Privilege Escalation

Local privilege escalation in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 allows a low-privileged local user to gain elevated-likely root-level-access through improper privilege management (CWE-269). The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N) reflects low-complexity exploitation requiring only a standard local account with no user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though IBM has released a patch via their support portal.

Privilege elevation in Google Chrome's Import feature before version 151.0.7922.173 enables sandbox escape and arbitrary code execution at the OS level, exploitable by a remote attacker who can deliver a crafted file and socially engineer a user into opening it. The vulnerability stems from CWE-250 (Execution with Unnecessary Privileges) within the Import component, yielding full confidentiality, integrity, and availability impact per CVSS C:H/I:H/A:H. No public exploit code has been identified at time of analysis, and SSVC confirms exploitation status as none, though the total technical impact rating and sandbox-escape primitive warrant prompt patching across all Chrome deployments.

Unverified password change in Laravel Backpack CRUD's account-info endpoint allows any authenticated Backpack admin to permanently take over their own or a hijacked session's account by mass-assigning the `password` field without supplying the current password. Affected versions are backpack/crud < 6.8.11 and 7.0.0-alpha.1 through 7.0.33, running on Laravel 11 with the default `App\Models\User` model whose `$fillable` includes `password`. The attack converts time-limited stolen session access into permanent credential control, bypassing the dedicated change-password flow that enforces `old_password` verification. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack is trivially constructable given full public advisory detail.

Local privilege escalation in Parallels RAS Client 21.0.26296 allows an attacker holding low-privileged code execution to reach SYSTEM-level authority by invoking an exposed dangerous function in the RAS RDP Backend Service (CWE-749). The CVSS 7.8 (High) rating reflects full confidentiality, integrity, and availability impact once exploited, with low attack complexity and no user interaction required beyond an initial foothold. No public exploit code and no CISA KEV confirmation have been identified at time of analysis, though ZDI's coordinated disclosure (ZDI-26-556) may accelerate POC development.

Local privilege escalation in Parallels RAS Client 21.0.26296 allows low-privileged local attackers to gain SYSTEM-level code execution by invoking an exposed dangerous function within the RAS RDP Backend Service. The root cause is CWE-749, where a privileged service function is accessible without proper access control to lower-privileged callers. Discovered and reported by Zero Day Initiative (ZDI-26-555 / ZDI-CAN-28885), no public exploit or CISA KEV listing has been identified at time of analysis.

Local privilege escalation in Parallels RAS Client 21.0.26296 allows a low-privileged local attacker to escalate to SYSTEM-level execution by invoking an exposed dangerous function within the RAS RDP Backend Service. The flaw (CWE-749) stems from the service exposing an unsafe method that can be abused without administrative rights, enabling full system compromise. No public exploit or CISA KEV listing has been identified at time of analysis, though the vulnerability was coordinated through Zero Day Initiative (ZDI-CAN-29220).

Command injection in the Sony XAV-9500ES car audio receiver firmware 3.02.00 allows a local attacker with low-privileged code execution to escalate to root via the device's crash dump handler. The handler passes user-controlled input directly to an OS system call without sanitization (CWE-78), enabling arbitrary command execution at the highest privilege level. Disclosed by ZDI as ZDI-26-477 (ZDI-CAN-29061); no public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Local privilege escalation in the Kenwood DNR1007XR network video recorder enables an attacker with existing low-privileged code execution to gain root-level access by exploiting incorrectly permissioned resources associated with the udhcpd DHCP service. Discovered by Zero Day Initiative and tracked as ZDI-CAN-29111/ZDI-26-487, the flaw stems from CWE-732 (Incorrect Permission Assignment for Critical Resource), granting full C:H/I:H/A:H impact once the prerequisite foothold is established. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Local privilege escalation in Kenwood DNR1007XR network video recorder devices allows a low-privileged local attacker to achieve root-level code execution by exploiting command injection in the JKGenService service. The flaw (CWE-78) exists because user-supplied input is passed without sanitization to a system call, enabling shell metacharacter injection. No public exploit has been identified at time of analysis, and the device is not listed in CISA KEV, but successful exploitation yields full system compromise on the affected hardware.

Privilege escalation on IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 allows any low-privileged local user to gain full system control by exploiting improper authorization checks (CWE-285). SSVC rates the technical impact as total, consistent with the CVSS C:H/I:H/A:H rating, meaning a successful attacker achieves complete compromise of confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, and EPSS at 0.13% (3rd percentile) reflects negligible current exploitation pressure, though the low attack complexity makes this a meaningful insider-threat or post-compromise escalation risk.

Local privilege escalation in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 allows an authenticated local attacker with low-level access to gain elevated (likely root) privileges due to improper privilege management (CWE-269). The CVSS score of 7.8 reflects total confidentiality, integrity, and availability impact upon successful exploitation. No public exploit has been identified at time of analysis, EPSS is extremely low at 0.11% (2nd percentile), and SSVC confirms no observed exploitation, though technical impact is rated total if the flaw is triggered.

Local privilege escalation in Ubuntu's AccountsService (before 23.13.9-8ubuntu7) lets any low-privileged local user gain full root access by exploiting an incomplete privilege-drop in a Canonical-specific patch. The patch sets the effective UID/GID to the target user before launching language helper scripts but neglects to change the real UID, leaving ruid=0. Any shell spawned by a helper script can call setuid(0) to restore root effective privileges, granting complete system compromise. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Privilege escalation in Abandoned Cart Pro for WooCommerce (Tyche Softwares) affects all versions up to and including 10.4.0, allowing an unauthenticated remote attacker to gain elevated privileges over a WordPress site. The CVSS 3.1 vector (AV:N/PR:N/UI:N) with a 9.8 score indicates the flaw is reachable over the network without credentials or user interaction, and yields full confidentiality, integrity, and availability impact. Reported by Patchstack; no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.

Privilege escalation in FreeIPA allows an attacker with high LDAP write privileges to create a rogue service principal that impersonates a privileged existing one, bypassing the uniqueness constraint enforced by the 389-ds directory server. The flaw arises because 389-ds fails to recognize equivalent representations of the same Kerberos principal name (CWE-706), enabling the creation of a shadow principal that Kerberos treats as legitimate. If exploited, an attacker can acquire valid Kerberos service tickets for sensitive services, with full domain compromise as the realistic worst-case outcome. No public exploit exists and CISA KEV does not list this CVE, though SSVC rates the technical impact as total.

Local privilege escalation and denial of service in libvirt's NodeGetFreePages RPC handler allows an unprivileged local user to corrupt the root libvirtd daemon's heap memory through a crafted integer overflow. The CWE-190 flaw causes an undersized buffer allocation that is subsequently overwritten with real NUMA node data, enabling heap buffer overflow in a root-owned process. No public exploit code or CISA KEV listing exists at time of analysis, but the CVSS 7.8 score (AV:L/AC:L/PR:L) and full C/I/A impact make this a genuine priority on multi-tenant RHEL virtualization hosts.

Full site takeover in the JSON Options WordPress plugin (versions through 0.0.4) is possible because one of its actions runs on every request without any capability check or nonce verification, exposing arbitrary WordPress option updates to unauthenticated users. An attacker can flip the users_can_register option on and set default_role to administrator, then self-register an admin account. Publicly available exploit code exists (reported by WPScan), and the flaw is rated CVSS 9.8 with SSVC technical impact assessed as total.

Improper access control in Splunk AI Toolkit versions below 6.0.0 allows an authenticated user holding the schedule_search capability to deserialize arbitrary model files by invoking the apply search command via a scheduled search. Because the toolkit does not designate apply as a risky command, Splunk's built-in risky-command access controls are never triggered, enabling privilege escalation beyond what the role should permit. A vendor-released patch exists (version 6.0.0); no public exploit or CISA KEV listing has been identified at time of analysis.

Privilege escalation in Splunk Enterprise allows any user holding the schedule_search capability to execute arbitrary SPL commands with system-level privileges on the search head by configuring PDF attachments in the email alert action workflow. The flaw exists because the search scheduler substitutes a system-level authentication context for the alert owner's context during PDF rendering, effectively granting the authenticated user full system access. Affected are all Splunk Enterprise installations across the 9.4, 10.0, 10.2, and 10.4 release branches below the patched versions; no public exploit or CISA KEV listing is identified at time of analysis.

Splunk Enterprise for Windows exposes a startup race condition on the management port that allows a low-privileged local user to intercept authentication tokens from Splunk child processes. By pre-binding the management port before the Splunk service initializes - exploiting the absence of exclusive address binding protections on Windows - an attacker captures session tokens that can be replayed to compromise all data and system integrity accessible to the Splunk service account. No public exploit code has been identified and EPSS is 0.12% (3rd percentile), indicating low current exploitation activity; however, the vulnerability is Windows-specific and patch is available from Splunk.

Privilege escalation in Splunk Enterprise allows an authenticated user holding the schedule_search capability to execute arbitrary SPL commands at the highest system privilege level and read every credential stored in the credential store. Affected versions span four supported release lines - below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 - meaning a wide swath of unpatched deployments across all current branches are exposed. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the credential store access potential makes this a high-priority patch for any deployment where the schedule_search capability is assigned to non-administrator users.

Local privilege escalation in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables a low-privileged authenticated user to gain root access by bypassing RBAC role enforcement. The flaw (CWE-269: Improper Privilege Management) means the operating system fails to correctly enforce the boundaries between assigned RBAC roles, allowing a standard user to assume or exercise privileges reserved for root. IBM has released a patch; no public exploit code or CISA KEV listing has been identified at time of analysis.

Local privilege escalation in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from an out-of-bounds write (CWE-787) that allows a low-privileged local attacker to achieve complete system compromise across confidentiality, integrity, and availability. The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N) reflects low-complexity exploitation requiring only a standard local account - a realistic threshold for insider threats or post-exploitation lateral movement within IBM Power environments. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis; however, the total C/I/A:H impact on high-value enterprise Unix systems warrants prompt patching.

Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 is achievable by an unauthenticated attacker on the same network segment via command injection triggered by crafted IPv6 Router Advertisement messages. The vulnerability (CWE-269, Improper Privilege Management) implies the RA processing subsystem executes injected commands with elevated OS-level privileges, enabling full confidentiality, integrity, and availability compromise of the affected host. No public exploit has been identified at time of analysis; IBM has released a patch per advisory https://www.ibm.com/support/pages/node/7283858.

Privilege escalation in Wekan open-source kanban (all versions prior to 9.89, dubbed 'SortBleed') allows any board member - including read-only or comment-only invitees - to atomically elevate themselves to sole board administrator, expose private boards to the public, and evict the legitimate owner via a single crafted Meteor DDP update call. The root cause is Meteor's OR-semantics allow-rule evaluation: the `canUpdateBoardSort` helper checked only that `sort` was among modified fields, not that it was the sole field, allowing arbitrary board mutations to be smuggled alongside a legitimate sort value. No public exploit identified at time of analysis, though the attack is fully reproducible from the public GHSA advisory and fix commit.

Unsigned x-amz-* header injection in Ceph Object Gateway (RGW) SigV4 allows any holder of a presigned URL to attach arbitrary unsigned x-amz-* headers - such as ACL grants, copy-source directives, or storage-class overrides - that RGW silently honors without verifying they were covered by the original cryptographic signature. Affected versions are Ceph prior to 19.2.6 and prior to 20.2.4; the flaw directly enables privilege escalation beyond the permissions the URL signer intended. No public exploit code or active exploitation is confirmed at time of analysis, and vendor-released patches for both stable branches are available.

Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 stems from the search-v2-operator being bound to a ClusterRole with cluster-administrator-equivalent permissions - including user impersonation, RBAC write, Certificate Signing Request approval, and ManifestWork management. An attacker who gains control of the operator's service account (a low-privileged cluster foothold) can leverage these excessive grants to take over the entire hub cluster and its managed clusters. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 9.9 rating reflects the near-total loss of cluster control if the operator identity is abused.

Privilege escalation in the search-v2-operator (Red Hat Advanced Cluster Management / OpenShift search component) allows a user with edit rights on the Search Custom Resource to abuse unvalidated CR fields (imageOverride, arguments, environment variables) to load an attacker-controlled container image or mount arbitrary secrets. Because the search ServiceAccount holds broad impersonation permissions, controlling that pod pivots into full cluster compromise. No public exploit is identified at time of analysis, and it is not listed in CISA KEV; the CVSS 9.1 rating reflects the scope change from a namespaced CR editor to the entire cluster.

Incorrect Default Permissions in Dell Command Update (DCU) exposes a local privilege escalation path on all versions prior to 5.7.1, allowing a low-privileged authenticated user to gain unauthorized read and write access to filesystem resources owned or managed by DCU. The flaw stems from overly permissive ACLs set during installation, consistent with CWE-276, and carries a CVSS 7.8 High rating reflecting full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog.

Local privilege escalation in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 allows an authenticated low-privileged user to gain full elevated privileges due to improper privilege management (CWE-269). The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that any standard local user account is sufficient to trigger the flaw with low complexity and no user interaction, resulting in complete confidentiality, integrity, and availability compromise of the affected system. No public exploit identified at time of analysis, and a vendor patch is available via IBM advisory.

Privilege escalation in Dell OpenManage Enterprise versions prior to 4.7.0 allows a remote attacker already holding high-privileged console credentials to elevate their access further within the platform, achieving full confidentiality, integrity, and availability impact against the management system. The root cause is improper privilege management (CWE-269), where the application fails to enforce correct privilege boundaries for existing high-privileged sessions. No public exploit or CISA KEV listing has been identified at time of analysis; Dell disclosed and patched this vulnerability via advisory DSA-2026-359.

Privilege escalation in the Total Donations WordPress plugin (versions 2.0.5 and earlier) lets a remote, unauthenticated attacker improperly assign or elevate account privileges, reported by Patchstack under CVE-2026-73390. Because the flaw needs no authentication and carries full confidentiality/integrity/availability impact (CVSS 9.8), a successful exploit can hand an attacker administrative control over the WordPress site. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.

Unauthenticated privilege escalation in the TrueBooker (truebooker-appointment-booking) WordPress plugin versions 1.2.6 and earlier allows a remote attacker with no credentials to elevate their privileges within the WordPress site, per a Patchstack report. The CVSS 9.8 rating (AV:N/AC:L/PR:N/UI:N) reflects fully remote, low-complexity abuse with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.

FreeBSD's ELF core dump subsystem contains a TOCTOU race condition that allows an unprivileged local user sharing an address space via rfork(2) to trigger a kernel heap out-of-bounds write, potentially escalating privileges to root. Affected releases are FreeBSD 14.4-RELEASE prior to p8, 15.0-RELEASE prior to p12, and 15.1-RELEASE prior to p2, as confirmed in FreeBSD Security Advisory FreeBSD-SA-26:55.elf. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Out-of-bounds kernel heap read and write in FreeBSD's semctl(2) GETALL and SETALL commands enable local privilege escalation by exploiting a 15-bit sequence-number wraparound in the System V semaphore subsystem. FreeBSD 14.4-RELEASE prior to p8, 15.0-RELEASE prior to p12, and 15.1-RELEASE prior to p2 are affected. An unprivileged local attacker races two processes - one cycling semaphore set destruction and recreation to wrap the 0x8000-bounded counter, another issuing GETALL or SETALL at the moment of wrap - causing the kernel to copy semaphore values using a mismatched buffer size and producing exploitable heap corruption. No public exploit code has been identified at time of analysis, but the vulnerability class (local kernel heap OOB via IPC race) is a consistently weaponized primitive for privilege escalation.

Use-after-free in the FreeBSD 15.1-RELEASE kernel's kqueue subsystem allows an unprivileged local user to corrupt kernel memory and escalate privileges to root. During a fork() system call, the kernel's knote copy routine fails to hold appropriate locks while reading knote state, and does not guard against a timer-based knote firing and being enqueued on the active list mid-copy, resulting in a double-enqueue of the new knote and subsequent list corruption. No public exploit or active exploitation has been identified at time of analysis, but the CVSS score of 8.4 (Local/No Privileges Required) reflects a realistic, high-severity local privilege escalation path on affected systems.

Privilege escalation in FreeBSD's POSIX shared memory subsystem allows any unprivileged local user to free kernel memory that remains in active use, then access that freed memory to overwrite kernel data structures and gain root privileges. The flaw spans four active FreeBSD release branches (14.3, 14.4, 15.0, 15.1) and is triggered by two standard system calls - open(2) with O_TRUNC and fspacectl(2) - when applied to largepage-backed shared memory objects. No public exploit has been identified and the vulnerability is not listed in CISA KEV; patched release levels are available for all affected branches via FreeBSD Security Advisory FreeBSD-SA-26:44.posixshm.

Privilege escalation in the FreeBSD kernel's POSIX shared memory subsystem allows an unprivileged local user to access freed kernel memory and escalate privileges. The flaw arises in the interaction between largepage-backed shared memory objects and the sendfile(2) syscall when used with the SF_NOCACHE flag, which prematurely frees pages that active memory mappings still reference, producing a use-after-free condition in kernel address space. Affected releases span FreeBSD 14.3, 14.4, 15.0, and 15.1; no public exploit or active exploitation has been identified at time of analysis, though a vendor security advisory (FreeBSD-SA-26:44.posixshm.asc) and patched releases are available.

Privilege escalation in FreeBSD's RACK TCP stack via a use-after-free condition allows an unprivileged local user to achieve full system compromise. The RACK setsockopt(2) handler temporarily releases the connection lock while copying option data from userspace; if a concurrent context switches TCP stacks twice during this window, the stale saved pointer to the per-connection control block references freed memory while the integrity check erroneously passes. Affected versions span FreeBSD 14.3, 14.4, 15.0, and 15.1 release branches, with vendor patches confirmed via FreeBSD-SA-26:43.tcp; no public exploit has been identified at time of analysis.

Use-after-free in the FreeBSD kernel virtual memory subsystem allows an unprivileged local user to corrupt the pager's page list by calling msync(MS_INVALIDATE) on a mapping of an unmanaged device object, then triggering a subsequent page fault. On object destruction, the affected page is freed twice, creating a kernel memory corruption primitive that may enable privilege escalation. No public exploit code has been identified and EPSS probability is very low (0.14%), but the vulnerability is confirmed by FreeBSD Security Advisory SA-26:37 with patches available for all affected release branches.

Stored cross-site scripting combined with privilege escalation in Confluence Data Center and Server lets an unauthenticated attacker persist malicious HTML/JavaScript that runs in a victim's browser, enabling actions performed as a higher-privileged user and abuse of insecure default configurations. Atlassian rates it Critical (vendor CVSS 4.0 score 9.3; the advisory body text separately cites 8.6), and it affects a long list of 7.x through 10.2.x branches. There is no public exploit identified at time of analysis and it is not on CISA KEV; it was found through Atlassian's bug bounty program.

Full system takeover is possible in Oracle Hyperion Financial Management 11.2.25.0.000 through the Security component, exploitable via SQL by a low-privileged network attacker with no user interaction required. Oracle classifies this as 'easily exploitable,' resulting in complete compromise of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and full-takeover impact elevate real-world risk for any organization running the affected version.

Full system takeover in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a low-privileged, network-authenticated attacker via the SQL interface targeting the Security component, with successful exploitation yielding complete confidentiality, integrity, and availability compromise. The CVSS 3.1 score of 8.8 reflects low attack complexity and no user interaction required, making exploitation straightforward for any attacker holding valid low-level credentials. No public exploit code has been identified and no CISA KEV listing is present at time of analysis, though the low barrier to exploitation warrants urgent patching for organizations running this version.

Full takeover of Oracle Virtual Directory (versions 12.2.1.4.0 and 14.1.2.0.0) is achievable by low-privileged network attackers via the LDAP protocol with no user interaction required. Oracle classifies this as 'easily exploitable,' and the CVSS 3.1 score of 8.8 reflects complete confidentiality, integrity, and availability compromise of the Virtual Directory Server. No public exploit code has been identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog, though the combination of network accessibility, low attack complexity, and low privilege requirement makes this a credible priority for Oracle Fusion Middleware environments.

Second-order SQL injection in Froxlor (versions before 2.3.8) enables an authenticated administrator with the change_serversettings=1 privilege to store a UNION-based SQL payload in the panel_admins.ip column via Admins.add or Admins.update, which executes without further victim interaction when IpsAndPorts.listing is called by the poisoned account, returning all administrator login names and bcrypt password hashes. A confirmed, publicly available proof-of-concept demonstrates the complete two-step store-then-trigger chain against a live instance, enabling full database exfiltration and privilege escalation from reseller admin to super-admin. No active exploitation is confirmed in CISA KEV, though the working PoC and the specific threat model of multi-admin hosting deployments materially elevate real-world risk.

Local privilege escalation in NVIDIA Cumulus Linux exposes network switch operating systems to full compromise by unprivileged local users. The flaw resides in the user management component, where improper privilege assignment (CWE-250) allows a low-privileged authenticated user to escalate to higher privilege levels - likely root - with low attack complexity and no user interaction required. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the CVSS 7.8 High score reflects the full triad impact once local access is obtained.

Excessive ClusterRole permissions on the managed-serviceaccount addon-manager pod in Red Hat Advanced Cluster Management for Kubernetes 2 allow a compromised addon-manager to read secrets across every namespace and approve arbitrary Certificate Signing Requests, resulting in cluster-wide information disclosure and privilege escalation. The CVSS scope-change (S:C) reflects that a single compromised pod can affect the entire Kubernetes cluster, not just the addon namespace. No public exploit code or active exploitation via CISA KEV has been confirmed at time of analysis.

Prompt-injection-driven privilege escalation in CodeWhale 0.8.41-0.8.63 allows an attacker who can place malicious instructions in content the agent ingests to execute arbitrary commands inside an already-approved long-running interactive shell session - such as python3 -i, mysql, ssh, or sudo -i - without triggering any user approval prompt. The root cause is that exec_shell_interact (and its RlmEvalTool counterpart) hardcoded ApprovalRequirement::Auto, overriding the default Required gate that governs code-executing tools. Fixed in version 0.8.64; no public exploit or CISA KEV listing has been identified at time of analysis.

Privilege escalation and arbitrary code execution in Red Hat Advanced Cluster Management for Kubernetes (RHACM) allows an authenticated low-privilege user to hijack the governance-policy container image across managed clusters. By annotating the namespaced ManagedClusterAddOn resource - a permission that may be granted to non-administrative users - the attacker causes the governance-policy-addon-controller to deploy a malicious, attacker-controlled image running with cluster-admin privileges on every managed cluster under the hub's control. No public exploit or CISA KEV listing has been confirmed at time of analysis, but the low attack complexity and high impact across cluster boundaries make this a prioritized patching target for multi-cluster RHACM deployments.

Privilege escalation in Dell Watchdog Timer Driver versions prior to 2.0.0.1 allows a local low-privileged attacker to gain full system control by abusing an improperly access-controlled IOCTL interface exposed by the kernel driver. The CVSS scope-changed score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C) reflects that exploitation crosses the kernel trust boundary, yielding complete confidentiality, integrity, and availability impact. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity makes this a meaningful local privilege escalation risk on Dell-equipped systems.

Privilege escalation in The Grid WordPress plugin (versions ≤ 2.7.9.1) permits any authenticated subscriber-level user to elevate their role, effectively granting unauthorized administrative access to the WordPress installation. The vulnerability stems from incorrect privilege assignment (CWE-266), where the plugin fails to properly restrict privileged actions to appropriate roles. With a CVSS score of 8.8 and no special configuration required beyond plugin installation and a valid subscriber account, this represents a meaningful threat to WordPress sites with open user registration. No public exploit code or CISA KEV listing has been identified at time of analysis.

Privilege escalation in Mozilla Firefox's Enterprise Policies component allows an attacker to gain elevated privileges by subverting administrator-defined policy enforcement, affecting Firefox before 154 and Firefox ESR before 153.1. Mozilla (the reporter) assigned CWE-269 (Improper Privilege Management) and the record carries a CVSS 9.8 rating, though the low EPSS score (0.15%, 5th percentile) signals minimal predicted exploitation. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Privilege escalation in Firefox's Request Handling component exposes all versions prior to 154 (and ESR prior to 153.1) to high-impact compromise of confidentiality, integrity, and availability. The flaw carries a CVSS 8.8 score with a network attack vector and no privilege prerequisite, meaning a remote attacker can trigger it by inducing a user to interact with attacker-controlled content. SSVC assessment confirms no active exploitation at time of analysis and rates technical impact as total, while fix versions are confirmed via two Mozilla security advisories.

Privilege escalation via the Application Update component in Mozilla Firefox allows a network-adjacent attacker, with user interaction, to gain elevated privileges with high impact to confidentiality, integrity, and availability. All Firefox versions prior to 154 are affected per Mozilla CPE data. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS score of 8.8 and the nature of the update mechanism - which on some platforms (e.g., Windows via the Mozilla Maintenance Service) operates with system-level privileges - make this a meaningful escalation risk.

Privilege escalation in Mozilla Firefox's Downloads API component exposes users on any version prior to Firefox 154 or Firefox ESR 153.1 to high-impact compromise across confidentiality, integrity, and availability. Classified under CWE-269 (Improper Privilege Management), the flaw enables an unauthenticated remote attacker to escalate privileges when a user interacts with a crafted download trigger, requiring no prior foothold on the target system. No public exploit has been identified at time of analysis, but Firefox's ubiquitous deployment and the low attack complexity make this a high-priority patch for any organization.

Privilege escalation via invalid pointer dereference in Mozilla Firefox's Graphics component allows a remote attacker to gain elevated privileges within the browser context. Affected versions are all Firefox releases prior to 154 and all Firefox ESR releases prior to 153.1, with patches confirmed in Mozilla advisories mfsa2026-74 and mfsa2026-77. No public exploit identified at time of analysis, and CISA's SSVC framework rates exploitation status as none with the attack not automatable, though technical impact is assessed as total.

Privilege escalation via the Shell Integration component in Mozilla Firefox allows a remote unauthenticated attacker - with user interaction - to achieve full compromise of confidentiality, integrity, and availability on affected systems. Affected are all Firefox releases prior to 154 and ESR branches prior to 140.14 and 153.1, as confirmed by Mozilla advisories mfsa2026-74, mfsa2026-76, and mfsa2026-77. No public exploit or CISA KEV listing has been identified at time of analysis, and SSVC rates exploitation status as none.

Privilege escalation in Firefox's Networking: Cookies component allows a remote, unauthenticated attacker to gain elevated privileges within the browser when a user visits a malicious page, yielding full confidentiality, integrity, and availability impact. All Firefox releases prior to 154 and both ESR branches prior to 140.14 and 153.1 are affected across all platforms. SSVC rates technical impact as total, but exploitation status is confirmed as none and the attack is not automatable due to the required user interaction; no public exploit or CISA KEV listing exists at time of analysis.

Use-after-free memory corruption in Firefox's Canvas2D graphics component enables privilege escalation against any unpatched browser version. Remote unauthenticated attackers can achieve full confidentiality, integrity, and availability impact by delivering a malicious web page to a victim using Firefox prior to version 154 (stable) or the affected ESR releases. No public exploit identified at time of analysis, but the memory corruption class and low attack complexity make this a high-priority patch for both consumer and enterprise Firefox deployments.

Privilege escalation via incorrect boundary conditions in Firefox's Graphics: CanvasWebGL component allows remote attackers to achieve high-impact code execution by luring users to a crafted web page. The flaw affects all Firefox releases prior to version 154 and multiple ESR branches (115.x, 140.x, 153.x), making the exposure broad across both consumer and enterprise deployments. No active exploitation has been confirmed (SSVC: Exploitation: none), but the CVSS 8.8 score and total technical impact classification warrant prompt patching.

Privilege escalation via the Remote Settings Client component affects Mozilla Firefox across all supported mainline and ESR release tracks, with Mozilla assigning the issue CVSS 8.8 High severity. The flaw (CWE-269, Improper Privilege Management) permits a network-based attacker to escalate privileges within the browser context when a user interacts with attacker-controlled content, achieving total confidentiality, integrity, and availability impact. No public exploit code exists and CISA has not listed this in KEV, but the simultaneous patching of three ESR branches alongside mainline signals that Mozilla assessed significant breadth of exposure across its install base.

Privilege escalation in Firefox's CanvasWebGL graphics component affects all Firefox releases prior to version 154 and both active ESR branches, enabling a remote attacker to gain full control over confidentiality, integrity, and availability within the browser process. The flaw stems from improper privilege management (CWE-269) in the WebGL canvas rendering pipeline, exploitable by luring a victim to a crafted web page - no authentication or special software is required beyond a standard Firefox installation. No public exploit code or active exploitation has been identified at time of analysis; however, Mozilla issued three simultaneous security advisories (MFSA2026-74/76/77) addressing all supported release tracks, signaling broad internal severity.

Privilege escalation in Firefox's DOM Navigation component allows a remote unauthenticated attacker to achieve full confidentiality, integrity, and availability compromise within the browser process by inducing a user to visit a malicious webpage. All Firefox releases prior to version 154 and all active ESR branches (115.x, 140.x, 153.x) are affected, with Mozilla issuing four simultaneous MFSA advisories (mfsa2026-74 through mfsa2026-77) indicating broad impact across every supported release channel. No public exploit or KEV listing has been identified at time of analysis, but the low attack complexity and zero authentication requirement make this a high-priority patch for all Firefox deployments.

Privilege escalation in Firefox's DOM Networking component allows remote attackers who can lure a user to a malicious webpage to achieve high-impact compromise of confidentiality, integrity, and availability. The flaw, rooted in improper privilege management (CWE-269), affects all Firefox releases prior to version 154 and multiple ESR branches, and has been patched across four simultaneous Mozilla advisories (mfsa2026-74 through mfsa2026-77). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Privilege escalation in ArcadeDB server (versions 26.7.3 and earlier) allows a low-privileged authenticated user with read-only access to a single database to gain full server-wide administrative control. The flaw stems from the server failing to bind the authenticated principal to asynchronous command worker threads, so a JavaScript command submitted with awaitResponse:false runs with no user context and bypasses the scripting authorization gate entirely. VulnCheck reported the issue; there is no public exploit identified at time of analysis, but the mechanics are fully documented in the vendor advisory, making exploitation straightforward.

Privilege escalation in ArcadeDB before 26.8.1 lets a low-privileged authenticated reader escalate to full server administrator via the gRPC transaction interface. Because the server fails to bind the authenticated principal to the gRPC transaction executor thread in beginTransaction, an attacker can call executeCommand with a valid transaction ID to run arbitrary JavaScript that bypasses scripting authorization, ultimately creating server-wide admin accounts. Reported by VulnCheck with a linked GitHub security advisory; no public exploit is identified at time of analysis, and the flaw carries a CVSS 4.0 base score of 9.4.

Vertical privilege escalation in Grav CMS before 2.0.14 lets a delegated administrator holding only the admin.users permission promote an account to super-admin by saving a group with access[admin][super]=true. The core group blueprint omits the required security@: admin.super guard on the access field, so the operator inherits full super-admin capabilities including the task scheduler and arbitrary Twig template evaluation - effectively code execution on the host. No public exploit identified at time of analysis and the issue is not in CISA KEV, but the fix is confirmed in the vendor GHSA advisory.

Privilege escalation in the Trueview T18061 WiFi 3MP Robot Pan-Tilt Security Camera (firmware Version 1.0) stems from an embedded RSA private key, letting a nearby attacker who recovers or reuses that key gain elevated access to the device. The flaw is classified under CWE-321 (use of a hard-coded cryptographic key), meaning every unit of this model likely shares the same secret key material. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; EPSS data was not provided.

Privilege escalation in Dokploy prior to version 0.29.6 allows an authenticated user with member:create permission to permanently seize organization ownership by exploiting two authorization logic flaws: the inviteMember tRPC procedure fails to restrict the role parameter to non-owner values, and the user creation service in user.ts permits arbitrary role assignment on self-hosted instances. Because owner roles cannot be demoted through normal application controls once assigned, a successful takeover is irreversible without direct database intervention. No public exploit code has been identified at time of analysis; vendor-released patch v0.29.6 closes both vulnerable code paths.

Privilege escalation in Red Hat Multicluster Engine for Kubernetes (MCE) lets a privileged service account on a managed spoke cluster submit a forged Certificate Signing Request that the managedcluster-import-controller auto-approves, yielding administrative credentials on the central hub cluster. The controller's auto-approval path neither inspects the CSR signer name nor decodes the PEM-encoded x509 request, so an attacker who already controls a spoke can pivot to full control of the hub and, by extension, every cluster it manages. No public exploit identified at time of analysis; EPSS is low (0.22%, 12th percentile) and CISA SSVC records no observed exploitation.

Service account role escalation in SkyPilot grants any authenticated user full administrative control by exploiting missing authorization enforcement on the permission update API. The server-side handler in sky/users/server.py accepted admin role assignments from any valid user without verifying the caller held admin privileges - a direct CWE-269 (Improper Privilege Management) failure. All versions are affected per wildcard CPE; a patch commit is available upstream but no formally tagged release has been confirmed. No active exploitation is confirmed at time of analysis.

Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 allows any attacker with local pod execution under the `search-serviceaccount` service account to impersonate `system:masters` and gain full cluster-admin control. The `search-serviceaccount` RBAC bindings grant cluster-wide `impersonate` permissions on users and groups - a grossly over-privileged configuration that collapses the entire cluster's security boundary if any pod running under this account is compromised. No public exploit has been identified at time of analysis and this CVE is not in CISA KEV, but the CVSS scope change (S:C) and full CIA triad impact (C:H/I:H/A:H) accurately reflect the catastrophic blast radius of successful exploitation.

Local privilege escalation in Zephyr RTOS (versions 4.0.0-4.4.1 with CONFIG_USERSPACE enabled) allows an unprivileged user-mode thread to execute arbitrary code in kernel supervisor mode by supplying forged struct device pointers with attacker-controlled API function tables to the flash_copy() system call. The syscall verifier z_vrfy_flash_copy() validated the output buffer but omitted the K_SYSCALL_DRIVER_FLASH object validation for src_dev and dst_dev that every sibling flash syscall enforces - a unique gap in the trust boundary that the kernel implementation blindly dereferences in supervisor context. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is confirmed in commit 1b1ecdc4 and available in Zephyr 4.4.2.

LDAP filter injection in Roundcube Webmail arises from unescaped substitution variables (`%u`, `%fu`, `%d`) embedded directly into LDAP `search_filter` configuration strings, affecting all 1.6.x releases before 1.6.18 and 1.7.x releases before 1.7.3. An authenticated user whose login credentials contain crafted LDAP metacharacters can manipulate server-side directory queries, potentially disclosing LDAP directory contents or escalating privileges by subverting group membership lookups. No active exploitation has been identified at time of analysis (SSVC: Exploitation none), though the low attack complexity and network accessibility warrant prompt patching for any LDAP-backed deployment.

Remote content blocking evasion in Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3 lets a crafted SVG image with an unclosed url() in a FuncIRI attribute slip past the remote-image blocker, so external resources load when a victim views a malicious email. This exposes the recipient's IP, mail-client fingerprint, and email-open telemetry to the sender, and per the advisory may aid further information disclosure or privilege escalation. It has a vendor patch and no public exploit identified at time of analysis; EPSS is low (0.31%) and CISA SSVC rates exploitation as none.

IMAP command injection in Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3 enables authenticated remote attackers to disclose information or escalate privileges by exploiting a desynchronization between mail search operations and LITERAL+ byte-count handling. The flaw was reported by Zach Hanley of Horizon3.ai and is classified as CWE-77 (Command Injection), with the vendor releasing patched versions 1.6.18 and 1.7.3 on 2026-08-09. No public exploit code or CISA KEV listing has been identified at time of analysis, though the C:H/I:H CVSS impact and the researcher's track record for producing working exploits elevate the urgency of patching.

Privilege escalation in GAPTEQ Designer v3.5 allows a remote attacker to abuse the Company Manager role to gain elevated privileges, per CWE-269 (improper privilege management). Publicly available exploit code exists (referenced on GitHub), and CISA's SSVC framework rates the technical impact as total and the flaw as automatable, though it is not listed in CISA KEV and EPSS remains low (0.21%, 11th percentile). The scope of affected deployments is limited to the GAPTEQ low-code application platform rather than a widely embedded library.

Privilege escalation in Squirro Cognitive Search before v3.14.2 lets a remote attacker submit a crafted request to gain elevated privileges within the enterprise search platform. The flaw is rated CVSS 9.8 with full confidentiality, integrity, and availability impact, and CISA's SSVC framework marks it automatable with total technical impact. No public exploit identified at time of analysis, and EPSS estimates near-term exploitation probability at just 0.21% (11th percentile).

Privilege escalation in the All-in-One WP Migration and Backup WordPress plugin (versions prior to 7.108) on multisite installations allows subsite administrators to execute arbitrary PHP code across the entire WordPress network. The vulnerability stems from missing access control enforcement on the migration import feature, which should be restricted to network-level administrators but is accessible to lower-privileged subsite admins. A publicly available exploit exists per WPScan and SSVC classification; however, EPSS sits at only 0.14% (4th percentile), and CISA KEV does not list this as actively exploited at time of analysis.

Privilege escalation in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.9) lets attackers take over the default administrator account by overwriting its password or email. The flaw stems from an authorization check that is silently skipped when the target user ID is a non-numeric string, which WordPress later coerces to integer 1 (the default admin). Where a public-facing frontend user form is configured the attack is fully unauthenticated; otherwise any subscriber-level account suffices. No public exploit identified at time of analysis, but the CVSS is 9.8 (Critical) and it was reported by Wordfence.

Unauthenticated privilege escalation in the Pods - Custom Content Types and Fields plugin for WordPress (all versions through 3.3.9) lets remote attackers bypass every authorization guard on the pods_admin AJAX router and perform administrator-level actions. Because failed checks return false instead of halting execution, an attacker with no account can promote themselves to Administrator or overwrite any user's password - including the site owner's - leading to full site takeover. Reported by Wordfence; no public exploit identified at time of analysis, though the root cause is precisely described.

Privilege escalation in the Real Estate Manager Pro WordPress plugin (all versions ≤ 12.8.6) allows authenticated Subscriber-level users to seize full Administrator control of a WordPress site. The flaw in `allow_attachment_actions()` confuses WordPress user IDs with media attachment IDs during capability checks, enabling a low-privileged user to edit an administrator account when those integer IDs collide. No confirmed active exploitation (CISA KEV) has been recorded, but the Subscriber-level access bar makes this a practical threat on any multi-user WordPress installation where the plugin is deployed.

Privilege escalation in the Wholesale Market WordPress plugin (versions up to and including 2.2.2) allows any authenticated user with Subscriber-level access or higher to elevate their account to Administrator by supplying an arbitrary role name to a poorly validated AJAX endpoint. The ced_wholesale_request_send_callback() handler accepts a client-controlled role_required POST parameter and passes it directly to WP_User::add_role() without an allowlist, relying solely on a nonce that is freely exposed to all authenticated users via wp_localize_script. No public exploit has been identified at time of analysis, but the low attack complexity combined with Subscriber-level access requirement makes this a realistic and attractive target on sites with the vulnerable configuration option active.

Privilege escalation in the bLoyal: Loyalty & Promotions WordPress plugin allows any subscriber-level authenticated user to overwrite the plugin's configured Loyalty Engine API URL via unprotected AJAX actions, then trigger an unauthenticated REST route to force the plugin to authenticate against an attacker-controlled server and invoke wp_set_auth_cookie() with an arbitrary WordPress user ID, yielding full administrator access. All plugin versions through 3.1.611.78 are affected across every WordPress installation running the plugin. No public exploit code identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the low barrier to entry - any subscriber account suffices - elevates practical risk significantly on sites with open registration.

Privilege escalation in the Propovoice WordPress plugin (all versions through 1.7.8) allows authenticated users holding the plugin-granted ndpv_manager role to create new WordPress accounts with full administrator privileges. The REST endpoint backing the team member create() function passes the user-supplied role parameter directly to WP_User::set_role() without validating it against an allowlist of safe roles or checking the WordPress promote_users capability. No public exploit has been identified at time of analysis, but the attack surface is broader than typical authenticated vulnerabilities because the ndpv_manager role is granted by the plugin itself - not the site administrator - expanding who can trigger the escalation.

Elevation of privilege in the Microsoft Malware Protection Engine (Microsoft Defender), publicly named 'ShieldBreak', allows a locally authenticated low-privileged user to gain high-level system access. The CVSS vector confirms a local, low-complexity attack requiring only low privileges and no user interaction, with full confidentiality, integrity, and availability impact. Proof-of-concept exploit code exists (E:P in the temporal vector), and Microsoft has acknowledged the vulnerability publicly.

Privilege escalation via a deterministic use-after-free in Zephyr RTOS's dynamic kernel-object disposal path affects any firmware build compiled with both CONFIG_USERSPACE and CONFIG_DYNAMIC_OBJECTS enabled. An unprivileged user thread can arm a dynamically-allocated k_timer, then release its last permission - causing unref_check() to free the timer's backing storage while the embedded struct _timeout dnode remains linked in the global _timeout_q; when the timer subsequently fires, z_timer_expiration_handler() dereferences and writes the freed - and potentially reallocated - kernel heap at ISR privilege. The bug constitutes a reliable sandbox-escape memory-corruption primitive scored CVSS 8.8 with scope change (S:C), and no public exploit has been identified at time of analysis.

Command injection (CWE-78) in Tenable Security Center versions prior to 6.9.0 enables a local attacker with write access to a specific configuration file to achieve arbitrary code execution at elevated privilege levels, with no user interaction required after file modification. Self-disclosed by Tenable and remediated in Security Center 6.9.0, as documented in advisory TNS-2026-22. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis.

Privilege escalation in Tenable Security Center allows an authenticated Security Manager to manage users outside their authorized group scope, bypassing the platform's intended group-based access controls. The flaw affects all Security Center versions prior to 6.9.0 and is exploitable over the network by any user holding the Security Manager role with at least one 'manage user' permission grant. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, though the vendor has self-reported it and released a patch via advisory TNS-2026-22.

Privilege escalation in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 enables a local low-privileged attacker to gain elevated system control by exploiting incorrectly set default permissions on files or resources managed by the WMS platform (CWE-269). The CVSS vector confirms a scope change (S:C) with full confidentiality, integrity, and availability impact, meaning a successful exploit transcends the initially compromised process context. Dell has released a fix in version 2605.0.2 via advisory DSA-2026-329; no public exploit code has been identified at time of analysis.

Privilege escalation in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 allows a low-privileged local attacker to fully compromise the host system through improper deserialization of untrusted data. The vulnerability carries a CVSS 7.8 High score with full confidentiality, integrity, and availability impact scoped to the vulnerable system. No public exploit code has been identified and EPSS places this at the 0th percentile for near-term exploitation likelihood; however, SSVC rates the technical impact as total, meaning successful exploitation results in complete system compromise for any attacker already holding local access.