Privilege Escalation

Missing authorization checks on three IAM REST API endpoints in Yamcs allow any authenticated low-privilege user to enumerate the server's complete privilege taxonomy and role-to-privilege mappings, directly enabling targeted privilege escalation reconnaissance. Affected are yamcs-core versions up to 5.12.7 and 5.13.0 through 5.13.1, used in production spacecraft operations and ground station environments. A proof-of-concept is confirmed in the GHSA advisory; no active exploitation (CISA KEV) has been identified, but the leaked data (including the ControlAccess and ChangeMissionDatabase privilege names) provides a precise roadmap for chained attacks including, per the advisory, algorithm-level remote code execution.

Incomplete authorization fix in Vikunja v2.3.0 allows Write-level collaborators to detach a shared child project from its parent hierarchy by supplying parent_project_id: 0, bypassing the Admin permission gate introduced by the CVE-2026-35595 fix. The flaw exists in versions v2.3.0 through the latest unstable builds and is fixed in v2.4.0. A detailed, independently reproducible proof-of-concept with curl commands is publicly documented in the GHSA advisory, though no CISA KEV listing has been identified at time of analysis.

Archive symlink traversal in aquaproj/aqua prior to v2.60.1 enables an attacker who controls a tool archive to write arbitrary files outside the extraction directory with the privileges of the user running aqua. The vulnerable combination in `pkg/unarchive/archives.go` - creating a symlink without destination validation, then following it with a regular file write - allows a malicious tar.gz to overwrite files such as shell startup scripts or PATH entries, resulting in user-level code execution. A working PoC is confirmed in GHSA-mf5c-hw34-4hpp; no CISA KEV listing is present and EPSS data is unavailable for this CVE.

Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.6 lets authenticated users holding the plugin's delegated management capability overwrite arbitrary WordPress site options, including those governing user roles, enabling full administrator takeover. The root cause is a missing capability check on the login settings save handler - the plugin fails to verify the caller's WordPress capabilities before persisting changes to the wp_options table. A public proof-of-concept exploit exists per WPScan; however, SSVC reports no active exploitation and the CVE is absent from CISA KEV.

Privilege escalation to administrator in the Ultimate Member WordPress plugin (versions 2.6.7 through 2.12.x) allows unauthenticated users registering via the plugin's own forms to self-assign any WordPress role, including administrator, by exploiting a logic failure in role validation. When the plugin cannot resolve the allowed roles for a given profile form, it falls back to validating the submitted role against the full site-wide role registry rather than the form's own allow-list - accepting any valid registered role. A publicly available exploit exists per WPScan, though SSVC assessment indicates no confirmed active exploitation campaigns at time of analysis. Vendor-released patch is available in version 2.13.0.

Improper access control in the ServiceNow AI Platform allows an unauthenticated user, under certain circumstances, to create or modify instance data beyond intended boundaries, resulting in privilege escalation. ServiceNow has patched hosted instances and supplied updates to partners and self-hosted customers; the vendor rates this maximum severity (CVSS 4.0 10.0) but reports no known exploitation. No public exploit identified at time of analysis.

Insecure default file permissions in the openssl_encrypt desktop GUI (jahlives/openssl_encrypt, all versions before 1.4.9) expose decrypted plaintext output files to any unprivileged local user on multi-user systems. Any co-resident local account can read sensitive plaintext written by the GUI without requiring elevated privileges or exploiting any authentication mechanism. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; a vendor-confirmed patch is available at version 1.4.9.

Privilege escalation in Flowintel's administrative user-edit API allows an organization administrator to modify full administrator accounts within their own organization, including resetting passwords, effectively enabling account takeover of a higher-privileged identity. Affected versions are 3.3.0 and above, as confirmed by upstream commit ffe64d1133b7d84909a69661bd5fee607e9ce757 which adds the missing role-hierarchy boundary check. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Privilege escalation in FluentCRM Pro (WordPress plugin, versions <= 3.1.12) allows authenticated users holding the Editor role to elevate their access level, yielding full confidentiality, integrity, and availability impact against the WordPress installation. Reported by Patchstack and scored CVSS 7.2 with PR:H, the flaw is rooted in CWE-266 (Incorrect Privilege Assignment), meaning the plugin fails to correctly enforce role boundaries for Editors interacting with CRM functionality. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Unauthenticated privilege escalation in the ACPT (Pro) - Custom Post Types plugin for WordPress affects all versions up to and including 2.0.63, allowing remote attackers with no credentials to improperly gain elevated privileges (CWE-266). Rated CVSS 9.8, the flaw grants full confidentiality, integrity, and availability impact, effectively enabling site takeover. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patching target.

WibuKey64.sys kernel-mode driver in Wibu-Systems WibuKey up to version 6.70 for Windows allows a local, low-privileged attacker to trigger memory boundary violations by supplying out-of-scope pointer values, with outcomes ranging from denial of service (BSOD) to full SYSTEM-level privilege escalation via kernel code execution. The CVSS Scope:Changed metric reflects the critical boundary crossing from user-space into the driver's SYSTEM-privileged kernel context, meaning successful exploitation yields complete machine control from an unprivileged account. No public exploit has been identified at time of analysis and WibuKey has not been listed in the CISA KEV catalog, but the low attack complexity makes this a high-value local privilege escalation primitive for post-compromise chains.

Local privilege escalation in WibuKey for Windows before 6.71 allows any low-privileged local user to gain full SYSTEM-level control by exploiting a write-what-where primitive in the WibuKey2_64.sys kernel driver. The root cause is an untrusted pointer dereference (CWE-123) in the 64-bit kernel driver, meaning attacker-controlled data is used directly as a kernel-space pointer, enabling arbitrary writes into kernel memory - a classic and highly reliable LPE primitive. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.

Local privilege escalation in Wibu-Systems CodeMeter Runtime allows a low-privileged local attacker to delete arbitrary files with SYSTEM privileges via an NTFS junction attack, potentially cascading to full system compromise. The cmu.exe utility creates predictable temporary files under C:\CM-Stick without validating NTFS reparse points before performing file operations; because the CodeMeter Runtime service runs as SYSTEM, any redirected file operation executes at the highest privilege level. A detailed public research writeup is available from shelltrail.com, substantially lowering the exploitation barrier; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.

Insufficient input validation in Spring Security's OAuth2 Authorization Server module (versions 7.0.0-7.0.4) allows an attacker holding a valid Initial Access Token to register a malicious OAuth2 client with crafted metadata fields via the Dynamic Client Registration endpoint. Depending on server configuration and how the metadata is subsequently rendered or fetched, the impact spans Stored XSS (targeting administrator sessions), Privilege Escalation (through insufficiently constrained scopes or grant types), or SSRF against internal infrastructure. No public exploit code or CISA KEV listing exists at time of analysis, but the SSVC framework rates the technical impact as total, warranting priority remediation for any deployment with Dynamic Client Registration explicitly enabled.

Privilege escalation in the CMP WordPress plugin before 4.1.18 allows Editor-role users to overwrite arbitrary WordPress options via an unguarded AJAX settings-import action, ultimately achieving full Administrator access. The flaw is contingent on an administrator having explicitly granted Editor-role users access to CMP's admin-bar controls - a non-default configuration - making real-world exposure narrower than the CVSS 7.2 score implies. No active exploitation is confirmed (absent from CISA KEV), and the EPSS score of 0.13% at the 3rd percentile corroborates the SSVC assessment of exploitation status 'none'; however, SSVC rates technical impact as 'total' given that successful exploitation yields unrestricted site control.

Privilege escalation in Bluewave Labs Checkmate <=3.3.0 allows authenticated administrators to self-elevate to the superadmin role by supplying an arbitrary role value via the role parameter in the POST /api/v1/invite API endpoint, handled by inviteController.js. The flaw stems from improper privilege management (CWE-269): the invite handler trusts the caller-supplied role field without enforcing that admins cannot grant themselves or others a higher tier than their own. A researcher's write-up and code sample are publicly referenced via GitHub Gist and an Outline blog post, indicating at minimum a working proof of concept exists. No active exploitation has been confirmed and EPSS sits at 0.22% (12th percentile), consistent with a niche, authenticated-only attack surface.

Privilege escalation in Veno File Manager 4.4.9 lets an authenticated user holding only the 'rename' permission take over the super administrator account. By sending a crafted POST request to the renameFile endpoint, the attacker renames the application configuration file, which forces the app to rebuild its configuration and reset super-admin credentials to default values. Publicly available exploit code exists (jfs-jfs GitHub repo); this is not in CISA KEV and EPSS is low (0.16%), indicating no observed mass exploitation yet.

Missing authentication on KubePi's SSO configuration endpoints (versions up to and including 1.6.15) lets unauthorized or low-privileged users read, create, and modify the global SSO/OIDC/SAML authentication configuration because those management routes share the public routing boundary with the SSO login/callback endpoints. An attacker can inspect or tamper with authentication settings - potentially leading to account takeover or privilege escalation - abuse the SSO connectivity-test as an SSRF primitive, and harvest authentication-related fields leaked by the user-list API. There is no public exploit identified at time of analysis; the issue is fixed in KubePi 2.0.0.

Local privilege escalation in the Linux kernel's OpenRISC signal return path allows any unprivileged local user to disable the Data MMU and gain arbitrary physical memory read/write access. The flaw exists in restore_sigcontext() on the OpenRISC (or1k) architecture, which fails to filter privileged Supervision Register (SR) bits copied from a user-controlled signal frame on sigreturn. Patched stable releases are available across all maintained kernel branches (5.10 through 7.2); no public exploit identified at time of analysis, though a verification proof-of-concept is documented in the fix description.

Cross-namespace privilege escalation in Kyverno 1.18.0-1.18.1 lets any tenant who can create a NamespacedMutatingPolicy in their own namespace force the cluster-privileged admission controller to generate resources (ConfigMaps, Secrets, NetworkPolicies, RoleBindings) in arbitrary namespaces, including kube-system. The nmpol CEL compiler unintentionally exposes the generator library to matchConditions, and neither the mpol validator nor GenerateResources enforces namespace scope on the generator.apply() target. A working proof-of-concept is published in the vendor advisory (GHSA-79gf-7frw-68m9); there is no KEV listing or evidence of active exploitation, and the issue is fixed in 1.18.2.

Privilege escalation in Ubiquiti UniFi OS affects a broad range of gateway, NVR, storage, and Cloud Key appliances running the UniFi OS platform, where leftover Active Debug Code (CWE-489) lets an authenticated low-privilege actor with network access elevate their privileges on the device. The flaw is vendor-reported via Ubiquiti Security Advisory Bulletin 067 and carries a 9.0 CVSS driven by a security-scope change and full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the wide device footprint makes it a notable patch priority.

SQL injection in ZTE SCP allows authenticated, adjacent-network users to craft malicious database queries that bypass authorization logic and access data outside their permitted scope. The flaw requires valid low-privileged credentials and adjacency to the management network but achieves high confidentiality impact by exposing arbitrary database contents - particularly sensitive in telecom infrastructure contexts. No public exploit code or CISA KEV listing has been identified; ZTE classifies this as high-priority and has published a security bulletin.

Cookie forgery in the Mang Board WP WordPress plugin (≤2.3.7) enables any subscriber-level account holder to forge administrator authentication cookies and change the administrator password, resulting in complete WordPress site takeover. The flaw originates in `mbw_get_hash_key()`, which generates HMAC material from the currently logged-in user's identity rather than the username embedded in the cookie under validation, while `mbw_validate_auth_cookie()` performs insufficient verification - allowing the forged cookie to pass as legitimate. No public exploit has been identified at time of analysis and no CISA KEV listing is present, but the CVSS 8.8 score accurately reflects the low privilege bar required and full confidentiality, integrity, and availability impact.

Privilege escalation in the Forminator Forms WordPress plugin (all versions before 1.57.1) allows unauthenticated remote attackers to register new sites on WordPress multisite networks regardless of whether the network administrator has enabled site registration, granting the attacker administrator-level privileges over each newly created sub-site. This flaw is scoped exclusively to WordPress multisite deployments; standard single-site WordPress installations are completely unaffected regardless of plugin version. No active exploitation has been confirmed by CISA KEV, though WPScan has published a public proof-of-concept and a vendor patch is available at version 1.57.1.

Privilege escalation in FreeBSD's POSIX shared memory subsystem allows an unprivileged local user to gain root-level access by exploiting a race condition in the FIOSSHMLPGCNF ioctl handler. The kernel's largepage shared memory page-size configuration check is performed without holding the rangelock, enabling two concurrent callers to each observe an unconfigured object and write conflicting page sizes, corrupting kernel object state in an exploitable way. No public exploit code or CISA KEV entry has been identified at time of analysis; EPSS is 0.13% (3rd percentile), indicating low current exploitation probability, though local privilege escalation primitives in OS kernels are high-value targets for post-compromise and container-escape scenarios.

Privilege escalation in FreeBSD's tty subsystem allows a local unprivileged user to gain elevated privileges by exploiting a race condition in the TIOCSCTTY ioctl handler. The handler fails to revalidate terminal state after a lock-drop sequence, enabling a concurrently destroyed terminal to be incorrectly linked to the attacker's session. No public exploit code has been identified at time of analysis, but vendor-confirmed patches exist for all affected release lines (15.0-RELEASE, 15.1-RELEASE, and 14.4-RELEASE).

Memory updated with the new marker. The analysis is clean and unmanipulated.

Privilege escalation in FreeBSD's kernel audio subsystem allows an unprivileged local user on systems with multiple audio devices to exploit a use-after-free in the sync group ioctl locking path to achieve full kernel compromise. The race condition arises when the ioctl releases the sync group list lock to sleep during a blocking lock attempt, and a concurrent operation frees the sync group structure before the sleeping thread reawakens and dereferences it. Affected releases include FreeBSD 14.4-RELEASE prior to p9, 15.0-RELEASE prior to p13, and 15.1-RELEASE prior to p3; no active exploitation has been confirmed (not in CISA KEV) and EPSS sits at 0.16% (6th percentile), reflecting low current threat activity.

Privilege escalation in FreeBSD 15.x unix socket implementation allows an unprivileged local user to achieve full system compromise via a use-after-free in the SOCK_STREAM receive path. Control messages are not fully detached from the socket buffer before error-path code frees the associated mbufs, leaving dangling references exploitable by a low-privileged attacker. No public exploit has been identified at time of analysis, but the low attack complexity (AC:L) and confirmed patch availability from the FreeBSD project make this a clear and immediate patching priority for affected deployments.

Broken access control in ThingsBoard Professional Edition 4.21 and below allows authenticated customer-tier users to manipulate API parameters in the Alarms comments endpoint to forge or overwrite system-generated alarm comments. Because customer accounts are low-privileged by design, the ability to impersonate system messages and overwrite system-owned data constitutes vertical privilege escalation with direct integrity impact on alarm audit trails. No public exploit code exists and the EPSS score of 0.15% (5th percentile) indicates low exploitation probability, but the flaw is easily reproducible by any valid customer credential on an unpatched instance.

Privilege escalation in Doorkeeper OpenID Connect prior to 1.10.4 allows self-registered OAuth clients to obtain scopes beyond what the server intends to grant. The Dynamic Client Registration endpoint directly assigns client-supplied scope values to the application record without intersecting them against the server's configured `default_scopes` and `optional_scopes`, and because `enforce_configured_scopes` is disabled by default, Doorkeeper's ScopeChecker subsequently honors those persisted application-level scopes over server-level restrictions. No public exploit has been identified at time of analysis; a vendor patch was released July 2, 2026.

Privilege-management weakness in Google Chrome's Actor component (versions prior to 152.0.7977.65) lets a remote attacker who successfully socially-engineers a user into loading a crafted HTML page bypass system access restrictions. Chromium rates the underlying severity as Low, and no public exploit or active exploitation has been identified; EPSS is 0.21% (11th percentile). Note a sharp signal conflict: the NVD-style CVSS base score is 9.8 (critical) while the vendor's own severity rating is Low and the description requires user interaction.

Improper privilege management in Google Chrome's FileSystem subsystem (all versions prior to 152.0.7977.65) allows a remote attacker to bypass system access restrictions by tricking a user into loading a specially crafted HTML page. The flaw is rated CVSS 4.3 (Medium) with impact limited to low integrity bypass - no confidentiality or availability impact - and carries an EPSS of 0.23% (13th percentile), indicating minimal observed exploitation interest. Vendor patch is available in stable channel 152.0.7977.65; no public exploit code or CISA KEV listing has been identified at time of analysis.

Improper privilege management in Chrome's Regional Capabilities component allows remote attackers to bypass system access restrictions by delivering a crafted Chrome extension through social engineering. Affected versions are all Chrome releases prior to 152.0.7977.65 across desktop platforms. Despite a CVSS base score of 8.8, EPSS exploitation probability is very low at 0.21% (11th percentile), no active exploitation is confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.

Sandbox escape via improper privilege management in Chrome's Navigation component allows a remote attacker who has already compromised the renderer process to break out of the Chrome sandbox and execute arbitrary code at OS level. Affected versions are all Chrome releases prior to 152.0.7977.65 across desktop platforms. The attack chain is multi-stage - renderer compromise must precede the sandbox escape - and social engineering is required, but the resulting impact is full confidentiality, integrity, and availability compromise outside the sandbox. No public exploit code and no CISA KEV listing have been identified at time of analysis; EPSS exploitation probability is low at 0.40% (33rd percentile).

Insufficient permissions restrictions in iOS and iPadOS (all versions prior to 26.5) allow a malicious locally-installed app to enumerate other applications installed on the device. The flaw, rooted in improper privilege management (CWE-269), exposes app inventory data that Apple's sandbox model is designed to protect. No public exploit identified at time of analysis, EPSS is extremely low at 0.09%, and SSVC exploitation status is confirmed none - placing this squarely as a low-urgency privacy concern rather than an active threat.

Stack buffer overflow in Zephyr RTOS's virtio PCI driver (drivers/virtio/virtio_pci.c) allows a malicious virtio device to corrupt the kernel stack with up to ~228 bytes of device-controlled data, or trigger a near-unbounded write via unsigned underflow, during boot-time device probe. All Zephyr versions are potentially affected (CPE: cpe:2.3:a:zephyrproject:zephyr:*:*:*:*:*:*:*:*) when compiled with CONFIG_ASSERT disabled, which is the production default. Exploitable scenarios are limited to bare-metal systems with untrusted physical or passthrough virtio PCIe devices, or confidential computing deployments where the Zephyr guest must be defended against a potentially malicious hypervisor. No public exploit identified at time of analysis; upstream patch is available at commit d98dacee.

Privilege escalation in rclone before 1.74.4 allows an attacker who controls a source remote to plant a setuid binary on the destination filesystem when the victim uses the --metadata flag during a copy or sync operation. The local backend passes source-supplied mode, uid, and gid metadata verbatim to os.Chmod and os.Chown without masking ModeSetuid or ModeSetgid bits, enabling an attacker to store a crafted binary with mode=40000755 and uid=0 on a remote they control. If rclone runs as root - common in automated backup/restore workflows - any local user on the destination system can execute the planted binary to gain root access. A proof-of-concept is documented in the upstream advisory; no confirmed active exploitation (CISA KEV) is recorded at time of analysis.

Privilege escalation in ShopEngine (all versions up to and including 4.9.4) allows Shop Manager-level authenticated users to achieve full WordPress site takeover by injecting arbitrary core options through a malicious WXR import file. The plugin's `rum_importer()` function is hooked to the WordPress core `import_start` action without any plugin-owned capability check or allowlist filtering, meaning attacker-controlled `<wp_option>` pairs from a crafted import file flow directly into `update_option()` - enabling manipulation of `users_can_register` and `default_role` to open administrator self-registration. No CISA KEV listing or EPSS score was present in the provided data; exploitation requires an existing Shop Manager account and WooCommerce's grant of the `import` capability to that role, but once those conditions are met the path to full site compromise is straightforward and documented.

Privilege escalation in the Total Donations WordPress plugin (all versions through 2.0.5) lets unauthenticated attackers promote themselves to full administrator, per Wordfence and Patchstack advisories. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates it Critical 9.8 with complete confidentiality, integrity, and availability impact. No public exploit code is identified at the time of analysis and it is not listed in CISA KEV, but the unauthenticated network-reachable admin-takeover primitive makes it high priority.

Privilege escalation in the Codefresh CI/CD platform allows authenticated platform users to elevate their account to Administrator level by invoking a specific API endpoint, per Codefresh security advisory SA2026-01. All versions covered by CPE cpe:2.3:a:octopus_deploy:codefresh are listed as affected with no minimum version floor specified. A successful attacker gains unrestricted administrative control of the platform - including access to all pipelines, stored secrets, integrations, and organizational settings. No public exploit code has been identified at time of analysis, and CISA KEV listing is not confirmed.

Self-service privilege escalation in the TYPO3 femanager (Frontend User Manager) extension allows any authenticated frontend user to assign themselves to arbitrary frontend usergroups via the profile edit plugin when operating under its default field configuration. The root cause is CWE-862 (Missing Authorization): the extension does not validate whether the requesting user is permitted to join the target group before processing the self-update. No public exploit has been identified at time of analysis, but the exploit path is straightforward for any logged-in frontend user on an affected TYPO3 installation. The CVSS 4.0 score of 6.0 reflects the prerequisite of an authenticated session and a specific configuration context.

Privilege escalation to SYSTEM in SKYSEA Client View and SKYMEC IT Manager (Sky Co., Ltd.) affects any Windows host where these IT management agents are installed. The root cause is CWE-276 - incorrect default permissions set on installation artifacts - allowing any authenticated local Windows user to plant or replace code that a SYSTEM-level service component subsequently executes. No public exploit code and no CISA KEV listing are confirmed at time of analysis, but the CVSS 4.0 score of 8.5 and zero attack complexity barriers make this a credible priority for organizations running these products in multi-user or shared-workstation environments.

Privilege escalation in the Jawn WordPress theme (by MvpThemes) affects all versions through 1.4.2, allowing an unauthenticated remote attacker to promote themselves to a full administrator account. The flaw was disclosed by Wordfence and independently catalogued by Patchstack, and its CVSS 9.8 rating reflects unauthenticated, network-reachable takeover of the WordPress site. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.

Privilege escalation via account takeover in InfusedWoo Pro (all versions up to and including 5.1.17) allows any authenticated subscriber-level user to hijack arbitrary WordPress accounts, including site administrators, by exploiting a missing capability check in the `ajax_iwar_preview_email()` AJAX function. The function incorrectly relies on `is_admin()` - a WordPress conditional that tests for admin-area request context rather than the requesting user's role - permitting low-privilege users to generate valid password reset links for any email address on the site. No public exploit has been identified at time of analysis, but the trivial exploitation path (subscriber-level access, no user interaction, no special configuration) makes this a high-priority remediation target for any site running the affected plugin.

Unauthenticated privilege escalation in the TranslatePress multilingual plugin for WordPress (all versions up to and including 3.3.2) allows a remote, unauthenticated attacker to gain elevated privileges within the site, per a Patchstack advisory. The flaw is classified as incorrect privilege assignment (CWE-266) and carries a CVSS 9.8, implying an attacker can escalate to a high-impact role without authentication or user interaction. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV.

Subscriber-level privilege escalation in the Booking Hub WordPress plugin (versions ≤ 1.3.0) allows authenticated users with only subscriber-level access to elevate their privileges to administrator-equivalent roles. The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N) confirms network-accessible exploitation with full confidentiality, integrity, and availability impact once a low-privilege account is obtained. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity makes this a realistic priority for any WordPress site running the affected plugin with user registration enabled.

Insecure file creation in RansomLook (≤ 2.0.0) exposes the Flask session-signing secret to any local OS user with read access to the application home directory, enabling complete authentication bypass. The secret key governs Flask session cookie signing and the legacy API-key derivation function; possession of it allows an attacker to forge valid session cookies and impersonate any user, including administrators. In LDAP-configured deployments, exploitation is especially direct because the session user loader accepts arbitrary usernames without verifying their existence against any user store. No public exploit has been identified at time of analysis.

Privilege escalation from userspace to kernel level is possible in Google's Fuchsia OS via a Use-After-Free condition in the Zircon kernel pager proxy component, affecting Android F30.1.1. An attacker with low-privileged code execution on the device can exploit the memory corruption flaw to gain kernel-level control, achieving full compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and SSVC assessment indicates no current active exploitation.

HP Easy Start for macOS prior to version 2.16.7.260722 is affected by privilege escalation vulnerabilities rooted in CWE-319 (Cleartext Transmission of Sensitive Information), allowing an authenticated low-privilege attacker with network positioning to intercept sensitive data and gain elevated access on the affected macOS system. The CVSS 4.0 score of 7.7 reflects high impact across confidentiality, integrity, and availability, though the attack prerequisite modifier (AT:P) indicates specific conditions must be satisfied before exploitation succeeds. No public exploit code or active exploitation has been confirmed; HP has released a patched version addressing these issues.

Privilege escalation in HP Easy Start for macOS (versions prior to 2.16.7.260722) allows low-privileged local users to gain elevated system access through insecure temporary file handling, classified under CWE-379. HP has released version 2.16.7.260722 to address these vulnerabilities, as detailed in advisory HPSBPI04124. No public exploit code exists and no CISA KEV listing is present at time of analysis, reducing immediate urgency despite a vendor-assigned CVSS 4.0 score of 7.7.

Privilege escalation vulnerabilities in HP Easy Start for macOS, versions prior to 2.16.7.260722, allow a local low-privileged user to gain elevated system access. Classified under CWE-1104 (Use of Unmaintained Third-Party Components), the root cause likely involves outdated bundled libraries within the printer setup utility. HP has released version 2.16.7.260722 as the remediation; no public exploit code or CISA KEV listing has been identified at time of analysis.

Incorrect default permissions in HCL Hive 1.0 expose containerized deployments to unauthorized lateral movement, container breakout, and interception of sensitive inter-service communications by network-accessible attackers requiring no authentication. The flaw (CWE-276) means the platform ships with overly permissive defaults - not a misconfiguration by the operator - making any default deployment potentially vulnerable without additional hardening. No public exploit code exists at time of analysis, and the vulnerability has not been added to the CISA KEV catalog, but the combination of a network-accessible vector, no authentication requirement, and high confidentiality impact warrants prompt remediation.

Local privilege escalation in Zscaler Client Connector enables a standard (non-administrative) local user to execute arbitrary code in a privileged context via multiple improper privilege handling flaws (CWE-280). The scope change captured in the CVSS vector (S:C) reflects that exploitation breaks the security boundary of the Client Connector's privileged agent process, extending impact beyond the attacker's initial user context to full High-rated confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis.

Privilege escalation in the Jawn WordPress theme (versions ≤ 1.4.2, by mvpthemes) allows a remote, unauthenticated attacker to elevate their privileges within a WordPress site, per a Patchstack advisory. The flaw is rooted in incorrect privilege assignment (CWE-266) and carries a CVSS 9.8, implying an attacker can reach administrator-level control without credentials or user interaction. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.

Unauthenticated privilege escalation in the Affiliate Pro - Affiliate Program for WooCommerce & WordPress plugin (versions up to and including 8.9.1) lets remote, unauthenticated attackers improperly acquire elevated privileges on affected WordPress sites. Reported by Patchstack and tracked as EUVD-2026-64804, the flaw carries a critical CVSS 9.8 with a fully network-exploitable vector and no user interaction. No public exploit identified at time of analysis, but the low attack complexity and unauthenticated nature make it a high-priority patching target.

Unauthenticated privilege escalation in the Digits WordPress plugin (versions 9.2 and earlier by UnitedOver, LLC) allows remote attackers to elevate their privileges without any authentication or user interaction, per Patchstack's disclosure. Digits is an OTP/phone-based login and registration plugin, so a flaw in its privilege-handling logic can let an outsider gain elevated account access. CVSS is rated 9.8 (critical); there is no public exploit identified at time of analysis and it is not on CISA KEV.

Local privilege escalation in Entevo HMI V2 R5 P0 M4 enables a low-privileged local user to break out of Kiosk Mode and gain administrative command execution on Windows. The escape path exploits the application's built-in PDF manual viewer: opening the manual triggers an external PDF reader, whose Print dialog exposes Windows Explorer shell access, ultimately permitting arbitrary command execution as an administrator. A proof-of-concept demonstration is publicly available via GitHub gist; EPSS is low at 0.17% and CISA SSVC indicates no confirmed active exploitation, though the public POC meaningfully lowers the skill bar for any attacker with local session access.

Privilege escalation in the OnGres StackGres operator lets a low-privilege, database-owning tenant elevate to administrator privileges, breaking the multi-tenant isolation model of this Kubernetes-based PostgreSQL platform. The CVSS 9.9 rating with a scope change (S:C) reflects that an authenticated tenant confined to their own database can cross a trust boundary to gain full administrative control. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the only public reference is a GitLab work item tracking the flaw.

Privilege escalation in the Content Mask WordPress plugin (before 1.8.5.5) allows any authenticated Contributor to publish posts and pages without holding the publish capability, bypassing WordPress's role-based access control. The root cause is a missing capability check (CWE-269) when the plugin registers and handles its custom post type publishing workflow. No public exploit identified at time of analysis; EPSS is 0.18% (8th percentile), and the flaw is not listed in CISA KEV, reflecting negligible observed exploitation interest.

Unauthenticated privilege escalation to administrator in the RestrictMate WordPress plugin before 1.3.0 lets any remote visitor abuse the account-registration flow, which fails to validate the user role submitted during signup, to create a brand-new administrator account and receive a logged-in admin session - resulting in full site takeover. Rated CVSS 9.8 with a fully remote, no-interaction, no-privilege vector; a vendor patch (1.3.0) exists and CISA's SSVC framework flags it as automatable with total technical impact. There is no public exploit identified at time of analysis and it is not on CISA KEV, and EPSS is low at 0.19% (8th percentile).

Privilege escalation in the Security Hardener WordPress plugin (all versions up to and including 2.4.4) allows any authenticated Subscriber-level user to create new Administrator accounts or reset existing Administrator passwords by sending crafted REST API requests. The plugin's user-enumeration blocking feature inadvertently replaces WordPress Core's granular capability checks on the /wp/v2/users REST endpoints with a bare is_user_logged_in() check, completely stripping create_users, edit_users, and delete_users enforcement. Because block_user_enum is enabled by default, this authorization bypass is active on every site immediately after plugin installation with no additional configuration required; no public exploit has been identified at time of analysis.

Privilege escalation in Forminator Forms WordPress plugin (versions before 1.57.0.7) allows any user with form-builder permissions to create a registration form that grants the WordPress administrator role to every visitor who self-registers through it. The role-restriction enforcement applied to registration forms is inconsistently applied, meaning the control exists in the codebase but can be bypassed at the configuration layer by a sufficiently privileged form author. No public exploit code has been identified at time of analysis, and EPSS sits at 0.14% (4th percentile), indicating low observed exploitation activity; however, a successful exploitation chain yields full WordPress site compromise.

Privilege escalation in WPeMatico RSS Feed Fetcher (all versions through 2.8.24) allows any authenticated WordPress subscriber to gain full administrative access by invoking the unprotected wpematico_import_settings function. The missing capability check permits arbitrary WordPress site options to be overwritten, enabling attackers to enable user registration and set the default registration role to administrator - a two-stage takeover requiring only a valid subscriber account. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack chain is low-complexity and directly actionable by any authenticated user.

Privilege escalation in LeafWiki versions 0.1.0 through 0.10.0 allows any authenticated user to elevate their own account role to administrator by manipulating the user update API. The flaw stems from improper privilege management (CWE-269) in the API endpoint responsible for account updates, which fails to enforce role-assignment restrictions. No public exploit code has been identified at time of analysis, but the attack is straightforward for any user with a valid account, making instances with open or semi-trusted registration particularly exposed.

Privilege escalation in HP OMEN Gaming Hub prior to version 1101.2608.0.0 allows local attackers holding standard user credentials to gain elevated system access by exploiting improper JWT signature verification (CWE-347). The gaming hub service, which operates with elevated OS privileges to manage hardware performance settings on HP OMEN systems, fails to validate cryptographic signatures on JWT tokens used for internal access control, enabling privilege claim forgery. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.

Incorrect authorization in Spring AI's tool calling subsystem allows the per-request tool allowlist to be bypassed at dispatch time, enabling invocation of tools not made available to the current request. Affected are Spring AI versions 1.0.0-1.0.9, 1.1.0-1.1.8, and 2.0.0. An authenticated low-privileged attacker who can influence model interactions may exploit this to invoke privileged tools outside their authorization scope, resulting in privilege escalation and potential confidentiality breach. No public exploit or CISA KEV listing has been identified at time of analysis.

Two-factor authentication bypass in Apache CloudStack allows an authenticated low-privileged user to exploit an improper privilege management flaw in the 2FA plugin's disable flow, effectively circumventing the second authentication factor. Affected deployments span versions 4.18.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0, with vendor-confirmed fixes in 4.20.3.1 and 4.22.1.1. No public exploit code has been identified and EPSS sits at 0.18% (8th percentile), indicating low observed exploitation pressure despite the high vendor-assigned CVSS of 8.8.

Privilege escalation in the AI Engine WordPress plugin (versions 2.8.0 through 3.6.0) enables any sub-site Administrator in a WordPress Multisite network to take over arbitrary accounts-including the Network Administrator-due to missing authorization checks on user management operations. A publicly available proof-of-concept exists per WPScan, and a vendor patch has been released at version 3.6.1. No active exploitation is confirmed by CISA KEV at time of analysis, though POC availability substantially lowers the bar for abuse by any authenticated sub-site admin.

Privilege escalation in Imagination Technologies Graphics DDK allows guest VM kernel software to issue crafted commands to GPU Firmware, triggering writes outside the guest's virtualized GPU memory boundary (CWE-823). Affected are multiple DDK release trains including versions 25.1 RTM2 through 25.3 RTM, 24.2 RTM2, 23.2 RTM2, and 1.18 RTM2. No public exploit code exists and CISA has not added this to KEV; however, SSVC assesses total technical impact given successful exploitation yields full C/I/A compromise of the guest environment.

Kernel-stack out-of-bounds write in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables a local attacker with low-privilege shell access to corrupt kernel memory by causing the kernel to parse a crafted filesystem image during directory reads. Successful exploitation can crash the system or escalate privileges to root, yielding full system compromise. No public exploit code has been identified and EPSS remains very low at 0.16% (6th percentile), though SSVC rates technical impact as total, reflecting the severity of a successful local privilege escalation on IBM Power infrastructure.

Local privilege escalation in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 allows an unprivileged local user to execute arbitrary payloads as root via the cmdnim utility. The CVSS vector (AV:L/AC:L/PR:L/S:C/C:H/I:H/A:H) confirms that any standard authenticated user account is sufficient to achieve full root-level code execution with no user interaction and no special configuration required. No public exploit has been identified at time of analysis, and this CVE is not currently listed in CISA KEV.

Untrusted pointer dereference (CWE-822) in IBM AIX's Virtual SCSI (vSCSI) initiator driver allows a low-privileged local user within a client LPAR to trigger kernel memory corruption, with outcomes spanning denial of service, privilege escalation, or full compromise of the client LPAR kernel. Affecting IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1, the CVSS 3.1 score of 8.8 with scope change (S:C) reflects the cross-LPAR isolation risk inherent in PowerVM virtualization environments where VIOS mediates I/O for multiple tenants. No public exploit code or active exploitation has been identified at time of analysis; however, CISA's SSVC framework rates the technical impact as total, meaning successful exploitation fully undermines the security of the affected system.

Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from improper privilege management (CWE-269), letting a remote attacker run arbitrary code on affected Power systems per IBM PSIRT. The 9.8 CVSS score reflects a network-reachable, low-complexity vector with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the IBM support advisory indicates a fix is available.

Arbitrary command execution on IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 is achievable by a local attacker through improper privilege management (CWE-269), yielding full confidentiality, integrity, and availability compromise of the affected system. The vulnerability carries a CVSS 7.8 HIGH score with a local attack vector, no prior privileges required, and a user interaction dependency. No public exploit code has been identified at time of analysis; a vendor-released patch is available via IBM's support advisory.

Local privilege escalation in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables any low-privileged authenticated user to achieve full system compromise through improper symbolic link handling. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms complete confidentiality, integrity, and availability impact with no user interaction required. No public exploit identified at time of analysis; a vendor patch has been released via IBM advisory https://www.ibm.com/support/pages/node/7283858.

Local privilege escalation in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 allows a low-privileged local user to gain elevated-likely root-level-access through improper privilege management (CWE-269). The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N) reflects low-complexity exploitation requiring only a standard local account with no user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though IBM has released a patch via their support portal.

Privilege elevation in Google Chrome's Import feature before version 151.0.7922.173 enables sandbox escape and arbitrary code execution at the OS level, exploitable by a remote attacker who can deliver a crafted file and socially engineer a user into opening it. The vulnerability stems from CWE-250 (Execution with Unnecessary Privileges) within the Import component, yielding full confidentiality, integrity, and availability impact per CVSS C:H/I:H/A:H. No public exploit code has been identified at time of analysis, and SSVC confirms exploitation status as none, though the total technical impact rating and sandbox-escape primitive warrant prompt patching across all Chrome deployments.

Unverified password change in Laravel Backpack CRUD's account-info endpoint allows any authenticated Backpack admin to permanently take over their own or a hijacked session's account by mass-assigning the `password` field without supplying the current password. Affected versions are backpack/crud < 6.8.11 and 7.0.0-alpha.1 through 7.0.33, running on Laravel 11 with the default `App\Models\User` model whose `$fillable` includes `password`. The attack converts time-limited stolen session access into permanent credential control, bypassing the dedicated change-password flow that enforces `old_password` verification. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack is trivially constructable given full public advisory detail.

Unscoped GitHub App installation token exposure in Tekton Pipelines-as-Code (openshift-pipelines/pipelines-as-code) allows any authenticated user with push access to one repository in a multi-repo GitHub App installation to read the Tekton task definitions from other private repositories in the same installation. By crafting a PipelineRun with a remote task annotation pointing at a private repository URL, the attacker causes Pipelines-as-Code to fetch and inline that repository's task YAML using the over-privileged installation token during webhook processing, producing a read-only confidentiality breach. No public exploit or CISA KEV listing exists at time of analysis; the EPSS signal is absent from provided data, but the low-complexity attack path and confirmed fix make this a prioritization candidate for any organization running multi-repository PAC installations.

Improper access control in Lighthouse - the cross-cluster service-discovery component of Submariner shipped with Red Hat Advanced Cluster Management for Kubernetes 2 - lets an attacker who has compromised a spoke cluster inject unauthorized EndpointSlices and ServiceImports into arbitrary namespaces on peer clusters. Because the destination namespace is taken from an attacker-controlled label/annotation on the broker object, resources can be planted into privileged namespaces such as kube-system and openshift-*, enabling privilege escalation and lateral cluster compromise. Rated CVSS 9.9 with a scope change; no public exploit identified at time of analysis.

Local privilege escalation in Parallels RAS Client 21.0.26296 allows an attacker holding low-privileged code execution to reach SYSTEM-level authority by invoking an exposed dangerous function in the RAS RDP Backend Service (CWE-749). The CVSS 7.8 (High) rating reflects full confidentiality, integrity, and availability impact once exploited, with low attack complexity and no user interaction required beyond an initial foothold. No public exploit code and no CISA KEV confirmation have been identified at time of analysis, though ZDI's coordinated disclosure (ZDI-26-556) may accelerate POC development.

Local privilege escalation in Parallels RAS Client 21.0.26296 allows low-privileged local attackers to gain SYSTEM-level code execution by invoking an exposed dangerous function within the RAS RDP Backend Service. The root cause is CWE-749, where a privileged service function is accessible without proper access control to lower-privileged callers. Discovered and reported by Zero Day Initiative (ZDI-26-555 / ZDI-CAN-28885), no public exploit or CISA KEV listing has been identified at time of analysis.

Local privilege escalation in Parallels RAS Client 21.0.26296 allows a low-privileged local attacker to escalate to SYSTEM-level execution by invoking an exposed dangerous function within the RAS RDP Backend Service. The flaw (CWE-749) stems from the service exposing an unsafe method that can be abused without administrative rights, enabling full system compromise. No public exploit or CISA KEV listing has been identified at time of analysis, though the vulnerability was coordinated through Zero Day Initiative (ZDI-CAN-29220).

Command injection in the Sony XAV-9500ES car audio receiver firmware 3.02.00 allows a local attacker with low-privileged code execution to escalate to root via the device's crash dump handler. The handler passes user-controlled input directly to an OS system call without sanitization (CWE-78), enabling arbitrary command execution at the highest privilege level. Disclosed by ZDI as ZDI-26-477 (ZDI-CAN-29061); no public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Privilege escalation to root on the Kenwood DNR1007XR car navigation/dashcam device is possible for physically present attackers who already hold low-privileged code execution on the device. The USB filesystem mount point is configured with incorrect default permissions (CWE-276), allowing a low-privileged process to write to or manipulate that directory and escalate to root with full code execution capability. No public exploit code or active exploitation has been identified at time of analysis; the attack surface is inherently constrained by the physical access prerequisite and the embedded nature of the device.

Local privilege escalation in the Kenwood DNR1007XR network video recorder enables an attacker with existing low-privileged code execution to gain root-level access by exploiting incorrectly permissioned resources associated with the udhcpd DHCP service. Discovered by Zero Day Initiative and tracked as ZDI-CAN-29111/ZDI-26-487, the flaw stems from CWE-732 (Incorrect Permission Assignment for Critical Resource), granting full C:H/I:H/A:H impact once the prerequisite foothold is established. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Local privilege escalation in Kenwood DNR1007XR network video recorder devices allows a low-privileged local attacker to achieve root-level code execution by exploiting command injection in the JKGenService service. The flaw (CWE-78) exists because user-supplied input is passed without sanitization to a system call, enabling shell metacharacter injection. No public exploit has been identified at time of analysis, and the device is not listed in CISA KEV, but successful exploitation yields full system compromise on the affected hardware.

Privilege escalation on IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 allows any low-privileged local user to gain full system control by exploiting improper authorization checks (CWE-285). SSVC rates the technical impact as total, consistent with the CVSS C:H/I:H/A:H rating, meaning a successful attacker achieves complete compromise of confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, and EPSS at 0.13% (3rd percentile) reflects negligible current exploitation pressure, though the low attack complexity makes this a meaningful insider-threat or post-compromise escalation risk.

Local privilege escalation in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 allows an authenticated local attacker with low-level access to gain elevated (likely root) privileges due to improper privilege management (CWE-269). The CVSS score of 7.8 reflects total confidentiality, integrity, and availability impact upon successful exploitation. No public exploit has been identified at time of analysis, EPSS is extremely low at 0.11% (2nd percentile), and SSVC confirms no observed exploitation, though technical impact is rated total if the flaw is triggered.