Privilege Escalation

Local privilege escalation in Windows License Manager exposes authenticated local users to full system compromise via a use-after-free condition (CWE-416). An attacker with a low-privileged local session who can win a memory-management race condition can corrupt heap state and redirect execution to gain SYSTEM-level privileges across a wide range of Windows 10, 11, and Server editions. No active exploitation is confirmed (absent from CISA KEV) and no public exploit code has been identified, but the breadth of affected Windows versions - from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025 - makes this a meaningful patch priority for multi-user and enterprise Windows environments.

Heap-based buffer overflow in Microsoft Standard XPS (XML Paper Specification), the Windows-integrated document format and print subsystem, enables a low-privileged local user to escalate to SYSTEM or administrator-level privileges across a broad range of Windows desktop and server releases. The flaw falls under CWE-122 and, given AC:L/PR:L/UI:N, requires only an existing standard user session and the ability to trigger XPS processing - no race condition or second-user interaction is needed. Microsoft has released patches for all affected builds; no public exploit code has been identified at time of analysis.

Use-after-free in the Windows Connected User Experiences and Telemetry service (DiagTrack) enables a locally-authenticated low-privileged attacker to escalate privileges to SYSTEM-level access. The vulnerability affects a broad range of current Windows releases - Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1, Windows Server 2022, and Windows Server 2025 - all receiving patched builds via Microsoft's update cycle. No public exploit code or CISA KEV listing has been identified at time of analysis, but the local privilege-escalation class and high C/I/A impact make this a credible post-compromise escalation path.

Privilege escalation via use-after-free in the Windows File History Service allows a local authenticated attacker to gain full system-level access. The vulnerability affects a wide range of Windows 10, Windows 11, and Windows Server 2016/2019 builds, patched by Microsoft in the corresponding Patch Tuesday update cycle. No public exploit or CISA KEV listing is present at time of analysis, but the High CVSS score (7.0) and C:H/I:H/A:H impact metrics reflect the severity of successful exploitation.

Local privilege escalation in Windows Connected User Experiences and Telemetry (DiagTrack) allows an authenticated local user to elevate to SYSTEM-level privileges by winning a race condition against the SYSTEM-privileged service. The flaw spans Windows 10 21H2/22H2, Windows 11 23H2 through 26H1, Windows Server 2022, and Windows Server 2025, all remediated in the associated Patch Tuesday release. No public exploit code or CISA KEV listing has been identified at time of analysis.

Privilege escalation in Microsoft SQL Server 2017 through 2025 allows any low-privileged authenticated database user to exploit improper symbolic link resolution during SQL Server file operations to gain high-level control over the host system across the network. The root cause is CWE-59 (link following): SQL Server resolves file system links without validating the resolved path, enabling a low-privilege login to redirect the high-privilege SQL Server service account into accessing or overwriting attacker-controlled targets. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad affected version scope - spanning all major SQL Server releases still in mainstream support - make patching an immediate operational priority.

Privilege escalation in Microsoft SQL Server (versions 2017, 2019, 2022, and 2025) allows a low-privileged authenticated user to elevate their database permissions to a higher role over the network via CWE-269 improper privilege management. With a CVSS 8.8 score and vector AV:N/AC:L/PR:L, the flaw requires only a valid SQL Server login - no attack complexity, no user interaction - and yields full confidentiality, integrity, and availability impact on the database instance. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the near-zero exploitation prerequisites within a widely deployed enterprise platform make urgent patching essential.

Privilege escalation in Microsoft SQL Server allows an authenticated low-privileged network attacker to gain complete control over affected database instances across SQL Server 2017, 2019, 2022, and 2025. The flaw stems from CWE-1220 (Insufficient Granularity of Access Control), where the access control model fails to enforce fine-grained permission boundaries, permitting a standard database login to exceed its intended privilege scope. No active exploitation has been confirmed by CISA KEV and no public proof-of-concept has been identified, but the broad version coverage and full C:H/I:H/A:H CVSS impact make patching urgent. Vendor-released patches are available across all affected release tracks.

Local privilege escalation in Windows Push Notifications affects Windows 10, Windows 11, and Windows Server 2022/2025 via a use-after-free (CWE-416) memory corruption flaw, allowing a low-privileged authenticated local user to obtain SYSTEM-level execution. The vulnerability spans nine distinct Windows release branches - including server editions - broadening the enterprise attack surface. No public exploit code or CISA KEV listing has been identified at time of analysis; however, LPE primitives of this class are routinely integrated into post-initial-access attack chains.

Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows an authenticated local attacker with low privileges to gain SYSTEM-level access via a race condition in kernel-level socket processing. The CVSS vector (AV:L/AC:H/PR:L/UI:N) reflects that exploitation requires an existing low-privilege foothold, precise timing to win the race window, but no user interaction. Microsoft has released patches across a wide range of supported Windows versions. No public exploit or CISA KEV listing has been identified at time of analysis, though race-condition LPE bugs in Windows kernel drivers are a favored post-exploitation technique.

Overly permissive ClusterRole in hawtio-operator amplifies the blast radius of any operator-pod compromise to cluster-wide Secret exposure. The operator's ServiceAccount is granted secrets: [create, get, list, update, watch] across all Kubernetes namespaces with no scope restriction, meaning an attacker who gains code execution in the operator pod can immediately read every Secret in the cluster - bootstrap tokens, cloud provider credentials, and secrets belonging to other operators. No public exploit code has been identified at time of analysis, but the vulnerability is a structural privilege misconfiguration that persists for the lifetime of any deployment running the default ClusterRole.

Privilege escalation in TYPO3 CMS 14.2.0-14.3.6 allows backend administrators without system-maintainer privileges to schedule configuration commands (configuration:set, configuration:show, configuration:read) through the TYPO3 scheduler module, bypassing the role-based authorization that normally restricts these operations to the highest privilege tier. An attacker holding a backend administrator account can leverage this to silently elevate themselves to system-maintainer status or corrupt system configuration to trigger a denial of service. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Privilege escalation in Dell Secure Connect Gateway (SCG) 5.0 allows a local attacker with basic system access to gain full administrative control of the affected host. The root cause is improper privilege management (CWE-269) in both the SCG 5.0 Application (prior to 5.36.00.00) and SCG 5.0 Appliance (prior to 5.36.00.16), as confirmed by Dell advisory DSA-2026-382. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.

Privilege escalation in JetBrains YouTrack before version 2026.2.18634 enables authenticated low-privileged users to alter group memberships without proper server-side authorization validation, effectively granting themselves elevated rights. The flaw (CWE-266, Incorrect Privilege Assignment) means the application trusts client-supplied group membership parameters without enforcing that the requesting user has the authority to make such changes. With a CVSS base score of 8.8 and full C:H/I:H/A:H impact, successful exploitation yields the equivalent of full administrative control over the YouTrack instance.

Privilege escalation in WP Fusion (Pro) for WordPress allows authenticated attackers with Subscriber-level access to create new administrator accounts and achieve full site compromise. The vulnerability resides in the ThriveCart Auto Login handler's `thrivecart()` function, which fails to enforce authorization on the `role` parameter during user account creation, enabling callers to self-assign the `administrator` role. The required access_key is distributed openly to all ThriveCart customers as part of the plugin's documented setup, substantially lowering the practical barrier for anyone who has transacted with the target site's ThriveCart storefront; no public exploit or CISA KEV listing has been identified at time of analysis.

Local privilege escalation to root in Dell Secure Connect Gateway (SCG) 5.0 lets a low-privileged operator with SSH access to the appliance host obtain full root control without a password by abusing the exposed Docker socket (CWE-250, Execution with Unnecessary Privileges). Affected builds are the SCG Appliance prior to 5.36.00.16 and the SCG Application prior to 5.36.00.00. The same socket exposure also enables container escape: an attacker who compromises any service inside the orchestrator container can break out to host-level control. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the technique (writable/accessible Docker socket) is a well-known and reliable escalation path.

Local privilege escalation in Dell Secure Connect Gateway 5.0 enables a low-privileged authenticated user with local shell access to gain elevated - likely root or administrator-level - control of the affected host. Both the virtual appliance (prior to 5.36.00.16) and standalone application (prior to 5.36.00.00) deployments are affected, as confirmed by Dell advisory DSA-2026-382. No public exploit code or active exploitation has been identified, and vendor-released patches are available for both product variants.

Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset variants via a heap-based out-of-bounds write stemming from a missing bounds check (CWE-122). An unprivileged local process on any affected device can trigger the flaw to achieve full kernel-level read, write, and execute access without requiring any user interaction. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the sheer breadth of affected chipsets across MediaTek's mid-range and budget device portfolio makes systematic patch deployment a significant supply-chain challenge.

Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged attacker to escalate privileges to kernel level with full system compromise. The CVSS vector (AV:L/AC:L/PR:N/UI:N) reflects that any Android app running on an affected device can trigger this flaw without special permissions or user interaction, consistent with typical Android kernel driver exposure. SSVC rates exploitation as 'none' and the attack as non-automatable, though technical impact is assessed as total; no public exploit or CISA KEV entry exists at time of analysis.

Authorization bypass in MISP's UiBeta theme collection view exposes full event details - including identifiers, info fields, timestamps, creator organization, all event tags, and galaxy clusters - to authenticated users who lack ACL permissions to those events. The UiBeta theme's `view.ctp` template performed an independent secondary database query using only `Event.uuid IN (...)` without invoking `createEventConditions()`, the canonical per-user ACL enforcement method, even though `CollectionsController::view()` correctly filtered events via `Event::fetchSimpleEvents($user, ...)`. The flaw is compounded because `CollectionElementsController::add()` accepts arbitrary UUIDs from collection owners without validating the submitter's authorization against the referenced event, making collection elements an attacker-controlled input to an unfiltered query. No public exploit code has been identified at time of analysis and no CISA KEV listing exists.

Account takeover via insecure direct object reference in the SureCart WordPress plugin (versions 4.0.0 through 4.6.2) allows any subscriber-level authenticated user to seize full control of an administrator account. The plugin's customer update endpoint validates that the requester has permission to update customers, but fails to verify that the target customer record belongs to the requesting user - enabling arbitrary cross-user email modification followed by a password reset. A compounding information disclosure flaw leaks customer identifiers and email addresses to all authenticated users, providing the enumeration primitive needed to complete the takeover chain without any additional knowledge. A publicly available proof-of-concept exploit exists, and vendor patch 4.6.3 is available.

Improper privilege management in the Tenda CP3 IP camera (firmware 27.5.57.101) exposes the CRedirServer::SetRedirectEnable function (Functions/Redirect.cpp) to remote abuse, letting an attacker toggle the device's redirect handling without proper authorization enforcement. The flaw was disclosed by VulDB (vuln #399276) and carries a CVSS 4.0 base score of 9.4, though no public exploit code and no active-exploitation evidence accompany the entry. No public exploit identified at time of analysis, and the single-source, sparse disclosure limits how much of the claimed impact can be independently confirmed.

Privilege escalation in MikroTik RouterOS lets a remote, unauthenticated attacker abuse the SSH login helper to rewrite the trusted RouterOS policy mask by supplying a username that begins with a prohibited character. Because the flaw is reached before authentication completes, an attacker who can open an SSH session to an affected device can escalate to full administrative privileges. Publicly available exploit code exists, and CERT-PL (the reporter) has published a companion advisory describing these RouterOS issues as actively exploited, though the CVE is not confirmed on CISA KEV in the provided data.

Privilege escalation in grav-plugin-api before 1.0.20 allows a low-privileged API manager to self-create a super-admin account by exploiting a logic gap in the InvitationsController's stripSuperFlags() method, which strips nested super flags but ignores dot-keyed equivalents such as 'api.super'. The attacker crafts an invitation payload containing the dot-keyed flag, which persists through sanitization into the new account, then self-accepts the invitation via the public acceptance endpoint - no real invitee participation required - and immediately receives a valid JWT granting full Grav site control. No public exploit or CISA KEV listing is present at time of analysis, but the attack is fully self-contained and conceptually trivial for any account already holding api.users.write permissions.

Privilege escalation in the Abandoned Cart Pro for WooCommerce WordPress plugin (all versions through 10.7.1) allows authenticated subscribers to gain full WordPress administrative access by hijacking the plugin's SMTP email routing. Missing capability checks and nonce verification on at least four AJAX endpoints - including wcap_save_connector_settings - permit any subscriber-level user to silently redirect outbound SMTP traffic through an attacker-controlled mail server. Once SMTP is redirected, the attacker intercepts auto-login recovery links sent to administrators and authenticates as admin without any further credentials. No public exploit has been identified at time of analysis, but the attack exploits a default-enabled feature, significantly lowering the bar for abuse on any standard installation.

Site takeover in the SEO Flow by LupsOnline WordPress plugin (versions 3.0.0 through before 3.0.3) stems from improper validation of the credential supplied with the plugin's API requests, allowing unauthenticated attackers to be served in the security context of the administrator who configured the plugin. Because the flaw grants effective administrator-level access, an attacker can fully compromise the affected WordPress site. Publicly available exploit code exists (published by WPScan), though EPSS remains low at 0.15% (4th percentile), and there is no public exploit identified as active in the wild.

Privilege escalation in Inductive Automation Ignition 8.1.53 and earlier allows any authenticated user who can execute gateway scripts to create SCADA/HMI projects without restriction, because the Gateway 'Create Project Role(s)' setting shipped with a blank default - effectively disabling the access control gate entirely. In industrial control system (ICS) environments, unauthorized project creation is operationally significant: projects define the logic, tags, and screens that interact with physical process equipment. Ignition 8.1.54 closes the gap by restricting project creation to Designer sessions, removing reliance on the misconfigured role setting. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Privilege escalation in PassMark's shared DirectIo64.sys kernel driver, bundled with PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016), allows any low-privileged local user to gain complete hardware-level control over the host. The driver exposes IOCTLs without validating the target device, register offset, or value, enabling arbitrary PCI configuration space reads and writes. An attacker can leverage this to enable Bus Master DMA on any PCI device, remap Base Address Registers to attacker-controlled physical memory addresses, or halt storage controller I/O - all without kernel exploits. A public proof-of-concept is available; no active exploitation (CISA KEV) confirmed at time of analysis.

Local privilege escalation in Acunetix 25.11.251107123 for Windows enables low-privileged local users to execute arbitrary code as SYSTEM by exploiting CWE-427 (Uncontrolled Search Path Element) in the wvsc.exe Web Vulnerability Scanning Engine. The SYSTEM-level wvsc.exe process searches for OpenSSL-related files at a hardcoded directory path that does not exist by default; an attacker creates the missing directory and plants a malicious file, which the service subsequently loads and executes, yielding full SYSTEM-level control. A public proof-of-concept is available via the Full Disclosure mailing list and corroborated by a VulnCheck advisory, making this trivially reproducible by any local user on affected Windows installations.

Local privilege escalation in JAL Information Technology's Pallet Control suite (including PalletControl and PalletControl Cloud) enables a low-privileged local attacker to execute arbitrary code with SYSTEM-level privileges due to incorrect default installation permissions (CWE-276). All tracked versions across three CPE entries are listed as affected per JPCERT/CC coordination notice JVN#84094853. No public exploit code has been identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog.

Unauthenticated account takeover in the ACPT (Premium) WordPress plugin (versions up to and including 2.0.66) lets remote attackers hijack any account, including administrators. The plugin's submit() handler processes anonymous form submissions without verifying that the submitter is authorized to modify the targeted user, then passes an attacker-controlled user ID to wp_update_user(), allowing the attacker to overwrite that user's email address and password. Reported by Wordfence; no public exploit and no CISA KEV listing at time of analysis, but the CVSS 9.8 rating reflects a trivially weaponizable full-compromise path where a vulnerable form is exposed.

Privilege escalation in MBS-solutions X-Serie Gateway firmware V6_00_05 allows a remote attacker to gain elevated privileges by abusing two CGI endpoints, /cgi-bin/wwwugw.cgi and /cgi-bin/ugwdownload.cgi. Per the CVSS vector the attack requires no authentication (PR:N) and yields high confidentiality and integrity impact, effectively granting an attacker administrative control over the gateway's configuration and data. A public write-up and proof-of-concept exist in a GitHub research repository, though there is no evidence of active exploitation.

Account takeover in slimkit ThinkSNS+ v2.4 allows a remote unauthenticated attacker to hijack arbitrary user accounts by abusing the password-reset flow, where the ResetPasswordController.php component continues to accept verification codes after they should have expired. Because expired codes remain valid (enabling reuse/replay of a code well past its lifetime), an attacker can complete a password reset for a targeted account and gain full control. No public exploit code is confirmed, though a detailed technical writeup exists; EPSS is low (0.21%) and the issue is not on CISA KEV.

Privilege escalation on MBS-Solutions X-Serie Gateway firmware V6_00_05 allows an authenticated low-privileged service user to gain full root access on the device. The firmware grants passwordless sudo execution of /usr/bin/tcpdump as root; by supplying the -z post-rotate flag, the attacker triggers execution of an arbitrary command with root privileges, achieving complete system compromise. A public proof-of-concept is available via the researcher's GitHub repository; no CISA KEV listing has been identified at time of analysis.

We need answer JSON only. We need synthesize. Let's inspect input. CVE-2026-75171: HubCore v.14.1.1 session cookie handling privilege escalation. CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE-384 Session Fixation. EPSS 0.22 percentile 13. No KEV. POC? References GitHub vulnerability-research maybe includes POC? It says references [cveorg] GitHub SilviaMun vulnerability-research/tree/main/CVE-2026-75171. That could be POC/research. We need use all. Tags: Privilege Escalation, Session Fixation, N A. CPE n/a. Product HubCore. Need product name "HubCore". Summary original synthesis not copy description. Mention session fixation? Need likely issue: session cookie handling allows privilege escalation via HUBCOREID cookie. Remote attacker unauthenticated? CVSS says PR:N, UI:N. So unauthenticated remote. Need state POC exists? Reference likely public research repo named CVE. We can infer publicly available exploit code? Need cautious: no explicit POC flag. The GitHub link is "vulnerability-research" might contain details/POC. We can say "a public vulnerability research repository for this CVE is referenced" but don't claim public exploit unless know. Field summary should mention if POC exists and EPSS risk. Per rules "If POC=YES but no KEV: publicly available exploit code exists". Input didn't have POC boolean, but reference GitHub SilviaMun/vulnerability-research may be POC. We can mention "a public research repository exists" not "exploit code exists" maybe. But need extraction maybe confidence_notes. Let's parse each field. product_name: "HubCore". Summary: Need 2-3 sentences, original. Start with specific impact verb and product. E.g. "Privilege escalation in HubCore v.14.1.1 permits remote attackers to hijack or forge the HUBCOREID session cookie, gaining elevated privileges. The vulnerability stems from improper session cookie handling (CWE-384) and is rated CVSS 9.8 with network, low complexity, no privileges or user interaction. No CISA KEV activity; EPSS 0.2

Privilege escalation in Kibana's Fleet management component allows any user holding Fleet management privileges to mint arbitrarily elevated Elasticsearch cluster credentials - up to full cluster administration - for every Elastic Agent enrolled in a targeted policy. Elasticsearch cluster privilege declarations sourced from integration packages were not validated before being used to generate agent credentials (CWE-863: Incorrect Authorization), enabling an attacker to inject overprivileged credentials across an entire agent fleet. No public exploit has been identified at time of analysis, and CISA KEV status is not confirmed, but the impact is laterally broad: a single privileged user can compromise all agents and the Elasticsearch cluster they authenticate to.

Local privilege escalation in HP Support Assistant (versions prior to 9.53.2.0) allows a low-privileged local user to gain elevated system privileges by exploiting insufficient granularity in access controls (CWE-1220). The vulnerability requires local authenticated access but no user interaction, and the CVSS 4.0 AT:P metric indicates specific attack conditions must be present. No public exploit code or active exploitation has been identified at time of analysis; HP has released a patched version addressing the issue.

Privilege escalation in the Bricksforge WordPress plugin (versions <= 3.1.8.8) lets a low-privileged user elevate their account to higher-privileged roles, per a Patchstack advisory. The flaw (CWE-266, Incorrect Privilege Assignment) carries a CVSS of 9.8 with a network/no-auth vector, though the 'Subscriber Privilege Escalation' label implies a logged-in subscriber account is the realistic starting point. No public exploit code, KEV listing, or EPSS score was provided at time of analysis.

Subscriber-level privilege escalation in WCFM Membership WordPress plugin (versions ≤ 2.11.11) enables any authenticated user holding a basic subscriber account to elevate their role to a higher-privileged level, producing high-integrity impact on the affected WordPress/WooCommerce installation. The flaw falls under CWE-266 (Incorrect Privilege Assignment) and was responsibly disclosed by Patchstack. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity and broad attacker pool (any registered subscriber) make this a realistic threat for multivendor marketplace deployments.

Improper authentication in Adobe ColdFusion 2023 and 2025 allows unauthenticated adjacent-network attackers to escalate privileges and gain limited read and write access to affected systems. The vulnerable administrative component is network-restricted by default, which partially contains exposure, but the scope change indicator in the CVSS vector signals that successful exploitation can affect components beyond the directly targeted service. No public exploit code or CISA KEV listing has been identified at time of analysis.

Full account takeover in WWBN AVideo arises because the video_id_hash acts as a non-expiring, non-revocable bearer token that authenticates the holder as the video owner with complete administrator privileges. Any attacker who obtains a valid video_id_hash can replay it indefinitely to gain full admin session access, and the credential keeps working even after the victim rotates their password - eliminating the primary recovery mechanism. Reported by VulnCheck with a fix in the vendor GitHub Security Advisory; no public exploit identified at time of analysis, and no EPSS or KEV data was provided.

Privilege escalation in util-linux through versions 2.41.5 and 2.42.2 allows local low-privilege users to execute privileged post-mount hook operations on pre-existing filesystems by exploiting libmount's failure to validate mount helper exit status before dispatching the MOUNT_POST stage. The root cause - captured by CWE-390 - lies in context_mount.c functions mnt_context_do_mount() and mnt_context_mount(), which gate post-mount hook execution solely on a zero result code without verifying whether the underlying mount helper or kernel syscall actually succeeded. No public exploit code has been identified at time of analysis, but the public GHSA advisory and three upstream patch commits provide sufficient technical detail to support independent exploit development.

Local privilege escalation in Elastic Agent on Windows enables a low-privileged local user to achieve SYSTEM-level code execution by exploiting overly permissive access controls (CWE-732) on resources created during unprivileged-mode installation. The agent service, running as SYSTEM, will execute attacker-controlled binaries placed via the CAPEC-642 binary replacement technique. Vendor-released patches 8.19.21, 9.4.6, and 9.5.2 are available per advisory ESA-2026-150; no public exploit identified at time of analysis.

Privilege escalation in the LiquidThemes Booking Hub WordPress plugin (≤1.3.1) allows authenticated low-privileged users to incorrectly assign themselves or others elevated WordPress roles, up to and including administrator. The flaw stems from CWE-266 (Incorrect Privilege Assignment) - the plugin fails to enforce proper capability checks before processing role or privilege assignment operations. CVSS 8.8 (PR:L) confirms exploitation requires an existing low-privilege account; no public exploit code or CISA KEV listing identified at time of analysis.

Unauthenticated privilege escalation in the WordPress Authorizer plugin (versions 3.15.1 and earlier) lets remote attackers with no credentials elevate themselves to elevated/administrative roles, according to a CVSS 9.8 rating and CWE-266 (incorrect privilege assignment). Authorizer is an authentication/SSO plugin, so a flaw in its role-assignment logic effectively hands attackers control of the authentication gate itself. No public exploit identified at time of analysis, and the issue is reported by Patchstack rather than listed in CISA KEV.

Privilege escalation in Craft CMS before 5.10.11 lets remote attackers gain administrator rights by registering a new account using the email address of a previously deactivated admin, because the admin flag is not validated and persists across registration. Exploitation requires public user registration to be enabled and email verification to be disabled. Reported by VulnCheck with a vendor security advisory (GHSA-242m-9wq7-vhwq); no public exploit identified at time of analysis.

Privilege escalation to administrator in the Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 allows unauthenticated visitors to bypass role restrictions enforced on front-end user registration forms. The plugin fails to validate that a submitted role value matches those actually offered by the configured form, and its blocklist against privileged roles is incomplete, enabling a two-stage attack: register with an elevated role, then escalate that account to full site administrator. A publicly available exploit exists per WPScan disclosure, raising the urgency of patching; no public KEV listing has been identified at time of analysis.

Privilege escalation in the JetBackup WordPress plugin before 3.1.23.5 allows a subscriber-level user to gain full administrator access by exploiting the plugin's failure to validate account roles during a site restore or migration. When the site owner performs a legitimate backup restore or migration, JetBackup blindly preserves and promotes accounts in the backup set without re-verifying their roles or capabilities, silently elevating an attacker's low-privilege account to administrator. A publicly available proof-of-concept exists per WPScan, though no confirmed mass exploitation (CISA KEV) is on record; the CVSS 7.1 score (AC:H/UI:R) reflects real-world complexity imposed by the site-owner trigger.

Unauthenticated privilege escalation in the WordPress plugin Booking for Appointments and Events Calendar - Amelia (Premium) versions 8.0 through 9.6.2 lets remote attackers gain full administrator control of a site. By abusing insufficient validation of the 'type' parameter in the customer update endpoint (with 'externalId' set to 0), an attacker elevates a customer to the manager role, then creates a provider entity linked to an existing administrator and overwrites that administrator's password. No public exploit has been identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network reachability make this a high-priority patch for affected sites.

Authentication bypass in HPE AOS-CX switch operating system allows an adjacent unauthenticated attacker, under high-complexity conditions, to circumvent authentication controls and achieve both integrity compromise and sensitive information exposure. The scope change in the CVSS vector (S:C) indicates successful exploitation can extend impact beyond the directly targeted switch - relevant in networked environments where a compromised switch becomes a pivot point. No public exploit code or CISA KEV listing is present at time of analysis.

Local privilege escalation in HPE Networking Fabric Composer allows an attacker holding a low-privileged local account to execute arbitrary code with root privileges, achieving complete host compromise. The CVSS vector (AV:L/AC:H/PR:L) confirms exploitation is confined to the local system and requires high attack complexity - consistent with a race condition or SUID-binary class of flaw. No public exploit has been identified at time of analysis, and this CVE does not appear in CISA KEV.

Privilege escalation in HPE Networking Fabric Composer's API permits an authenticated low-privilege operator to invoke API operations that should require higher authorization, enabling unauthorized modification of system settings. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms the exploit path is network-accessible with no user interaction required beyond holding a valid operator-role credential. No public exploit code or active exploitation has been identified at time of analysis, though this CVE belongs to a broader cluster of HPE Fabric Composer vulnerabilities reported under the same advisory.

Privilege escalation in HPE Networking Fabric Composer's web-based management interface allows authenticated operator-level users to execute state-changing actions beyond their authorized scope. The CVSS vector (PR:L/I:H) confirms exploitation requires low-privilege credentials but yields high-integrity impact - unauthorized modification of platform state that should be gated to higher-privilege roles. No active exploitation or public exploit code has been identified at time of analysis.

Arbitrary file write via the HPE Networking Fabric Composer API enables an authenticated administrative user to escalate privileges to root on the underlying operating system. The vulnerability allows admin-level API users to write attacker-controlled content to arbitrary filesystem paths, which can then be leveraged to execute arbitrary OS commands as root. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Broken access control in HPE Networking Fabric Composer's API allows authenticated low-privilege operator users to read data beyond their authorized scope, potentially enabling lateral movement or privilege escalation within the management plane. The vulnerability is network-exploitable with low attack complexity once a valid operator credential is obtained, as reflected by the CVSS 7.6 score (AV:N/AC:L/PR:L). No public exploit code or CISA KEV listing has been identified at time of analysis.

Local privilege escalation in HPE Networking Fabric Composer allows an attacker with low-level local access to execute arbitrary code with root privileges on the host operating system. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only a local foothold with minimal privileges - no user interaction or elevated rights needed beyond initial system access. No public exploit code or CISA KEV listing has been identified at time of analysis; however, HPE has published a security bulletin acknowledging the issue.

Privilege escalation via an unauthenticated API endpoint in HPE Networking Fabric Composer allows a remote attacker to obtain administrative privileges and achieve complete compromise of the Fabric Composer host. The CVSS vector (AV:N/AC:H/PR:N/UI:N) confirms network-accessible, unauthenticated exploitation, though AC:H indicates a non-trivial exploitation condition such as a race, specific request sequence, or transient configuration state. No active exploitation is confirmed and no public exploit code has been identified at time of analysis.

Privilege escalation in the HPE Networking Fabric Composer API allows authenticated low-privilege operator users to invoke state-changing API operations beyond their authorized scope, including modifications to configurations of network systems managed by the platform. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/I:H) confirms the flaw is remotely exploitable with no complexity or interaction requirements, and that the integrity impact extends beyond Fabric Composer itself to the downstream network infrastructure it manages. No public exploit code or CISA KEV listing is present at time of analysis, but the low exploitation barrier - a valid low-privilege credential - makes this a meaningful insider and credential-theft escalation risk.

Privilege escalation in Easybyte Software's Konga before 2.1.0 allows any authenticated local Windows user to execute arbitrary code at the privilege level of the account running Konga by planting attacker-controlled OpenSSL configuration or library files in a hardcoded filesystem path that is absent from default installations and resides in a location writable by all authenticated users. The root cause is CWE-427 (Uncontrolled Search Path Element): Konga loads OpenSSL from a fixed, predictable path without verifying the integrity or provenance of files found there, enabling a classic library-planting attack. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available in version 2.1.0.

Privilege escalation in HPE Networking Fabric Composer's API allows an authenticated low-privilege operator user to elevate permissions to administrative level, resulting in complete system compromise. The flaw is exploitable over the network without user interaction, making it accessible to any attacker holding a valid operator account. No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity makes this a credible internal-threat vector in any environment where operator credentials are broadly issued or have been exposed.

Privilege escalation in Kibana allows an authenticated user holding workflow edit permissions to cause scheduled workflow executions to run under the privileges of a higher-privileged user, granting unauthorized read and write access to data outside their authorization scope. The flaw (CWE-863, Incorrect Authorization) stems from Kibana's workflow scheduling subsystem failing to enforce authorization boundaries when executing scheduled jobs - a pattern classified under CAPEC-180. No public exploit exists at time of analysis, but the CVSS 8.3 (High) score with a network-accessible, low-privilege attack vector reflects genuine impact for any multi-user Kibana deployment. Elastic's advisory ESA-2026-61 references Kibana 9.4.3 as the fix release.

Privilege escalation in Rockwell Automation's Redundancy Module Configuration Tool (RMConfigTool.exe) enables a local standard user to execute arbitrary code with Administrator or SYSTEM privileges via DLL search order hijacking. The tool searches system PATH directories for required DLLs, and one or more of those directories have incorrect default permissions allowing write access by non-privileged accounts; if a malicious DLL is planted there before an administrator runs the tool, it loads into the elevated process. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the underlying technique is well-understood and commonly leveraged in post-exploitation privilege escalation chains.

DLL hijacking in Rockwell Automation's Redundancy Module Configuration Tool (RM3ConfigTool.exe) allows a local low-privileged attacker to escalate to Administrator or SYSTEM privileges by planting a malicious DLL in a writable system PATH directory before an administrator launches the utility. The root cause is CWE-276 (Incorrect Default Permissions): the installer grants standard users write access to one or more directories that RM3ConfigTool.exe searches at runtime for a required DLL, enabling the classic DLL planting technique. No public exploit code has been identified at the time of analysis, and this CVE does not appear in the CISA KEV catalog.

Privilege escalation in Rockwell Automation FactoryTalk® Activation Manager exposes authenticated local Windows users to full SYSTEM-level access by exploiting visible console windows spawned by the installer's custom actions during installation or repair operations. Any low-privileged user present on the machine during an install or repair sequence can interact with these unprotected, SYSTEM-privileged console windows to launch an unrestricted command shell. No public exploit has been identified at time of analysis, but the attack technique - console window hijacking during elevated installer operations - is a well-documented Windows privilege escalation class requiring minimal skill once the precondition is met.

Privilege escalation in Firefox's WebDriver BiDi component allows network-based attackers, with user interaction, to achieve full compromise of the browser process across confidentiality, integrity, and availability dimensions. All Mozilla Firefox versions prior to 155 are affected, as confirmed by vendor advisory mfsa2026-82 and the wildcard CPE cpe:2.3:a:mozilla:firefox:*. No public exploit code has been identified at time of analysis, and SSVC confirms no observed exploitation, though CISA rates the technical impact as total.

Use-after-free in Firefox's WebGPU graphics component allows privilege escalation when a victim visits a specially crafted webpage. Affecting all Firefox versions prior to 155 and ESR prior to 153.2, a remote unauthenticated attacker can trigger memory corruption by delivering malicious WebGPU content, achieving full confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit or active exploitation has been identified at time of analysis; SSVC confirms exploitation status as none and the attack is not automatable due to required user interaction.

Privilege escalation in Mozilla Firefox for Android (versions prior to 155) allows a remote, unauthenticated attacker to achieve full compromise of confidentiality, integrity, and availability by exploiting improper access control (CWE-284) when a user interacts with attacker-controlled content. Mozilla confirmed the fix in Firefox 155, documented under MFSA2026-82. No public exploit code exists and CISA has not added this to KEV, though SSVC rates the technical impact as 'total', underscoring the severity if successfully triggered.

Privilege escalation in Mozilla Firefox's Graphics component via an invalid pointer (CWE-763) exposes users running all Firefox versions prior to 155 and ESR branches prior to 115.40, 140.15, and 153.2 to full compromise of confidentiality, integrity, and availability. The CVSS 8.8 network-vector score with no required privileges but mandatory user interaction (UI:R) places this squarely in the drive-by exploitation category - a victim visiting a crafted webpage is sufficient to trigger the flaw. No active exploitation is confirmed at time of analysis (SSVC exploitation: none, no KEV listing), but the total technical impact rating and the broad Firefox install base make this a high-priority patching target.

Privilege escalation in Dell PowerStore storage appliances allows an authenticated low-privilege user to invoke administrator-only management operations via the network, resulting in full confidentiality, integrity, and availability compromise of the storage system. The flaw stems from incorrect authorization checks (CWE-863), where the system fails to enforce proper privilege boundaries on API or management interface operations. No public exploit identified at time of analysis and no CISA KEV listing, but the low attack complexity and high-impact CVSS 8.8 rating make this a credible threat in multi-tenant or shared-access storage environments.

Unauthenticated account takeover in the Nokri - Job Board WordPress theme (versions through 1.6.6) lets remote attackers reset any user's password, including administrators. The flaw stems from the nokri_reset_password() function accepting an empty reset token that matches the empty or unset sb_password_forget_token user meta value, so no valid token is ever needed. Reported by Wordfence and rated CVSS 9.8; no public exploit or CISA KEV listing is identified at time of analysis.

Privilege escalation to root in Plesk for Linux (18.0.34 up to 18.0.79.9 / 18.0.80.5) lets a customer- or reseller-level account with shell access run OS command injection (CWE-78) to take over the entire hosting server. Any tenant permitted to use - or to toggle on - their own shell access can break out of their restricted account and reach the root identity, collapsing the isolation between shared-hosting customers and the host. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the vendor rates it critical (CVSS 9.0) and has shipped fixed builds.

Privilege escalation in HP ImageDiags prior to version 5.0.0.36 enables a local low-privileged attacker - contingent on active interaction by a higher-privileged user - to gain elevated system privileges through insufficient access controls on temporary file resources (CWE-379). All versions of HP ImageDiags before 5.0.0.36 are affected per HP security bulletin HPSBGN04143. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog.

Subscriber-level privilege escalation in Fluent Forms Pro Add On Pack (versions <= 6.2.12) allows authenticated users with minimal access to gain significantly elevated permissions within a WordPress installation. Reported by Patchstack against the wp_manage_ninja plugin, the flaw stems from incorrect privilege assignment (CWE-266), meaning subscriber-role accounts can trigger functionality reserved for higher-privileged roles such as administrators. No public exploit or CISA KEV listing has been identified at time of analysis, though the network-accessible attack vector and high CVSS impact across confidentiality, integrity, and availability make this a meaningful risk for any WordPress site accepting subscriber registrations.

Privilege escalation in MCPHub prior to version 1.0.29 allows any authenticated low-privilege user to modify system-wide configuration via the PUT /api/system-config endpoint. The handler updateSystemConfig never validates req.user.isAdmin, meaning the app-wide authentication middleware - which only confirms a valid session exists - is the sole barrier, granting any account holder effective administrative control over routing rules and server integrations. No public exploit has been identified at time of analysis, but the attack is trivially reproducible given network access and any valid credential.

Local privilege escalation in ieungSoft Ultra RAMDisk Pro 1.82 allows a low-privileged local user to gain SYSTEM or kernel-level control via improper privilege management in the URDSCSI.sys kernel driver (CWE-266). The vendor did not respond to coordinated disclosure, leaving no official patch; a public proof-of-concept exploit exists, confirmed by the CVSS 4.0 E:P metric and a detailed write-up. No active exploitation has been confirmed in CISA KEV, but the low exploitation barrier (low-privilege local access, no interaction, public PoC) makes this a credible post-compromise escalation tool.

Cross-workspace privilege escalation in ToolJet Database before v3.16.44 enables any authenticated user to read database tables belonging to arbitrary workspaces by supplying victim workspace identifiers in the join_tables endpoint request path. The endpoint grants JOIN_TABLES capability to all authenticated users without validating role membership or workspace affiliation, breaking ToolJet's multi-tenant isolation entirely. No public exploit or CISA KEV listing has been identified, but the CVSS 4.0 score of 8.2 reflects high confidentiality impact across both the vulnerable and subsequent systems in shared deployments.

Privilege escalation in the @hulumi/policies npm package before 1.3.2 lets attackers bypass the administrator-policy guardrail (CIS 1.16) by crafting admin-equivalent inline or attached IAM policy shapes that the validator failed to fully inspect. Any environment relying on this library to detect over-privileged IAM policies could silently pass admin-equivalent access as compliant. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.

Privilege escalation in hulumi before v1.3.2 lets an actor holding the documented IAM principal abuse the weekly integration IAM policy to perform role lifecycle operations on af-e2e-* roles that lack sufficient permission-boundary restrictions. Because the policy allows role creation without a constraining boundary, the actor can mint persistent, higher-privilege roles inside the sandbox AWS account, converting scoped test access into durable elevated access. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Local privilege escalation in Colorful iGameCenter 2.0.0.81 stems from its bundled WinRing0x64.sys driver, whose sub_11504 IOCTL handler exposes arbitrary physical-memory access via attacker-controlled PhysicalAddress/AlignNumer/AlignSize arguments. A low-privileged local user can abuse this IOCTL Dispatch path to read and write kernel-visible physical memory and escalate to SYSTEM. Publicly available exploit code exists for the underlying WinRing0 driver class, but this specific CVE is not listed in CISA KEV and EPSS is unavailable; no active exploitation is confirmed.

Vertical privilege escalation in XueZhiSi XZS Open Source Exam System (versions <= 3.9.0) allows an authenticated teacher account (role=2) to permanently delete administrator accounts (role=3) via the POST /api/teacher/user/delete/{id} REST endpoint. The three-step delete sequence - getUserById(id), setDeleted(true), updateByIdFilter() - executes without any role-based authorization check on the target resource, enabling a lower-privileged user to destroy privileged accounts irreversibly. No public exploit code or CISA KEV listing exists; EPSS sits at 0.15%, reflecting minimal observed activity at time of analysis.

Local privilege escalation in SiYuan's Windows NSIS installer affects versions 2.0.14 through 3.8.0, allowing a local attacker with write access to a directory to execute arbitrary code with elevated privileges by planting a malicious binary that the NSIS installer resolves ahead of System32 during an all-users installation. The root cause is electron-builder's preInit hook invoking system utilities such as TASKKILL by short name via nsExec::Exec, causing the installer's launch directory to take search-path precedence over System32 before the license page is even displayed. No public exploit code has been identified at time of analysis, though the binary-planting technique is well-documented in Windows installer security research.

Privilege escalation to Administrator in the Addify Custom User Registration Fields for WooCommerce plugin (versions ≤ 2.2.3) lets unauthenticated attackers gain admin rights by supplying an arbitrary role slug during WooCommerce checkout. The plugin trusts an attacker-controlled afreg_select_user_role value from the unauthenticated Store API /wc/store/v1/checkout request and passes it straight to WP_User::add_role() without validating it against the admin-configured allowed role list. No public exploit identified at time of analysis, and exploitation requires the plugin's 'User Role Selection' feature to be enabled.

Account takeover in the Uix UserCenter WordPress plugin (all versions through 1.0.3) lets unauthenticated attackers seize any account, including administrators. The plugin's profile-update action never checks that the targeted account belongs to the requester and authorizes the action with a token signed by a hardcoded key that is identical on every installation, so an attacker can forge a valid token for any user and overwrite that user's email and password. Rated CVSS 9.8 with publicly available exploit code (WPScan), though EPSS is low at 0.14%.

Privilege escalation to full site takeover affects the MemberHero WordPress plugin through version 6.9, where the frontend registration flow fails to restrict which account fields a visitor may set, letting unauthenticated attackers self-register with an arbitrary role - including Administrator. Version 6.9 was advertised as the fix but the patch is incomplete, so current installs remain exploitable to gain admin access and hijack existing accounts, and no fully-fixed release exists at time of analysis. Publicly available exploit code exists (WPScan), though EPSS remains low at 0.15% (4th percentile).

Authenticated command injection in IBM Langflow OSS 1.0.0 through 1.11.1 lets any logged-in flow user escalate to arbitrary OS command execution under the server process identity. By saving a flow containing a crafted 'type' field and triggering a build of a wrapper flow that references it, the attacker coerces the backend into evaluating attacker-controlled code, defeating the LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false guardrail intended to block custom code execution. The vendor (IBM) reported it and has released a fix; there is no public exploit identified at time of analysis and it is not in CISA KEV.

Local privilege escalation in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 exploits a format string vulnerability (CWE-134) to allow a low-privileged local attacker to gain elevated - potentially root-level - privileges with full confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis; EPSS sits at 0.10% (1st percentile), consistent with an SSVC exploitation status of 'none'. IBM has released a patch at the advisory linked below.

Privilege escalation in SpringBlade 2.7.3 through 3.5.0 lets authenticated low-privilege users forge admin JWT tokens using a hardcoded signing key embedded in publicly distributed JARs, then POST to an unprotected internal Feign user-creation endpoint to register new system administrator accounts. The Spring Cloud Gateway authentication filter validates JWT structure but performs no role or caller-identity checks, making bypass trivial for anyone with initial account access. A public POC is available; vendor-released patch exists in v5.0.0; no CISA KEV listing confirmed at time of analysis.

Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.6 lets authenticated users holding the plugin's delegated management capability overwrite arbitrary WordPress site options, including those governing user roles, enabling full administrator takeover. The root cause is a missing capability check on the login settings save handler - the plugin fails to verify the caller's WordPress capabilities before persisting changes to the wp_options table. A public proof-of-concept exploit exists per WPScan; however, SSVC reports no active exploitation and the CVE is absent from CISA KEV.

Privilege escalation to administrator in the Ultimate Member WordPress plugin (versions 2.6.7 through 2.12.x) allows unauthenticated users registering via the plugin's own forms to self-assign any WordPress role, including administrator, by exploiting a logic failure in role validation. When the plugin cannot resolve the allowed roles for a given profile form, it falls back to validating the submitted role against the full site-wide role registry rather than the form's own allow-list - accepting any valid registered role. A publicly available exploit exists per WPScan, though SSVC assessment indicates no confirmed active exploitation campaigns at time of analysis. Vendor-released patch is available in version 2.13.0.

Improper access control in the ServiceNow AI Platform allows an unauthenticated user, under certain circumstances, to create or modify instance data beyond intended boundaries, resulting in privilege escalation. ServiceNow has patched hosted instances and supplied updates to partners and self-hosted customers; the vendor rates this maximum severity (CVSS 4.0 10.0) but reports no known exploitation. No public exploit identified at time of analysis.