Privilege Escalation
Monthly
Local privilege escalation in Google Android/Pixel devices allows an already-running non-privileged app to bypass permission checks and gain elevated privileges through a logic error in the code. Exploitation requires the attacker to have existing local code execution at User level on an unpatched device, with no user interaction needed once the malicious or compromised app is running. No public exploit code or active exploitation is identified at time of analysis, and EPSS is low at 0.13% (percentile 3%).
An integer overflow in the Android VPU (video processing unit) driver's size handling leads to an out-of-bounds write in kernel memory, allowing a locally installed application to escalate privileges to kernel/system level on affected Pixel devices. Exploitation requires only local low-privileged access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) and no user interaction, making it attractive for a malicious or trojanized app. No public exploit code or CISA KEV listing was identified at time of analysis, and the EPSS signal is not provided; the vulnerability is addressed in the September 2026 Android/Pixel security bulletin.
Local privilege escalation in the Android kernel's fingerprint (gf) driver allows a process with access to the fingerprint device interface to corrupt kernel heap memory and gain root-level code execution. The flaw is a heap-based out-of-bounds write in gf_base_update_finger_base() within gf_base.c, exploitable with a low-privileged local context and no user interaction, consistent with a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N). Fixes are delivered through the Android/Pixel Security Bulletin dated 2026-09-01; no public exploit code or CISA KEV listing was identified at time of analysis.
An out-of-bounds write in the Wave6 VPU video-decoder driver (Wave6VpuDecFlush in wave6.c) lets an unprivileged local app corrupt kernel memory on affected Android devices, escalating to kernel-level privilege and full device compromise. The flaw requires local code execution - an attacker must already be able to run code on the device and reach the decoder's flush routine - but needs no user interaction and no prior elevated privileges (AV:L, PR:N, UI:N). It is not known to be actively exploited, has no identified public exploit code at time of analysis, and carries a low EPSS score of 0.11% (2nd percentile), making it a serious but locally-scoped privilege-escalation issue rather than an internet-facing emergency.
Remote exploitation of the cellular modem stack in Google Android devices allows an attacker who controls the radio path to trigger a heap-based out-of-bounds write and escalate privileges on the handset, without any user interaction. The supplied CVSS 3.1 base score of 8.8 reflects high confidentiality, integrity and availability impact, but its PR:L metric (low privileges required) conflicts with the vendor description stating that no additional execution privileges are needed. No public exploit code, EPSS score, or CISA KEV entry was included in the intelligence feed, so active exploitation is unconfirmed at the time of analysis.
An out-of-bounds write in the Goodix fingerprint trusted-application test handler (gf_ta_test_set_config in gf_ta_test.c) on Android allows a locally installed application holding low privileges to corrupt memory and escalate to kernel-level privileges without any user interaction. The flaw stems from improper validation of caller-supplied input reaching a memory-write path inside the fingerprint TA interface. Google addressed it in the Pixel security bulletin dated 2026-09-01; no public exploit code or CISA KEV entry was identified at time of analysis.
Local privilege escalation in the Android kernel (CVE-2026-0194) arises from an integer overflow that enables a permission bypass, allowing code already running on a device to elevate its privileges. The issue is local in scope: the assessed vector is AV:L/PR:L, meaning an attacker must first be able to execute code on the handset - for example through an installed malicious or compromised app - after which the overflow can be triggered with no user interaction and, per the description, no additional execution privileges. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; EPSS is low at roughly 0.12 percent (2nd percentile), and remediation is delivered through the September 2026 Pixel/Android security bulletin.
Local privilege escalation in Google Android's init process allows an unprivileged local app to bypass an access-control policy and gain elevated privileges on affected Android/Pixel builds. The root cause is a logic error in the ac_init_policy routine in init.c, tracked as CWE-693 (protection mechanism failure), and the vendor scores it 8.4 with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - no user interaction, no privileges required (PR:N), and no non-default configuration needed, though the attack is strictly local and requires the attacker to first get code running on the device. No public exploit code has been identified at time of analysis and EPSS is low (0.13%, 3rd percentile), so active exploitation is not confirmed; a fix is covered by the September 2026 Android/Pixel security bulletin.
An out-of-bounds write in Android's VP9 hardware decoder (Vp9DecodeFrameTag in vp9hwd_headers.cc) lets a crafted VP9 video stream corrupt memory in the codec context, giving an attacker code execution at the decoder's privilege level. Affected devices are those running Android builds that include the vulnerable VP9 hardware decoding path prior to the September 2026 Pixel security bulletin fix. No public exploit code or CISA KEV entry was identified at time of analysis, so exploitation appears to require a motivated actor with a delivery path for malicious media.
Local privilege escalation in pdfforge PDF Architect allows an attacker who already holds low-privileged code execution on a Windows host to hijack a library loaded by the product's activation-service (Update Service) process and run code as SYSTEM. The flaw is an uncontrolled search path element (CWE-427) in which the service resolves a DLL from a location an unprivileged user can write to, so no remote vector or user interaction is required once the foothold exists. It was reported through Trend Micro's Zero Day Initiative as ZDI-CAN-29536 / ZDI-26-615; no public exploit code, EPSS telemetry, or CISA KEV entry is present in the supplied data.
Local privilege escalation in the CrowdStrike Falcon sensor for Windows occurs when the Microsoft Office File Malicious Macro Removal policy setting is enabled, letting an unprivileged process race the sensor's macro-cleanup file operation (CWE-367) and write arbitrary files to protected locations, ultimately reaching SYSTEM-level privileges. Affected builds are the Falcon sensor for Windows at 7.34 and above, the 7.32 LTS line, and 7.16 on Windows 7/2008 R2; the CrowdStrike Laroux Malware Cleanup Tool is also affected, while Mac, Linux, and Legacy sensor platforms are not. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, though the CVSS 3.1 base score is 8.8.
Authenticated users holding only read-only (reader) privileges on an ArcadeDB database can escalate to arbitrary JVM scripting by POSTing a {"language":"js"} command to /api/v1/command/{database}, because the polyglot query engine never applies the database-administrator authorization check enforced on the SQL/Cypher paths. A cooperating sandbox flaw lets those scripts reflect from the bound database object through database.getClass().getClassLoader().loadClass to classes outside the allowedPackages whitelist, allowing an attacker to read arbitrary host files such as /etc/passwd and configuration files outside the database scope. Process creation remains blocked, so OS command execution is not confirmed; exploitation needs valid credentials and no user interaction, the flaw is fixed in ArcadeDB 26.7.1, and no public exploit code or CISA KEV entry was identified at time of analysis.
Privilege escalation in OpenBMC's phosphor-net-ipmid IPMI stack allows an attacker who already holds a valid low-privileged IPMI session to redirect that session's authorization context to a different, higher-privileged account while the original integrity and encryption keys stay in place, so no re-authentication ever occurs. Downstream vendors that package phosphor-net-ipmid — NVIDIA and H3C among them — inherit the flaw in their BMC firmware. Rated CVSS 8.8 with high confidentiality, integrity and availability impact; no public exploit code identified at time of analysis, and the issue is not listed in CISA KEV.
Authenticated privilege escalation in the Consulting WordPress theme (versions up to and including 6.7.16) lets any subscriber-level user take over a site as administrator by chaining two coding flaws. The theme's masterstudy_ms_stm_set_discard_transient AJAX action writes an attacker-chosen transient value without any capability check or nonce, and the theme's "developer access" login path trusts a transient value in legacy string mode, so an attacker can seed a known token and then log in as any existing account, including an admin. The CVSS score is 8.8 (network, low privileges, no user interaction, full confidentiality/integrity/availability impact); no EPSS score, KEV listing, or public exploit code was provided at time of analysis.
Improper privilege management in Mozilla Firefox's Enterprise Policies component lets a remote attacker escalate privileges inside the browser after convincing a user to interact with malicious content (CVSS 8.8, AV:N/AC:L/PR:N/UI:R). Successful exploitation yields high confidentiality, integrity and availability impact across the browser's security boundary, although CISA's SSVC assessment rates the flaw as not automatable and with no known exploitation. Fixes ship in Firefox 156 and Firefox ESR 153.3; no public exploit code or KEV listing has been identified at time of analysis.
Privilege escalation in Mozilla Firefox's Session Restore component (CWE-269) allows an attacker who lures a user into viewing crafted content to escape the normal browser security boundary and obtain elevated privileges inside the browser process. The issue is fixed in Firefox 156 and Firefox ESR 153.3, and the 8.8 rating reflects a network-delivered, unauthenticated attack that nonetheless requires victim interaction. No public exploit code or CISA KEV entry has been identified at time of analysis, so this is currently a patch-now flaw rather than a confirmed in-the-wild campaign.
Privilege escalation in the Mozilla Firefox DevTools component allows code running in a lower-privileged context to cross the DevTools/chrome privilege boundary and execute with elevated browser privileges; Firefox 156 and Firefox ESR 153.3 contain the fix. The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and classified CWE-269 (Improper Privilege Management), but CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and no public exploit code or KEV listing was observed at time of analysis. Notably, the network attack vector with user interaction suggests a page-delivered trigger rather than purely local DevTools misuse, though the advisory itself is terse.
Memory-corruption privilege escalation in Mozilla Firefox lets a remote attacker achieve arbitrary code execution at elevated privilege when a victim browses attacker-controlled web content — no account or credentials are required, but the CVSS vector (UI:R) confirms the victim must open the page. Mozilla fixed the flaw in Firefox 156 and Firefox ESR 153.3. No public exploit code and no CISA KEV listing were identified at time of analysis, and CISA's SSVC decision points rate exploitation as 'none' and automatable as 'no', so worm-like or mass-scanning abuse is not currently anticipated.
A privilege-escalation flaw in Mozilla Firefox's Graphics: CanvasWebGL component lets attacker-supplied web content cross a privilege boundary inside the browser, with high confidentiality, integrity and availability impact. The issue affects Firefox builds prior to 156 and Firefox ESR prior to 153.3, and exploitation requires the victim to load attacker-controlled content (UI:R) but no authentication (PR:N). No public exploit code has been identified and CISA's SSVC assessment records exploitation as 'none', so this is a patch-promptly issue rather than an emergency; the vendor has shipped fixed builds.
Privilege escalation in Mozilla Firefox affects all builds prior to Firefox 156 and Firefox ESR 153.3, stemming from use of uninitialized memory inside the Graphics: CanvasWebGL component. A remote attacker who gets a victim to render crafted WebGL canvas content can corrupt memory in the graphics path and potentially escalate privileges or execute arbitrary code in the browser's context — the CVSS vector confirms no authentication is required (PR:N) but user interaction is (UI:R). No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; Mozilla shipped fixes in Firefox 156 and Firefox ESR 153.3 per advisories MFSA2026-90 and MFSA2026-93.
A privilege-escalation flaw in Firefox's Crash Reporting component lets an attacker who can influence crash-report handling gain elevated privileges on the affected host, potentially leading to full compromise of confidentiality, integrity and availability. Exploitation is unauthenticated at the network layer (PR:N) but requires victim interaction (UI:R), and affects Firefox builds prior to 156 and Firefox ESR prior to 153.3. There is no public exploit identified at time of analysis, CISA KEV does not list this CVE, and CISA's SSVC framework rates exploitation as 'none' with automatable 'no', indicating a serious but not currently weaponized issue.
A memory-safety flaw in Firefox's Audio/Video component - a classic out-of-bounds write/overflow class issue caused by incorrect boundary checking - lets an attacker who convinces a user to open a crafted page or media file corrupt memory and escalate privileges to the level the browser process runs at. The issue affects Firefox branches prior to 156 and Firefox ESR prior to 153.3, and is reachable without authentication but requires user interaction. Mozilla has released fixed builds (Firefox 156, Firefox ESR 153.3) via advisories MFSA2026-90 and MFSA2026-93; there is no public exploit identified at time of analysis and CISA SSVC records exploitation as 'none'.
Privilege escalation in Mozilla Firefox for Android allows an attacker who can get a user to open a crafted web page to gain privileges beyond those normally granted to web content, with high impact to confidentiality, integrity, and availability. Mozilla fixed the flaw in Firefox 156; no public exploit code and no active exploitation have been identified, and CISA's SSVC assessment rates exploitation as 'none' with automatable 'no'. The 8.8 CVSS score is driven entirely by a network attack vector plus required user interaction (UI:R), so real-world risk depends on convincing a target to browse attacker-controlled content rather than on mass scanning.
An incorrect-bounds condition in Firefox's WebRender graphics component lets crafted web content corrupt memory inside the browser, giving the attacker a path to code execution and privilege escalation on the affected system. All Firefox releases before 156 are affected, along with the ESR branches before 115.41, 140.16, and 153.3; exploitation requires the victim to load attacker-influenced content (CVSS UI:R), and no public exploit code or CISA KEV entry has been recorded at time of analysis. With a CVSS base of 8.8 across full confidentiality, integrity, and availability impact, this is a high-severity browser flaw that should be patched on a normal browser-update cadence.
Privilege escalation in Mozilla Firefox's DOM: Service Workers component lets attacker-supplied web content break out of its intended privilege boundary and gain elevated capabilities inside the browser. The flaw affects Firefox before 156 and the ESR branches before 115.41, 140.16, and 153.3, and carries a CVSS base score of 8.8 with a user-interaction requirement (the victim must load attacker-controlled content). No public exploit code has been identified and CISA's SSVC assessment records exploitation as 'none' with 'automatable: no', so this is a high-severity patch-now issue rather than a known exploited threat.
Let me synthesize. CVE-2026-92015 — privilege escalation in Firefox WebExtensions. CVSS 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. CWE-269 improper privilege management. Fixed in Firefox 156, ESR 115.41, ESR 140.16, ESR 153.3. SSVC: exploitation none, automatable no, technical impact total. No KEV, no POC mentioned. Product name: "Firefox WebExtensions" — 1-3 words. Maybe "Mozilla Firefox" is safest but the specific component is WebExtensions. Let's use "Firefox WebExtensions". Hmm, guidance says product name 1-3 words, specific product. "Firefox WebExtensions" works. Summary: must not start with "A vulnerability". Start with impact verb + product. "Privilege escalation in Mozilla Firefox's WebExtensions component allows ..." Requires UI:R, so user interaction — a user must visit a page or install an extension? Description is vague. CVSS says AV:N/PR:N/UI:R. So an attacker could get a user to interact (e.g., install malicious extension or visit a page) which then allows privilege escalation from extension context to higher privileges (browser-level / OS-level?). CWE-269 improper privilege management. Be careful: we don't know exact mechanism beyond "privilege escalation in WebExtensions component". Confidence notes should state that the root cause mechanism is not described publicly beyond CWE-269; Bugzilla bug 2060235 is likely restricted. Affected products: Firefox < 156, ESR < 115.41, ESR < 140.16, ESR < 153.3. CPE cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*. Advisories mfsa2026-90 through -93. Remediation: upgrade to Firefox 156, ESR 115.41, ESR 140.16, ESR 153.3. Workarounds: restrict extension installation via enterprise policy (ExtensionSettings / blocked_install_message), disable WebExtensions? Not feasible. Mention that extension installation restrictions reduce exposure; trade-off: blocks all extension installs including legitimate ones. Prevalence: Firefox is widely deployed → high. Maybe "high" — ubiquitous is for OpenSSL/nginx/Linux kernel. Firefox
Incorrect boundary conditions in Firefox's Graphics component allow a privilege escalation that was fixed in Firefox ESR 115.41 and Firefox ESR 140.16. An attacker who can get a victim to load crafted content — a web page or similar rendered surface — can trigger a buffer overflow (CWE-120) in the graphics pipeline and potentially cross from the low-privilege content process into a more privileged browser context, yielding high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and CISA SSVC records exploitation status as 'none', though the CVSS base score of 8.8 and the total technical impact rating make patching a priority for any organization running an unpatched ESR branch.
Privilege escalation in Mozilla Firefox's Graphics: CanvasWebGL component lets a crafted web page corrupt memory and gain privileges beyond those normally granted to web content. Exploitation requires the victim to open a malicious page in an affected Firefox build (network vector, no authentication, user interaction required), after which an attacker can achieve high confidentiality, integrity and availability impact. Mozilla fixed the flaw in Firefox 156, Firefox ESR 115.41, ESR 140.16 and ESR 153.3; CISA SSVC records no known exploitation and the issue is not considered automatable, and no public exploit code has been identified at time of analysis.
A boundary-condition error in Firefox's Graphics: CanvasWebGL component allows an attacker who lures a victim to a crafted web page to corrupt memory and escalate privileges, with a CVSS base score of 8.8 reflecting high confidentiality, integrity, and availability impact. The flaw is a classic buffer overflow (CWE-120) in the WebGL/Canvas rendering path, reachable over the network with no authentication but requiring user interaction (UI:R) in the form of visiting attacker-controlled content. Mozilla has shipped fixes in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3, and no public exploit code or active exploitation has been identified at time of analysis.
A memory-corruption flaw in Mozilla Firefox's CanvasWebGL graphics component (incorrect boundary conditions, CWE-120) allows a remote attacker to crash or corrupt the browser's heap and potentially escalate privileges beyond the normal content-process security boundary. Every Firefox release before 156 and every ESR branch before 115.41, 140.16, and 153.3 is affected, and exploitation requires the victim to load attacker-controlled web content (CVSS 8.8, AV:N/AC:L/PR:N/UI:R). No public exploit code and no active exploitation are reported at time of analysis — CISA's SSVC records Exploitation: none and Automatable: no, so this is a patch-priority issue rather than an emergency.
Memory corruption in Mozilla Firefox's Graphics: CanvasWebGL component lets a web page that renders attacker-crafted WebGL content corrupt memory and escalate out of the browser's restricted process, yielding code execution at higher privilege. All Firefox builds before 156 are affected, with ESR branches fixed in 115.41, 140.16, and 153.3. No public exploit code exists and CISA SSVC records exploitation as 'none', so this is a high-severity patch-now bug rather than an active campaign.
An out-of-bounds write in Firefox's Graphics: CanvasWebGL component lets a malicious web page corrupt memory and gain elevated privileges on the host, affecting Firefox builds prior to 156 and the ESR branches prior to 115.41, 140.16, and 153.3. Exploitation is remote but requires the victim to load attacker-controlled WebGL/Canvas content (CVSS UI:R), so it is not automatable and no public exploit code or active exploitation has been identified at time of analysis. Mozilla rated it High (CVSS 8.8) with total technical impact under CISA's SSVC framework.
Incorrect boundary conditions in Firefox's Graphics: CanvasWebGL component allow a remote attacker who convinces a user to open a crafted page to corrupt memory and achieve code execution with the privileges of the browser. The flaw is a classic buffer overflow (CWE-120) rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R), meaning no authentication is needed but the victim must load attacker-controlled content. Mozilla fixed it in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3; no public exploit code has been identified and CISA's SSVC assessment records no active exploitation.
Privilege escalation in Mozilla Firefox's Graphics: CanvasWebGL component lets a remote, unauthenticated attacker corrupt memory via malformed WebGL content and gain elevated code execution inside the browser process, provided the victim loads an attacker-controlled page. Mozilla shipped fixes in Firefox 156, Firefox ESR 115.41, ESR 140.16, and ESR 153.3 (mfsa2026-90 through mfsa2026-93). CVSS is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), CISA SSVC records Exploitation: none and Automatable: no, no CISA KEV listing is present, and no public exploit code has been identified at time of analysis.
A memory-safety flaw in the Graphics: CanvasWebGL component of Mozilla Firefox allows a crafted web page to corrupt memory and escalate privileges beyond the browser's normal security boundary. Because exploitation only requires the victim to load attacker-controlled WebGL/Canvas content in an unpatched Firefox build, the issue affects all mainstream, ESR 115, ESR 140, and ESR 153 release trains prior to the fixed versions. Mozilla has released Firefox 156, Firefox ESR 115.41, ESR 140.16, and ESR 153.3, and while no public exploit code or CISA KEV entry has been identified at time of analysis, the CWE-120 buffer-condition root cause and CVSS 8.8 rating make prompt patching important.
Let me synthesize this. CVE-2026-76159: Duplicati for Windows before v2.4.0.0, incorrect permission assignment (CWE-732) in configuration loader, allows local low-priv attacker to escalate to SYSTEM via attacker-controlled preload.json. Product name: Duplicati. Tags include "Microsoft" which is likely a mislabeled tag — Duplicati is an independent open-source project (duplicati.com), not Microsoft. Though it runs on Windows... The tag "Microsoft" as vendor is wrong. Emit mislabeled_tag with target "Microsoft". Confidence high? Duplicati is an independent open-source backup tool, not Microsoft. Yes, high confidence. Missing tags? Maybe "windows" — since it's Windows-specific. Hmm, missing_tag target "Windows", suggested "windows". That's unambiguously implied ("Duplicati for Windows", MSI installers). Could emit. But careful — is "windows" a valid tag slug in their taxonomy? They said emit only when unambiguously implied. I'll include it with high confidence... Actually risk: their taxonomy may be "Microsoft Windows". Hmm. I'll include it maybe. Let's be a bit conservative but it seems clearly applicable. I'll include "windows" for missing_tag. Hmm, but if the slug doesn't exist it might attach a bad tag. The instructions say suggested is "lowercase hyphenated slug (e.g. target "WordPress", suggested "wordpress")". So "windows" is fine. Also "privilege-escalation" technique tag is already present as "Privilege Escalation". Fine. CVSS given is 4.0 base with E:X etc. Score 7.0. PR:L, AV:L, UI:P. Hmm, why UI:P? Probably because attacker needs to force the app to load the config... The preload.json is attacker-controlled — likely attacker with write access to a directory that gets loaded. Local low-priv attacker writes preload.json, then triggers service restart (UI:P passive — waiting for service restart/admin action). Anyway. My assessed CVSS 3.1: AV:L/AC:L/PR:L/UI:P? Hmm, UI:P isn't valid in 3.1. UI options: N, R. If user interaction required (someone must rest
Local privilege escalation in the scan_mysql actor of leapp-repository's leapp-upgrade-el9toel10 package allows code already running as the mysql OS account to obtain root on RHEL hosts during a RHEL 9 to RHEL 10 in-place upgrade. The actor invokes 'mysqld --validate-config' directly as root instead of via the packaged User=mysql systemd unit, so attacker-written persisted state (mysqld-auto.cnf pointing plugin_dir at the mysql-writable /var/lib/mysql) causes a malicious shared object to be dlopen()'d with UID 0 and full capabilities in the unconfined_t SELinux domain. Exploitation is not confirmed in the wild and no public exploit code was identified at time of analysis, but the upstream fix is public (leapp-repository PR 1343 / commit 3e4caff) and the CVSS score is 7.3 with all three impact metrics High.
Privilege escalation to full administrator equivalence in the Eventin event management plugin for WordPress allows any authenticated user who controls the user ID 1 account - regardless of their currently assigned role - to bypass every WordPress capability check and achieve remote code execution via the built-in plugin and theme editors. The flaw is rooted in PermissionManager::manage_permissions() unconditionally returning the always-true 'exist' capability primitive for all capability evaluations when the requesting user ID equals 1, granting blanket access to manage_options, edit_plugins, edit_themes, promote_users, and update_core. Exploitation is conditional on user ID 1 having been demoted to a lower-privilege role as a hardening measure; default installations where user ID 1 retains administrator rights are not impacted. No public exploit has been identified at time of analysis.
Sandbox escape in Apple iOS, iPadOS, and macOS allows a locally installed low-privileged malicious app to break out of its sandbox and gain elevated access to system resources, affecting iOS/iPadOS and macOS versions prior to 27 (macOS Golden Gate 27). Apple corrected the underlying permissions weakness (CWE-269, improper privilege management) by adding restrictions in the version 27 releases, so devices updated to iOS 27, iPadOS 27, or macOS Golden Gate 27 are remediated. The flaw is local-only with no remote or network trigger and requires the attacker to first get a malicious app onto the device; EPSS is 0.19% (8th percentile) and no public exploit identified at time of analysis, so risk is concentrated on devices that permit sideloaded, enterprise-provisioned, or otherwise untrusted applications.
Local privilege escalation in the NetworkManager-l2tp VPN plugin allows any local user who can create and activate their own L2TP profile to inject a newline into connection properties (vpn.data / vpn.secrets), so the root-running pluto daemon executes an attacker-supplied leftupdown command and yields root on the host. Fedora builds 1.52.0 through 1.52.3 and EPEL builds 1.20.0 through 1.20.23 are affected; fixed versions 1.52.4 and 1.20.24 are published upstream. There is no CISA KEV listing and no public exploit identified at time of analysis, although a public technical writeup of the 'newline to root' technique is referenced and the identical bug class was previously exploited in CVE-2018-10900 (NetworkManager-vpnc).
Privilege escalation in Apache Syncope allows an authenticated account that holds delegation-management rights to create or update delegations assigning Roles it does not own or Roles belonging to a realm subtree outside the scope it was authorized for, granting access beyond the intended administrative boundary. The flaw affects Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2, and is remediated by upgrading to 4.0.8 or 4.1.3. No public exploit identified at time of analysis, no CISA KEV listing, and EPSS is 0.48% (40th percentile); exploitation is post-authentication and depends on the delegation feature being in use, despite the published CVSS vector showing PR:N.
Authentication bypass via ID Token claim spoofing in Ping Identity PingAM allows a remote attacker to inject or override protected ID Token claims through a well-crafted request. In vulnerable configurations this lets an attacker impersonate other identities or escalate privileges by forging trusted claims that downstream relying parties consume. Ping Identity has released a patch; no public exploit is identified at time of analysis, and CISA SSVC records exploitation status as none.
Logitech's Logi Options+ updater service on Windows mishandles service-level privileges (CWE-269), exposing an attack surface that any authenticated local user can abuse to obtain a SYSTEM shell. With a proof-of-concept publicly documented on the amberwolf security blog, the exploitation barrier is minimal for any adversary already present on a Windows endpoint running the software. Organizations with broad Logitech peripheral deployments face meaningful privilege escalation risk if this path is chained with initial access obtained via phishing or credential compromise.
Privilege escalation in the User Registration & Membership WordPress plugin (versions 4.4.6 through pre-5.2.8) allows any subscriber-level authenticated user to be granted the WordPress role attached to a paid membership plan without completing payment, by exploiting a missing capability check and absent payment method and plan validation on the purchase endpoint. Where site administrators have configured membership plans mapped to privileged WordPress roles - including administrator - this results in full privilege escalation from subscriber to administrator without financial transaction. A publicly available proof-of-concept exploit from WPScan confirms the attack path is well-documented and reproducible against sites with open user registration.
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.8 allows any authenticated user holding an Author-level role or above to assign themselves an arbitrary WordPress role, including Administrator, resulting in full site takeover. The plugin fails to enforce server-side authorization checks when creating membership plans and when users attach plans to their own accounts, permitting role manipulation that bypasses WordPress's native access-control hierarchy. A publicly available exploit exists via WPScan, and the CVSS 7.2 score understates real-world risk because the provided PR:H metric conflicts with the description's requirement of only Author-level access - a low-privilege role - suggesting a closer real-world base score of approximately 8.8.
Privilege escalation in the MemberPress Corporate Accounts WordPress plugin (≤1.5.39) allows authenticated subscribers holding a corporate account to create new administrator accounts or hijack existing ones by overwriting their email addresses. The root cause is a mass assignment flaw in the `add_sub_account_user` function, which forwards the raw `userdata` POST array directly to WordPress's `wp_insert_user()` without stripping sensitive keys such as `role` or `ID`. Wordfence reported the vulnerability; a partial patch was released in version 1.5.39, meaning even the latest disclosed version may still be exploitable in some code paths. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the Add User Autocomplete WordPress plugin before 1.2 allows any authenticated user - including subscribers - to self-assign the administrator role on a WordPress multisite installation by submitting a crafted site-membership invitation request with an attacker-controlled role parameter. The plugin performs no capability check (no `current_user_can()`) and no nonce validation before accepting and creating the invitation, making the attack trivial for any account holder. No public exploit or CISA KEV listing is identified at time of analysis; EPSS sits at 0.13% (3rd percentile), but the low barrier (subscriber-level auth) makes any multisite deployment with this plugin a meaningful lateral escalation risk.
Unauthenticated site takeover in the WP Component WordPress plugin through version 2.2.4 stems from an AJAX-style action exposed to logged-out users that performs no capability or nonce validation and blindly writes an attacker-supplied option name and value. Because the handler can overwrite arbitrary wp_options entries, an attacker can flip 'users_can_register' on and set 'default_role' to administrator, then self-register an admin account. Reported by WPScan; carries CVSS 9.8 with EPSS 0.14% (3rd percentile) and no public exploit identified at time of analysis.
Privilege escalation in the Temporary Login Without Password WordPress plugin (versions 1.5 through 1.9.8) allows a site-level administrator on a WordPress multisite network to elevate their own account or grant a newly provisioned temporary login to network super admin status. The missing authorization check in the account-provisioning and account-promotion logic completely bypasses the multisite privilege boundary, enabling a subordinate site admin to seize control of the entire WordPress network without any additional user interaction. Vendor-released patch is available in version 1.9.9; no public exploit identified at time of analysis, and EPSS is low at 0.14%.
Privilege escalation in the Linux kernel CIFS/SMB client allows a local user with write access to a setuid or setgid binary on a CIFS mount to retain those elevated-execution bits on the server after a write operation that should have stripped them. The flaw exists in cifs_setattr_unix() and cifs_setattr_nounix(), which unconditionally dropped the ATTR_MODE flag when ATTR_KILL_SUID/ATTR_KILL_SGID was present, preventing the cleared mode from being propagated to the server when using cifsacl, modefromsid, SMB3.1.1 POSIX extensions, or SMB1 Unix extensions. An attacker who can write to a setuid binary on such a mount can subsequently execute it with unintended elevated privileges. No public exploit has been identified and EPSS is 0.21%, but vendor-confirmed patches are available in kernels 7.2.4, 6.18.51, and 7.3-rc1.
Out-of-bounds memory access in the Linux kernel's NTFS (ntfs3) driver arises because the mapping-pairs runlist decoder confirms that a run's starting LCN falls inside the volume but never checks that the run's end (lcn + length) also stays within nr_clusters. Mounting or parsing a crafted NTFS image can therefore drive the kernel to reference clusters beyond the volume boundary, corrupting memory and potentially escalating privilege. No public exploit has been identified and EPSS is low (0.20%), indicating this is a hardening/DoS-leaning fix rather than an imminent mass-exploitation threat.
Local privilege escalation in the Linux kernel BPF bloom filter implementation (bloom_map_alloc) affects 32-bit x86 kernels via two compounding integer arithmetic bugs: a BITS_TO_BYTES(U32_MAX) wrap at allocation time causes under-allocation of the bitset, and a u32-to-signed-long sign-extension in set_bit/test_bit causes negative bit offsets, enabling out-of-bounds kernel heap reads and writes. Exploitation requires a process holding CAP_BPF on a 32-bit x86 kernel; 64-bit kernels are entirely unaffected. No public exploit identified at time of analysis; EPSS at 0.20% reflects the narrow attack surface imposed by the 32-bit-only constraint.
Privilege escalation in the SMS Alert Order Notifications WordPress plugin (versions ≤ 3.9.9) allows any authenticated subscriber - the lowest standard WordPress role - to elevate their account privileges, potentially gaining full administrative control over the affected site. The CVSS 8.8 score with PR:L confirms that only a low-privileged account is required, making exploitation accessible to any registered user on the platform. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Privilege escalation in the Gato GraphQL WordPress plugin (versions ≤ 19.2.3) allows authenticated subscribers - the lowest registered-user role in WordPress - to elevate their access beyond their assigned privileges. The root cause is CWE-266 (Incorrect Privilege Assignment), where the plugin's GraphQL endpoint handling fails to properly gate privileged operations against low-privilege requestors. No confirmed active exploitation or public POC is identified at time of analysis, but the trivially low access bar of a subscriber account combined with full CIA impact makes this a high-priority finding for any WordPress installation running this plugin.
Local privilege escalation in the ST Engineering iDirect iQ200 VSAT satellite terminal (firmware 23.0.1.0) allows a holder of the factory-installed low-privilege field-technician account to gain full administrative control of the device. Because the low-privilege account ships pre-configured on every unit, no credentials must be phished, obtained, or brute-forced - the initial foothold is built in. No public exploit has been identified at time of analysis; the flaw was reported through CISA ICS-CERT (advisory ICSA-26-183-01).
Local privilege escalation in Pardus-software (the software center for TUBITAK BILGEM's Pardus Linux distribution) allows a low-privileged local user to gain full system control. The flaw stems from incorrect privilege assignment (CWE-266), where the application grants elevated permissions to processes or objects that should operate with restricted rights, enabling an authenticated local user to escalate to root or equivalent. Versions before 1.0.5 are affected; no public exploit or active exploitation has been identified at time of analysis.
Sandbox/permission-restriction bypass in the Hugo static site generator (versions after v0.43, fixed in v0.165.0) lets a Node tool invoked during a build read and write files outside the project's working directory. Because TailwindCSS ships in the default security.exec.allow list and must be run with highly permissive Node flags (--allow-addons, --allow-child-process, --allow-worker), the Node permission model that was supposed to contain build tools (from the fix for GHSA-x597-9fr4-5857) is effectively neutralized. Reported by VulnCheck; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation in MultiVendorX WordPress plugin before 5.0.16 allows authenticated vendor-role users to grant administrator-level WordPress capabilities to the vendor role, enabling full site takeover. The plugin's role and capability settings update mechanism fails to enforce access boundaries, letting any vendor - a legitimately registered but low-privileged marketplace seller - rewrite role permissions without restriction. A publicly available exploit exists via WPScan, and the vendor has released a patch in version 5.0.16.
Privilege escalation and arbitrary code execution affect Netskope Endpoint DLP (EPDLP) on Windows, where a privileged local user can send a crafted message to the EPDLP inter-process communication port to trigger a CWE-190 integer overflow, corrupting process memory. The vulnerability is gated behind two explicit non-default conditions - the EPDLP module must be active in the client configuration, and Windows Memory Integrity (HVCI/VBS) must be disabled on the host. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Container escape in IBM Aspera Enterprise WebApps 1.0.0-1.0.5 allows a local attacker with low privileges inside the container to break out to the underlying host due to unrestricted system call access. The CVSS vector (S:C/C:H/I:H/A:H) reflects full host compromise as the post-escape impact, not merely container-level damage. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; IBM has released a patch.
Denial of service in IBM Db2 11.5.0-11.5.9 and 12.1.0-12.1.5 allows a low-privileged authenticated network user to disable specific server functionality under certain conditions, producing both availability and integrity impact. The root cause is CWE-269 (Improper Privilege Management): the server fails to enforce correct privilege boundaries around a particular Db2 operation, allowing a user whose authorization should not extend to that action to invoke it. No public exploit has been identified at time of analysis; IBM has released a patch and the vendor advisory is the sole remediation reference.
Privilege escalation in the Lenovo Filez Client application allows a local authenticated user to gain elevated system rights via improper file or directory permissions (CWE-276). The CVSS 4.0 score of 8.5 reflects a meaningful local attack path with low complexity and no special attack requirements, though exploitation is bounded by the requirement for an existing local foothold. No active exploitation or public proof-of-concept has been identified at time of analysis.
Improper privilege management in IBM WebSphere Application Server 8.5 and 9.0 lets an authenticated user who holds a low-privilege administrative role modify security configuration, resulting in information disclosure or denial of service. The flaw is remotely reachable with low complexity (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N) but requires valid administrative credentials, so it is an insider/privileged-abuse issue rather than an unauthenticated attack path. EPSS is only 0.19% (9th percentile), there is no CISA KEV listing and no public exploit identified at time of analysis; IBM has published a fix.
Local privilege escalation to root affects the Backup Manager component of WebPros Plesk, where a time-of-check-to-time-of-use race condition during backup restore allows an attacker to abuse insecure symlink following and take ownership of arbitrary files or directories. A low-privileged Plesk account holder who wins the race can redirect a root-executed restore operation onto attacker-chosen paths, gaining full root control of the hosting server. No public exploit is identified at time of analysis, and it is not listed in CISA KEV.
Local privilege escalation in gvfs's privileged gvfsd-admin daemon affects Red Hat Enterprise Linux 6 through 10, allowing an authenticated local attacker to obtain root access. The daemon's use of symlink-following chown() on attacker-controlled directory paths creates a TOCTOU window during D-Bus socket setup. By racing the operation and substituting a symlink to a root-owned file such as /etc/pam.d/su, an attacker causes the daemon to transfer ownership of that critical file to the attacker's UID, enabling subsequent modification and full privilege escalation to root.
Unauthenticated privilege escalation in the SiteSkite WordPress plugin (versions ≤ 2.1.5) allows a remote attacker to gain elevated privileges within a WordPress installation without any authentication. The vulnerability is classified under CWE-266 (Incorrect Privilege Assignment), meaning the plugin incorrectly grants elevated roles or capabilities during some reachable code path. With full C:H/I:H/A:H impact and PR:N, successful exploitation results in complete compromise of the affected WordPress site, though AC:H signals a non-trivial exploitation condition such as a race condition, specific request sequence, or timing-dependent logic.
OpenPanel's server-side mutation resolvers fail to enforce project access levels, allowing read-only project members to execute 26 of 29 write operations that should be restricted to higher-privileged roles. Affected actions include deleting reports and dashboards, scheduling entire projects for deletion, publishing private analytics to public share links, and modifying alerting rules - all achievable by any user with the lowest valid project membership tier. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; organizations should consult GitHub Security Advisory GHSA-f9rx-pxgw-c6rg for patch details.
Privilege escalation in capgo.app (npm package `capgo` ≤ 12.207.1) allows an authenticated org_member to promote an external account to org_admin or org_billing_admin by exploiting a missing role-rank comparison in the `validateInvite()` function of the invite-new-user Edge Function. The invitation-acceptance path compounds the issue by using the Supabase service-role key, which bypasses two dedicated database triggers designed to enforce privilege boundaries, resulting in full administrative control over the organization's apps, channels, members, and billing. No public exploit is identified at time of analysis; an upstream fix is available via PR #3096.
Container escape in crun >= 1.29, when built with libkrun and started rootful with passt networking (krun.use_passt), allows an attacker who controls the container image to execute arbitrary code with host root privileges. This is a regression introduced in crun 1.29, meaning environments that recently upgraded are at risk while those on earlier versions are not. No public exploit code or CISA KEV listing has been identified at time of analysis, but successful exploitation yields full host compromise via container escape.
Privilege escalation in the Registration Form for WooCommerce WordPress plugin (versions before 1.1.3) allows any authenticated Contributor-level user to register new WordPress accounts with arbitrary roles, including Administrator. The plugin fails to verify that the form ID supplied during registration belongs to a legitimate registration form, instead blindly reading the permitted-role allow-list from any post the attacker controls. Exploitation results in full site takeover. A publicly available proof-of-concept exists. This vulnerability is an incomplete fix of a prior privilege escalation issue tracked as CVE-2026-54807.
Privilege escalation in the Bulk Password Reset WordPress plugin (all versions ≤1.3.3) allows any authenticated subscriber-level user to perform a full administrative account takeover. The plugin fails to validate the requesting user's identity before permitting bulk password changes and email-address updates, meaning an attacker can redirect an administrator's email to an attacker-controlled address, then invoke the standard WordPress password-reset flow to obtain reset credentials for that admin account. No public exploit code has been identified at time of analysis, but source code references from WordPress Plugin Trac directly expose the vulnerable functions at lines 44, 594, 659, and 679 of bulk_password_reset.php.
Improper privilege management in Open WebUI 0.10.0 through 0.11.0 allows any authenticated low-privilege user with write access to a knowledge base to delete administrator-owned external connection configurations shared across the entire instance. The DELETE /api/v1/knowledge/{id}/delete endpoint in knowledge.py correctly validated the user's write access to their own knowledge base but then cascaded the delete to the underlying shared external connection without verifying admin role or checking whether other knowledge bases depended on that connection. This means a single non-admin user can render all other knowledge bases on the instance that share the same external vector store connection permanently unavailable. No public exploit has been identified at time of analysis; vendor-released patch is available in version 0.11.1.
Privilege escalation to root in Schneider Electric PowerLogic T300 (versions 2.9.8-5620 and prior) is achievable by an authenticated SSH user through OS command injection in the device's operating system console. An attacker with high-privilege SSH access can inject shell metacharacters into user-controlled console input that the device fails to properly sanitize, breaking out of the intended command context to execute arbitrary commands as root and perform unauthorized administrative operations. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 score of 8.7 reflects subsequent-system impact rated High, consistent with the device's ICS/energy-metering deployment context.
Privilege escalation in Snipe-IT before 8.7.0 allows any authenticated user to bypass authorization controls by replaying signed Livewire component snapshots directly against the /livewire/update endpoint. Because authorization is enforced only at the HTTP route layer and not within Livewire component lifecycle methods, a low-privilege session holder can invoke protected admin operations including creating OAuth clients, minting personal access tokens, and reading sensitive administrative data. No active exploitation has been confirmed (no CISA KEV listing), but the vendor-confirmed fix is available in version 8.7.0.
Privilege escalation in the Portworx Operator on Red Hat OpenShift (OCP) allows a low-privileged, namespace-scoped user to cause the operator to assign cluster-wide permissions beyond what the user was authorized to hold. The flaw (CWE-266, Incorrect Privilege Assignment) is constrained to the initial provisioning phase of a Portworx storage cluster, meaning the exploitation window is finite but deliberate timing by an insider or a compromised account could reliably hit it. No public exploit code has been identified and the vulnerability is absent from CISA KEV; the CVSS 4.0 score of 7.7 reflects high confidentiality, integrity, and availability impact when the specific provisioning condition is met.
Local privilege escalation in ESET AV Remover (standalone) enables a low-privileged local user to attain SYSTEM-level control by sending specially crafted RPC messages to the tool's privileged service component. The root cause is CWE-269 (Improper Privilege Management): the RPC handler fails to enforce access controls commensurate with the operations it exposes, allowing an unprivileged caller to invoke functionality that executes at a higher privilege level. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.
Privilege escalation in YITH WooCommerce Waitlist Premium for WordPress (versions ≤3.35.0) allows any subscriber-level authenticated user to manufacture a new WordPress administrator account, achieving full site takeover. The vulnerable AJAX handler add_user_in_waiting_list() is exposed to all logged-in users with no nonce or capability check, and applies parse_str() plus extract() to attacker-supplied POST data before passing the injected variables directly to wp_create_user() and $user->set_role(). No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack mechanics are trivially derivable from the Wordfence disclosure.
Privilege escalation in PublishPress Capabilities WordPress plugin (all versions ≤2.50.0) allows authenticated Editor-level users to elevate to site-wide capability managers without administrator consent. The root cause is a hard-coded role assignment in `addPluginCapabilities()` that unconditionally grants the Editor role all 15 `manage_capabilities_*` capabilities on the first `admin_init` hook after plugin activation, writing the grants persistently to the WordPress database. Once escalated, an Editor can create, rename, and delete non-system roles; modify capabilities of non-administrator roles; restore role backups; and write arbitrary plugin options under several namespaced prefixes - stopping short of full Administrator access only because WordPress's `map_meta_cap` layer blocks further escalation. No public exploit or CISA KEV listing identified at time of analysis.
WP EasyCart (Shopping Cart & eCommerce Store) versions up to and including 5.9.3 exposes a privilege escalation path allowing authenticated Store Manager-level users to promote themselves to WordPress administrator. The `ec_ajax_save_page_default_options()` AJAX handler accepts arbitrary POST parameters and writes them directly to the WordPress options table via `update_option()` without any allowlist, while its nonce is embedded in frontend product and category templates accessible to any user holding the plugin's custom 'wpec_manager' capability. No public exploit code has been identified at time of analysis, but the attack technique is mechanically straightforward and requires only a Store Manager credential to execute.
Remote code execution in FireBox - WooCommerce Popup Builder (all versions ≤ 3.1.10) allows authenticated Author-level attackers to execute arbitrary PHP on the server by injecting unsanitized PHP expressions into campaign condition rules via the `firebox_meta` REST endpoint. The plugin's `Executer::allowedToRun()` blacklist (Executer.php L231) uses a trivially bypassable regex that permits WordPress core functions such as `wp_insert_user`, `update_option`, and `file_put_contents`, which the `value` function in the PHP Conditions class then evaluates directly. Critically, sites migrated from any version prior to 3.1.10 are automatically subjected to `Migrator::preserveCampaignRoleAccess()`, which grants Author-role users `edit_fireboxes` and `publish_fireboxes` capabilities, making exploitation reachable from any registered Author account with no further privilege requirements. No public exploit code or CISA KEV listing has been confirmed at time of analysis.
Privilege elevation in Chrome's WebUI component prior to version 153.0.8010.36 enables sandbox escape and arbitrary code execution outside the browser sandbox when the renderer process has already been compromised. This is a second-stage, chained exploit: an attacker must first achieve renderer-level code execution (e.g., via a separate renderer bug) and then leverage this WebUI flaw (CWE-250 - execution with unnecessary privileges) to break out of the sandbox. No public exploit code has been identified and no CISA KEV listing exists; SSVC rates automatable exploitation as 'no', consistent with the multi-step chain requirement.
Local privilege escalation in Waves Central for macOS (versions up to 16.6.2) allows any authenticated local user to gain root code execution by abusing a flawed XPC client authorization scheme in the product's privileged helper service. The helper validates connecting XPC clients by performing a certificate-chain equality comparison against itself rather than enforcing a pinned code requirement (application identifier and Apple Team ID), meaning any process carrying the Waves signing certificate can impersonate a legitimate client and instruct the helper to run arbitrary scripts as root. No public exploit has been identified at time of analysis; a vendor-released fix is available in version 17.0.
Privilege escalation in Adobe Acrobat Reader and Adobe Acrobat (all editions through 26.002.21900 and Acrobat 2024 through 24.001.30383) allows a low-privileged local attacker to gain full elevated access via an Incorrect Authorization flaw (CWE-863). The CVSS scope-change indicator (S:C) with C:H/I:H/A:H confirms the vulnerability crosses a privilege boundary beyond Acrobat's own security domain - almost certainly compromising the underlying OS context. No user interaction is required, enabling silent exploitation once a foothold is established. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation and local code execution affect the OpenTelemetry.Resources.Host NuGet package (opentelemetry-dotnet-contrib) on macOS prior to version 1.16.0-beta.2. The host.id resource attribute detector invokes sh and ioreg using bare names resolved through the PATH environment variable rather than absolute paths, allowing a local attacker with fewer privileges than the host application to substitute malicious binaries and execute arbitrary code in the application's security context. No public exploit has been identified at time of analysis; Linux and Windows hosts are explicitly unaffected.
Local privilege escalation in Maono Link 3.8.13 on Windows enables any standard user account to gain elevated service-level privileges by writing a malicious payload to C:\ProgramData\Maono. The MaonoAiServices Windows service runs with elevated OS privileges while leaving its data directory writable by unprivileged local users - a classic insecure service directory permission pattern (CWE-428). Vendor patch 4.0.80 is available; no public exploit has been identified at time of analysis.
Unauthorized file transfer and execution in the ConnectWise ScreenConnect client (all versions prior to 26.6.5) lets a party to an active remote session push and run files on the Host machine without authorization or the Host's confirmation under certain circumstances. This turns a legitimate support session into a code-execution channel against the remote endpoint; ScreenConnect servers are explicitly not affected. No public exploit identified at time of analysis, though the client's remote-support role makes it an attractive target.
Local information disclosure in Android Wear (Wear OS) versions 14, 16, and 17 lets a co-resident application read sensitive device state data because checkReadPermission in PermissionsManager.java fails to enforce a required permission. No additional execution privileges or user interaction are needed, so any installed app can silently monitor protected state. No public exploit identified at time of analysis, and the flaw is fixed in the September 2026 Wear security patch level.
Local privilege escalation in Android XR 14's MicroXR Blobstore component lets a co-resident malicious app read files belonging to other applications because a required permission check is missing. Any app installed on the device can exploit it with no user interaction and no elevated privileges, exposing another app's stored blobs. No public exploit identified at time of analysis; this is a Google/Android XR platform issue tracked in the September 2026 Android XR security bulletin.
Incorrect Authorization (CWE-863) in Adobe Commerce and Magento Open Source allows unauthenticated remote attackers to escalate privileges and gain write access to restricted platform resources without user interaction. Scope change is confirmed: successful exploitation crosses privilege boundaries within the Commerce platform, granting access to administrative or otherwise protected functionality. SSVC classifies technical impact as total and the attack as automatable, elevating operational priority despite no active exploitation currently recorded in CISA KEV.
Incorrect Authorization in Adobe Commerce, Magento Open Source, and Adobe Commerce B2B allows remote unauthenticated attackers to bypass access controls and read sensitive platform data, achieving a privilege-escalation effect without any user interaction. The flaw stems from CWE-863 (Incorrect Authorization), where authorization checks fail to enforce the correct permission boundaries, letting an unauthenticated network request access resources restricted to higher-privilege roles. No public exploit code has been identified at time of analysis, but the combination of PR:N and C:H on a major e-commerce platform makes this a meaningful exposure for confidential business and customer data.
Local privilege escalation in Google Android/Pixel devices allows an already-running non-privileged app to bypass permission checks and gain elevated privileges through a logic error in the code. Exploitation requires the attacker to have existing local code execution at User level on an unpatched device, with no user interaction needed once the malicious or compromised app is running. No public exploit code or active exploitation is identified at time of analysis, and EPSS is low at 0.13% (percentile 3%).
An integer overflow in the Android VPU (video processing unit) driver's size handling leads to an out-of-bounds write in kernel memory, allowing a locally installed application to escalate privileges to kernel/system level on affected Pixel devices. Exploitation requires only local low-privileged access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) and no user interaction, making it attractive for a malicious or trojanized app. No public exploit code or CISA KEV listing was identified at time of analysis, and the EPSS signal is not provided; the vulnerability is addressed in the September 2026 Android/Pixel security bulletin.
Local privilege escalation in the Android kernel's fingerprint (gf) driver allows a process with access to the fingerprint device interface to corrupt kernel heap memory and gain root-level code execution. The flaw is a heap-based out-of-bounds write in gf_base_update_finger_base() within gf_base.c, exploitable with a low-privileged local context and no user interaction, consistent with a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N). Fixes are delivered through the Android/Pixel Security Bulletin dated 2026-09-01; no public exploit code or CISA KEV listing was identified at time of analysis.
An out-of-bounds write in the Wave6 VPU video-decoder driver (Wave6VpuDecFlush in wave6.c) lets an unprivileged local app corrupt kernel memory on affected Android devices, escalating to kernel-level privilege and full device compromise. The flaw requires local code execution - an attacker must already be able to run code on the device and reach the decoder's flush routine - but needs no user interaction and no prior elevated privileges (AV:L, PR:N, UI:N). It is not known to be actively exploited, has no identified public exploit code at time of analysis, and carries a low EPSS score of 0.11% (2nd percentile), making it a serious but locally-scoped privilege-escalation issue rather than an internet-facing emergency.
Remote exploitation of the cellular modem stack in Google Android devices allows an attacker who controls the radio path to trigger a heap-based out-of-bounds write and escalate privileges on the handset, without any user interaction. The supplied CVSS 3.1 base score of 8.8 reflects high confidentiality, integrity and availability impact, but its PR:L metric (low privileges required) conflicts with the vendor description stating that no additional execution privileges are needed. No public exploit code, EPSS score, or CISA KEV entry was included in the intelligence feed, so active exploitation is unconfirmed at the time of analysis.
An out-of-bounds write in the Goodix fingerprint trusted-application test handler (gf_ta_test_set_config in gf_ta_test.c) on Android allows a locally installed application holding low privileges to corrupt memory and escalate to kernel-level privileges without any user interaction. The flaw stems from improper validation of caller-supplied input reaching a memory-write path inside the fingerprint TA interface. Google addressed it in the Pixel security bulletin dated 2026-09-01; no public exploit code or CISA KEV entry was identified at time of analysis.
Local privilege escalation in the Android kernel (CVE-2026-0194) arises from an integer overflow that enables a permission bypass, allowing code already running on a device to elevate its privileges. The issue is local in scope: the assessed vector is AV:L/PR:L, meaning an attacker must first be able to execute code on the handset - for example through an installed malicious or compromised app - after which the overflow can be triggered with no user interaction and, per the description, no additional execution privileges. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; EPSS is low at roughly 0.12 percent (2nd percentile), and remediation is delivered through the September 2026 Pixel/Android security bulletin.
Local privilege escalation in Google Android's init process allows an unprivileged local app to bypass an access-control policy and gain elevated privileges on affected Android/Pixel builds. The root cause is a logic error in the ac_init_policy routine in init.c, tracked as CWE-693 (protection mechanism failure), and the vendor scores it 8.4 with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - no user interaction, no privileges required (PR:N), and no non-default configuration needed, though the attack is strictly local and requires the attacker to first get code running on the device. No public exploit code has been identified at time of analysis and EPSS is low (0.13%, 3rd percentile), so active exploitation is not confirmed; a fix is covered by the September 2026 Android/Pixel security bulletin.
An out-of-bounds write in Android's VP9 hardware decoder (Vp9DecodeFrameTag in vp9hwd_headers.cc) lets a crafted VP9 video stream corrupt memory in the codec context, giving an attacker code execution at the decoder's privilege level. Affected devices are those running Android builds that include the vulnerable VP9 hardware decoding path prior to the September 2026 Pixel security bulletin fix. No public exploit code or CISA KEV entry was identified at time of analysis, so exploitation appears to require a motivated actor with a delivery path for malicious media.
Local privilege escalation in pdfforge PDF Architect allows an attacker who already holds low-privileged code execution on a Windows host to hijack a library loaded by the product's activation-service (Update Service) process and run code as SYSTEM. The flaw is an uncontrolled search path element (CWE-427) in which the service resolves a DLL from a location an unprivileged user can write to, so no remote vector or user interaction is required once the foothold exists. It was reported through Trend Micro's Zero Day Initiative as ZDI-CAN-29536 / ZDI-26-615; no public exploit code, EPSS telemetry, or CISA KEV entry is present in the supplied data.
Local privilege escalation in the CrowdStrike Falcon sensor for Windows occurs when the Microsoft Office File Malicious Macro Removal policy setting is enabled, letting an unprivileged process race the sensor's macro-cleanup file operation (CWE-367) and write arbitrary files to protected locations, ultimately reaching SYSTEM-level privileges. Affected builds are the Falcon sensor for Windows at 7.34 and above, the 7.32 LTS line, and 7.16 on Windows 7/2008 R2; the CrowdStrike Laroux Malware Cleanup Tool is also affected, while Mac, Linux, and Legacy sensor platforms are not. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, though the CVSS 3.1 base score is 8.8.
Authenticated users holding only read-only (reader) privileges on an ArcadeDB database can escalate to arbitrary JVM scripting by POSTing a {"language":"js"} command to /api/v1/command/{database}, because the polyglot query engine never applies the database-administrator authorization check enforced on the SQL/Cypher paths. A cooperating sandbox flaw lets those scripts reflect from the bound database object through database.getClass().getClassLoader().loadClass to classes outside the allowedPackages whitelist, allowing an attacker to read arbitrary host files such as /etc/passwd and configuration files outside the database scope. Process creation remains blocked, so OS command execution is not confirmed; exploitation needs valid credentials and no user interaction, the flaw is fixed in ArcadeDB 26.7.1, and no public exploit code or CISA KEV entry was identified at time of analysis.
Privilege escalation in OpenBMC's phosphor-net-ipmid IPMI stack allows an attacker who already holds a valid low-privileged IPMI session to redirect that session's authorization context to a different, higher-privileged account while the original integrity and encryption keys stay in place, so no re-authentication ever occurs. Downstream vendors that package phosphor-net-ipmid — NVIDIA and H3C among them — inherit the flaw in their BMC firmware. Rated CVSS 8.8 with high confidentiality, integrity and availability impact; no public exploit code identified at time of analysis, and the issue is not listed in CISA KEV.
Authenticated privilege escalation in the Consulting WordPress theme (versions up to and including 6.7.16) lets any subscriber-level user take over a site as administrator by chaining two coding flaws. The theme's masterstudy_ms_stm_set_discard_transient AJAX action writes an attacker-chosen transient value without any capability check or nonce, and the theme's "developer access" login path trusts a transient value in legacy string mode, so an attacker can seed a known token and then log in as any existing account, including an admin. The CVSS score is 8.8 (network, low privileges, no user interaction, full confidentiality/integrity/availability impact); no EPSS score, KEV listing, or public exploit code was provided at time of analysis.
Improper privilege management in Mozilla Firefox's Enterprise Policies component lets a remote attacker escalate privileges inside the browser after convincing a user to interact with malicious content (CVSS 8.8, AV:N/AC:L/PR:N/UI:R). Successful exploitation yields high confidentiality, integrity and availability impact across the browser's security boundary, although CISA's SSVC assessment rates the flaw as not automatable and with no known exploitation. Fixes ship in Firefox 156 and Firefox ESR 153.3; no public exploit code or KEV listing has been identified at time of analysis.
Privilege escalation in Mozilla Firefox's Session Restore component (CWE-269) allows an attacker who lures a user into viewing crafted content to escape the normal browser security boundary and obtain elevated privileges inside the browser process. The issue is fixed in Firefox 156 and Firefox ESR 153.3, and the 8.8 rating reflects a network-delivered, unauthenticated attack that nonetheless requires victim interaction. No public exploit code or CISA KEV entry has been identified at time of analysis, so this is currently a patch-now flaw rather than a confirmed in-the-wild campaign.
Privilege escalation in the Mozilla Firefox DevTools component allows code running in a lower-privileged context to cross the DevTools/chrome privilege boundary and execute with elevated browser privileges; Firefox 156 and Firefox ESR 153.3 contain the fix. The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and classified CWE-269 (Improper Privilege Management), but CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and no public exploit code or KEV listing was observed at time of analysis. Notably, the network attack vector with user interaction suggests a page-delivered trigger rather than purely local DevTools misuse, though the advisory itself is terse.
Memory-corruption privilege escalation in Mozilla Firefox lets a remote attacker achieve arbitrary code execution at elevated privilege when a victim browses attacker-controlled web content — no account or credentials are required, but the CVSS vector (UI:R) confirms the victim must open the page. Mozilla fixed the flaw in Firefox 156 and Firefox ESR 153.3. No public exploit code and no CISA KEV listing were identified at time of analysis, and CISA's SSVC decision points rate exploitation as 'none' and automatable as 'no', so worm-like or mass-scanning abuse is not currently anticipated.
A privilege-escalation flaw in Mozilla Firefox's Graphics: CanvasWebGL component lets attacker-supplied web content cross a privilege boundary inside the browser, with high confidentiality, integrity and availability impact. The issue affects Firefox builds prior to 156 and Firefox ESR prior to 153.3, and exploitation requires the victim to load attacker-controlled content (UI:R) but no authentication (PR:N). No public exploit code has been identified and CISA's SSVC assessment records exploitation as 'none', so this is a patch-promptly issue rather than an emergency; the vendor has shipped fixed builds.
Privilege escalation in Mozilla Firefox affects all builds prior to Firefox 156 and Firefox ESR 153.3, stemming from use of uninitialized memory inside the Graphics: CanvasWebGL component. A remote attacker who gets a victim to render crafted WebGL canvas content can corrupt memory in the graphics path and potentially escalate privileges or execute arbitrary code in the browser's context — the CVSS vector confirms no authentication is required (PR:N) but user interaction is (UI:R). No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; Mozilla shipped fixes in Firefox 156 and Firefox ESR 153.3 per advisories MFSA2026-90 and MFSA2026-93.
A privilege-escalation flaw in Firefox's Crash Reporting component lets an attacker who can influence crash-report handling gain elevated privileges on the affected host, potentially leading to full compromise of confidentiality, integrity and availability. Exploitation is unauthenticated at the network layer (PR:N) but requires victim interaction (UI:R), and affects Firefox builds prior to 156 and Firefox ESR prior to 153.3. There is no public exploit identified at time of analysis, CISA KEV does not list this CVE, and CISA's SSVC framework rates exploitation as 'none' with automatable 'no', indicating a serious but not currently weaponized issue.
A memory-safety flaw in Firefox's Audio/Video component - a classic out-of-bounds write/overflow class issue caused by incorrect boundary checking - lets an attacker who convinces a user to open a crafted page or media file corrupt memory and escalate privileges to the level the browser process runs at. The issue affects Firefox branches prior to 156 and Firefox ESR prior to 153.3, and is reachable without authentication but requires user interaction. Mozilla has released fixed builds (Firefox 156, Firefox ESR 153.3) via advisories MFSA2026-90 and MFSA2026-93; there is no public exploit identified at time of analysis and CISA SSVC records exploitation as 'none'.
Privilege escalation in Mozilla Firefox for Android allows an attacker who can get a user to open a crafted web page to gain privileges beyond those normally granted to web content, with high impact to confidentiality, integrity, and availability. Mozilla fixed the flaw in Firefox 156; no public exploit code and no active exploitation have been identified, and CISA's SSVC assessment rates exploitation as 'none' with automatable 'no'. The 8.8 CVSS score is driven entirely by a network attack vector plus required user interaction (UI:R), so real-world risk depends on convincing a target to browse attacker-controlled content rather than on mass scanning.
An incorrect-bounds condition in Firefox's WebRender graphics component lets crafted web content corrupt memory inside the browser, giving the attacker a path to code execution and privilege escalation on the affected system. All Firefox releases before 156 are affected, along with the ESR branches before 115.41, 140.16, and 153.3; exploitation requires the victim to load attacker-influenced content (CVSS UI:R), and no public exploit code or CISA KEV entry has been recorded at time of analysis. With a CVSS base of 8.8 across full confidentiality, integrity, and availability impact, this is a high-severity browser flaw that should be patched on a normal browser-update cadence.
Privilege escalation in Mozilla Firefox's DOM: Service Workers component lets attacker-supplied web content break out of its intended privilege boundary and gain elevated capabilities inside the browser. The flaw affects Firefox before 156 and the ESR branches before 115.41, 140.16, and 153.3, and carries a CVSS base score of 8.8 with a user-interaction requirement (the victim must load attacker-controlled content). No public exploit code has been identified and CISA's SSVC assessment records exploitation as 'none' with 'automatable: no', so this is a high-severity patch-now issue rather than a known exploited threat.
Let me synthesize. CVE-2026-92015 — privilege escalation in Firefox WebExtensions. CVSS 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. CWE-269 improper privilege management. Fixed in Firefox 156, ESR 115.41, ESR 140.16, ESR 153.3. SSVC: exploitation none, automatable no, technical impact total. No KEV, no POC mentioned. Product name: "Firefox WebExtensions" — 1-3 words. Maybe "Mozilla Firefox" is safest but the specific component is WebExtensions. Let's use "Firefox WebExtensions". Hmm, guidance says product name 1-3 words, specific product. "Firefox WebExtensions" works. Summary: must not start with "A vulnerability". Start with impact verb + product. "Privilege escalation in Mozilla Firefox's WebExtensions component allows ..." Requires UI:R, so user interaction — a user must visit a page or install an extension? Description is vague. CVSS says AV:N/PR:N/UI:R. So an attacker could get a user to interact (e.g., install malicious extension or visit a page) which then allows privilege escalation from extension context to higher privileges (browser-level / OS-level?). CWE-269 improper privilege management. Be careful: we don't know exact mechanism beyond "privilege escalation in WebExtensions component". Confidence notes should state that the root cause mechanism is not described publicly beyond CWE-269; Bugzilla bug 2060235 is likely restricted. Affected products: Firefox < 156, ESR < 115.41, ESR < 140.16, ESR < 153.3. CPE cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*. Advisories mfsa2026-90 through -93. Remediation: upgrade to Firefox 156, ESR 115.41, ESR 140.16, ESR 153.3. Workarounds: restrict extension installation via enterprise policy (ExtensionSettings / blocked_install_message), disable WebExtensions? Not feasible. Mention that extension installation restrictions reduce exposure; trade-off: blocks all extension installs including legitimate ones. Prevalence: Firefox is widely deployed → high. Maybe "high" — ubiquitous is for OpenSSL/nginx/Linux kernel. Firefox
Incorrect boundary conditions in Firefox's Graphics component allow a privilege escalation that was fixed in Firefox ESR 115.41 and Firefox ESR 140.16. An attacker who can get a victim to load crafted content — a web page or similar rendered surface — can trigger a buffer overflow (CWE-120) in the graphics pipeline and potentially cross from the low-privilege content process into a more privileged browser context, yielding high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and CISA SSVC records exploitation status as 'none', though the CVSS base score of 8.8 and the total technical impact rating make patching a priority for any organization running an unpatched ESR branch.
Privilege escalation in Mozilla Firefox's Graphics: CanvasWebGL component lets a crafted web page corrupt memory and gain privileges beyond those normally granted to web content. Exploitation requires the victim to open a malicious page in an affected Firefox build (network vector, no authentication, user interaction required), after which an attacker can achieve high confidentiality, integrity and availability impact. Mozilla fixed the flaw in Firefox 156, Firefox ESR 115.41, ESR 140.16 and ESR 153.3; CISA SSVC records no known exploitation and the issue is not considered automatable, and no public exploit code has been identified at time of analysis.
A boundary-condition error in Firefox's Graphics: CanvasWebGL component allows an attacker who lures a victim to a crafted web page to corrupt memory and escalate privileges, with a CVSS base score of 8.8 reflecting high confidentiality, integrity, and availability impact. The flaw is a classic buffer overflow (CWE-120) in the WebGL/Canvas rendering path, reachable over the network with no authentication but requiring user interaction (UI:R) in the form of visiting attacker-controlled content. Mozilla has shipped fixes in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3, and no public exploit code or active exploitation has been identified at time of analysis.
A memory-corruption flaw in Mozilla Firefox's CanvasWebGL graphics component (incorrect boundary conditions, CWE-120) allows a remote attacker to crash or corrupt the browser's heap and potentially escalate privileges beyond the normal content-process security boundary. Every Firefox release before 156 and every ESR branch before 115.41, 140.16, and 153.3 is affected, and exploitation requires the victim to load attacker-controlled web content (CVSS 8.8, AV:N/AC:L/PR:N/UI:R). No public exploit code and no active exploitation are reported at time of analysis — CISA's SSVC records Exploitation: none and Automatable: no, so this is a patch-priority issue rather than an emergency.
Memory corruption in Mozilla Firefox's Graphics: CanvasWebGL component lets a web page that renders attacker-crafted WebGL content corrupt memory and escalate out of the browser's restricted process, yielding code execution at higher privilege. All Firefox builds before 156 are affected, with ESR branches fixed in 115.41, 140.16, and 153.3. No public exploit code exists and CISA SSVC records exploitation as 'none', so this is a high-severity patch-now bug rather than an active campaign.
An out-of-bounds write in Firefox's Graphics: CanvasWebGL component lets a malicious web page corrupt memory and gain elevated privileges on the host, affecting Firefox builds prior to 156 and the ESR branches prior to 115.41, 140.16, and 153.3. Exploitation is remote but requires the victim to load attacker-controlled WebGL/Canvas content (CVSS UI:R), so it is not automatable and no public exploit code or active exploitation has been identified at time of analysis. Mozilla rated it High (CVSS 8.8) with total technical impact under CISA's SSVC framework.
Incorrect boundary conditions in Firefox's Graphics: CanvasWebGL component allow a remote attacker who convinces a user to open a crafted page to corrupt memory and achieve code execution with the privileges of the browser. The flaw is a classic buffer overflow (CWE-120) rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R), meaning no authentication is needed but the victim must load attacker-controlled content. Mozilla fixed it in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3; no public exploit code has been identified and CISA's SSVC assessment records no active exploitation.
Privilege escalation in Mozilla Firefox's Graphics: CanvasWebGL component lets a remote, unauthenticated attacker corrupt memory via malformed WebGL content and gain elevated code execution inside the browser process, provided the victim loads an attacker-controlled page. Mozilla shipped fixes in Firefox 156, Firefox ESR 115.41, ESR 140.16, and ESR 153.3 (mfsa2026-90 through mfsa2026-93). CVSS is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), CISA SSVC records Exploitation: none and Automatable: no, no CISA KEV listing is present, and no public exploit code has been identified at time of analysis.
A memory-safety flaw in the Graphics: CanvasWebGL component of Mozilla Firefox allows a crafted web page to corrupt memory and escalate privileges beyond the browser's normal security boundary. Because exploitation only requires the victim to load attacker-controlled WebGL/Canvas content in an unpatched Firefox build, the issue affects all mainstream, ESR 115, ESR 140, and ESR 153 release trains prior to the fixed versions. Mozilla has released Firefox 156, Firefox ESR 115.41, ESR 140.16, and ESR 153.3, and while no public exploit code or CISA KEV entry has been identified at time of analysis, the CWE-120 buffer-condition root cause and CVSS 8.8 rating make prompt patching important.
Let me synthesize this. CVE-2026-76159: Duplicati for Windows before v2.4.0.0, incorrect permission assignment (CWE-732) in configuration loader, allows local low-priv attacker to escalate to SYSTEM via attacker-controlled preload.json. Product name: Duplicati. Tags include "Microsoft" which is likely a mislabeled tag — Duplicati is an independent open-source project (duplicati.com), not Microsoft. Though it runs on Windows... The tag "Microsoft" as vendor is wrong. Emit mislabeled_tag with target "Microsoft". Confidence high? Duplicati is an independent open-source backup tool, not Microsoft. Yes, high confidence. Missing tags? Maybe "windows" — since it's Windows-specific. Hmm, missing_tag target "Windows", suggested "windows". That's unambiguously implied ("Duplicati for Windows", MSI installers). Could emit. But careful — is "windows" a valid tag slug in their taxonomy? They said emit only when unambiguously implied. I'll include it with high confidence... Actually risk: their taxonomy may be "Microsoft Windows". Hmm. I'll include it maybe. Let's be a bit conservative but it seems clearly applicable. I'll include "windows" for missing_tag. Hmm, but if the slug doesn't exist it might attach a bad tag. The instructions say suggested is "lowercase hyphenated slug (e.g. target "WordPress", suggested "wordpress")". So "windows" is fine. Also "privilege-escalation" technique tag is already present as "Privilege Escalation". Fine. CVSS given is 4.0 base with E:X etc. Score 7.0. PR:L, AV:L, UI:P. Hmm, why UI:P? Probably because attacker needs to force the app to load the config... The preload.json is attacker-controlled — likely attacker with write access to a directory that gets loaded. Local low-priv attacker writes preload.json, then triggers service restart (UI:P passive — waiting for service restart/admin action). Anyway. My assessed CVSS 3.1: AV:L/AC:L/PR:L/UI:P? Hmm, UI:P isn't valid in 3.1. UI options: N, R. If user interaction required (someone must rest
Local privilege escalation in the scan_mysql actor of leapp-repository's leapp-upgrade-el9toel10 package allows code already running as the mysql OS account to obtain root on RHEL hosts during a RHEL 9 to RHEL 10 in-place upgrade. The actor invokes 'mysqld --validate-config' directly as root instead of via the packaged User=mysql systemd unit, so attacker-written persisted state (mysqld-auto.cnf pointing plugin_dir at the mysql-writable /var/lib/mysql) causes a malicious shared object to be dlopen()'d with UID 0 and full capabilities in the unconfined_t SELinux domain. Exploitation is not confirmed in the wild and no public exploit code was identified at time of analysis, but the upstream fix is public (leapp-repository PR 1343 / commit 3e4caff) and the CVSS score is 7.3 with all three impact metrics High.
Privilege escalation to full administrator equivalence in the Eventin event management plugin for WordPress allows any authenticated user who controls the user ID 1 account - regardless of their currently assigned role - to bypass every WordPress capability check and achieve remote code execution via the built-in plugin and theme editors. The flaw is rooted in PermissionManager::manage_permissions() unconditionally returning the always-true 'exist' capability primitive for all capability evaluations when the requesting user ID equals 1, granting blanket access to manage_options, edit_plugins, edit_themes, promote_users, and update_core. Exploitation is conditional on user ID 1 having been demoted to a lower-privilege role as a hardening measure; default installations where user ID 1 retains administrator rights are not impacted. No public exploit has been identified at time of analysis.
Sandbox escape in Apple iOS, iPadOS, and macOS allows a locally installed low-privileged malicious app to break out of its sandbox and gain elevated access to system resources, affecting iOS/iPadOS and macOS versions prior to 27 (macOS Golden Gate 27). Apple corrected the underlying permissions weakness (CWE-269, improper privilege management) by adding restrictions in the version 27 releases, so devices updated to iOS 27, iPadOS 27, or macOS Golden Gate 27 are remediated. The flaw is local-only with no remote or network trigger and requires the attacker to first get a malicious app onto the device; EPSS is 0.19% (8th percentile) and no public exploit identified at time of analysis, so risk is concentrated on devices that permit sideloaded, enterprise-provisioned, or otherwise untrusted applications.
Local privilege escalation in the NetworkManager-l2tp VPN plugin allows any local user who can create and activate their own L2TP profile to inject a newline into connection properties (vpn.data / vpn.secrets), so the root-running pluto daemon executes an attacker-supplied leftupdown command and yields root on the host. Fedora builds 1.52.0 through 1.52.3 and EPEL builds 1.20.0 through 1.20.23 are affected; fixed versions 1.52.4 and 1.20.24 are published upstream. There is no CISA KEV listing and no public exploit identified at time of analysis, although a public technical writeup of the 'newline to root' technique is referenced and the identical bug class was previously exploited in CVE-2018-10900 (NetworkManager-vpnc).
Privilege escalation in Apache Syncope allows an authenticated account that holds delegation-management rights to create or update delegations assigning Roles it does not own or Roles belonging to a realm subtree outside the scope it was authorized for, granting access beyond the intended administrative boundary. The flaw affects Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2, and is remediated by upgrading to 4.0.8 or 4.1.3. No public exploit identified at time of analysis, no CISA KEV listing, and EPSS is 0.48% (40th percentile); exploitation is post-authentication and depends on the delegation feature being in use, despite the published CVSS vector showing PR:N.
Authentication bypass via ID Token claim spoofing in Ping Identity PingAM allows a remote attacker to inject or override protected ID Token claims through a well-crafted request. In vulnerable configurations this lets an attacker impersonate other identities or escalate privileges by forging trusted claims that downstream relying parties consume. Ping Identity has released a patch; no public exploit is identified at time of analysis, and CISA SSVC records exploitation status as none.
Logitech's Logi Options+ updater service on Windows mishandles service-level privileges (CWE-269), exposing an attack surface that any authenticated local user can abuse to obtain a SYSTEM shell. With a proof-of-concept publicly documented on the amberwolf security blog, the exploitation barrier is minimal for any adversary already present on a Windows endpoint running the software. Organizations with broad Logitech peripheral deployments face meaningful privilege escalation risk if this path is chained with initial access obtained via phishing or credential compromise.
Privilege escalation in the User Registration & Membership WordPress plugin (versions 4.4.6 through pre-5.2.8) allows any subscriber-level authenticated user to be granted the WordPress role attached to a paid membership plan without completing payment, by exploiting a missing capability check and absent payment method and plan validation on the purchase endpoint. Where site administrators have configured membership plans mapped to privileged WordPress roles - including administrator - this results in full privilege escalation from subscriber to administrator without financial transaction. A publicly available proof-of-concept exploit from WPScan confirms the attack path is well-documented and reproducible against sites with open user registration.
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.8 allows any authenticated user holding an Author-level role or above to assign themselves an arbitrary WordPress role, including Administrator, resulting in full site takeover. The plugin fails to enforce server-side authorization checks when creating membership plans and when users attach plans to their own accounts, permitting role manipulation that bypasses WordPress's native access-control hierarchy. A publicly available exploit exists via WPScan, and the CVSS 7.2 score understates real-world risk because the provided PR:H metric conflicts with the description's requirement of only Author-level access - a low-privilege role - suggesting a closer real-world base score of approximately 8.8.
Privilege escalation in the MemberPress Corporate Accounts WordPress plugin (≤1.5.39) allows authenticated subscribers holding a corporate account to create new administrator accounts or hijack existing ones by overwriting their email addresses. The root cause is a mass assignment flaw in the `add_sub_account_user` function, which forwards the raw `userdata` POST array directly to WordPress's `wp_insert_user()` without stripping sensitive keys such as `role` or `ID`. Wordfence reported the vulnerability; a partial patch was released in version 1.5.39, meaning even the latest disclosed version may still be exploitable in some code paths. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the Add User Autocomplete WordPress plugin before 1.2 allows any authenticated user - including subscribers - to self-assign the administrator role on a WordPress multisite installation by submitting a crafted site-membership invitation request with an attacker-controlled role parameter. The plugin performs no capability check (no `current_user_can()`) and no nonce validation before accepting and creating the invitation, making the attack trivial for any account holder. No public exploit or CISA KEV listing is identified at time of analysis; EPSS sits at 0.13% (3rd percentile), but the low barrier (subscriber-level auth) makes any multisite deployment with this plugin a meaningful lateral escalation risk.
Unauthenticated site takeover in the WP Component WordPress plugin through version 2.2.4 stems from an AJAX-style action exposed to logged-out users that performs no capability or nonce validation and blindly writes an attacker-supplied option name and value. Because the handler can overwrite arbitrary wp_options entries, an attacker can flip 'users_can_register' on and set 'default_role' to administrator, then self-register an admin account. Reported by WPScan; carries CVSS 9.8 with EPSS 0.14% (3rd percentile) and no public exploit identified at time of analysis.
Privilege escalation in the Temporary Login Without Password WordPress plugin (versions 1.5 through 1.9.8) allows a site-level administrator on a WordPress multisite network to elevate their own account or grant a newly provisioned temporary login to network super admin status. The missing authorization check in the account-provisioning and account-promotion logic completely bypasses the multisite privilege boundary, enabling a subordinate site admin to seize control of the entire WordPress network without any additional user interaction. Vendor-released patch is available in version 1.9.9; no public exploit identified at time of analysis, and EPSS is low at 0.14%.
Privilege escalation in the Linux kernel CIFS/SMB client allows a local user with write access to a setuid or setgid binary on a CIFS mount to retain those elevated-execution bits on the server after a write operation that should have stripped them. The flaw exists in cifs_setattr_unix() and cifs_setattr_nounix(), which unconditionally dropped the ATTR_MODE flag when ATTR_KILL_SUID/ATTR_KILL_SGID was present, preventing the cleared mode from being propagated to the server when using cifsacl, modefromsid, SMB3.1.1 POSIX extensions, or SMB1 Unix extensions. An attacker who can write to a setuid binary on such a mount can subsequently execute it with unintended elevated privileges. No public exploit has been identified and EPSS is 0.21%, but vendor-confirmed patches are available in kernels 7.2.4, 6.18.51, and 7.3-rc1.
Out-of-bounds memory access in the Linux kernel's NTFS (ntfs3) driver arises because the mapping-pairs runlist decoder confirms that a run's starting LCN falls inside the volume but never checks that the run's end (lcn + length) also stays within nr_clusters. Mounting or parsing a crafted NTFS image can therefore drive the kernel to reference clusters beyond the volume boundary, corrupting memory and potentially escalating privilege. No public exploit has been identified and EPSS is low (0.20%), indicating this is a hardening/DoS-leaning fix rather than an imminent mass-exploitation threat.
Local privilege escalation in the Linux kernel BPF bloom filter implementation (bloom_map_alloc) affects 32-bit x86 kernels via two compounding integer arithmetic bugs: a BITS_TO_BYTES(U32_MAX) wrap at allocation time causes under-allocation of the bitset, and a u32-to-signed-long sign-extension in set_bit/test_bit causes negative bit offsets, enabling out-of-bounds kernel heap reads and writes. Exploitation requires a process holding CAP_BPF on a 32-bit x86 kernel; 64-bit kernels are entirely unaffected. No public exploit identified at time of analysis; EPSS at 0.20% reflects the narrow attack surface imposed by the 32-bit-only constraint.
Privilege escalation in the SMS Alert Order Notifications WordPress plugin (versions ≤ 3.9.9) allows any authenticated subscriber - the lowest standard WordPress role - to elevate their account privileges, potentially gaining full administrative control over the affected site. The CVSS 8.8 score with PR:L confirms that only a low-privileged account is required, making exploitation accessible to any registered user on the platform. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Privilege escalation in the Gato GraphQL WordPress plugin (versions ≤ 19.2.3) allows authenticated subscribers - the lowest registered-user role in WordPress - to elevate their access beyond their assigned privileges. The root cause is CWE-266 (Incorrect Privilege Assignment), where the plugin's GraphQL endpoint handling fails to properly gate privileged operations against low-privilege requestors. No confirmed active exploitation or public POC is identified at time of analysis, but the trivially low access bar of a subscriber account combined with full CIA impact makes this a high-priority finding for any WordPress installation running this plugin.
Local privilege escalation in the ST Engineering iDirect iQ200 VSAT satellite terminal (firmware 23.0.1.0) allows a holder of the factory-installed low-privilege field-technician account to gain full administrative control of the device. Because the low-privilege account ships pre-configured on every unit, no credentials must be phished, obtained, or brute-forced - the initial foothold is built in. No public exploit has been identified at time of analysis; the flaw was reported through CISA ICS-CERT (advisory ICSA-26-183-01).
Local privilege escalation in Pardus-software (the software center for TUBITAK BILGEM's Pardus Linux distribution) allows a low-privileged local user to gain full system control. The flaw stems from incorrect privilege assignment (CWE-266), where the application grants elevated permissions to processes or objects that should operate with restricted rights, enabling an authenticated local user to escalate to root or equivalent. Versions before 1.0.5 are affected; no public exploit or active exploitation has been identified at time of analysis.
Sandbox/permission-restriction bypass in the Hugo static site generator (versions after v0.43, fixed in v0.165.0) lets a Node tool invoked during a build read and write files outside the project's working directory. Because TailwindCSS ships in the default security.exec.allow list and must be run with highly permissive Node flags (--allow-addons, --allow-child-process, --allow-worker), the Node permission model that was supposed to contain build tools (from the fix for GHSA-x597-9fr4-5857) is effectively neutralized. Reported by VulnCheck; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation in MultiVendorX WordPress plugin before 5.0.16 allows authenticated vendor-role users to grant administrator-level WordPress capabilities to the vendor role, enabling full site takeover. The plugin's role and capability settings update mechanism fails to enforce access boundaries, letting any vendor - a legitimately registered but low-privileged marketplace seller - rewrite role permissions without restriction. A publicly available exploit exists via WPScan, and the vendor has released a patch in version 5.0.16.
Privilege escalation and arbitrary code execution affect Netskope Endpoint DLP (EPDLP) on Windows, where a privileged local user can send a crafted message to the EPDLP inter-process communication port to trigger a CWE-190 integer overflow, corrupting process memory. The vulnerability is gated behind two explicit non-default conditions - the EPDLP module must be active in the client configuration, and Windows Memory Integrity (HVCI/VBS) must be disabled on the host. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Container escape in IBM Aspera Enterprise WebApps 1.0.0-1.0.5 allows a local attacker with low privileges inside the container to break out to the underlying host due to unrestricted system call access. The CVSS vector (S:C/C:H/I:H/A:H) reflects full host compromise as the post-escape impact, not merely container-level damage. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; IBM has released a patch.
Denial of service in IBM Db2 11.5.0-11.5.9 and 12.1.0-12.1.5 allows a low-privileged authenticated network user to disable specific server functionality under certain conditions, producing both availability and integrity impact. The root cause is CWE-269 (Improper Privilege Management): the server fails to enforce correct privilege boundaries around a particular Db2 operation, allowing a user whose authorization should not extend to that action to invoke it. No public exploit has been identified at time of analysis; IBM has released a patch and the vendor advisory is the sole remediation reference.
Privilege escalation in the Lenovo Filez Client application allows a local authenticated user to gain elevated system rights via improper file or directory permissions (CWE-276). The CVSS 4.0 score of 8.5 reflects a meaningful local attack path with low complexity and no special attack requirements, though exploitation is bounded by the requirement for an existing local foothold. No active exploitation or public proof-of-concept has been identified at time of analysis.
Improper privilege management in IBM WebSphere Application Server 8.5 and 9.0 lets an authenticated user who holds a low-privilege administrative role modify security configuration, resulting in information disclosure or denial of service. The flaw is remotely reachable with low complexity (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N) but requires valid administrative credentials, so it is an insider/privileged-abuse issue rather than an unauthenticated attack path. EPSS is only 0.19% (9th percentile), there is no CISA KEV listing and no public exploit identified at time of analysis; IBM has published a fix.
Local privilege escalation to root affects the Backup Manager component of WebPros Plesk, where a time-of-check-to-time-of-use race condition during backup restore allows an attacker to abuse insecure symlink following and take ownership of arbitrary files or directories. A low-privileged Plesk account holder who wins the race can redirect a root-executed restore operation onto attacker-chosen paths, gaining full root control of the hosting server. No public exploit is identified at time of analysis, and it is not listed in CISA KEV.
Local privilege escalation in gvfs's privileged gvfsd-admin daemon affects Red Hat Enterprise Linux 6 through 10, allowing an authenticated local attacker to obtain root access. The daemon's use of symlink-following chown() on attacker-controlled directory paths creates a TOCTOU window during D-Bus socket setup. By racing the operation and substituting a symlink to a root-owned file such as /etc/pam.d/su, an attacker causes the daemon to transfer ownership of that critical file to the attacker's UID, enabling subsequent modification and full privilege escalation to root.
Unauthenticated privilege escalation in the SiteSkite WordPress plugin (versions ≤ 2.1.5) allows a remote attacker to gain elevated privileges within a WordPress installation without any authentication. The vulnerability is classified under CWE-266 (Incorrect Privilege Assignment), meaning the plugin incorrectly grants elevated roles or capabilities during some reachable code path. With full C:H/I:H/A:H impact and PR:N, successful exploitation results in complete compromise of the affected WordPress site, though AC:H signals a non-trivial exploitation condition such as a race condition, specific request sequence, or timing-dependent logic.
OpenPanel's server-side mutation resolvers fail to enforce project access levels, allowing read-only project members to execute 26 of 29 write operations that should be restricted to higher-privileged roles. Affected actions include deleting reports and dashboards, scheduling entire projects for deletion, publishing private analytics to public share links, and modifying alerting rules - all achievable by any user with the lowest valid project membership tier. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; organizations should consult GitHub Security Advisory GHSA-f9rx-pxgw-c6rg for patch details.
Privilege escalation in capgo.app (npm package `capgo` ≤ 12.207.1) allows an authenticated org_member to promote an external account to org_admin or org_billing_admin by exploiting a missing role-rank comparison in the `validateInvite()` function of the invite-new-user Edge Function. The invitation-acceptance path compounds the issue by using the Supabase service-role key, which bypasses two dedicated database triggers designed to enforce privilege boundaries, resulting in full administrative control over the organization's apps, channels, members, and billing. No public exploit is identified at time of analysis; an upstream fix is available via PR #3096.
Container escape in crun >= 1.29, when built with libkrun and started rootful with passt networking (krun.use_passt), allows an attacker who controls the container image to execute arbitrary code with host root privileges. This is a regression introduced in crun 1.29, meaning environments that recently upgraded are at risk while those on earlier versions are not. No public exploit code or CISA KEV listing has been identified at time of analysis, but successful exploitation yields full host compromise via container escape.
Privilege escalation in the Registration Form for WooCommerce WordPress plugin (versions before 1.1.3) allows any authenticated Contributor-level user to register new WordPress accounts with arbitrary roles, including Administrator. The plugin fails to verify that the form ID supplied during registration belongs to a legitimate registration form, instead blindly reading the permitted-role allow-list from any post the attacker controls. Exploitation results in full site takeover. A publicly available proof-of-concept exists. This vulnerability is an incomplete fix of a prior privilege escalation issue tracked as CVE-2026-54807.
Privilege escalation in the Bulk Password Reset WordPress plugin (all versions ≤1.3.3) allows any authenticated subscriber-level user to perform a full administrative account takeover. The plugin fails to validate the requesting user's identity before permitting bulk password changes and email-address updates, meaning an attacker can redirect an administrator's email to an attacker-controlled address, then invoke the standard WordPress password-reset flow to obtain reset credentials for that admin account. No public exploit code has been identified at time of analysis, but source code references from WordPress Plugin Trac directly expose the vulnerable functions at lines 44, 594, 659, and 679 of bulk_password_reset.php.
Improper privilege management in Open WebUI 0.10.0 through 0.11.0 allows any authenticated low-privilege user with write access to a knowledge base to delete administrator-owned external connection configurations shared across the entire instance. The DELETE /api/v1/knowledge/{id}/delete endpoint in knowledge.py correctly validated the user's write access to their own knowledge base but then cascaded the delete to the underlying shared external connection without verifying admin role or checking whether other knowledge bases depended on that connection. This means a single non-admin user can render all other knowledge bases on the instance that share the same external vector store connection permanently unavailable. No public exploit has been identified at time of analysis; vendor-released patch is available in version 0.11.1.
Privilege escalation to root in Schneider Electric PowerLogic T300 (versions 2.9.8-5620 and prior) is achievable by an authenticated SSH user through OS command injection in the device's operating system console. An attacker with high-privilege SSH access can inject shell metacharacters into user-controlled console input that the device fails to properly sanitize, breaking out of the intended command context to execute arbitrary commands as root and perform unauthorized administrative operations. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 score of 8.7 reflects subsequent-system impact rated High, consistent with the device's ICS/energy-metering deployment context.
Privilege escalation in Snipe-IT before 8.7.0 allows any authenticated user to bypass authorization controls by replaying signed Livewire component snapshots directly against the /livewire/update endpoint. Because authorization is enforced only at the HTTP route layer and not within Livewire component lifecycle methods, a low-privilege session holder can invoke protected admin operations including creating OAuth clients, minting personal access tokens, and reading sensitive administrative data. No active exploitation has been confirmed (no CISA KEV listing), but the vendor-confirmed fix is available in version 8.7.0.
Privilege escalation in the Portworx Operator on Red Hat OpenShift (OCP) allows a low-privileged, namespace-scoped user to cause the operator to assign cluster-wide permissions beyond what the user was authorized to hold. The flaw (CWE-266, Incorrect Privilege Assignment) is constrained to the initial provisioning phase of a Portworx storage cluster, meaning the exploitation window is finite but deliberate timing by an insider or a compromised account could reliably hit it. No public exploit code has been identified and the vulnerability is absent from CISA KEV; the CVSS 4.0 score of 7.7 reflects high confidentiality, integrity, and availability impact when the specific provisioning condition is met.
Local privilege escalation in ESET AV Remover (standalone) enables a low-privileged local user to attain SYSTEM-level control by sending specially crafted RPC messages to the tool's privileged service component. The root cause is CWE-269 (Improper Privilege Management): the RPC handler fails to enforce access controls commensurate with the operations it exposes, allowing an unprivileged caller to invoke functionality that executes at a higher privilege level. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.
Privilege escalation in YITH WooCommerce Waitlist Premium for WordPress (versions ≤3.35.0) allows any subscriber-level authenticated user to manufacture a new WordPress administrator account, achieving full site takeover. The vulnerable AJAX handler add_user_in_waiting_list() is exposed to all logged-in users with no nonce or capability check, and applies parse_str() plus extract() to attacker-supplied POST data before passing the injected variables directly to wp_create_user() and $user->set_role(). No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack mechanics are trivially derivable from the Wordfence disclosure.
Privilege escalation in PublishPress Capabilities WordPress plugin (all versions ≤2.50.0) allows authenticated Editor-level users to elevate to site-wide capability managers without administrator consent. The root cause is a hard-coded role assignment in `addPluginCapabilities()` that unconditionally grants the Editor role all 15 `manage_capabilities_*` capabilities on the first `admin_init` hook after plugin activation, writing the grants persistently to the WordPress database. Once escalated, an Editor can create, rename, and delete non-system roles; modify capabilities of non-administrator roles; restore role backups; and write arbitrary plugin options under several namespaced prefixes - stopping short of full Administrator access only because WordPress's `map_meta_cap` layer blocks further escalation. No public exploit or CISA KEV listing identified at time of analysis.
WP EasyCart (Shopping Cart & eCommerce Store) versions up to and including 5.9.3 exposes a privilege escalation path allowing authenticated Store Manager-level users to promote themselves to WordPress administrator. The `ec_ajax_save_page_default_options()` AJAX handler accepts arbitrary POST parameters and writes them directly to the WordPress options table via `update_option()` without any allowlist, while its nonce is embedded in frontend product and category templates accessible to any user holding the plugin's custom 'wpec_manager' capability. No public exploit code has been identified at time of analysis, but the attack technique is mechanically straightforward and requires only a Store Manager credential to execute.
Remote code execution in FireBox - WooCommerce Popup Builder (all versions ≤ 3.1.10) allows authenticated Author-level attackers to execute arbitrary PHP on the server by injecting unsanitized PHP expressions into campaign condition rules via the `firebox_meta` REST endpoint. The plugin's `Executer::allowedToRun()` blacklist (Executer.php L231) uses a trivially bypassable regex that permits WordPress core functions such as `wp_insert_user`, `update_option`, and `file_put_contents`, which the `value` function in the PHP Conditions class then evaluates directly. Critically, sites migrated from any version prior to 3.1.10 are automatically subjected to `Migrator::preserveCampaignRoleAccess()`, which grants Author-role users `edit_fireboxes` and `publish_fireboxes` capabilities, making exploitation reachable from any registered Author account with no further privilege requirements. No public exploit code or CISA KEV listing has been confirmed at time of analysis.
Privilege elevation in Chrome's WebUI component prior to version 153.0.8010.36 enables sandbox escape and arbitrary code execution outside the browser sandbox when the renderer process has already been compromised. This is a second-stage, chained exploit: an attacker must first achieve renderer-level code execution (e.g., via a separate renderer bug) and then leverage this WebUI flaw (CWE-250 - execution with unnecessary privileges) to break out of the sandbox. No public exploit code has been identified and no CISA KEV listing exists; SSVC rates automatable exploitation as 'no', consistent with the multi-step chain requirement.
Local privilege escalation in Waves Central for macOS (versions up to 16.6.2) allows any authenticated local user to gain root code execution by abusing a flawed XPC client authorization scheme in the product's privileged helper service. The helper validates connecting XPC clients by performing a certificate-chain equality comparison against itself rather than enforcing a pinned code requirement (application identifier and Apple Team ID), meaning any process carrying the Waves signing certificate can impersonate a legitimate client and instruct the helper to run arbitrary scripts as root. No public exploit has been identified at time of analysis; a vendor-released fix is available in version 17.0.
Privilege escalation in Adobe Acrobat Reader and Adobe Acrobat (all editions through 26.002.21900 and Acrobat 2024 through 24.001.30383) allows a low-privileged local attacker to gain full elevated access via an Incorrect Authorization flaw (CWE-863). The CVSS scope-change indicator (S:C) with C:H/I:H/A:H confirms the vulnerability crosses a privilege boundary beyond Acrobat's own security domain - almost certainly compromising the underlying OS context. No user interaction is required, enabling silent exploitation once a foothold is established. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation and local code execution affect the OpenTelemetry.Resources.Host NuGet package (opentelemetry-dotnet-contrib) on macOS prior to version 1.16.0-beta.2. The host.id resource attribute detector invokes sh and ioreg using bare names resolved through the PATH environment variable rather than absolute paths, allowing a local attacker with fewer privileges than the host application to substitute malicious binaries and execute arbitrary code in the application's security context. No public exploit has been identified at time of analysis; Linux and Windows hosts are explicitly unaffected.
Local privilege escalation in Maono Link 3.8.13 on Windows enables any standard user account to gain elevated service-level privileges by writing a malicious payload to C:\ProgramData\Maono. The MaonoAiServices Windows service runs with elevated OS privileges while leaving its data directory writable by unprivileged local users - a classic insecure service directory permission pattern (CWE-428). Vendor patch 4.0.80 is available; no public exploit has been identified at time of analysis.
Unauthorized file transfer and execution in the ConnectWise ScreenConnect client (all versions prior to 26.6.5) lets a party to an active remote session push and run files on the Host machine without authorization or the Host's confirmation under certain circumstances. This turns a legitimate support session into a code-execution channel against the remote endpoint; ScreenConnect servers are explicitly not affected. No public exploit identified at time of analysis, though the client's remote-support role makes it an attractive target.
Local information disclosure in Android Wear (Wear OS) versions 14, 16, and 17 lets a co-resident application read sensitive device state data because checkReadPermission in PermissionsManager.java fails to enforce a required permission. No additional execution privileges or user interaction are needed, so any installed app can silently monitor protected state. No public exploit identified at time of analysis, and the flaw is fixed in the September 2026 Wear security patch level.
Local privilege escalation in Android XR 14's MicroXR Blobstore component lets a co-resident malicious app read files belonging to other applications because a required permission check is missing. Any app installed on the device can exploit it with no user interaction and no elevated privileges, exposing another app's stored blobs. No public exploit identified at time of analysis; this is a Google/Android XR platform issue tracked in the September 2026 Android XR security bulletin.
Incorrect Authorization (CWE-863) in Adobe Commerce and Magento Open Source allows unauthenticated remote attackers to escalate privileges and gain write access to restricted platform resources without user interaction. Scope change is confirmed: successful exploitation crosses privilege boundaries within the Commerce platform, granting access to administrative or otherwise protected functionality. SSVC classifies technical impact as total and the attack as automatable, elevating operational priority despite no active exploitation currently recorded in CISA KEV.
Incorrect Authorization in Adobe Commerce, Magento Open Source, and Adobe Commerce B2B allows remote unauthenticated attackers to bypass access controls and read sensitive platform data, achieving a privilege-escalation effect without any user interaction. The flaw stems from CWE-863 (Incorrect Authorization), where authorization checks fail to enforce the correct permission boundaries, letting an unauthenticated network request access resources restricted to higher-privilege roles. No public exploit code has been identified at time of analysis, but the combination of PR:N and C:H on a major e-commerce platform makes this a meaningful exposure for confidential business and customer data.