Privilege Escalation

Improper privilege management in AMD's KVM key download component allows authenticated local attackers to swap tokens and exfiltrate sensitive cryptographic keys due to insufficient access controls, potentially enabling unauthorized access to privileged resources and compromising system confidentiality. The vulnerability requires authenticated access (PR:L) but carries high confidentiality impact (VC:H), making it a significant risk in multi-tenant or shared-access environments.

Fleet trusts untrusted client-supplied IP address headers (X-Forwarded-For, X-Real-IP, True-Client-IP) when determining source IP for incoming requests, allowing both authenticated and unauthenticated attackers to spoof their apparent IP address and bypass per-IP rate limiting controls. This enables brute-force and password-spraying attacks against authentication endpoints to scale without triggering rate-limit protections, though the vulnerability does not itself enable authentication bypass, privilege escalation, data exposure, or remote code execution.

Privilege escalation in Essential Addons for Elementor (all versions ≤ 6.5.13) allows authenticated WordPress users with Author-level access or above to create new accounts with elevated roles such as Editor by exploiting the plugin's `register_user` function, which applies an incomplete role denylist that blocks only 'administrator' while leaving other privileged roles unguarded. The network-accessible, low-complexity attack vector (AV:N/AC:L/PR:L) makes this realistic for any site with the plugin's registration widget exposed and populated with low-trust authors. No public exploit has been identified at time of analysis and CISA KEV status is absent, but the plugin's broad WordPress deployment increases aggregate exposure.

Local privilege escalation vulnerabilities in Palo Alto Networks GlobalProtect App on Windows, macOS, and Linux allow a low-privileged local user to elevate to NT AUTHORITY\SYSTEM (Windows) or root (macOS/Linux), enabling full OS-level command execution. The root cause is CWE-426 (Untrusted Search Path), where the application resolves executables or libraries from attacker-controllable locations. No public exploit has been identified and CISA SSVC confirms exploitation status as none; however, SSVC rates technical impact as total, reflecting the complete privilege gain achievable upon successful exploitation.

Hiseeu C90 v5.7.15 exposes a UART bootloader in debug mode when the device battery is disconnected, allowing unauthenticated physical attackers with direct hardware access to achieve privilege escalation and potentially execute arbitrary code with full device control. This vulnerability requires physical tampering to trigger but bypasses all software-based security controls once activated.

IObit Uninstaller 9.5.0.15 contains an unquoted service path vulnerability in the IObitUnSvr service that allows local attackers to escalate privileges to SYSTEM level. Rated high severity (CVSS 8.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.

Privilege escalation in the mk_mysql agent plugin on Windows in Checkmk <2.4.0p29, <2.3.0p47, and 2.2.0 (EOL) allows a local unprivileged user able to create a Windows service whose name matches. Rated medium severity (CVSS 5.2), this vulnerability is low attack complexity.

FactoryCamera on Samsung Mobile Devices prior to SMR May-2026 Release 1 exposes a unique device identifier to local low-privileged attackers due to incorrect default file or resource permissions (CWE-276). Affected platforms span Android 14, 15, and 16. The vulnerability carries a CVSS 4.0 score of 6.8 with high confidentiality impact on the vulnerable system, though real-world risk is substantially tempered by the requirement for local device access, an EPSS of 0.01% (1st percentile), and SSVC classification of exploitation: none. No public exploit code or active exploitation has been identified at time of analysis.

Privilege escalation in the ionic network driver on VMware ESXi 8.x and 9.x hosts equipped with AMD-Pensando DPU hardware allows a low-privileged local attacker to corrupt heap memory and potentially execute arbitrary code with elevated privileges. Reported by AMD (AMD-SB-2001) and tracked as EUVD-2025-209814, the flaw carries a CVSS 4.0 base score of 8.8 with total technical impact but high attack complexity. There is no public exploit identified at time of analysis, and CISA SSVC rates exploitation as none with EPSS at just 0.01%, indicating no observed exploitation activity.

Local privilege escalation in the ionic cloud driver used by VMware ESXi 8.x and 9.x hosts running AMD-Pensando DPU products allows a low-privileged local attacker to corrupt heap memory and potentially execute arbitrary code with elevated (host-level) privileges. The flaw was reported by AMD (AMD-SB-2001) and carries a CVSS 4.0 base score of 8.8 with a 'total' technical impact under SSVC. There is no public exploit identified at time of analysis and EPSS is negligible (0.01%, 3rd percentile), consistent with SSVC exploitation status of 'none'.

Privilege escalation in Intel AI Playground software before version 3.0.0 alpha via an uncontrolled search path element (CWE-427) allows a local low-privileged attacker to execute arbitrary code with elevated privileges. Exploitation requires an authenticated user, active user interaction, high attack complexity, and specific attack conditions (AT:P), making this a constrained but high-impact local privilege escalation. No public exploit code has been identified and CISA SSVC rates current exploitation as none, consistent with the extremely low EPSS score of 0.01% (3rd percentile).

Escalation of privilege in Intel Endpoint Management Assistant (EMA) software before version 1.14.5 allows an unauthenticated adversary on an adjacent network to gain elevated privileges on the vulnerable host, fully compromising its confidentiality, integrity, and availability. The flaw stems from improper input validation in a Ring 3 user-application component and carries a CVSS 4.0 base score of 8.7 (High). There is no public exploit identified at time of analysis, exploitation is not observed per CISA SSVC (Exploitation: none), and EPSS is very low at 0.03%.

Privilege escalation in Intel Server Firmware Update Utility Software before version 16.0.12 exposes authenticated local users to an uncontrolled search path (DLL/library hijacking) condition within the Ring 3 user-application layer. A low-privileged local attacker who can plant a malicious library or executable in a directory the utility searches at launch can escalate privileges with high impact to confidentiality, integrity, and availability of the affected system. No public exploit is identified at time of analysis, and EPSS sits at the 3rd percentile, consistent with SSVC exploitation status of 'none'.

Privilege escalation in Intel Connectivity Performance Suite software installers before version 50.25.1121.193 allows a local, low-privileged authenticated attacker to gain elevated privileges through an uncontrolled search path (CWE-427) triggered during installer execution in Ring 3 user space. Exploitation is constrained by high attack complexity, a mandatory specific attack configuration (AT:P), and a requirement for active user interaction, making this a targeted rather than opportunistic risk. No active exploitation has been confirmed - EPSS sits at 0.01% (3rd percentile), SSVC lists exploitation as none, and no CISA KEV listing exists.

Privilege escalation in Intel NPU Driver software installers before version 32.0.100.4511 stems from incorrect default permissions applied to Ring 3 (user-space) components during installation, classified under CWE-276. A local authenticated low-privileged user on an affected system can exploit these misconfigured permissions under high-complexity conditions - requiring specific attack prerequisites and active user interaction - to achieve full confidentiality, integrity, and availability compromise of the vulnerable system. No active exploitation is confirmed (not in CISA KEV), EPSS is at the 1st percentile (0.01%), and SSVC designates exploitation status as none, indicating this is a theoretical but not currently weaponized risk.

Local privilege escalation in Dell PowerScale InsightIQ versions 5.0.0 through 6.2.0 allows high-privileged attackers to execute code with unnecessary elevated privileges, potentially escalating to full system compromise. The vulnerability requires existing local access and high privilege level on the affected system; no public exploit has been identified at time of analysis.

Improper input validation in an Axis OS configuration file allows authenticated SSH users to execute code and potentially escalate privileges. The vulnerability requires valid SSH credentials but affects all Axis OS versions, making it a significant risk for organizations running Axis network devices with SSH access exposed or shared credentials.

Privilege escalation in Axis OS via path traversal in ACAP configuration files allows high-privileged local attackers to achieve code execution with elevated permissions. The vulnerability requires the device to be configured for unsigned ACAP application installation and the attacker to socially engineer a user into installing a malicious ACAP application. CVSS 6.7 reflects high confidentiality, integrity, and availability impact, but exploitation is constrained by high-privilege requirement and user interaction. No public exploit code or active exploitation has been identified at time of analysis.

Command injection in Axis OS ACAP configuration file processing allows privilege escalation when unsigned ACAP applications are enabled and a user installs a malicious application. The vulnerability requires high-privileged user interaction and local access but bypasses normal code signing protections to achieve code execution with elevated privileges.

Axis OS allows privilege escalation via improper input validation during ACAP application installation when unsigned applications are permitted, enabling authenticated attackers with high privileges to gain elevated system access. The vulnerability requires explicit administrative configuration allowing unsigned ACAP installations and victim interaction to install a malicious application. No public exploit code or active exploitation has been confirmed at time of analysis.

Privilege escalation in MantisBT allows authenticated project managers to grant project-level administrator access to any user - including themselves - by submitting a forged access_level value to the ProjectUsersAddCommand handler via manage_proj_user_add.php or the REST API endpoint PUT /project/{id}/users. The frontend form correctly restricts selectable access levels to the actor's own role or below, but the backend command (versions <= 2.28.1) performs no equivalent server-side enforcement, accepting and persisting the elevated value. A proof-of-concept exists per SSVC data; however, real-world impact is bounded to project-scoped privilege elevation and does not confer instance-wide administrative capabilities such as managing users, plugins, or custom fields globally.

WSO2 Identity Server in multi-organization deployments fails to validate organization context during adaptive authentication flow execution, allowing privileged users in one organization to trigger authentication logic on other organizations. An attacker with adaptive authentication configuration privileges can exploit this context validation gap to bypass authorization boundaries, escalate privileges, and gain unauthorized access to user accounts and resources across organizational boundaries.

Improper privilege management in Dell ECS 3.8.1.0-3.8.1.7 and ObjectScale prior to 4.3.0.0 allows high-privileged local attackers to escalate privileges and gain full system access, affecting confidentiality, integrity, and availability. No public exploit code or active exploitation has been identified at the time of analysis.

Argus Surveillance DVR 4.0 contains an unquoted service path vulnerability in the DVRWatchdog service that allows local attackers to escalate privileges by exploiting the service binary path. Rated high severity (CVSS 8.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.

WordPress TheCartPress 1.5.3.6 contains an unauthenticated privilege escalation vulnerability that allows attackers to create administrator accounts by submitting crafted requests to the AJAX. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Path traversal in SharpCompress `WriteToDirectory()` allows malicious ZIP and TAR archives to create directories outside the intended extraction root via relative (`../../`) and absolute path (`/tmp/`) overrides in the directory-entry fast-path. TAR archives can be further escalated to arbitrary file writes when callers implement `SymbolicLinkHandler` without validating symlink targets, enabling an attacker to write files anywhere on the filesystem subject to process permissions. CVSS 5.9 reflects moderate severity; real-world impact depends on whether the application extracts untrusted archives and implements symlink handling.

Privilege escalation in SysReptor prior to version 2026.29 allows authenticated User Admins to hijack Superuser accounts by exploiting an overly permissive email-change capability combined with the optional Forgot Password reset flow. When the 'Forgot Password' feature is enabled (non-default) and the targeted Superuser has no MFA configured, a User Admin can redirect the password reset token to an attacker-controlled address and authenticate as Superuser, gaining access to the Django backend (/admin) and full installation settings control. No public exploit exists and EPSS stands at 0.02% (5th percentile), consistent with SSVC's 'none' exploitation status, but the impact when conditions are met is significant for the affected SysReptor installation.

Privilege escalation in Suite Numérique People prior to version 1.25.0 allows authenticated domain administrators to remotely promote any existing user to Owner role via a crafted invitation request, without requiring acceptance from the target user. The vulnerability requires valid Administrator credentials on a mail domain but grants immediate full domain ownership, creating a severe lateral privilege escalation risk within multi-tenant deployments.

Symlink following in cPanel's Nova plugin (Cpanel::Nova::Connector) allows any authenticated cPanel user to redirect a root-executed chmod to arbitrary filesystem paths by placing a symlink at a user-controlled legacy Nova path within their home directory. Affected are more than a dozen cPanel release trains spanning versions 11.86 through 11.136, plus WP Squared 11.136.x. No public exploit exists and EPSS stands at 0.04%, but CISA's SSVC framework rates the technical impact as total given the potential to set root-level permissions on critical system files, enabling local privilege escalation or denial of service in multi-tenant hosting environments.

Stored XSS in FacturaScripts product search modal allows authenticated warehouse users to inject malicious JavaScript via product reference field, which executes in the browser of any user opening the search modal in sales or purchase documents. An attacker with warehouse write access can escalate privileges by executing arbitrary authenticated requests in an administrator's session, including creation of new admin accounts, without requiring the admin's password. The vulnerability exploits improper output encoding combined with HTML parser re-interpretation during innerHTML assignment.

DLL hijacking in ZTE Cloud PC client uSmartView allows unauthenticated local attackers to achieve arbitrary code execution and privilege escalation by planting a malicious DLL that is loaded by uSmartViewServiceAgent.exe running with SYSTEM privileges. The vulnerability requires local access but no authentication and affects multiple ZXCloud IRAI product versions. No public exploit code or active exploitation has been confirmed at this time.

ZTE Cloud PC client uSmartview contains an OpenSSL configuration file privilege escalation vulnerability (CVE-2026-40004) that allows authenticated local attackers with user-level privileges to execute arbitrary code and escalate to higher privilege levels through a malicious openssl.cnf file. This requires physical access or local system access combined with user interaction, and affects ZTE's virtualized desktop infrastructure product. The CVSS score of 5.5 reflects the physical attack vector and additional user interaction requirement, despite the severity of code execution and cross-system scope impact.

HCL BigFix Service Management (SX) is affected by a Broken Access Control vulnerability leading to privilege escalation. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Same-origin policy bypass in Google Chrome's Canvas implementation allows a remote, unauthenticated attacker to cross origin boundaries by inducing a victim to visit a crafted HTML page. All Chrome versions prior to 148.0.7778.96 are affected. No public exploit exists and CISA KEV confirms no active exploitation, but the SOP bypass primitive could enable partial data exfiltration from other browser origins, making it a meaningful integrity and confidentiality concern for users of unpatched versions.

Site isolation bypass in Google Chrome prior to 148.0.7778.96 allows a remote attacker to read cross-origin response data that Chrome's Opaque Response Blocking (ORB) mechanism should render inaccessible, by luring a user to a crafted HTML page. The flaw stems from an inappropriate implementation in the ORB subsystem (CWE-269), undermining one of Chrome's core cross-origin data leak defenses. No active exploitation is confirmed (SSVC: none; EPSS: 0.03%), and a vendor patch is available in the stable channel release 148.0.7778.96.

Local privilege escalation in ZTE PROCESS Guard Service allows authenticated local users to escalate privileges and achieve arbitrary code execution through improper access control enforcement, affecting the cloud computer client. The vulnerability requires local access and authenticated user context but operates across system boundaries, potentially compromising system integrity. No active exploitation has been confirmed at time of analysis, though the combination of privilege escalation and RCE capability makes this a moderate-priority local threat.

The ciguard static analysis container image (versions 0.1.0-0.8.1) runs as root due to a missing USER directive in the Dockerfile, creating a privilege-escalation amplification risk for future container-runtime escape vulnerabilities. This is a defence-in-depth gap rather than a directly exploitable vulnerability; it reduces the impact of hypothetical escapes (such as runc CVE-2024-21626) from host-root compromise to non-root user compromise. Vendor-released patch in v0.8.2 adds a dedicated non-root ciguard user and USER directive, verified by container inspection and automated regression testing in v0.8.3.

Kubewarden versions before 1.35.0 permit RBAC reconnaissance attacks when users with AdmissionPolicy or AdmissionPolicyGroup creation privileges craft policies using the unchecked `can_i` host capability. The vulnerability allows enumeration of any user or service account permissions across the cluster via SubjectAccessReview requests executed with policy-server privileges, despite the absence of context-aware resource grants. This information disclosure enables attackers to discover sensitive permission configurations without requiring cluster-wide policy creation rights, a capability not available by default but exploitable when granted.

Stored cross-site scripting in Grav CMS Form plugin allows editor-level users to inject arbitrary JavaScript via taxonomy tag and category values that execute in administrator browsers when viewing any page in the admin panel. The vulnerability exploits unescaped Twig `|raw` filters in the select field template combined with a bypassable XSS detection regex, enabling privilege escalation through nonce theft and unauthorized admin actions. Vendor-released patch available in grav-plugin-form 9.0.1 and Grav core 2.0.0-beta.2.

Cross-organization dashboard configuration disclosure in runZero Platform allows authenticated users to view sensitive dashboard configurations outside their authorized organization scope via network requests. The vulnerability stems from improper privilege management (CWE-269) and affects versions prior to v4.0.260416.0, enabling authenticated attackers with low privileges to escalate access and view confidential configuration data across organizational boundaries.

Privilege escalation in Mentoring theme for WordPress (all versions ≤1.2.8) allows unauthenticated remote attackers to create administrator accounts via broken registration role validation in mentoring_process_registration(). The flaw bypasses normal WordPress role restrictions, enabling complete site takeover without requiring any authentication or user interaction. CVSS 9.8 (critical) with network attack vector and no complexity barriers. EPSS and KEV data not provided, but the combination of unauthenticated admin account creation represents an imminent site compromise risk for all installations with registration enabled.

Non-admin users holding the SETTINGS permission in pyload-ng can disable TLS peer and hostname verification by setting general.ssl_verify=off via the set_config_value() API, enabling man-in-the-middle attacks on all outbound HTTPS requests including downloads, captcha fetches, and plugin calls. This is an incomplete fix for a series of prior allowlist bypasses (CVE-2026-33509, CVE-2026-35463, CVE-2026-35464, CVE-2026-35586) in which security-sensitive configuration options were omitted from the ADMIN_ONLY_CORE_OPTIONS allowlist.

Norton Secure VPN installed via Microsoft Store allows low-privilege Windows users to escalate to SYSTEM-level privileges by replacing files during the installation process, causing arbitrary file deletion. Cisco Talos discovered this TOCTOU (Time-of-Check Time-of-Use) race condition in the installer. No public exploit code or active exploitation confirmed at time of analysis, but the local attack vector with low complexity (CVSS AC:L) makes this highly exploitable once installation details are known.

Out-of-bounds write in MediaTek's slbc (secure local buffer component) due to type confusion allows local privilege escalation to full system compromise when an attacker already holds System privilege. The vulnerability requires no user interaction and affects 32 MediaTek chipset models. CISA SSVC framework rates technical impact as total; however, EPSS score of 0.02% suggests limited real-world exploitation despite the high CVSS score of 6.7, likely due to the requirement for pre-existing System privilege.

Local privilege escalation in MediaTek chipsets (MT6765, MT8893, MT8791T, and 19 others) due to missing permission checks in geniezone allows attackers with System privilege to escalate their access without user interaction. CVSS 6.7 reflects high confidentiality, integrity, and availability impact, but EPSS score of 0.02% (4th percentile) and SSVC 'none' exploitation status indicate this vulnerability has not been observed in active, widespread exploitation despite the low barrier to exploitation from privileged context.

Local privilege escalation in MediaTek geniezone component due to missing bounds check allows System-privileged actors to achieve total system compromise across multiple chipset models. The vulnerability requires prior System-level access and affects 17 MediaTek chipset variants (MT6899, MT8791T, MT8786, MT6789, MT8367, MT6768, MT8766, MT6993, MT6991, MT6877, MT8788E, MT8781, MT8768, MT6989, MT8910, MT8196, MT8793). No public exploit code identified at time of analysis; exploitation remains unconfirmed in active systems despite SSVC indicating total technical impact potential.

Privilege escalation in GeoVision LPC2011/LPC2211 Web Interface allows authenticated attackers to leak stored credentials via specially crafted HTTP requests to the ssi.cgi endpoint. The vulnerability affects firmware version 1.10 and requires low-privilege user access but no additional user interaction, enabling unauthenticated credential disclosure on affected devices.

Kernel memory access and privilege escalation in PassMark DirectIo64.sys driver affect BurnInTest 11.0 Build 1011, OSForensics 11.1 Build 1007, and PerformanceTest 11.1 Build 1004. Local authenticated attackers can send crafted IOCTL 0x8011E044 calls to the vulnerable driver to read arbitrary kernel memory and elevate privileges to SYSTEM level. Public exploit code is available in the researcher's GitHub repository. EPSS data not available; no CISA KEV listing indicates no confirmed widespread exploitation, though POC availability lowers the barrier for local attacks.

IBM i 7.2-7.6 contains an invalid authorization check in the Web Administration GUI that allows authenticated high-privilege users with administrator access to trigger privilege escalation, enabling user-controlled code execution with administrator privileges. The vulnerability requires high privileges and user interaction (CVSS:H for confidentiality, integrity, and availability), but is not currently listed in CISA's Known Exploited Vulnerabilities catalog, and no public exploit code has been identified as of the analysis date.

Local privilege escalation in Acronis DeviceLock DLP on Windows (all builds before 9.0.93212) is achievable via DLL hijacking, granting an attacker full confidentiality, integrity, and availability impact over the affected system. Exploitation requires a low-privileged local account, high attack complexity, and user interaction - all factors that meaningfully constrain real-world exploitability despite the severe potential impact. No public exploit code and no active exploitation have been identified at time of analysis; EPSS at 0.01% (3rd percentile) and SSVC Exploitation status of 'none' both confirm negligible mass-exploitation probability.

Privilege escalation in OpenClaw's gateway plugin HTTP authentication mechanism allows an authenticated user with operator.read scope to gain unauthorized operator.write runtime access. The gateway auth route incorrectly widens identity-bearing read-scoped requests into write permissions, bypassing the intended authorization boundary. No active exploitation has been identified (CISA KEV absent), and the vendor has confirmed a patch in version 2026.4.8 of the npm package.

Spring gRPC 1.0.0 through 1.0.2 inherits authenticated user identity on gRPC worker threads after access denial, allowing a subsequent unauthenticated request on the same thread to gain escalated permissions. The vulnerability requires an authenticated attacker with prior knowledge of thread reuse patterns and affects only configurations where both authenticated and unauthenticated requests share gRPC worker threads. A patch is available in version 1.0.3.

mpGabinet 23.12.19 and earlier suffers from privilege escalation due to excessive database privileges assigned to the application service account. An attacker with local access to extract database credentials from the application process memory gains administrative database access, enabling unauthorized actions beyond what the application interface permits. CVSS 6.9 indicates high confidentiality impact from local access without authentication; no active exploitation confirmed in CISA KEV at time of analysis.

Elevation of Privileges in Dell Alienware Command Center (AWCC) versions prior to 6.13.8.0 allows a local low-privileged attacker to gain full system access by exploiting a component that executes with unnecessarily elevated rights (CWE-250). The attack requires high complexity and user interaction (CVSS AV:L/AC:H/PR:L/UI:R), placing real-world exploitability well below the theoretical maximum despite the total technical impact assessed by SSVC. No public exploit exists and EPSS places this in the 2nd percentile, confirming no public exploitation activity at time of analysis. Dell has released a fix in AWCC 6.13.8.0.

Local privilege escalation in the Fan Control (FanControl) desktop application V251 for Windows allows a low-privileged local user to gain administrator-level execution by abusing the application's Open File Dialog, which processes user-supplied paths under the app's elevated security context (CWE-269). Because Fan Control requires elevated permissions to access hardware sensors and fan controllers, an attacker who can interact with the running elevated instance can pivot from limited user rights to full SYSTEM/administrator control. There is no public exploit identified in the structured input, though a referenced GitHub gist likely contains a technical write-up; EPSS is very low (0.01%) and CISA SSVC lists exploitation status as none, indicating no observed in-the-wild activity.

Privilege escalation in OpenClaw's chat.send gateway endpoint allows write-scoped API callers to bypass authorization controls and persist admin-only verboseLevel session overrides via the /verbose parameter. All OpenClaw npm package versions up to and including 2026.3.24 are affected; the vendor-released fix is version 2026.3.28. No public exploit code has been identified at time of analysis, and CISA SSVC assessment confirms no active exploitation with only partial technical impact, aligning with an EPSS score in the 14th percentile.

Kirby CMS's REST API allows authenticated users with the `pages.create` permission to immediately publish pages by overriding the `isDraft` flag, bypassing the separate `pages.changeStatus` authorization check. This affects all 4.x releases before 4.9.0 and 5.x releases from 5.0.0 through 5.3.x, and is exploitable only by authenticated users in deployments where the two permissions are intentionally split. No public exploit code has been identified and EPSS sits at 0.03% (9th percentile), consistent with the SSVC assessment of no known active exploitation; the vulnerability is nevertheless a real workflow integrity bypass for editorial CMS environments.

Improper privilege management in IBM Guardium Key Lifecycle Manager versions 4.1 through 5.1 allows remote unauthenticated attackers to achieve limited confidentiality and integrity compromise through a network attack requiring high complexity. The vulnerability stems from inadequate access control enforcement that permits elevation of privileges without authentication, affecting a widely deployed enterprise key management solution.

Unprivileged local users on FreeBSD can read sensitive kernel memory via a page table manipulation bug in pmap_pkru_update_range(). When applying protection keys to 1GB largepage mappings created through shm_create_largepage(3), the kernel incorrectly treats userspace memory as page table entries, enabling unauthorized information disclosure. This affects FreeBSD 13.5, 14.3, 14.4, and 15.0 releases and has been confirmed fixed by vendor patches.

Oracle Java SE 25.0.1 exposes an integrity-bypass in its Libraries component that allows a remote unauthenticated attacker, via multiple protocols, to perform unauthorized data writes against accessible Java SE data. The attack is constrained to client-side deployments - specifically sandboxed Java Web Start applications and sandboxed Java applets loading untrusted internet code - and carries a vendor-assigned CVSS 3.7 (Low). No active exploitation is confirmed (SSVC: none, EPSS: 0.03%), and a vendor patch is available via the April 2026 Oracle Critical Patch Update.

Erlang OTP SSH daemon (ssh_sftpd) stores unresolved user-supplied paths in file handles, allowing authenticated SFTP users to modify file attributes (permissions, ownership, timestamps) outside the configured chroot directory via SSH_FXP_FSETSTAT requests. When the SSH daemon runs as root, this enables privilege escalation through setting setuid bits or changing ownership of system files. The vulnerability affects OTP versions 17.0 through 28.4.3 (and earlier point releases in 27.x and 26.x series); patched versions are available per vendor advisory.

Honor PcManager contains a privilege bypass vulnerability allowing local attackers without privileges to impact service availability through a type-confusion mechanism. The vulnerability requires high attack complexity and local access, resulting in a CVSS 3.2 (low severity) score with confidentiality and integrity impact ruled out. No active exploitation or public exploit code has been identified at the time of analysis.

XiangShan open-source RISC-V processor commit edb1dfaf7d290ae99724594507dc46c2c2125384 and earlier versions fail to properly gate the Control and Status Register (CSR) write-enable path for Physical Memory Attribute (PMA) configuration, allowing local attackers with code execution privileges to write to PMA CSRs that should raise illegal-instruction exceptions per the RISC-V specification. Successful exploitation enables attackers to alter memory attribute enforcement, potentially leading to privilege escalation, information disclosure, or denial of service depending on platform security boundaries. No public exploit code or active exploitation has been confirmed at time of analysis.

Dell PowerProtect Data Domain appliances versions 7.7.1.0-8.7.0.0, LTS2025 8.3.1.0-8.3.1.20, and LTS2024 7.13.1.0-7.13.1.60 contain an improper privilege management vulnerability in iDRAC that allows a high-privileged local attacker with user interaction to elevate privileges and perform unauthorized delete operations. The vulnerability requires high privileges and local access combined with user interaction, limiting real-world attack surface primarily to insider threats or physical facility access scenarios.

OpenXiangShan NEMU fails to properly enforce Smstateen permission controls, allowing authenticated local users to access IMSIC (Incoming Message Signal Interrupt Controller) state through stopei/vstopei CSRs despite mstateen0.IMSIC being cleared. This privilege escalation enables cross-context information disclosure of interrupt state and potential disruption of interrupt handling mechanisms in lower-privileged execution contexts.

STProcessMonitor 11.11.4.0 driver in Safetica Application suite allows local privileged users to send crafted IOCTL requests (0xB822200C) that terminate processes protected by third-party security implementations due to insufficient caller validation in the kernel-mode driver handler. This enables denial of service attacks against critical services without requiring user interaction. Publicly available exploit code exists, and the vulnerability is tracked in CISA's LOLDrivers database as a legitimate-but-abused Windows driver.

Local privilege escalation in the AMD Platform Configuration Blob (APCB) SMM driver, shipped in AGESA firmware across nearly the entire modern AMD EPYC, Ryzen, Threadripper, and Instinct MI300 line, lets a Ring 0 attacker escalate into System Management Mode (SMM) and potentially run arbitrary code below the operating system. The flaw stems from the SMM driver improperly invoking UEFI boot services, and AMD-reported it with a CVSS 4.0 base of 7.1; there is no public exploit identified at time of analysis and EPSS is negligible at 0.01%. Because SMM code runs at a higher trust level than the OS kernel, successful exploitation can undermine firmware integrity and any SMM-based security guarantees.

Privilege escalation in ASUS Member Center (华硕大厅) versions 1.6.6.4 and earlier allows authenticated local users to achieve Administrator-level privilege escalation by exploiting a Time-of-check Time-of-use (TOC-TOU) race condition during the update process. An attacker can substitute a malicious payload for the legitimate downloaded update immediately after integrity verification completes but before execution, causing the compromised code to run with administrative privileges upon user consent. CVSS 5.4 reflects the requirement for local access, user interaction, and elevated (but non-Administrator) initial privileges; however, the vulnerability achieves full privilege escalation to Administrator with moderate technical difficulty.

Privilege escalation in ASUS DriverHub through version 1.0.6.11 allows local authenticated users to modify update validation resources, bypassing security checks to execute arbitrary code with elevated privileges during driver updates. The vulnerability exploits improper file permission assignment in the update process, requiring user interaction to trigger the elevated execution. CVSS 5.4 indicates moderate severity; exploitation requires local access and authenticated user status with specific file system conditions.

Stored cross-site scripting in ApostropheCMS versions 4.28.0 and prior allows authenticated editors to inject arbitrary JavaScript into the color-field widget, executing in the browsers of all site visitors. Exploitation enables mass session hijacking and privilege escalation to administrative control; publicly available proof-of-concept exploit code exists, though no active exploitation has been confirmed. The vulnerability has been patched in version 4.29.0.

Financial rate manipulation in Kimai versions up to 2.52.0 allows any authenticated user (even with lowest privileges) to set their own hourly and internal rates via the User Preferences API, bypassing the role-based disable flag that otherwise hides these fields in the UI. This enables unauthorized inflation of billing rates, potentially leading to fraudulent invoices. Exploitation is confirmed by a public proof-of-concept, but no active exploitation has been reported and the EPSS score is low.

Stored cross-site scripting in Kimai before 2.53.0 allows authenticated low-privilege users to inject JavaScript via the profile alias field. The incomplete `escapeForHtml()` function fails to escape double and single quotes, enabling HTML attribute injection when the alias is rendered in the team member widget, and leading to privilege escalation if an administrator views the page. Public proof-of-concept code exists, but no active exploitation has been confirmed in the wild.

DLL hijacking in Lenovo Service Bridge prior to version 5.0.2.20 allows a local authenticated user to execute arbitrary code with elevated privileges by planting a malicious DLL in a directory resolved before the legitimate library during application load. Confirmed by Lenovo security advisory LEN-211071 and EUVD-2026-22919, this is a CWE-427 uncontrolled search path issue confined entirely to local exploitation. No public exploit has been identified at time of analysis, and EPSS at 0.01% (2nd percentile) reflects negligible observed exploitation activity.

Arbitrary WordPress action execution in Avada (Fusion) Builder plugin versions up to 3.15.1 allows authenticated attackers with Subscriber-level access to invoke unvalidated WordPress action hooks via the Dynamic Data feature, potentially enabling privilege escalation, file inclusion, denial of service, or remote code execution depending on available hooks in the WordPress installation. The vulnerability stems from the `output_action_hook()` function accepting user-controlled input without authorization checks. No public exploit code or active exploitation has been confirmed at time of analysis.

Serendipity's serendipity_setCookie() function accepts unsanitized HTTP_HOST header values as the cookie domain parameter, allowing remote attackers to scope authentication cookies (session tokens, auto-login tokens) to attacker-controlled domains and facilitate session hijacking. The vulnerability requires user interaction (victim authentication during poisoned Host header) and man-in-the-middle or reverse proxy misconfiguration to exploit, affecting all versions of Serendipity that use the vulnerable function. A proof-of-concept demonstrating cookie domain poisoning exists; exploitation probability is moderate (EPSS 6.9, CVSS AC:H reflects attack complexity), and no evidence of active exploitation has been identified.

Stored cross-site scripting (XSS) in Chamilo LMS versions prior to 2.0.0-RC.3 allows authenticated users to upload malicious HTML files containing JavaScript via the social post attachment API endpoint. The uploaded files are served without sanitization, content-type restrictions, or proper content-disposition headers, causing embedded JavaScript to execute in the browser within the application's trusted origin. This enables session hijacking, account takeover, and privilege escalation attacks, particularly when an administrator views a malicious link. The vulnerability is confirmed fixed in version 2.0.0-RC.3.

Stored XSS in October CMS versions before 3.7.14 and 4.1.10 allows authenticated users with media upload permissions to bypass SVG sanitization regex patterns and inject malicious JavaScript through crafted SVG files. When a superuser or other high-privileged user views or embeds the malicious SVG, the payload executes in their browser context, enabling privilege escalation. The vulnerability requires both authenticated backend access and user interaction (viewing/embedding the SVG), resulting in a CVSS 4.8 (Medium) rating; no public exploit code has been identified at time of analysis.

Stored Cross-Site Scripting (XSS) in October CMS versions prior to 3.7.14 and 4.1.10 allows authenticated backend users with editor settings permissions to inject malicious JavaScript into Markup Classes fields, which executes unsanitized in the Froala editor dropdown menus when any user-including superusers-opens a RichEditor. This enables privilege escalation when a superuser performs routine content editing tasks. CVSS 5.1 indicates moderate risk; exploitation requires authenticated backend access and user interaction (opening an editor), but the stored nature of the payload and privilege escalation potential elevate real-world concern. No public exploit code or active CISA KEV status reported.

Improper privilege management in Microsoft Windows allows authenticated local attackers to deny service by exploiting a privilege escalation flaw affecting Windows 10 versions 21H2 and 22H2, Windows 11 versions 22H3 through 26H1, and Windows Server 2022 and 2025. The vulnerability requires local access and valid credentials but does not permit code execution or data manipulation. CVSS 5.5 reflects moderate severity; CISA SSVC framework rates exploitation as none with partial technical impact, indicating this is not currently a priority threat despite patch availability.

Stored cross-site scripting in Apache Storm UI before 2.8.6 allows authenticated users with topology submission rights to inject malicious HTML/JavaScript via unsanitized component identifiers, stream names, and grouping values in the visualization component. The payload persists in Nimbus and executes in the browser of any administrator viewing the topology visualization, enabling privilege escalation in multi-tenant deployments. EPSS score of 0.04% and SSVC assessment of partial technical impact with no automated exploitation indicate relatively low real-world risk despite the concerning privilege-escalation scenario.

Galaxy Wearable prior to version 2.2.68.26 allows local attackers to access sensitive information through incorrect default file or directory permissions, exposing high-value data on affected wearable devices. The vulnerability requires local access but no authentication or user interaction, making it exploitable by any user on the device.

Local privilege escalation in systemd 259 before 260 allows authenticated local users to gain root-level access via varlink communication to systemd-machined, exploiting improper namespace isolation. The vulnerability requires low privileges, high attack complexity, and user interaction, affecting the systemd init system across Linux distributions. No public exploit code or active exploitation has been confirmed at time of analysis.

OpenClaw before version 2026.3.25 contains a privilege escalation vulnerability in the gateway plugin subagent fallback deleteSession function that improperly uses a synthetic operator.admin runtime scope, allowing authenticated attackers to execute privileged operations with unintended administrative access by triggering session deletion without a request-scoped client. CVSS score of 6.1 reflects the requirement for low-level user authentication (PR:L) and network accessibility; patch availability is confirmed.

Aiven Operator versions 0.31.0 through 0.36.x allow developers with ClickhouseUser CRD creation permissions in their own namespace to exfiltrate secrets from arbitrary namespaces by exploiting a confused deputy vulnerability in the operator's ClusterRole. An attacker can craft a malicious ClickhouseUser resource that causes the operator to read privileged credentials (database passwords, API keys, service tokens) from production namespaces and write them into the attacker's namespace with a single kubectl apply command. The vulnerability is fixed in version 0.37.0.

Frappe Learning Management System versions prior to 2.46.0 allow authenticated students to modify their own quiz scores via client-side manipulation using browser developer tools before submission. This vulnerability compromises the integrity of quiz results and academic reliability without enabling privilege escalation, unauthorized account access, or exposure of confidential information. The fix is available in version 2.46.0, and no public exploit code or active exploitation has been identified at the time of analysis.

Use of a default cryptographic key in Intel Pentium Processor Silver Series, Celeron Processor J Series, and Celeron Processor N Series hardware allows privilege escalation when a hardware reverse engineer with privileged user access performs a high-complexity physical attack with special internal knowledge. The vulnerability has a CVSS score of 5.8 with physical attack vector (AV:P) and high attack complexity (AC:H), requiring privileged access (PR:H) and special attack time requirements (AT:P). No public exploit code or active CISA KEV designation has been identified.

Red Hat Process Automation Manager container images allow local privilege escalation when the /etc/passwd file is created with group-writable permissions during the build process. An attacker with non-root command execution capability who is a member of the root group can modify /etc/passwd to create a new user with UID 0, gaining full root privileges within the container. This requires high privileges (membership in root group) and challenging conditions (AC:H), but affects all versions of Red Hat Process Automation 7 distributed as container images. No public exploit code has been identified at the time of analysis.

Container privilege escalation in Red Hat Web Terminal allows local attackers with group membership to modify the /etc/passwd file and create arbitrary user accounts including root. The vulnerability stems from overly permissive group-writable permissions on /etc/passwd during image build, enabling privilege escalation from non-root container users to full root access within the container. Red Hat Web Terminal across multiple versions is affected; no public exploit code or active exploitation has been reported at the time of analysis.

Privilege escalation in OpenShift Update Service (OSUS) container images allows local attackers with high privileges to gain root access by modifying the group-writable /etc/passwd file created during build time. An attacker executing commands within an affected container can leverage root group membership to inject a new user with UID 0, achieving full container root privileges. No public exploit code or active exploitation has been identified at the time of analysis.

Container privilege escalation in Red Hat Multicluster Engine for Kubernetes allows authenticated local attackers to escalate from non-root container execution to full root privileges by exploiting group-writable permissions on the /etc/passwd file created during container image build time, enabling arbitrary UID assignment including UID 0.