Privilege Escalation

Privilege escalation to proxy administrator with follow-on arbitrary command execution affects the LiteLLM proxy server (AI Gateway) from 1.87.0 up to the fixed releases 1.100.4, 1.101.3, 1.102.2, 1.103.1 and 1.104.0-rc.2. An authenticated account holding internal_user privileges can submit crafted metadata through the API-key creation flow so the proxy encrypts and returns a forged administrator credential, then replay that ciphertext as a bearer token to be trusted as a proxy admin and run commands via the MCP stdio endpoint. Versions after 1.91.0 are vulnerable in the default configuration, while 1.87.0 through 1.90.x are only exposed when EXPERIMENTAL_UI_LOGIN=true is explicitly set; CVSS 3.1 scores this 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), the priority label is act_now, and no public exploit code or CISA KEV entry was identified at time of analysis.

Local non-administrative users on hosts running WatchGuard Agent can tamper with, append to, or delete the agent's security logs because the log directory is assigned incorrect permissions, and can stage further local attacks by placing executable content in a directory owned by a privileged service. The issue requires an existing local, authenticated account and the specific directory misconfiguration; there is no remote or unauthenticated path, and privilege escalation depends on a further execution mechanism that is not described in the available data. No public exploit identified at time of analysis, but the vendor has published an advisory and the issue is prioritized for this week.

Privilege escalation in Cozmoslabs Profile Builder through 4.0.4 allows an authenticated low-privilege user to raise their own level of access, with high impact on confidentiality, integrity and availability (CVSS 8.8, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The practical barrier is obtaining an initial account, which is materially lowered on WordPress sites that enable open self-registration, since an attacker can then create their own low-privilege foothold and escalate from it. There is no public exploit identified at time of analysis, and the vendor-published Patchstack record is the only reference available; the priority label places it in this week's remediation queue rather than an emergency response.

Privilege escalation in the HIPAA Forms WordPress plugin (versions before 3.3.2) lets an account that already holds the plugin's own custom user role push that role up to administrator-level capabilities. The plugin handles a request that rebuilds its custom role without any capability check, so a role holder can rewrite their own permissions; per the assessed vector the attacker must be authenticated and must already possess that specific custom role (PR:H), making this an insider or role-holder escalation path rather than unauthenticated remote takeover, and no victim interaction is required. A public PoC reference exists but is not verified as working exploit code, there is no CISA KEV listing, and a vendor fix is available in 3.3.2.

Privilege escalation in the Grav Login plugin (3.6.0 before 3.9.13) allows page authors to obtain super-user accounts by defining an invitation form in page frontmatter and submitting the login.invite task without authentication. The missing authorization check requires an existing authenticated page-author foothold (PR:L) to plant the invitation form, so it is not exploitable by a fully anonymous outsider; no public exploit code or CISA KEV entry was identified at time of analysis. This is a credible, actionable privilege-escalation issue rather than a drop-everything remote-root flaw.

Privilege escalation in the Multicluster Global Hub Operator lets an attacker who already controls the operator or holds its service-account credentials impersonate arbitrary users, groups, and service accounts cluster-wide, then use that identity to obtain full administrative control. The issue is rated CVSS 3.1 7.2 HIGH (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and stems from an overly permissive RBAC configuration in multicluster-global-hub-operator-bundle. No CISA KEV listing, EPSS score, or public exploit code is present in the supplied data; no public exploit identified at time of analysis.

Local privilege escalation in NoMachine allows an attacker who already has low-privileged code execution on the host to abuse predictably generated Redis database credentials and execute arbitrary code in the context of the service account. The flaw is CWE-331 insufficient entropy in the authentication mechanism for NoMachine's bundled Redis database, rated CVSS 7.8 with a local vector requiring low privileges but no user interaction. The supplied intelligence did not include a CISA KEV entry or public exploit code, so no public exploit was identified at time of analysis; risk is bounded because an initial local foothold is mandatory and no remote network vector exists.

Local privilege escalation in NoMachine on Windows lets any user who can already run low-privileged code on the host obtain SYSTEM-level execution by abusing an overly permissive access-control list on a named pipe exposed by the NoMachine Device Service. The flaw is strictly local (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) and requires the Device Service to be installed and running, so it cannot be used for initial access - it is a post-compromise escalation step. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, but successful exploitation yields full confidentiality, integrity and availability impact as SYSTEM; the finding was reported through Trend Micro ZDI as ZDI-CAN-31213 / ZDI-26-773.

Improper privilege management in Cisco Snort 3 allows a locally authenticated low-privilege attacker to escalate privileges on affected deployments, including Cisco Secure Firewall Threat Defense, Cisco UTD Snort IPS Engine, Cisco Cyber Vision, and Open Source Snort 3 installations. Exploitation requires an existing local foothold (AV:L, PR:L) with no user interaction, so the practical risk is post-compromise privilege escalation or abuse of malicious low-privilege local accounts rather than remote attack. No public exploit identified at time of analysis; no CISA KEV active-exploitation confirmation was provided.

Privilege escalation in pfSense-pkg-RESTAPI before 2.9.0 lets an authenticated account holding the scoped settings-sync permission modify REST API configuration secrets through the HA sync endpoint, elevating that non-administrative user to full administrator. The issue is confined to installations of the unofficial pfSense REST API package and is not exploitable against a default configuration with no scoped-permission accounts; no public exploit code was identified at time of analysis. CVSS scores it 8.8, but practical risk is bounded by the deliberately assigned sync privilege and any REST API ACL or firewall restrictions on API endpoints.

Unauthenticated privilege escalation in the WP User Manager WordPress plugin (versions 2.9.21 through 2.9.25) allows an attacker to submit a live paid registration form and receive its configured administrator-equivalent role once the associated payment gateway has been disconnected - the payment gate is silently dropped instead of failing closed. The flaw is rated CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H, CWE-269), but practical exploitation requires the non-default combination of a published paid registration form that assigns a privileged role plus an inactive gateway, so sites that never offered paid registration, never mapped the form to a high-privilege role, or have unpublished the form are not exposed. Publicly available exploit code exists and the issue is fixed in 2.9.26; no KEV listing appears in the supplied intelligence.

Privilege escalation in the Simple Banner WordPress plugin before 3.3.3 lets any role that an administrator has permitted to manage banners gain the full 'administrator' capability, allowing an authenticated low-privileged user to take complete control of the site. The flaw is only reachable when an admin has explicitly delegated banner management to a non-administrator role and the attacker holds an account in that role - a non-default configuration reflected in the AC:H/PR:L vector - so default installs and unauthenticated visitors are not exposed. Publicly available exploit code exists and the vendor has released version 3.3.3 as a fix; no CISA KEV listing is associated with this CVE at time of analysis.

Trigger.dev before 4.6.0 exposes each environment's root TRIGGER_SECRET_KEY and other plaintext secrets through the GET /api/v1/projects/:projectRef/envvars endpoint, so an attacker holding a restricted read:envvars API key can escalate beyond that key's intended read-only scope. The affected environments are staging, production, and preview, and successful exploitation lets the attacker trigger tasks and mint admin public JWTs; exploitation requires a valid scoped key rather than anonymous access. This is a genuine priority rather than a high-score/low-real-risk issue, and no public exploit identified at time of analysis.

Takeover of the Oracle EDI Gateway component in Oracle E-Business Suite 12.2.3 through 12.2.15 is possible for a high-privileged attacker who can reach the application over HTTP, with full confidentiality, integrity, and availability impact (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The critical qualifier is the PR:H prerequisite: the attacker must already hold an elevated EDI Gateway account, so this is not exploitable by unauthenticated or low-privileged users and realistic exposure is confined to trusted operators or adversaries who have already stolen such credentials. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied in the source data.

Incorrect privilege assignment in the CICD-toolchain-for-serverless-applications IAM policy (versions 1.0.7 through 1.0.10) lets an authenticated user who can push to the application source repository escalate privileges beyond the application stack inside the same AWS account. Because the CloudFormation deployment role is not scoped to the application's own resources, an attacker-supplied application template processed by the toolchain pipeline can read or modify unrelated IAM role policies, Secrets Manager secrets, and SSM parameters. Exploitation is gated on repository push rights (CVSS PR:L) and on the pipeline actually deploying the crafted template; no public exploit code and no confirmed active exploitation were identified at time of analysis, and AWS has released 1.0.11 to close the path.

Froxlor before 2.3.15 allows an authenticated hosting customer with write access to their document root to escalate to root by replacing the statistics directory with a symlink, so the root-run traffic cron's recursive chown follows the link and changes ownership of arbitrary host directories. Exploitation requires a valid customer account, enabled goaccess/webalizer/awstats statistics, and execution of the scheduled traffic cron; no public exploit identified at time of analysis. Vendor-released patch: 2.3.15.

Cross-tenant privilege escalation in StreamsHub Console for Apache Kafka allows an authenticated Kubernetes tenant that can create or modify Console custom resources to point spec.containers.api.spec.image at an arbitrary container image, which the operator then deploys into a pod running under a ServiceAccount bound by ClusterRoleBinding to cluster-wide Strimzi CRD read access, Kafka/KafkaRebalance patch rights, and cluster-monitoring-view. The attacker-controlled code reads the projected ServiceAccount token and gains read/write control over the Strimzi control plane across tenant boundaries, with high confidentiality and integrity impact (CVSS 9.9, scope changed). Exploitation is gated by the tenant-level RBAC permission rather than being open to the internet, and no public exploit code or confirmed active exploitation was identified at time of analysis.

Local privilege escalation in Apple macOS Sequoia before 15.8 and Tahoe before 26.7 allows an app already running on the host to gain elevated privileges, rated CVSS 3.1 7.8 (CWE-269, Improper Privilege Management). Exploitation requires local code execution as an unprivileged app (AV:L, PR:L) and no user interaction; it is not remotely reachable and patched systems are unaffected. No public exploit code or CISA KEV entry was identified at time of analysis.

Local privilege escalation in IBM Sterling Connect:Direct for UNIX (6.3.0.0-6.3.0.7 and 6.4.0.0-6.4.0.6) allows an authenticated local attacker with a low-privileged account to gain elevated privileges through improper privilege management. The CVSS 3.1 score is 8.4 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N), reflecting high confidentiality and integrity impact to the host with scope change, but the attack is not remotely reachable. No public exploit was identified at the time of analysis, and exploitation requires an existing local foothold on a host running the affected Connect:Direct components, likely under elevated privileges.

Local privilege escalation in Progressive Robot hMailServer 6.0.0 through 6.3.6 allows any authenticated, non-administrator user on the host to run code as LocalSystem or as the mail server's virtual service account, but only when the installer was pointed at a folder that inherits writable permissions from its parent, such as the root of an NTFS drive. The installer accepts any path without warning and creates neither the program folder nor its Bin subfolder with explicit permissions, so a drive-root install leaves Bin writable to Authenticated Users (Modify on Windows clients) or Users (create files and folders on Windows Server); the default Program Files installation grants ordinary users only read and execute and is explicitly not affected. No public exploit code or active exploitation is confirmed at time of analysis, and the reference to the v6.3.7 release indicates the vendor has shipped a fixed version.

SQL injection in Integratec's pre-authentication login endpoint (/login/ap_Login.aspx/start) allows remote unauthenticated attackers to read database contents-including credentials and user information-by supplying a crafted UNION-based payload in the sInfo POST parameter. The report carries an 8.8 CVSS score, and our independent assessment is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L, with no authentication or user interaction required; exploitation is limited mainly by whether the login interface is reachable from untrusted networks. No public exploit code was identified at time of analysis, but our independent assessment treats this as a credible, actionable priority rather than a paper-tiger high score.

Privilege escalation in the Login with phone number WordPress plugin (through version 1.8.77) allows unauthenticated remote attackers to potentially obtain elevated privileges, with high attack complexity reflecting conditions such as timing or a specific registration/login state that the attacker does not fully control. The issue is CWE-266 incorrect privilege assignment and carries a CVSS 8.1 score with high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and no CISA KEV status was provided; defenders should prioritize patching internet-facing WordPress sites running this plugin.

OttoKit (SureTriggers) WordPress plugin through 1.1.40 contains an incorrect privilege assignment flaw that can allow remote attackers to escalate privileges, and the vendor CVSS vector scores it 9.8 with network reachability, low attack complexity, no privileges required, and no user interaction. Successful exploitation could lead to full WordPress site compromise given the high confidentiality, integrity, and availability impact, though the provided data does not clarify whether a specific integration or API must be enabled or whether a pre-existing low-privileged account is required despite the PR:N rating; no public exploit identified at time of analysis.

Privilege escalation in the Salon Booking System WordPress plugin (10.17 through versions before 10.31.11) lets authenticated users who hold the plugin's custom salon staff role assign arbitrary capabilities, including administrator, to other accounts through the customer-editing function, enabling full site takeover. Publicly available exploit code exists, but the flaw is access-gated: it is not reachable by anonymous visitors or ordinary subscribers and requires a provisioned salon staff account, so exposure depends on how widely that role is granted and on the hygiene of those accounts. It is not confirmed actively exploited (no CISA KEV entry) and no EPSS score was provided.

Missing authorization in phpMyFAQ before 4.1.9 allows authenticated non-superadmin accounts that hold the delete_user permission to delete superadmin users and strip administrative accountability from the application. The /admin/api/user/delete endpoint accepts a superadmin userId other than the protected userId 1, so an attacker with a low-privilege admin session can remove higher-privileged administrators; confidentiality is unaffected while integrity and availability impacts are high. No public exploit was identified at time of analysis, and exploitation is gated by the specific delete_user permission rather than being available to every authenticated user.

Privilege escalation in phpMyFAQ 4.2.0-alpha pre-release builds lets a category-restricted delegated administrator escape their assigned scope and grant groups unrestricted category access. The flaw resides in GroupController::saveCategoryRestrictions(), which fails to validate submitted categoryIds against the caller's own scope, so a crafted POST to /admin/api/group/category-restrictions with out-of-scope or empty values elevates the attacker's effective permissions. Exploitation requires valid credentials for a privileged but scope-limited admin role (PR:H), and no public exploit code or confirmed active exploitation has been identified at time of analysis; the affected range is a pre-release train that is unlikely to be widely deployed in production.

Privilege escalation in phpMyFAQ builds from 4.2.0-alpha.2 up to but not including 4.2.0-beta allows a non-superadmin administrator who holds GROUP_EDIT to abuse the group permission API's updatePermissions and updateMembers endpoints, grant a group rights beyond the attacker's language or category scope, and self-join that group to obtain unrestricted FAQ create, edit, and publish access across all languages and categories. The CVSS 4.0 base score is 7.0, but exploitation requires an authenticated scoped administrator account and is only meaningful in deployments that use delegated administration limited by language or category, since a single-superadmin installation offers no scoped boundary to escalate from. No public exploit identified at time of analysis.

Privilege escalation in phpMyFAQ pre-release builds (4.2.0-alpha.2 through versions before 4.2.0-beta) allows an administrator holding the USER_EDIT right to re-grant FAQ rights in a way that silently discards per-right language restrictions, yielding unrestricted create, edit, and publish access across every language. The flaw lives in UserController::updateUserRights and can be triggered against the attacker's own account by submitting a language-scoped rights update to the update-rights API. Exploitation is access-gated: it requires an authenticated operator with USER_EDIT (PR:H) and only affects the 4.2.0 development line, so stable installations outside that range are not exposed; no public exploit code or confirmed active exploitation was identified at time of analysis.

Stored cross-site scripting in the EU VAT Assistant for WooCommerce plugin (all versions up to and including 2.1.30.260413) lets an unauthenticated visitor inject arbitrary script through the customer-supplied 'vat_number' field at checkout, which is persisted and later rendered without escaping inside WooCommerce → Orders → Edit Order. The payload fires in the reviewing administrator's browser session, so a single poisoned order can be leveraged to create a rogue administrator account and take over the entire WordPress site. No public exploit code or confirmed active exploitation was identified at time of analysis, but the low attack complexity, lack of authentication requirements (CVSS PR:N), scope change, and the fact that the trigger is a routine admin workflow make this a genuine, actionable priority for any store running the plugin on default configuration.

Local privilege escalation in IBM i 7.3, 7.4, 7.5, and 7.6 allows an authenticated, low-privileged user to obtain QSECOFR/Root authority, as described in CVE-2026-102917. The vulnerability has a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires prior authentication and local access; it is not remotely exploitable. No public exploit code has been identified at time of analysis, and IBM has released a patch via its support advisory.

Unauthenticated administrative account creation in WhaTicket Community through commit cf04795 allows remote attackers to self-register as administrators via POST /auth/signup by omitting the profile field or setting it to admin. Successful exploitation grants control over user management, settings, and all tickets, contacts, messages, and WhatsApp connections. The flaw is unauthenticated and network-reachable under the assessed CVSS:3.1 vector, but no CISA KEV active exploitation is confirmed and no public exploit is explicitly identified at time of analysis, although a public technical writeup reference exists.

Local privilege escalation in cifs-utils lets an unprivileged local user obtain root on affected hosts by injecting unauthorized options into a privileged CIFS mount. When a root-owned service mounts a Common Internet File System share using a credentials file whose contents the attacker can control or influence - for example a file that is world-writable or lives in an attacker-owned path - cifs-utils assembles those unsanitized values into the mount option string, so the attacker can slip in extra options that bypass permission checks and cause files to be executed with administrative privileges. The flaw is tracked as CWE-88 (argument/option injection) with a CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); exploitation requires an existing low-privilege local account (authenticated, per PR:L) and a deployment where such a privileged, credentials-file-driven CIFS mount workflow exists, so internet-facing hosts that do not mount attacker-influenced CIFS shares are not at risk. No public exploit code or confirmed active exploitation was identified at time of analysis, and Red Hat has published advisory and Bugzilla tracking pages for RHEL 6 through 10 and OpenShift Container Platform 4.

Authenticated attackers with Subscriber-level or higher PilotPress membership on WordPress sites can escalate to full Administrator privileges by exploiting a flawed ONTRAPORT synchronization routine in PilotPress versions up to and including 2.0.43. The defect allows an attacker to rename a remote ONTRAPORT contact to an existing Administrator's WordPress login, then leverage the plugin's authentication hook to cause WordPress core to issue an Administrator authentication cookie. This is a genuine high-priority vulnerability (CVSS 8.8), requiring a valid ONTRAPORT contact and the Customer Center nonce, but no victim interaction. No public exploit code was identified at time of analysis.

Unauthenticated privilege escalation in the Cozmoslabs User Profile Builder WordPress plugin (all versions up to and including 4.0.3) allows an attacker to obtain a fully activated administrator account: they submit role=administrator through the public [wppb-register] registration form, then click the activation link emailed to them, and the activation handler applies that role via WP_User::set_role() without any allow-list check. The attack is conditional rather than trivial - the site must already carry a legacy registration form field with meta-name 'role' from before the 4.0.3 upgrade (the 4.0.3 reserved-name block deliberately exempts pre-existing fields), must have email confirmation enabled so the wp_signups path is used, and must allow open user registration. That combination of stable site-state prerequisites is why CVSS 3.1 scores it 8.1 with AC:H despite PR:N/UI:N, and no public exploit code has been identified at the time of analysis.

Privilege escalation in the Theme My Login plugin for WordPress (versions up to and including 7.2.1) allows unauthenticated attackers to change arbitrary user passwords on multisite installations in certain configurations, leading to account takeover and potential full network compromise. The flaw stems from improper validation of user identity before password updates (CWE-269). Exploitation requires a non-default multisite setup, and no public exploit code is identified at time of analysis; the effective attack complexity is higher than the base CVSS 9.8 score implies due to this configuration dependency.

Unauthenticated privilege escalation in the My Calendar - Accessible Event Manager WordPress plugin (all versions up to and including 3.8.7) allows remote attackers to overwrite the credentials of the default Administrator account (user ID 1) and gain full wp-admin access. The flaw arises from unsanitized reflection of the `mcs` GET parameter into post content, enabling injection of a nested `[my_calendar above=...]` shortcode that is processed by `mc_generate_calendar_nav()`, which calls arbitrary PHP functions via `call_user_func()` without authorization or callable allowlisting. No public exploit code has been identified at time of analysis, but the plugin's auto-generated `/my-calendar/` page is publicly accessible by default, making exploitation trivially reachable by an unauthenticated attacker.

Privilege escalation in the Nexter Extension WordPress plugin (all versions up to and including 4.7.11) allows an authenticated Subscriber-level or higher user to restore a stale stored Administrator role onto their own account, effectively becoming an Administrator. Exploitation is tightly constrained: the attacker's account must previously have held the Administrator role, must have used the plugin's View Admin Role Switcher, and must have been demoted specifically through the wp-admin/users.php?action=promote bulk role-change control rather than the Edit User screen. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV, and the assessed conditions are why the effective risk is lower than the 7.5 (HIGH) base score implies.

Unauthenticated attackers can take over any WordPress user account, including administrators, on sites running the MailOptin plugin up to version 1.2.78.6 that have a 'WordPress User Registration' opt-in form published. The flaw allows manipulation of the optin_data[form_custom_field_mappings] parameter to override saved mappings, enabling injection of arbitrary wp_users column names (e.g., ID, user_pass) into wp_insert_user(), which then updates the target account's password. No authentication, nonce, or capability check is required, and the only prerequisite is the presence of the registration form; sites using MailOptin solely for mailing-list optins without this connection are not affected. No public exploit identified at time of analysis.

Privilege escalation in the InstaWP Connect - 1-click WP Staging & Migration WordPress plugin (all versions up to and including 0.1.4.1) lets any authenticated user at Subscriber level or above read the site's plaintext InstaWP master API key from a plugin settings page and redeem it for a full administrator session. The key is disclosed because the admin page is registered with a role name returned by InstaWP_Setting::get_allowed_role() in place of a real capability, and because generate_section_field() prints the master API key directly into a plain-text HTML input without a manage_options check; the attacker then derives the bearer secret from that key, satisfies the plugin's REST validate_api_request(), and calls POST /wp-json/instawp-connect/v2/auto-login to mint a 30-second single-use login URL that sets an administrator authentication cookie. Exploitation is not default-configured: it additionally requires the site to be actively connected to InstaWP (a valid master API key in instawp_api_options) and an administrator to have added the attacker's role to the plugin's Sync Tab Access list (instawp_sync_tab_roles) while still retaining administrator in that list, so realistic exposure is narrower than the 7.5 base score implies. There is no public exploit code identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); authentication requirements are authenticated (CVSS PR:L) with high attack complexity (AC:H).

Privilege escalation in the Customer Email Verification for WooCommerce WordPress plugin through 3.3.0 allows unauthenticated attackers to gain authentication as any WordPress account that still has an unverified email address, including administrators, by brute-forcing a per-user activation secret that has only about 101 possible values. The weakness is genuine and high impact (full account takeover), but real-world risk is heavily gated by three preconditions: the plugin's 'Encoding method' must be set to the non-default 'hashids' option, the attacker must recover or brute-force the Hashids salt (which defaults to an md5(time()) value fixed at first initialization), and the targeted account's email must remain unverified. An upstream changeset addressing the issue is referenced in the WordPress plugin repository, and no public exploit code was identified at time of analysis; CVSS 3.1 scores it 8.1 (High, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), so despite the High score it should be triaged as lower priority than a default-configuration, unauthenticated account-takeover bug in most deployments.

Privilege escalation to full WordPress site takeover is possible in the Backuply backup/restore plugin (all versions up to and including 1.5.8) via a second-order SQL injection that an authenticated subscriber-level user plants in the profile Biographical Info field and that only fires when an administrator later creates a backup capturing that value and then restores it. During the restore the injected SQL executes blind inside an INSERT into wp_usermeta, allowing the attacker to alter database records - most notably to set the default_role option in wp_options to administrator and enable open registration, so a subsequently registered account is granted Administrator rights. Exploitation cannot be self-triggered by the attacker (UI:R) and requires a valid authenticated account (PR:L, no anonymous path); no public exploit identified at time of analysis.

Privilege escalation to root on Ivanti Connect Secure 22.8R2.4, where the dsinvoked broker improperly trusts DSCache configuration data and can be induced to act on attacker-controlled input. Exploitation is not remote in isolation: the CVSS vector (AV:L/PR:L/AC:H) requires an attacker to already hold a low-privileged foothold on the appliance plus the specific broker/DSCache state needed to satisfy the high attack-complexity constraint. The practical risk is elevated because the CVE description and Volexity reporting tie this flaw to chained exploitation of upstream unauthenticated issues in October 2026, which removes the local-access barrier for a real attacker; no CISA KEV entry is present in the supplied data, and no specific patch version is provided. Treat this as a genuine high-priority hardening item - the exploitation signals are reported but the remediation data is incomplete.

Path traversal in wildfly-core's deployment content handler allows an authenticated JBoss EAP, WildFly, Fuse 7, or Single Sign-On 7 user who holds the Deployer RBAC role to escape the restricted deployment directory and create files with attacker-controlled content or delete arbitrary directories on the server, escalating to full management SuperUser privileges. Exploitation requires that the Deployer role be delegated to the attacker (CVSS vector shows PR:L - authenticated, not anonymous) plus a crafted deployment name containing traversal sequences; environments that reserve the Deployer role for fully trusted administrators face little practical exposure. No public exploit code was identified at time of analysis and the flaw is not listed in CISA KEV, so this is a credible, actionable priority rather than an emergency.

Jinja2 template injection in Ansible Operator Plugins (CWE-1336) lets an authenticated Kubernetes user who can create or modify a custom resource reconciled by an affected Ansible-based operator execute embedded Jinja2 expressions inside the operator pod, achieving remote code execution and escalating to the operator's service account. Because these operators typically hold cluster-wide RBAC, successful exploitation crosses a privilege boundary (CVSS 3.1 base 8.5, AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H), affecting components of Red Hat Ansible Automation Platform 2, Red Hat Advanced Cluster Management for Kubernetes 2, the Migration Toolkit for Applications/Containers/Virtualization, OpenShift Service Mesh 3 and related Red Hat OpenShift and OpenStack streams. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; the high attack complexity reflects the prerequisite that the targeted operator must pass attacker-controllable CR spec values into Jinja2 templating without sanitization. This is a genuinely high-priority flaw rather than a CVSS-inflated one, but with an important authentication caveat: purely anonymous or read-only users cannot trigger it.

Authenticated XPath injection in the OPNsense firewall and routing platform (all versions prior to 26.1.10) lets a user holding CA Manager or Certificate Manager privileges recover values stored in config.xml character by character. The Trust module stores attacker-controlled certificate and CA refid values and interpolates them unescaped into XPath queries in CAsField.php and CertificatesField.php; because the resulting refcount/in_use boolean is returned to the requester, it acts as a blind injection oracle for secrets such as password hashes, API credentials, certificate private keys, VPN key material, and high-availability credentials, which in turn can enable privilege escalation and compromise of other security domains. Exploitation is post-authentication, requires those specific trust-management privileges, and is high-complexity and iterative (roughly one boolean leak per request), so this is a genuine but second-tier information-disclosure issue rather than a drive-by remote compromise; no public exploit code has been identified at time of analysis. Vendor-released patch: 26.1.10.

Boolean-based blind SQL injection in EspoCRM versions 8.1.0 through 9.3.7 allows an authenticated non-administrator to inject crafted expressions through the 'where' parameter of the GET entity streamAttachments endpoint, enabling extraction of arbitrary database contents - including active administrator session tokens - and subsequent full privilege escalation. The flaw requires a valid low-privilege session (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L, 7.6) and is not exploitable anonymously. Public exploit code exists for this issue, though it has not been confirmed as actively exploited (CISA KEV); EspoCRM 9.3.8 is the fixed release.

Cleartext credential disclosure in P4 Search (formerly Helix Search) 2026.4.2 and earlier allows an authenticated administrator on the connected P4 Server to retrieve stored credentials through the product's configuration API, enabling privilege escalation beyond the administrator's intended scope. The defect is rooted in insufficient granularity of access control (CWE-1220): the API exposes secret material that administrators should not be able to read back, and the resulting credential exposure has cross-boundary confidentiality, integrity, and availability consequences per the assessed scope change (S:C). Exploitation is privilege-gated by the PR:H authentication requirement in the CVSS vector, so this is not reachable by anonymous or unprivileged users, and no public exploit code or confirmed active exploitation has been identified at time of analysis. A vendor patch is available in P4 Search 2026.4.3.

Local privilege escalation in TotalAV versions up to 7.1.17 allows an authenticated but unprivileged local user to impersonate the SYSTEM service by forging a gRPC IPC authentication token, leading to arbitrary code execution as NT AUTHORITY\SYSTEM. Publicly available exploit code exists (a proof-of-concept C file is linked in the disclosure), though CISA KEV does not list the vulnerability as actively exploited, and the SSVC assessment rates exploitation as 'poc' with total technical impact. Exploitation requires a local foothold and the vulnerable TotalAV service to be running; it cannot be triggered remotely or against hosts without TotalAV.

Frontend Admin by DynamiApps (the acf-frontend-form-element WordPress plugin) through version 3.29.13 assigns privileges incorrectly, letting a submitted frontend form escalate the submitting user's role - most seriously to administrator - which on WordPress equates to full site compromise. The provided CVSS 3.1 vector scores this 9.8 as network-reachable with no privileges required (PR:N), while our independent assessment scores it 8.8 with PR:L, because the real-world precondition is that a Frontend Admin form capable of affecting roles (for example a user-registration or profile-edit form) is published and reachable by the attacker; sites that expose such a form to anonymous visitors are effectively unauthenticated targets, whereas sites gating it behind login require at least a low-privilege account first. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so there is no confirmation of active exploitation, though the low complexity and high payoff make opportunistic scanning plausible.

Rate-limit bypass in the Eclipse Connected Services Platform api-gateway (affected versions 1.1.1 through 1.7.3) allows any unauthenticated remote client to evade request throttling by rotating the value of the leftmost X-Forwarded-For header element, which the shipped default ClientIpKeyResolver trusts without validation. Because each unique header value produces a fresh rate-limit bucket, an attacker can issue unlimited requests against any route that relies on the default resolver and has rate limiting configured, degrading the availability protections the gateway is meant to enforce. No KEV entry or publicly available exploit code was identified at time of analysis, and EPSS is low (0.15%, 4th percentile); CISA SSVC rates exploitation as 'none' while noting the issue is automatable, so mass scanning should be expected even without a dedicated exploit. The net effect is a moderate-priority security-control bypass (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) rather than a system compromise, with deployments that customize the key resolver or sanitize X-Forwarded-For at a trusted edge proxy unaffected.

Privilege escalation in the Fluent CRM WordPress plugin version 3.2.5 and earlier allows an authenticated low-privileged user - such as a subscriber or self-registered account - to elevate their privileges and gain control over site resources, with a CVSS 3.1 score of 8.8 and high impact to confidentiality, integrity, and availability. Exploitation is not anonymous: it requires a valid low-privilege WordPress account plus an active vulnerable plugin installation, but no user interaction is needed (PR:L, UI:N) and no non-default configuration is named in the advisory. No public exploit identified at time of analysis; this is a genuine priority, not a high-CVSS-but-low-real-risk issue.

Privilege escalation in the Fluent CRM WordPress plugin (all versions through 3.2.5) allows a low-privileged account to elevate itself to higher privileges, including administrator-equivalent capabilities, by abusing an incorrectly assigned privilege (CWE-266). The vendor-supplied vector scores this 9.8 (AV:N/AC:L/PR:N/UI:N), but the independent vector analysis assigns PR:L, meaning the realistic starting point is an authenticated low-privileged WordPress account, and that prerequisite is the one condition that most changes the real-world risk; the exact vulnerable endpoint and required account level are not detailed in the available data. No public exploit code has been identified at time of analysis, and Fluent CRM is not listed in CISA KEV; the sole public reference is the Patchstack advisory. Sites running Fluent CRM 3.2.5 or earlier should treat this as high priority because WordPress administrator takeover typically yields full site compromise, data theft, and persistent backdooring.

Local privilege escalation in the FreeBSD kernel kqueue subsystem affects FreeBSD 15.1-RELEASE before patch level p4, where a race condition in the parent-to-child knote copy path can free a marker knote and cause a use-after-free. A local user with low privileges (PR:L) may leverage this to corrupt kernel memory and potentially escalate privileges, though exploitation requires winning a high-complexity, non-deterministic timing race (AC:H). No public exploit code or confirmed active exploitation was identified at time of analysis; EPSS is low at 0.14% (3rd percentile).

Out-of-bounds access to kernel heap memory in FreeBSD's System V semaphore subsystem allows an unprivileged local user to potentially escalate privileges or crash the kernel. The flaw is a race in semop(2): the invoking thread blocks, releases the per-set lock, and on wake-up re-validates its semaphore set using a 15-bit sequence number embedded in the IPC identifier; if roughly 32,768 sets are created and destroyed in the same table slot during that window, the counter wraps and the kernel falsely treats a freed/reused set as still valid, leading to an out-of-bounds dereference (CWE-787). Exploitation requires local code execution and a timing-dependent counter wrap, so practical risk is limited despite the total technical impact rating - no public exploit code has been identified at time of analysis, EPSS is 0.18% (7th percentile), and CISA SSVC records Exploitation: none, Automatable: no.

Unauthenticated attackers can register an administrator-equivalent account on any WordPress site running the User Rights Access Manager plugin through version 1.1.3, resulting in full site takeover. The plugin leaves one of its AJAX account-registration handlers accessible without any capability or nonce check, and assigns newly self-registered users a role that was created as a direct copy of the administrator role, so a single crafted request yields a fully privileged account. Publicly available exploit code exists, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) confirms the attack is remote, unauthenticated, and requires no user interaction; no CISA KEV entry has been reported, so active exploitation is not confirmed, but the low complexity and public proof-of-concept make this a high-priority patch target wherever the plugin is deployed.

Credential theft in Heym 0.0.55 through 0.0.120 allows a shared collaborator to seize the error_workflow_id execution field and repoint it at an attacker-controlled workflow containing an HTTP node, so that when the owner's parent workflow enters an error state the owner's decrypted credentials are injected into the attacker's workflow and exfiltrated over the network. The attack is remote and low-complexity, requiring only low privileges - an existing collaboration grant on the target workflow (PR:L per both the supplied CVSS 4.0 vector and the assessed CVSS 3.1 vector) - with no user interaction, producing high confidentiality impact and only low integrity impact from the single overwritten field. No public exploit code or CISA KEV entry was identified at time of analysis, and single-owner Heym deployments that do not use shared collaborators are not exposed.

A heap-based buffer overflow in the eventd daemon of Juniper Networks Junos OS and Junos OS Evolved allows a local unprivileged attacker to send crafted IPC messages, leading to denial of service or privilege escalation to root. The vulnerability affects all platforms and carries a CVSS 4.0 base score of 8.6 due to high confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis; exploitation requires a pre-existing local account or foothold on the device, and network-based unauthenticated attacks are not possible.

A privilege escalation in KEDA 2.20.2 and earlier lets a namespace administrator who can create TriggerAuthentication and ScaledObject resources point hashiCorpVault.address at an endpoint they control and select Kubernetes authentication without supplying a credential; KEDA then logs in to that endpoint using the operator pod's projected ServiceAccount token, handing the attacker the operator's cluster-wide permissions including broad Secret reads and workload or admission-related operations. The prior CVE-2025-68476 JWT-shape filter does not block this path because the operator token's subject is a Kubernetes ServiceAccount, so it passes the filter. Exploitation is authenticated (CVSS PR:L) and gated by tenant-level RBAC to create those CRDs, but it is most dangerous in multi-tenant clusters where namespace admins are untrusted relative to the cluster-scoped operator; there is no public exploit code identified at time of analysis, and the issue is fixed in 2.21.0 via audience enforcement plus an outbound Vault-address allowlist.

Local privilege escalation in the SUID-root mount(8) utility shipped with util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, where the attacker-controlled LIBMOUNT_FORCE_MOUNT2 environment variable is read with getenv() and can force the legacy, non-atomic multi-step bind-mount path. On hosts whose /etc/fstab contains a bind mount authorized for unprivileged use via the user or users option and hardened with nosuid, noexec, or nodev, a local low-privileged user can win a timing race between the initial bind mount and the follow-up remount that applies those protective flags, briefly exposing an unprotected mount from which a SUID binary can be executed to obtain root. Exploitation is conditional (it requires that specific non-default fstab configuration) and non-deterministic because it depends on a race window; no public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV). Vendor-released patches are available in util-linux 2.41.5 and 2.42.2.

Local privilege escalation in MyReport Updater through 2.1.1 allows authenticated low-privileged local users to gain SYSTEM rights by abusing the updater service's gRPC interface (UpdaterManager.exe) to set a malicious reference server and arbitrary installLocation, then planting a DLL such as HID.dll that is loaded by osk.exe. Publicly available exploit code exists, though no confirmed active exploitation (not in CISA KEV). With a CVSS 4.0 score of 8.5 and assessed CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, this is a genuine, actionable local privilege escalation rather than an inflated high-CVSS score, though it is not a mass-exploitation emergency.

Privilege escalation in the WordPress plugin Frontend Dashboard (M A Vinoth Kumar), affecting versions through 3.0.7, lets remote attackers obtain elevated account capabilities through incorrect privilege assignment (CWE-266). Patchstack scores the flaw 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but the assessed vector is PR:L, meaning exploitation in practice most likely requires an existing low-privileged account (for example a subscriber) to elevate from, which typically presupposes that open user registration is enabled on the target site. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV; exploitation is bounded to WordPress sites actually running this plugin within the affected version range.

Privilege escalation in Red Hat OpenShift Container Platform 4's insights-runtime-extractor DaemonSet lets an authenticated low-privileged tenant who can schedule a pod on a node run attacker-controlled code as root in the host user namespace. The extractor scanner enters the workload's namespaces and executes the workload's argv[0] via exec.Command after only seteuid() has changed, leaving real/saved UID 0 and retaining capabilities; a malicious pod binary matching node, python, python3, MainThread, or any path containing java can call setuid(0) and reach the host CRI-O socket from the inherited cwd. CVSS 8.8 (AV:L/PR:L/S:C) reflects local, non-network exploitation requiring workload scheduling, and no public exploit was identified at time of analysis.

Unauthenticated privilege escalation in the SimpleForm WordPress plugin up to and including version 3.10.0 allows any remote visitor to create an Administrator-level WordPress account by submitting crafted registration data. The vulnerable AJAX action wp_ajax_nopriv_simpleform_wp_register lacks a capability check for role assignment, and related meta-saving logic fails to exclude wp_capabilities, while the required nonce is publicly emitted on every front-end page. No public exploit code is confirmed at time of analysis, but the flaw is trivially exploitable against default configurations; an upstream fix exists via changeset 3726513, though a tagged release is not independently confirmed.

Local privilege escalation in Nix (before 2.35.3) and Lix (before 2.95.4) allows an unprivileged local user to escalate to the privileged nix-daemon account-typically root-by exploiting a repair operation that destroys and replaces a store path before verifying its content. The flaw is a timing-sensitive incorrect behavior order (CWE-696) that only affects multi-user daemon deployments; single-user installs are far less exposed. No public exploit code has been identified at time of analysis.

Privilege escalation in the Membership & User Roles for WooCommerce (Automatic Role Changer) plugin through version 20260828 lets an authenticated subscriber-level user re-acquire a previously revoked Administrator role and take full administrative control of the WordPress site. The flaw is reachable when the plugin is configured in Replace Roles mode and the attacker's account previously legitimately held Administrator while the plugin was active, because that role stays cached in the dfxwcrc_foreign_roles user meta and is re-applied whenever a role-assignment event fires, such as completing a purchase for a role-mapped product. Wordfence reported the issue (CVSS 7.5, CWE-269) and no public exploit code was identified at the time of analysis; the stacked preconditions - former legitimate admin, stale cache, Replace Roles mode - materially limit real-world exploitation, and only former privileged users, not arbitrary subscribers, can abuse it.

Privilege escalation in the Bit Integrations - Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress (all versions up to and including 2.10.6) allows unauthenticated attackers to overwrite an administrator's password and take over the admin account. The plugin stores raw, attacker-controlled field values - including user_pass and user_email - verbatim into wp_btcbi_log.field_data on anonymous front-end requests with no capability check, and when an administrator clicks 'Re-execute' on the resulting failure log row, the stored payload is replayed inside that administrator's session and written to the administrator's own user record. Exploitation is not automatic: it requires a non-default configuration in which an administrator has mapped a user-supplied form field to the user_pass parameter of the WP User Registration 'Update User' action, plus the manual Re-execute click (CVSS 3.1 AV:N/AC:H/PR:N/UI:R), so an anonymous remote attacker can plant the payload but cannot complete the escalation alone; no public exploit code was identified at time of analysis.

Local privilege escalation in Hyland Desktop Host for Windows (all versions before 25.1.1) lets a low-privileged local user gain full administrative control of the host by abusing weak filesystem permissions on the directory from which a privileged service runs. The affected service executes out of %PROGRAMDATA%\Hyland\DesktopHost\bin, a location writable by non-administrative users; an attacker who can drop or replace a binary or library there and trigger a service (re)start causes that code to execute with the service's elevated (typically SYSTEM) context, yielding confidentiality, integrity, and availability impact across the host (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), although the attack is technically straightforward to reproduce on a shared or multi-user machine where an unprivileged account already exists.

Server-side request forgery in Adobe Content Credentials (CAI Content Credentials SDK) allows unauthenticated remote attackers to induce the server to make arbitrary outbound requests, potentially reaching internal services and escalating privileges. The CVSS 3.1 base score is 8.6 (HIGH) with a changed scope, high confidentiality impact, and no integrity or availability impact. Exploitation requires no user interaction; no public exploit code has been identified at time of analysis, and the vendor advisory APSB26-163 should be consulted for fixes.

Server-side request forgery in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) allows an authenticated low-privileged attacker to coerce the application server into issuing requests to internal resources, yielding elevated access and disclosure of data outside the attacker's intended scope. Adobe assigns this a CVSS 3.1 base score of 7.1 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N); exploitation is non-deterministic because the vendor states success depends on conditions beyond the attacker's control, and it requires an existing foothold as a low-privileged account. There is no public exploit identified at time of analysis and no CISA KEV listing, so the practical risk profile is that of a moderate-severity, post-authentication SSRF rather than a remotely exploitable unauthenticated flaw.

Server-side request forgery in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) lets an attacker who already holds a high-privileged ColdFusion account force the server to issue requests to internal or otherwise restricted resources, resulting in privilege escalation and unauthorized access to internal services. The vulnerability is network-reachable (AV:N), needs no user interaction (UI:N), but is gated by the high-privilege precondition (PR:H), so it is not exploitable against default unauthenticated configurations - the practical risk is concentrated on internet-exposed ColdFusion administrative interfaces and insider or post-compromise scenarios. The CVSS vector changes scope (S:C), meaning the attacker can leverage the vulnerable ColdFusion component to affect resources outside its own security authority, and no public exploit code has been identified at time of analysis. This is a solid-priority-but-not-emergency issue rather than an emergency, driven mainly by the privileged access required to trigger it.

Server-side request forgery in Adobe ColdFusion 2023 (≤2023.0.25) and ColdFusion 2025 (≤2025.0.13) lets unauthenticated, network-reachable attackers coerce the server into issuing arbitrary outbound requests, with the changed scope (S:C) allowing those requests to pivot into back-end or cloud services that can confer elevated privileges. Rated CVSS 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, CWE-918), the flaw requires no authentication and no user interaction per the vector, but real-world data exposure depends on the ColdFusion instance having reachable internal targets such as cloud metadata endpoints or internal APIs. No CISA KEV listing and no public exploit code were identified at time of analysis, yet the default-configuration exposure of affected versions makes prompt patching advisable.

Server-side request forgery in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) allows a low-privileged authenticated attacker to make the ColdFusion server issue requests to internal or otherwise restricted resources, potentially escalating access and reading sensitive data. The vulnerability is rated CVSS 3.1 7.7 with scope changed and high confidentiality impact only; authentication as a low-privileged user is required (PR:L), no user interaction is needed, and no public exploit code was identified at time of analysis.

Server-side request forgery in Adobe ColdFusion 2025 (up to and including 2025.0.13) and ColdFusion 2023 (up to and including 2023.0.25) allows unauthenticated remote attackers to cause the server to make arbitrary requests, resulting in privilege escalation with the scope changed. This critical vulnerability has a CVSS score of 10.0 and requires no user interaction. No public exploit has been identified at the time of analysis.

Server-side request forgery in Adobe ColdFusion lets remote unauthenticated attackers force the server to issue requests to internal or otherwise protected endpoints, which Adobe flags as potentially escalating privileges across a security boundary. The affected builds are ColdFusion 2023 up to and including 2023.0.25 and ColdFusion 2025 up to and including 2025.0.13; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, base 8.6) confirms no user interaction and no authentication prerequisite, with confidentiality being the only impact dimension assessed. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, so risk derives from high internet/network exposure of affected builds rather than confirmed active exploitation. Real-world severity hinges on what the ColdFusion host can reach internally, since a scope-changed SSRF that touches cloud metadata services or internal admin APIs can yield credential material even without an integrity or availability impact.

Privilege escalation in Adobe Experience Manager (AEM) allows an authenticated, low-privileged user - an author or contributor-level account - to abuse an Improper Restriction of XML External Entity Reference (XXE, CWE-611) in XML parsing and thereby read local files and reach internal resources well beyond their intended permissions, crossing a security boundary as reflected by the scope-changed CVSS 9.6 rating. The vector is network-reachable with no user interaction required (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N), so the only real precondition is obtaining valid low-tier credentials, which makes author instances and deployments with broadly provisioned low-privilege accounts the highest-risk exposure. No public exploit code has been identified at time of analysis, and builds updated past the affected ranges are not exploitable.

Authenticated privilege escalation in Omnispace's Agora Project before 26.10.0 allows any regular, non-administrative member to create new user accounts by directly invoking the user-edit action actionVueEditUser, which is missing the editRight() function-level authorization check that guards comparable administrative actions. The flaw is reachable over the network by an attacker who already holds a valid member login (CVSS vector PR:L, no user interaction required) and results in high integrity impact and limited confidentiality exposure, with the practical risk concentrated in self-registration-enabled, shared or multi-tenant deployments where member accounts are easy to obtain. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; a vendor patch is available in version 26.10.0, and the VulnCheck advisory classifies the weakness as broken function-level authorization (Authentication Bypass / Privilege Escalation).

Heap-based buffer overflow in the Windows WebDAV implementation lets a locally authenticated attacker with only low privileges corrupt heap memory and elevate privileges on the same host, yielding high confidentiality, integrity and availability impact (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U). Exploitation requires a pre-existing foothold - code execution as a normal user on the target and reachable WebDAV/WebClient functionality - so this is a post-compromise privilege-escalation primitive rather than a remote entry point, and CISA's SSVC assessment marks it non-automatable, i.e. not suited to wormable mass exploitation. No public exploit code and no active exploitation have been identified at time of analysis, but Microsoft has shipped patches and real-world risk is concentrated on multi-user hosts such as RDS/terminal servers and shared workstations where several low-privileged users can run code.

Privilege escalation in Microsoft SharePoint Server Subscription Edition lets an authenticated attacker who holds only a low-privileged account escalate to full control over the affected farm, with high impact to confidentiality, integrity, and availability (CVSS 8.8, vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is reachable over the network with low complexity and no user interaction, but it is not pre-authentication - an attacker must first obtain or already possess valid SharePoint credentials. Affected are deployments of SharePoint Server Subscription Edition 16.0.0 prior to build 16.0.20326.20190; patched builds are not exploitable. No public exploit code has been identified at time of analysis, CISA SSVC rates exploitation as none, and Microsoft has released a vendor fix, so this is a high-priority but not emergency patch.

Privilege escalation in upKeeper Instant Privilege Access through version 1.7.1 lets a local, authenticated low-privileged user gain elevated privileges by triggering improper handling of undefined values during input processing, with user interaction required for the escalation to succeed. The flaw carries a CVSS 4.0 base score of 8.6 (High) driven by total confidentiality, integrity and availability impact across both the vulnerable component and subsequent systems, although local access (AV:L), a valid low-privileged account (PR:L) and mandatory user interaction (UI:A) materially constrain real-world exploitability. There is no public exploit identified at time of analysis, and CISA SSVC assessment records Exploitation: none with Automatable: no, meaning scripted or fully autonomous attacks are not expected.

Lenve vhr through commit 03abbd3 exposes BCrypt password hashes, phone numbers, and addresses for all operators to any authenticated user who requests GET /chat/hrs. A low-privileged operator account (CVSS PR:L) is sufficient, making this a confidentiality-only privilege-escalation enabler if weak hashes are cracked offline; the assessed impact is CVSS 7.1 with no integrity or availability impact. No CISA KEV confirmation or public exploit code was identified at time of analysis.

Privilege escalation in Dockhand before 1.0.50 allows an attacker who holds administrative rights in a different tenant of a shared OIDC provider such as Microsoft Entra ID to obtain Dockhand administrator access by recreating the group Dockhand maps to its admin role and signing in, because the application fails to validate the OIDC iss, aud, nonce, and exp claims. The issue is rated CVSS 4.0 9.2 (critical) on network reach, no privileges required on Dockhand itself, no user interaction, and full confidentiality, integrity, and availability impact once admin access is obtained, though exploitation requires a shared multi-tenant IdP deployment and knowledge of the mapped group name, so single-tenant or isolated IdP deployments are not affected. No public exploit identified at time of analysis and the vulnerability is not in CISA KEV; a vendor patch is available in 1.0.50.

Local privilege escalation in WSUS (Windows Server Update Services) allows an authenticated low-privileged attacker with local access to elevate privileges by exploiting incorrect default permissions (CWE-276). The vulnerability has a Microsoft-assigned CVSS 3.1 score of 7.5 (AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H), indicating high attack complexity and required user interaction, but it can lead to full compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, and a patch is available per the Microsoft advisory.

Privilege escalation in Leantime prior to 3.10.0 allows an authenticated low-privilege user to create a full administrator account, or to install, enable, disable and remove plugins, by calling methods exposed through the application's JSON-RPC dispatcher. Any user holding a valid ordinary browser session can trigger this by sending the required X-Requested-With: XMLHttpRequest header and invoking leantime.rpc.api.api.createApiKeyWithProjects with an attacker-chosen role, because PermissionEnforcer::enforce treats API service methods that lack a RequiresPermission attribute as public; exposure widens significantly on installations where open or self-service registration is enabled, since obtaining the prerequisite low-privilege session becomes trivial. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects complete compromise of confidentiality, integrity and availability once the privilege boundary is crossed, and the vendor has shipped a fix in version 3.10.0.

Zoom Workplace clients with the Zoom Phone feature contain a network-reachable buffer overflow (CWE-120) that can lead to privilege escalation and full compromise of confidentiality, integrity, and availability on the targeted client. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H, base 8.0) requires user interaction and high attack complexity, and it indicates low privileges are needed even though the vendor description claims unauthenticated access-this authentication prerequisite is unverified. No public exploit identified at time of analysis.

Privilege escalation in the custom URL scheme handler of Zoom Workplace for Android before version 7.2.1 allows an attacker who can get the device to process a crafted link or invoke the handler (for example via a co-resident malicious app) to gain capabilities beyond those the invoking context should hold, with high confidentiality and integrity impact per the assessed CVSS of 8.1. Only the Android client is indicated; iOS and desktop builds are not referenced in the affected CPE, and installations at 7.2.1 or later are not affected. There is no CISA KEV listing and no public exploit code identified at time of analysis, and the authentication prerequisite is genuinely ambiguous: the description suggests an unauthenticated network attacker while the published CVSS vector (PR:L) and the independent assessment differ on whether any session is required, so treat the exploitability preconditions as unresolved pending confirmation from Zoom. Note that the vendor vector (PR:L/UI:N) and the assessed vector (PR:N/UI:R) diverge, meaning it is not settled whether success needs a low-privileged session or user interaction with a crafted link.

Newline injection in the Ftps.add API of Froxlor 0.10.0 through versions prior to 2.3.14 lets an authenticated customer account insert arbitrary entries into the root-owned NSS group database, ultimately enabling local privilege escalation on affected hosts. The unvalidated additional_members parameter accepts embedded newline characters, and the REBUILD_NSSUSERS cron job later writes those values without sanitization into /var/lib/extrausers/group, so an attacker with a valid customer login can seed privileged group memberships that are cashed in only once they obtain local access to the machine. Exploitation is gated by customer-level authentication (CVSS vector PR:L) and by the host being deployed with the libnss-extrausers backend with the rebuild cron active; no public exploit code identified at time of analysis, and there is no confirmed actively exploited (CISA KEV) status.

Unauthenticated remote attackers can achieve code execution and privilege escalation against NVIDIA AIStore for Linux by injecting arbitrary Kubernetes host-namespace and container security settings into the legacy ETL Kubernetes PodSpec initialization API, rated CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) because the impact escapes the AIStore workload and extends to the underlying Kubernetes node and cluster. The vector confirms the attack is network-reachable with no privileges or user interaction required, though practical exploitation depends on the legacy ETL/transformation feature being enabled and the ETL API being exposed, and on Kubernetes RBAC and PodSecurity admission being permissive enough for AIStore to actually schedule host-namespaced or privileged pods. At time of analysis there is no confirmed active exploitation (CISA KEV) and no public exploit code identified, but the vendor-reported severity, the scope-changed impact, and CWE-250 (execution with unnecessary privileges) place this in top-priority territory for any cluster running an exposed AIStore ETL endpoint.

Privilege escalation in Mozilla Firefox's WebExtensions component allows remote attackers to reach high confidentiality, integrity, and availability impact inside the browser's privileged context, provided the victim performs an interaction such as visiting attacker-controlled content (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8). Unauthenticated attackers can reach the flaw over the network against default installations, but the required user interaction rules out a zero-click drive-by path. All Firefox builds before 158 and Firefox ESR builds before 153.5 are affected; upgrading to 158 or ESR 153.5 removes the condition. There is no public exploit identified at time of analysis and CISA's SSVC decision framework rates exploitation as 'none' and automatable as 'no', making this a genuine high-priority patch item rather than an emergency.

Privilege escalation in the DOM: Navigation component of Mozilla Firefox (prior to 158) and Firefox ESR (prior to 153.5) lets an unauthenticated attacker gain elevated privileges inside the browser when a victim loads attacker-controlled web content, producing high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.8, CWE-269). The sole gate on exploitation is user interaction (UI:R, PR:N): the victim simply has to render a hostile or compromised page in an unpatched build, with no authentication, special configuration, or local access required. No public exploit code has been identified at time of analysis, and CISA's SSVC triage records exploitation as "none" with technical impact "total" and automatable as "no"; combined with the absence of KEV listing and EPSS data, this reads as a genuinely high-severity but not yet demonstrably exploited issue whose urgency depends on future exploit development. Vendor-released patches are available in Firefox 158 and Firefox ESR 153.5, and upgrading fully removes the exposure.

Privilege escalation in Mozilla Firefox's Panning and Zooming component lets an attacker who gets a target to render crafted content cross a privilege boundary inside the browser, with high impact to confidentiality, integrity and availability (CVSS 8.8). Affected builds are Firefox before 158 and Firefox ESR before 153.5, which Mozilla fixed via advisories mfsa2026-106, mfsa2026-108, mfsa2026-109 and mfsa2026-110. Exploitation status: no public exploit identified at time of analysis, and EPSS is low at 0.19% (8th percentile), but the input vector and our independent assessment disagree on the exploit preconditions (PR:L/UI:N versus PR:N/UI:R), so reconcile those signals before prioritization; authentication requirements are not confirmed from available data.