/schedule.update derive the internal serviceId from applicationId or composeId but only enforce the owner/admin host-schedule gate in the alternate branch, a member can bind their applicationId to a 'dokploy-server' (host-level) schedule and execute an arbitrary supplied script as root via schedule.runManually. No public exploit identified at time of analysis; fixed in 0.29.13.
Privilege escalation to host root in Dokploy self-hosted PaaS versions prior to 0.29.13 allows any authenticated organization member to hijack WebSocket terminal and log-streaming handlers that authenticate the session but never check the role/permission model enforced elsewhere. Because these handlers can open an interactive shell into any container - including the Dokploy container that mounts the Docker socket - a low-privileged tenant can obtain root on the host and cross every tenant boundary. No public exploit identified at time of analysis, though the upstream fix commit and a regression test are public. The CVSS is 9.9 driven by scope change and full CIA impact.
Privilege escalation in Apache Ranger versions 2.8.0 and earlier allows an attacker to elevate their effective permissions by manipulating a URL parameter, undermining the very access-control layer Ranger is meant to enforce across Hadoop-ecosystem services. Apache rates it CVSS 9.8 with a network, low-complexity, no-privilege vector, though the 'privilege escalation' framing implies a pre-existing foothold that is worth verifying. There is no public exploit identified at time of analysis, and the EPSS score is low (0.19%, 9th percentile), indicating no observed mass-exploitation activity yet.
Incorrect default permissions in Samsung Bixby prior to version 4.0.86.0 allow a local attacker with low privileges to execute arbitrary commands within the Bixby process context. The flaw exists in the out-of-box permission configuration - no special user-triggered setup is required to be vulnerable. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the local privilege escalation to Bixby's execution context presents meaningful risk for shared-device and enterprise fleet environments.
Privilege escalation in the Vitepos WordPress point-of-sale plugin allows any user holding the custom Outlet Manager role to reset the password of any WordPress account - including site administrators - and achieve full account takeover. The flaw stems from a missing per-target authorization check in the password-reset API endpoint, combined with the plugin granting the Outlet Manager role overly broad reset capabilities by default. A publicly available proof-of-concept exists per WPScan, though EPSS remains low (0.13%, 3rd percentile), suggesting exploitation has not yet been observed at scale.
Unauthenticated account takeover in the FoodBoxBooker WordPress plugin (versions before 1.0.7) lets remote attackers reset the password of any user - administrators included - because the plugin fails to properly validate password-reset requests. Successful exploitation yields full administrative control and effective site takeover. Publicly available exploit code exists; the flaw is not listed in CISA KEV and EPSS is low (0.15%, 4th percentile), indicating no confirmed mass exploitation yet.
Local privilege escalation in Kingston FURY CTRL RGB Control Software 2.0.65.0 allows a low-privileged local user to gain full system-level access through the NTIOLib_KSFX.sys kernel driver component. The driver's privilege management is improperly implemented (CWE-269), enabling manipulation that elevates attacker control without requiring user interaction or elevated starting privileges. A public proof-of-concept exploit has been released via Google Drive, and the vendor did not respond to disclosure - meaning no patch exists and the exploit is freely usable against unmitigated systems.
Unauthenticated privilege escalation to full site takeover in the AI Copilot - Content Generator plugin for WordPress (all versions through 1.5.6) lets remote attackers create an administrator account by saving and executing a malicious workflow whose wp_create_user action node specifies role=administrator. The plugin's only authorization barrier is a waic-nonce that is publicly emitted into frontend JavaScript (WAIC_DATA.waicNonce) on any page rendering the [aiwu-form] shortcode or public chatbot, so the nonce check provides no real protection. Reported by Wordfence with CVSS 9.8; no public exploit identified at time of analysis, but exploitation is trivial once the shortcode or chatbot is on a public page.
Privilege escalation in the XML-RPC API of Plesk before 18.0.80 allows an authenticated reseller-level account to obtain a fully administrative session for the root user, effectively taking over the entire hosting server. The flaw is a CWE-269 improper privilege management issue reported through HackerOne; no public exploit has been identified at time of analysis and it is not listed in CISA KEV. Because a reseller can cross the privilege boundary to root with low attack complexity, this is a high-impact server-takeover vector in multi-tenant hosting environments.
Privilege escalation in Sonatype Nexus Repository 3 allows an authenticated user holding privilege-management rights to elevate their own access to full administrator by exploiting a type-confusion flaw (CWE-843) in the REST privilege update endpoint. Exploitation is constrained to specific role configurations, but the network-accessible attack surface and high confidentiality and integrity impact (VC:H/VI:H per the CVSS 4.0 vector) make this a meaningful insider or compromised-account risk in enterprise DevOps environments. A vendor-released patch is available in the Nexus Repository 3.95.0 release; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Subscriptions for WooCommerce WordPress plugin (before 2.0.1) is reachable by any authenticated Shop Manager through a missing capability check on a nonce-protected AJAX action that installs and activates arbitrary plugins from user-supplied slugs. Shop Managers, who by WordPress design are not granted plugin management capabilities, can exploit this gap to install a malicious plugin and achieve full server-side code execution. A publicly available proof-of-concept exists; however, EPSS is low (0.18%, 8th percentile) and the vulnerability is absent from CISA KEV, indicating exploitation remains opportunistic rather than widespread.
Local privilege escalation in PowerISO 9.3.0.0 on Windows exposes low-privileged local users to full system compromise via the scdemu.sys kernel driver's improper privilege management (CWE-269). The exploit - publicly detailed as arbitrary registry write or deletion through the driver's IOCTL interface - allows elevation to SYSTEM-level control with high confidentiality, integrity, and availability impact on the vulnerable host. No vendor patch exists; the vendor did not respond to responsible disclosure, and a public proof-of-concept has been released, lowering the skill threshold for exploitation.
Local privilege escalation in udisks2 exploits insufficient polkit authorization on the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method, allowing a low-privileged user with an active console session to spoof the 'as-user' parameter and mount filesystems on behalf of arbitrary users, including root. The attack specifically leverages fstab entries carrying 'user' or 'users' mount options, which are common on desktop Linux installations, to bypass the authorization check entirely. A vendor-released patch exists in udisks 2.11.2; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in OpenReception's appointment booking platform (versions prior to 1.0.2) lets any TENANT_ADMIN promote an account to platform-wide GLOBAL_ADMIN with a single PUT request to the staff role-update endpoint. Because no policy check enforces that only an existing GLOBAL_ADMIN may grant that role, schema validation alone acts as the authorization gate, and after re-login the attacker's JWT carries platform-wide control over every tenant. No public exploit identified at time of analysis, but the fix is a one-line authorization guard, making the flaw trivially reproducible for anyone reading the GHSA advisory or patch commit.
Privilege escalation in Google Chrome's Contextual Tasks feature (prior to 151.0.7922.109) allows a remote attacker to escalate privileges by luring a victim to a crafted HTML page that delivers insufficiently validated untrusted input. The vulnerability carries a CVSS 8.8 score, reflecting high confidentiality, integrity, and availability impact with no prior authentication required from the attacker. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the low attack complexity and Chrome's ubiquitous deployment surface make prompt patching a priority.
OS-level privilege escalation in Google Chrome's Windows CredentialProvider component allows a local attacker to gain elevated system privileges by winning a race condition triggered via a malicious file. Affected are all Chrome for Windows builds prior to 151.0.7922.109. No public exploit code has been identified and CISA has not added this to the Known Exploited Vulnerabilities catalog, but the SSVC assessment rates technical impact as total, meaning successful exploitation yields full system compromise.
Local privilege escalation in Sophos Endpoint for macOS (before 2026.1.1) and Sophos Home for macOS (before 10.11.6) allows any local user to execute arbitrary code with root privileges. The flaw stems from improper authorization (CWE-285) in the security agent's privileged components, so a low-privileged or unprivileged local account can fully compromise the host. No public exploit identified at time of analysis, but the CVSS 9.3 rating and scope change to root make this a high-priority patch for macOS fleets.
Privilege escalation in the Frontend Admin by DynamiApps WordPress plugin (versions up to and including 3.29.10) lets remote unauthenticated attackers elevate their privileges, per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H vector rated 9.8 Critical. The flaw (CWE-266, Incorrect Privilege Assignment) stems from the plugin's frontend user-management forms exposing role/capability assignment without proper authorization, enabling an attacker to gain administrator-level access to the WordPress site. No public exploit identified at time of analysis and the CVE is not on CISA KEV, but the CVSS profile indicates trivially weaponizable network-based abuse.
Privilege escalation in Order Delivery Date for WooCommerce (versions ≤ 4.6.0) allows authenticated shop managers to exceed their intended role boundaries and gain elevated administrative access to the WordPress installation. Exploitation requires an existing shop manager account, confirmed by the CVSS:3.1 PR:H metric, limiting the attack surface to environments where untrusted or compromised accounts hold that role. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Unauthenticated privilege escalation in the AIWU (AI Copilot Content Generator) WordPress plugin versions 1.5.6 and earlier allows remote attackers with no authentication to gain elevated privileges within the WordPress site. Reported by Patchstack and tracked as EUVD-2026-53963, the flaw carries a CVSS 9.8 rating driven by network-reachable, no-interaction exploitation with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Editor-level privilege escalation in the PublishPress Capabilities WordPress plugin (versions ≤ 2.45.0) enables authenticated users holding an Editor role to exceed their intended permission boundary and gain unauthorized elevated capabilities. The root cause is incorrect privilege assignment (CWE-266) within the plugin's capability management logic, and with a CVSS base score of 7.2 (High) reflecting high impact across confidentiality, integrity, and availability, the flaw is most dangerous on multi-tenant or agency WordPress sites where Editor accounts are distributed to semi-trusted users. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the Forminator WordPress plugin (≤1.56.0) allows authenticated Contributor-level users to elevate their privileges to a higher role, potentially achieving administrative control over the WordPress installation. The flaw, rooted in CWE-266 (Incorrect Privilege Assignment), carries a CVSS score of 8.8 and a full High C/I/A impact rating, indicating that successful exploitation can result in complete compromise of confidentiality, integrity, and availability of the affected site. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-privilege entry bar and network accessibility make this an elevated priority for WordPress deployments using this plugin.
Privilege escalation in the Kadence WooCommerce Email Designer WordPress plugin (all versions up to and including 1.5.19) lets unauthenticated remote attackers gain elevated privileges due to a missing authorization check (CWE-862). Reported by Patchstack and tracked as EUVD-2026-53939, the flaw carries a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) rating, so no login or user interaction is required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is not confirmed in the wild.
Privilege escalation in WSO2 API Manager and related Carbon-based products allows a low-privileged user, using a validly issued token, to invoke product-level Admin REST APIs that should be restricted, potentially resulting in full administrative account takeover. The flaw stems from insufficient scope/privilege restriction on issued tokens (CWE-269) and affects API Manager, API Control Plane, Universal Gateway, Traffic Manager, and the Carbon REST API common/utility components. No public exploit identified at time of analysis; exploitation requires the attacker to already hold a low-privileged account and obtain a token for it.
Local privilege escalation in the NI-PAL kernel driver allows a low-privileged authenticated Windows user to escalate to SYSTEM-level and execute arbitrary code, as confirmed by the NI vendor advisory. Affected deployments include NI-PAL versions 26.3.1 and all prior releases running exclusively on Microsoft Windows. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog, but the low access complexity (AC:L, AT:N in CVSS 4.0) means exploitation requires no special conditions beyond a local user session.
Privilege escalation in Progress MarkLogic Server (versions before 11.3.6 and 12.0.3) lets an authenticated user holding only a low-privileged Hadoop integration role break out of that role and perform privileged operations against the internal Security database, effectively enabling full control over authentication and authorization data. Rated CVSS 9.9 with a changed scope, the flaw turns a minimal Hadoop-connector account into an administrative foothold. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation in Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user holding only a low-privileged REST role to abuse the REST API document patch operation, gaining the ability to run privileged operations against the internal Security database and effectively take over authorization data. Rated CVSS 9.9 with a changed scope, it is exploitable by any low-privileged REST account over the network. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and minimal privilege requirement make it a high-priority patch.
Privilege escalation in Progress MarkLogic Server before 11.3.6 and 12.0.3 lets an authenticated user holding only a low-privileged REST role elevate to administrator through the SQL, SPARQL, and Optic REST query interfaces, after which they can run privileged operations and read data they were never authorized to see. The flaw is remotely reachable and requires only valid low-tier credentials, driving a critical 9.9 CVSS score. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation in Progress MarkLogic Server's REST API document processing pipeline allows an authenticated user holding an administrative REST role to elevate their access to a higher privilege level, resulting in unauthorized disclosure of sensitive server-side data. Affected versions span both the 11.x and 12.x release trains, patched in 11.3.6 and 12.0.3 respectively per the vendor's August 2026 critical security bulletin. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, though the scope change (S:C) and high confidentiality and integrity impact in the CVSS vector underscore meaningful post-exploitation consequence within the MarkLogic environment.
Privilege escalation in Google SecOps (Chronicle SOAR) versions prior to 6.3.85 on Google Cloud Platform allows an authenticated attacker to forge a crafted internal authentication header and elevate from a low-privileged account to system-level administrative access. The flaw stems from improper validation of the origin/trust of an internal auth header (CWE-346), and carries a critical CVSS 4.0 base score of 9.4 driven by high confidentiality, integrity, and availability impact plus a scope change onto subsequent systems. There is no public exploit identified at time of analysis; Google patched the cloud-hosted service transparently and states no customer action is needed.
Privilege escalation in CCleaner's Uninstaller component on Windows allows a local low-privileged attacker to gain SYSTEM-level access by planting an NTFS symlink or directory junction before or during application uninstallation. The uninstaller executes file deletion with elevated (SYSTEM) integrity and follows the attacker-controlled link without validation, redirecting destructive operations to arbitrary system paths. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; Gen Digital has released a fix in CCleaner 7.10.1464.
Privilege escalation in Rancher's authorization (SAR) impersonation middleware lets an authenticated user holding only the default 'user' global role forge Impersonate-User and Impersonate-Group HTTP headers (e.g. impersonating cluster-admin or the system:masters group) to obtain full administrative control of the Rancher control plane and, transitively, every downstream cluster it manages. The flaw stems from the middleware trusting client-supplied impersonation headers instead of the authenticated identity in the request context. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the upstream fix in rancher/rancher PR #55983 and advisory GHSA-v584-7w32-jwpq confirm the root cause and remediation.
Privilege escalation to cluster-admin in Red Hat Advanced Cluster Management for Kubernetes (ACM) lets a user holding only namespace-scoped 'edit' rights on an ACM hub namespace take over the entire cluster. By creating a Channel pointing to an attacker-controlled Helm repository and a Subscription referencing it, the app-subscription controller (multicluster-operators-subscription) applies the chart with its own elevated authority and without enforcing the subscription-admin role or namespace confinement, letting the chart install cluster-scoped objects such as a ClusterRoleBinding to cluster-admin. No public exploit identified at time of analysis, and EPSS is low (0.25%), but the technical impact is total and the flaw directly contradicts ACM's documented namespace-confinement guarantee.
Privilege escalation in Red Hat's Multicluster Engine (MCE) for Kubernetes ClusterCurator controller allows a namespace-scoped tenant administrator to obtain cluster-wide administrative control. By creating a namespaced ClusterCurator resource, the tenant can cause the controller to mint an authentication token for a ServiceAccount holding cluster-admin authority, breaking tenant isolation. Rated CVSS 9.1 (scope-changed) by Red Hat; no public exploit identified at time of analysis and not listed in CISA KEV.
Privilege escalation in the Smart Popup by Supsystic WordPress plugin (all versions through 1.12.0) enables unauthenticated remote attackers to create persistent WordPress Administrator accounts with attacker-controlled credentials. Three compounding flaws are chained: a PHP `array_merge()` collision silently removes the `save` action from the popup module's permission blocklist, the subscription confirmation email leaks a reusable `pps_nonce` that the `wp_ajax_nopriv_save` endpoint accepts, and `createWpSubscriber()` applies no server-side role allowlist - allowing an attacker to freely set `params[tpl][sub_wp_create_user_role]=administrator`. No public exploit or CISA KEV listing is confirmed at time of analysis, but the attack chain is fully described in the CVE and the low complexity makes independent weaponization likely.
Privilege escalation in Dokan (WordPress multivendor marketplace plugin) versions up to and including 5.0.1 enables any authenticated vendor or seller to read, modify, or delete any WordPress user account - including site administrators - via REST API calls to `/wp-json/dokan/v1/customers/{id}`. The plugin's `CustomersController` re-registers WooCommerce's customer CRUD routes but replaces the native `manage_woocommerce` capability gate with a flawed check that inspects only the requesting user's role and never validates authorization against the target user. Setting the `password` parameter on an administrator's record via a PUT request yields full site takeover. No public exploit identified at time of analysis, though the attack is mechanically trivial for any Vendor-role account holder.
Missing authorization middleware on the PUT /api/v1/executions/:id endpoint in Flowise prior to 3.1.3 allows any authenticated workspace member, regardless of assigned RBAC role, to overwrite execution state, data, and metadata for any workflow execution in their workspace. The flaw is a straightforward RBAC enforcement gap - the checkAnyPermission() middleware present on all sibling GET and DELETE routes was omitted from the PUT handler - making privilege escalation trivially reproducible with a single authenticated API call. No confirmed active exploitation (not in CISA KEV), but a working proof-of-concept curl command is published in the vendor's GitHub security advisory, and a vendor-released patch is available in version 3.1.3.
Privilege escalation in the Android kernel VPU (Video Processing Unit) driver stems from a use-after-free in vpu_ioctl.c, allowing an attacker to elevate to kernel-level privileges without any additional execution privileges or user interaction. It affects Google Android devices (per the Pixel security bulletin for 2026-08-01), and Android's advisory states no user interaction is required; SSVC rates the technical impact as total and the flaw as automatable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the total-impact, no-interaction profile makes it a high-priority patch target.
Veeam ONE's Reporter service exposes an improper privilege management flaw (CWE-269) that enables a locally authenticated, high-privileged user to escalate into the Reporter service's security context, achieving full confidentiality, integrity, and availability impact on the vulnerable system. All versions of the product appear affected per the wildcard CPE string, and the vulnerability was responsibly disclosed via HackerOne. No public exploit code or active exploitation has been identified at time of analysis.
Privilege escalation in Liman MYS (HAVELSAN Inc.) versions 2.2.3 through pre-2.3.1 enables authenticated low-privilege users to gain administrator-level access via missing server-side authorization checks (CWE-862). The platform, a centralized Linux server management system used primarily in Turkish government and enterprise environments, fails to verify whether the requesting user has rights to perform privileged operations before executing them. No public exploit identified at time of analysis, but the CVSS 8.8 score with network vector and low privilege requirement makes this a high-priority patch target for any organization running the affected versions.
ASUSTOR Backup Plan (ABP) and EZSync (AES) background services run as NT AUTHORITY\SYSTEM and expose a file-based IPC channel whose AES encryption key is readable by standard users and recoverable via Windows DPAPI, allowing any authenticated local account to forge valid service requests. The services further fail to verify the identity of the requesting process and validate filesystem paths using an insufficient substring check, enabling directory traversal sequences to bypass path restrictions. A local attacker can chain these weaknesses to perform arbitrary file reads and writes as SYSTEM, achieving full local privilege escalation. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Privilege escalation in Adobe Campaign Classic (ACC) stems from an incorrect authorization flaw (CWE-863) that lets an attacker gain elevated privileges without any user interaction. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scores it 9.8 Critical, implying a network-reachable, low-complexity path to full compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so exploitation is currently theoretical based on the vendor advisory.
Server-Side Request Forgery in Adobe Campaign Classic (ACC) enables remote attackers to coerce the server into issuing crafted internal requests, resulting in privilege escalation without any user interaction. Adobe rates the flaw at the maximum CVSS 10.0 with a changed scope, indicating the SSRF pivots beyond the vulnerable component to compromise other systems or trust boundaries. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated, network-reachable nature makes it a top-priority patch.
Privilege escalation in Razer RzUpdateService 1.10.14.0 allows a local low-privileged user to gain SYSTEM-level access by manipulating the lpThreadParameter argument processed by the service's Named Pipe Handler. The service, which runs at elevated Windows privilege, fails to enforce proper privilege boundaries when handling named pipe input (CWE-269), enabling a local user to leverage the service's execution context against the underlying system. A public proof-of-concept is confirmed available; the vulnerability is not currently listed in CISA KEV, though the low attack complexity combined with the published POC elevates real-world risk in environments with Razer hardware deployed.
Authentication and authorization bypass in @fastify/aws-lambda 6.4.0 lets an unauthenticated remote attacker forge the entire AWS Lambda proxy event by setting a single client-controlled HTTP header. Because the request.awsLambda.event/context decoration reads the untrusted x-apigateway-event and x-apigateway-context headers before falling back to the trusted internal invocation token, any application that consults these values for identity or API Gateway authorizer claims can be tricked into granting attacker-chosen access, enabling full privilege escalation. Rated CVSS 9.1; no public exploit identified at time of analysis, but the attack is trivial and documented in the vendor advisory.
Privilege escalation in Telenia Software TVox allows any process running as the apache OS user to obtain full root-level command execution without a password, by exploiting a misconfigured vendor-supplied sudoers entry in /etc/sudoers.d/telenia that grants NOPASSWD execution of /bin/nice. Affected branches are 26.x up to and including 26.5.3, and 24.x up to and including 24.9.21. A public exploit is available via KarmaInsecurity advisory KIS-2026-16; no CISA KEV listing has been confirmed, though the trivial exploitation complexity and available proof-of-concept materially elevate real-world risk for any environment where the TVox web tier is reachable.
Incorrect default permissions in Synology Assistant before version 7.0.7-50095 expose locally created installation artifacts to unauthorized access, enabling low-privileged local users to read or write arbitrary files and trigger denial-of-service conditions during the installation window. The CVSS score of 7.3 (High) with C:H/I:H/A:H reflects the breadth of potential file system impact, though an EPSS of 0.13% (3rd percentile) and SSVC exploitation status of 'none' confirm no public exploitation activity at time of analysis. A vendor-released patch exists at version 7.0.7-50095, and no public exploit code has been identified.
Privilege escalation in the "Import and export users and customers" WordPress plugin before 2.4.2 lets a user who holds only the user-creation capability create a full administrator account and overwrite an existing administrator's password or email via the CSV import routine. The plugin fails to re-check WordPress role-assignment and per-user edit permissions on imported rows, so a low-tier account can seize total control of the site. Publicly available exploit code exists (reported by WPScan) and a vendor patch is available; EPSS is low (0.13%), indicating limited widescale exploitation so far despite the high CVSS of 9.1.
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT7921, MT7922, MT7925, MT7927) due to a missing permission check (CWE-862) that allows a standard user-level process to invoke restricted driver operations. An attacker with low-privilege local access can fully compromise confidentiality, integrity, and availability of the affected system without any user interaction. No public exploit identified at time of analysis; EPSS at 0.15% (5th percentile) and SSVC exploitation status of 'none' confirm negligible current exploitation activity.
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of its declared Android permissions - to invoke protected telephony operations by exploiting a missing authorization check (CWE-862). The flaw affects 35 MediaTek chipsets spanning the Helio and Dimensity families and yields high confidentiality and integrity impact over telephony functions such as call management and SMS routing. No public exploit has been identified and EPSS of 0.15% (5th percentile) indicates negligible current exploitation activity, though the zero-privilege-required nature of local exploitation lowers the attacker bar once device access is established.
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges without credentials or user interaction on chipsets MT7986, MT7916, MT7915, MT7981, and MT6890. The missing bounds check in the driver's AP-mode frame processing allows memory corruption that yields high confidentiality and integrity impact on the affected device. No public exploit has been identified and EPSS remains very low at 0.17%, though SSVC rates technical impact as total - underscoring the severity if a capable, range-proximate attacker develops working exploit code.