Privilege Escalation

Privilege escalation in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.9) lets attackers take over the default administrator account by overwriting its password or email. The flaw stems from an authorization check that is silently skipped when the target user ID is a non-numeric string, which WordPress later coerces to integer 1 (the default admin). Where a public-facing frontend user form is configured the attack is fully unauthenticated; otherwise any subscriber-level account suffices. No public exploit identified at time of analysis, but the CVSS is 9.8 (Critical) and it was reported by Wordfence.

Unauthenticated privilege escalation in the Pods - Custom Content Types and Fields plugin for WordPress (all versions through 3.3.9) lets remote attackers bypass every authorization guard on the pods_admin AJAX router and perform administrator-level actions. Because failed checks return false instead of halting execution, an attacker with no account can promote themselves to Administrator or overwrite any user's password - including the site owner's - leading to full site takeover. Reported by Wordfence; no public exploit identified at time of analysis, though the root cause is precisely described.

Privilege escalation in the Real Estate Manager Pro WordPress plugin (all versions ≤ 12.8.6) allows authenticated Subscriber-level users to seize full Administrator control of a WordPress site. The flaw in `allow_attachment_actions()` confuses WordPress user IDs with media attachment IDs during capability checks, enabling a low-privileged user to edit an administrator account when those integer IDs collide. No confirmed active exploitation (CISA KEV) has been recorded, but the Subscriber-level access bar makes this a practical threat on any multi-user WordPress installation where the plugin is deployed.

Privilege escalation in the Wholesale Market WordPress plugin (versions up to and including 2.2.2) allows any authenticated user with Subscriber-level access or higher to elevate their account to Administrator by supplying an arbitrary role name to a poorly validated AJAX endpoint. The ced_wholesale_request_send_callback() handler accepts a client-controlled role_required POST parameter and passes it directly to WP_User::add_role() without an allowlist, relying solely on a nonce that is freely exposed to all authenticated users via wp_localize_script. No public exploit has been identified at time of analysis, but the low attack complexity combined with Subscriber-level access requirement makes this a realistic and attractive target on sites with the vulnerable configuration option active.

Privilege escalation in the bLoyal: Loyalty & Promotions WordPress plugin allows any subscriber-level authenticated user to overwrite the plugin's configured Loyalty Engine API URL via unprotected AJAX actions, then trigger an unauthenticated REST route to force the plugin to authenticate against an attacker-controlled server and invoke wp_set_auth_cookie() with an arbitrary WordPress user ID, yielding full administrator access. All plugin versions through 3.1.611.78 are affected across every WordPress installation running the plugin. No public exploit code identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the low barrier to entry - any subscriber account suffices - elevates practical risk significantly on sites with open registration.

Privilege escalation in the Propovoice WordPress plugin (all versions through 1.7.8) allows authenticated users holding the plugin-granted ndpv_manager role to create new WordPress accounts with full administrator privileges. The REST endpoint backing the team member create() function passes the user-supplied role parameter directly to WP_User::set_role() without validating it against an allowlist of safe roles or checking the WordPress promote_users capability. No public exploit has been identified at time of analysis, but the attack surface is broader than typical authenticated vulnerabilities because the ndpv_manager role is granted by the plugin itself - not the site administrator - expanding who can trigger the escalation.

Elevation of privilege in the Microsoft Malware Protection Engine (Microsoft Defender), publicly named 'ShieldBreak', allows a locally authenticated low-privileged user to gain high-level system access. The CVSS vector confirms a local, low-complexity attack requiring only low privileges and no user interaction, with full confidentiality, integrity, and availability impact. Proof-of-concept exploit code exists (E:P in the temporal vector), and Microsoft has acknowledged the vulnerability publicly.

Privilege escalation via a deterministic use-after-free in Zephyr RTOS's dynamic kernel-object disposal path affects any firmware build compiled with both CONFIG_USERSPACE and CONFIG_DYNAMIC_OBJECTS enabled. An unprivileged user thread can arm a dynamically-allocated k_timer, then release its last permission - causing unref_check() to free the timer's backing storage while the embedded struct _timeout dnode remains linked in the global _timeout_q; when the timer subsequently fires, z_timer_expiration_handler() dereferences and writes the freed - and potentially reallocated - kernel heap at ISR privilege. The bug constitutes a reliable sandbox-escape memory-corruption primitive scored CVSS 8.8 with scope change (S:C), and no public exploit has been identified at time of analysis.

Command injection (CWE-78) in Tenable Security Center versions prior to 6.9.0 enables a local attacker with write access to a specific configuration file to achieve arbitrary code execution at elevated privilege levels, with no user interaction required after file modification. Self-disclosed by Tenable and remediated in Security Center 6.9.0, as documented in advisory TNS-2026-22. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis.

Privilege escalation in Tenable Security Center allows an authenticated Security Manager to manage users outside their authorized group scope, bypassing the platform's intended group-based access controls. The flaw affects all Security Center versions prior to 6.9.0 and is exploitable over the network by any user holding the Security Manager role with at least one 'manage user' permission grant. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, though the vendor has self-reported it and released a patch via advisory TNS-2026-22.

Privilege escalation in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 enables a local low-privileged attacker to gain elevated system control by exploiting incorrectly set default permissions on files or resources managed by the WMS platform (CWE-269). The CVSS vector confirms a scope change (S:C) with full confidentiality, integrity, and availability impact, meaning a successful exploit transcends the initially compromised process context. Dell has released a fix in version 2605.0.2 via advisory DSA-2026-329; no public exploit code has been identified at time of analysis.

Privilege escalation in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 allows a low-privileged local attacker to fully compromise the host system through improper deserialization of untrusted data. The vulnerability carries a CVSS 7.8 High score with full confidentiality, integrity, and availability impact scoped to the vulnerable system. No public exploit code has been identified and EPSS places this at the 0th percentile for near-term exploitation likelihood; however, SSVC rates the technical impact as total, meaning successful exploitation results in complete system compromise for any attacker already holding local access.

Privilege escalation in Akaunting versions 3.1.21 and earlier allows any low-privileged authenticated user to self-assign the administrator role, gaining full platform control. The flaw resides in the UpdateUser job, which invokes roles()->sync() on caller-supplied role IDs without verifying whether the requesting user holds authorization to assign roles - exploitable by any account holding the default update-auth-profile permission. No public exploit has been confirmed at time of analysis, but the low exploitation barrier (authenticated, no special config) and full admin impact make this a high-priority remediation target.

Privilege escalation in getgrav/grav-plugin-api versions 1.0.6 through 1.0.11 allows any holder of a scoped, read-only API key to perform super-admin write operations - including rewriting group ACL maps to elevate arbitrary accounts to super-admin. The flaw exists because four privileged write endpoints (GroupsController, AccountsConfigController, PreferencesController, DashboardWidgetController) authorize via an isSuperAdmin() early-return that entirely skips requirePermission(), the only function that enforces scope caps on API keys. A leaked CI or monitoring key with a minimal scope such as api.pages.read is sufficient to achieve full administrative compromise. No public exploit code has been identified at time of analysis, and a patch is available in version 1.0.13.

Remote code execution in Grav API plugin versions before 1.0.13 is achievable by any attacker holding a scoped api.config.write API key. The ConfigController fails to enforce its super-scope gates, permitting scoped keys to overwrite scheduler.custom_jobs configuration that Grav subsequently executes via the Symfony Process component. A public exploit exists per SSVC data, the attack is rated automatable, and technical impact is assessed as total - making this a high-priority patching target despite a low EPSS score.

Privilege escalation in the Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 allows an authenticated API key holder with api.users.write scope to silently bypass the scope-cap enforcement and self-elevate to super-administrator. The flaw lies in UsersController's create() and update() methods, which validate scope caps only for api.users.write actions but fall back to a bare isSuperAdmin() check - reading access.api.super from the parent account rather than the key's own scope - when granting super privileges, allowing a limited key on a super account to mint or promote unrestricted admin accounts. A proof-of-concept exists per SSVC assessment, CISA rates exploitation as automatable with total technical impact, and a vendor-released patch is available at version 1.0.13.

Privilege escalation in Grav Plugin API before 1.0.13 allows an attacker controlling a minimal api.users.write API key - issued under a super admin account - to craft invitation records that embed super-admin access flags, which are written verbatim to any account that accepts the invitation. The root cause is CWE-269 improper privilege management: InvitationsController's strip-super and accept-groups decisions evaluate isSuperAdmin() against the owning account rather than against the API key's declared scope, so a deliberately restricted key silently retains the owner's super-admin authority for these checks. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Privilege escalation in the Essential Addons for Elementor WordPress plugin (versions 5.8.6 through before 6.7.2) permits unauthenticated remote attackers to self-register accounts with arbitrary WordPress roles, up to and including administrator, by supplying crafted values in user registration fields that overwrite reserved account attributes. The attack is gated on a non-default site configuration - specifically, a custom profile registration field with a particular label must have been set up by the site administrator - meaning only a subset of the estimated multi-million plugin install base is realistically exposed. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the unauthenticated path to full admin access makes affected sites a critical-priority remediation target.

Unauthenticated account takeover in the Wishlist Member WordPress membership plugin (versions up to and including 3.34.1) lets remote attackers seize any existing account, including administrators. The wpm_register() function verifies the registration cookie only against the GET reg parameter while trusting the POST mergewith and wpm_id parameters, so an attacker who supplies a victim's numeric user ID as mergewith causes wp_update_user() (plus a direct $wpdb query) to overwrite that account's username, password, email, and name with attacker values while suppressing WordPress notification emails. No public exploit has been identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network vector make this a critical-priority issue for any site running the plugin.

Missing authentication in OpenChoreo's cluster-gateway internal API lets any network-reachable caller invoke /api/proxy/, /api/exec/, and /api/wirelogs/ without a client certificate or token, exposing tenant Kubernetes Secrets and allowing workload mutation and arbitrary command execution across every connected data plane. All deployments before 1.0.3, 1.1.3, and 1.2.0-rc.2 are affected, and the fix introduces an opt-in --internal-mtls mode plus a dedicated internal CA. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV; risk is amplified because the internal listener effectively brokers cross-tenant, multi-cluster control-plane access.

SSH key injection in FreePBX versions 17.0.5.34 through 17.0.10.x allows authenticated administrators to escalate from web application control to persistent OS-level shell access on the underlying host. The publicKeySave AJAX endpoint in Backup.class.php appends caller-supplied SSH public keys to /home/asterisk/.ssh/authorized_keys without reliably enforcing backup-only command restrictions or source IP constraints, granting the asterisk OS user unrestricted interactive shell access. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available in version 17.0.11.

Privilege escalation in Budibase's public role-assignment API allows an app-scoped builder to grant themselves or other users builder access - or arbitrary data-plane roles - across any app in a shared tenant. Versions prior to 3.39.24 are affected; the CVSS score of 8.8 (PR:L) reflects that a low-privilege authenticated account is sufficient, with no user interaction or elevated complexity required. No public exploit or CISA KEV listing is identified at time of analysis, but the vulnerability is straightforwardly reproducible given the published commit diff and GHSA advisory detail.

Privilege escalation in IBM i versions 7.3 through 7.6 allows a local authenticated attacker to abuse improper authorization controls in the Navigator for i debugger component to access or manipulate sensitive system data, or create new profiles with elevated privileges. The vulnerability is classified under CWE-285 (Improper Authorization), indicating the debugger fails to enforce sufficient privilege checks before granting access to sensitive operations. No public exploit or CISA KEV listing exists at time of analysis, though SSVC assesses the technical impact as total should exploitation occur.

Privilege escalation in IBM i (7.3, 7.4, 7.5, 7.6) lets a remote, authenticated attacker gain elevated privileges by abusing improper validation of pointers read from Java-controlled addresses, giving full compromise of the affected component and a scope-changing impact beyond it. IBM assigned a critical CVSS 9.9 (S:C) despite requiring low privileges. No public exploit identified at time of analysis, and CISA SSVC records exploitation status as none, so this is a patch-worthy critical without evidence of active abuse yet.

Security-restriction bypass in IBM i (the operating system for IBM Power servers, formerly OS/400) versions 7.3 through 7.6 lets a remote attacker abuse improper validation of user-controlled addresses to elevate privileges and cross a security boundary. Vendor scoring rates this a maximum-severity, unauthenticated network flaw (CVSS 10.0, scope-changed), though there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.33%). IBM published a fix, and CISA's SSVC framework currently marks exploitation as 'none' with a 'total' technical impact.

Thread authority swap mismanagement in IBM i 7.3 through 7.6 enables a low-privileged local attacker to gain elevated system authorities, including potentially *ALLOBJ-equivalent access. The CVSS scope change (S:C) confirms that successful exploitation extends privilege impact beyond the attacker's own user profile, threatening the broader system partition. No public exploit or active CISA KEV listing exists at time of analysis; risk is driven by low attack complexity and the critical role IBM i plays in regulated enterprise environments.

Arbitrary file read in HashiCorp Vault Secrets Operator versions 1.3.0 through 1.4.1 lets a low-privileged Kubernetes tenant abuse the AppRole authentication's SecretIDPath configuration to read files from the operator pod's filesystem and exfiltrate their contents to an attacker-controlled endpoint, enabling privilege escalation across the cluster. Because the operator pod typically holds credentials and tokens spanning multiple tenants, a single limited-RBAC tenant can cross trust boundaries (CVSS scope change), yielding a 9.6 rating. No public exploit identified at time of analysis, but the low attack complexity and multi-tenant blast radius make this a high-priority patch.

Privilege escalation in IBM i 7.3 through 7.6 allows remote authenticated users to gain unauthorized elevated privileges via improper privilege management. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms network-reachable exploitation requiring only low-level credentials, with full confidentiality, integrity, and availability impact on the affected system. No public exploit code or CISA KEV listing is identified at time of analysis, but a vendor-released patch is available.

Privilege escalation in Kibana Fleet allows an authenticated low-privileged user to bypass integration-scoped authorization controls by exploiting a logic flaw in how policy update requests are validated (CWE-863). An operator holding only the Elastic Defend endpoint policy management role can craft a Fleet API update request that substitutes a different integration type into an existing endpoint policy they control, because Fleet evaluates the authorization check against the stored policy's original integration rather than the replacement integration supplied in the request. No public exploit code has been identified at time of analysis, but the vendor (Elastic) has issued advisory ESA-2026-127 with patched releases.

Privilege escalation in Kibana arises from insufficient CSRF protection in the Vega visualization engine, affecting all versions prior to 8.19.20 and 9.4.5. Any Kibana user with visualization creation rights can embed a specially crafted Vega specification that, when rendered by a higher-privileged user's browser, silently issues authenticated HTTP requests to Kibana under the victim's session credentials. No public exploit code has been identified and no CISA KEV listing exists at time of analysis, though the low attack complexity and widely deployed nature of the product make this a meaningful remediation priority.

Privilege escalation in Elastic Kibana's Agent Builder component (versions 9.4.0-9.4.3) allows authenticated low-privileged users to create and execute Agent tools that invoke Kibana features they are not authorized to access, bypassing the platform's feature-level access controls. The Agent Builder omits authorization verification against the target feature's required privilege set before tool creation and execution, enabling cross-feature privilege escalation and potential disclosure of sensitive data. No public exploit code exists and EPSS is 0.25%, but SSVC rates technical impact as total, making this a meaningful risk in multi-tenant or role-segmented Kibana deployments.

Local privilege escalation in IBM i versions 7.3 through 7.6 allows an authenticated local user with low-level system privileges to gain elevated authority due to improper privilege management (CWE-269). The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires no special conditions beyond existing local access, with full confidentiality, integrity, and availability impact upon success. No public exploit code has been identified at time of analysis, and IBM has released a patch via its support portal.

Privilege escalation in Lenovo Dock Manager exposes local authenticated users to full system compromise via an improperly protected cryptographic key, discovered during Lenovo's own internal security assessment. An attacker with a standard local user account can extract the weakly protected key and leverage it to elevate privileges on the affected endpoint. No public exploit has been identified at time of analysis; Lenovo has released a patch via advisory LEN-223470.

Privilege escalation in Lenovo Dock Manager allows a local authenticated user to execute arbitrary code with elevated privileges by exploiting improper file or directory permissions (CWE-276). The flaw was identified during Lenovo's own internal security assessment, suggesting proactive vendor discovery rather than external researcher or attacker-driven disclosure. No public exploit code has been identified at time of analysis, and the local-only attack vector (AV:L, PR:L) meaningfully constrains real-world exposure compared to network-exploitable vulnerabilities, though enterprise environments with shared Lenovo workstations should treat this as a genuine privilege escalation risk.

Symlink race condition in rsync before 3.5.0 enables local privilege escalation by allowing an attacker to redirect ACL and extended attribute application to arbitrary files outside the intended destination tree. A low-privileged local attacker exploits the timing window between rsync's file write and the subsequent acl_set_file() or lsetxattr() call by substituting a crafted symlink at a predictable destination path, causing rsync to stamp permissions onto unintended files. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV; however, the CVSS 4.0 score of 7.2 reflects genuine high confidentiality and integrity impact when successfully timed.

Symlink following in rsync before 3.5.0 enables local privilege escalation by allowing a low-privileged attacker to redirect ancillary file writes - such as log files, batch files, or daemon statistics - to arbitrary filesystem locations. Affected installations are those where rsync executes with elevated privileges, specifically setuid binaries or privileged daemon configurations, making the impact proportional to how widely such configurations are deployed. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 8.5 and the designation of v3.5.0 as a 'major security release' by the rsync maintainers signal this is treated as a high-severity finding.

Privilege escalation in the Directories Pro WordPress plugin (versions <= 2.0.5) allows a subscriber-level authenticated user to gain higher-level privileges within the WordPress installation. Reported by Patchstack and classified under CWE-266 (Incorrect Privilege Assignment), this flaw exposes sites using the plugin for directory listings to unauthorized data access and content manipulation. No public exploit code or CISA KEV listing has been identified at time of analysis, though the network-accessible attack surface warrants prompt patching.

Privilege escalation in the WooCommerce-focused "SMS Alert Order Notifications" WordPress plugin (versions 3.9.7 and earlier) lets an unauthenticated remote attacker gain elevated privileges on the site. The flaw stems from incorrect privilege handling (CWE-266) and, per its CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N), is remotely reachable without authentication or user interaction, yielding full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 9.8 base score and unauthenticated nature make it a serious, near-full-compromise risk.

Unauthenticated privilege escalation in the miniOrange SAML SP Single Sign On WordPress plugin (versions ≤ 5.4.3) allows network-accessible attackers to elevate their privileges without any prior authentication. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates exploitation is remotely achievable but requires specific conditions to be met - likely particular SAML configuration states or timing-sensitive request manipulation. Full confidentiality, integrity, and availability impact is reported, consistent with an attacker reaching WordPress administrator-level access. No public exploit code or CISA KEV listing has been identified at time of analysis.

Privilege escalation in the miniOrange OTP Verification WordPress plugin (versions 5.5.1 and earlier) allows unauthenticated remote attackers to elevate their privileges, per a Patchstack advisory. The flaw is rooted in a weak account/OTP verification mechanism (CWE-640) that can be abused without any credentials, and carries a CVSS 9.8 rating reflecting full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the unauthenticated network vector makes this a high-priority patching candidate.

Privilege escalation in the Service Finder Booking WordPress plugin (versions 6.2 and below) allows any authenticated subscriber-level user to elevate their privileges within the application, resulting in full confidentiality, integrity, and availability impact. The flaw is network-exploitable with low complexity and requires only a valid subscriber account, making it accessible to any registered user on affected sites. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 8.8 score reflects the high-impact potential once a low-privileged account is obtained.

Unauthenticated privilege escalation in the MStore API WordPress plugin (versions 4.20.0 and earlier) allows remote, unauthenticated attackers to gain elevated privileges on affected WordPress installations. Rooted in CWE-266 (Incorrect Privilege Assignment), the flaw is reachable over the network without any authentication or user interaction, though elevated attack complexity (AC:H) indicates a specific condition or race condition must be satisfied. No public exploit code or CISA KEV listing has been identified at time of analysis, but the full-impact CVSS score of 8.1 reflects the severity of a complete privilege compromise if exploited successfully.

KiviCare WordPress plugin before version 4.5.2 exposes an unauthenticated registration endpoint that fails to enforce role restrictions, permitting any remote attacker to self-register a privileged clinic-staff (doctor) account without credentials. Once registered, the attacker gains full access to patient records, billing data, and clinic management functions. A vendor patch exists at version 4.5.2; no public exploit has been identified at time of analysis.

Symlink-following jail escape in the ansible-jailexec FreeBSD connection plugin (versions through 1.3.0) allows a party controlling content inside a managed jail to achieve arbitrary root-owned file writes on the jail host. The put_file method resolves transfer destinations as the jail's filesystem root concatenated with the task's target path, then executes mkdir -p and mv on the host as root - outside the jail's chroot - enabling any symlink planted inside the jail to redirect those writes to arbitrary host paths. An attacker already present inside a managed jail who can anticipate or observe Ansible playbook execution can thereby escape the jail boundary entirely, writing cron jobs, rc.d scripts, or authorized_keys entries to the host and achieving full host compromise. No public exploit has been identified at time of analysis; vendor-released patch 2.0.0 is available.

Local privilege escalation in IBM Informix Dynamic Server 14.10 and 15.0 allows any low-privileged local OS user to gain root access by exploiting improper access controls in the setuid-root `oninit` utility. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms a low-complexity local attack requiring no user interaction, resulting in full system compromise. No public exploit has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog.

Privilege escalation in IBM Db2 (data server versions 11.5.0-11.5.9 and 12.1.0-12.1.5) allows an attacker to submit a specially crafted query that bypasses authorization controls and gains elevated database privileges, classified as CWE-285 improper authorization. IBM reported the issue and has published a fix; there is no public exploit identified at time of analysis and it is not on CISA KEV. EPSS is low at 0.32% (25th percentile) despite the 9.8 CVSS, indicating no observed mass-exploitation activity yet.

Unauthenticated remote crash of rsyslogd is possible through a flaw in the optional imptcp input module, where a crafted input sequence during oversize-frame recovery produces an invalid internal message length and terminates the logging daemon. Systems running Red Hat Enterprise Linux 6 through 10 are affected only when imptcp is explicitly loaded with a non-default frame delimiting mode; the default imptcp framing and the separate imtcp module are explicitly confirmed unaffected. No public exploit code and no CISA KEV listing have been identified at time of analysis; CVSS scores this at 7.5 High solely on the basis of network-accessible, unauthenticated availability impact.

Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 lets a namespace-scoped tenant abuse the multicloud-operators-subscription controller as a confused deputy: by crafting Subscription Custom Resources, a namespace-admin causes the controller's highly privileged ServiceAccount to deploy attacker-chosen cluster-scoped resources. This breaks tenant isolation and can yield cluster-wide privilege escalation and arbitrary code execution. Rated CVSS 9.9 (scope-changing), with no public exploit identified at time of analysis and no active exploitation reported (not in CISA KEV).

Privilege escalation in IBM i 7.3 through 7.6 allows remote authenticated attackers to gain elevated privileges by submitting a crafted, client-supplied profile name that bypasses server-side validation. The root cause is improper privilege management (CWE-269) in profile name handling, enabling an attacker with only low-level authenticated access to escalate to higher system privileges. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity and high impact across confidentiality, integrity, and availability make this a serious priority for IBM i environments.

Privilege escalation and arbitrary code execution in Red Hat's multicluster engine (MCE) for Kubernetes lets a low-privileged tenant holding create or update rights on ClusterCurator resources hijack the cluster-curator-controller's service account. Because the CreateJob() function unmarshals the attacker-supplied spec.install.overrideJob raw extension without validation, the injected Job runs with the controller's elevated permissions, enabling cluster-wide secret access and full compromise. Rated CVSS 9.9 by Red Hat; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Privilege escalation in Red Hat's multicluster engine for Kubernetes (MCE) lets a namespace-scoped authenticated user gain cluster-wide control by abusing the cluster-curator-controller. By creating a ClusterCurator custom resource with a specific, attacker-chosen naming convention, the user tricks the controller into minting a cluster-scoped ClusterRoleBinding on their behalf, breaking the namespace isolation boundary. There is no public exploit identified at time of analysis, but the CVSS 9.9 rating reflects that a low-privileged tenant can obtain secrets access, manage cluster actions, and destroy hosted clusters or node pools.

Privilege escalation to root authority in IBM i 7.3 through 7.6 is achievable by any authenticated low-privileged user via a remote code execution flaw in the activation engine component. The activation engine executes with unnecessary system privileges (CWE-250), allowing a planted malicious script to run with root authority, resulting in full compromise of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis, though the vendor has released a patch and the low attack complexity makes this a credible near-term threat for unpatched IBM i environments.

Remote authenticated attackers can execute arbitrary commands on IBM i 7.3 through 7.6 by exploiting improper privilege management (CWE-250), achieving full confidentiality, integrity, and availability compromise on affected systems. The CVSS vector of AV:N/AC:L/PR:L/UI:N confirms that only a low-privileged account and network reachability are required - no complex preconditions or user interaction needed. IBM has confirmed the vulnerability and released a patch via advisory; no public exploit code or CISA KEV listing has been identified at time of analysis.

Privilege escalation in IBM i (formerly OS/400) releases 7.3 through 7.6 lets a remote authenticated user with low privileges gain higher, potentially all-object, authority by abusing improper authorization checks in the handling of high-authority threads. The flaw is scored CVSS 9.9 because of a scope change (S:C) that lets a foothold on the platform lead to full compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and EPSS is low at 0.24%, but a vendor patch is available.

Privilege escalation in IBM i versions 7.3 through 7.6 via the Navigator for i web-based administration interface allows an authenticated low-privileged user to elevate their session to root and execute arbitrary commands on the system. The CVSS 3.1 score of 8.8 (PR:L, AV:N, AC:L) reflects that exploitation requires only valid credentials and network access to the Navigator for i interface, with full confidentiality, integrity, and availability impact upon success. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Remote authenticated command execution in IBM i 7.3 through 7.6 stems from improper privilege management during monitor owner reassignment, a specific system management function. An attacker holding low-privileged credentials can exploit this flaw over the network without user interaction to execute arbitrary commands, achieving both high confidentiality and high integrity impact on the affected system. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and authentication barrier make this a credible threat in any environment with broad user access to IBM i.

Privilege escalation via OS command injection in IBM i Navigator for i (versions 7.3 through 7.6) allows any authenticated, low-privileged network user to execute arbitrary OS commands as the root user. The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N) confirms this is a low-complexity, network-accessible exploit requiring only a valid user account - no additional privileges or user interaction needed. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and full CIA impact make this a genuine remediation priority for IBM i environments.

Privilege escalation in IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 allows an authenticated low-privileged user to gain unauthorized access to protected data and functionality when the Liberty collectives feature is in use. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms network-exploitable, low-complexity exploitation requiring only low-level authentication with no user interaction - resulting in high confidentiality and integrity impact. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available.

Privilege escalation in Semaphore UI allows an authenticated project manager to gain owner-level project control by exploiting a role-shadowing flaw in the custom role creation API. Affected versions prior to 2.18.19 and between 2.19.0-alpha3 and 2.19.5-beta5 permit a project manager to POST a custom role with a slug matching a built-in role name and bitmask 15, causing the middleware to resolve the database-backed custom role instead of the protected built-in, thereby granting CanUpdateProject and CanManageProjectUsers capabilities reserved for owners. No public exploit code has been identified at time of analysis and this CVE is not listed in CISA KEV, but the low exploitation complexity (AC:L, single API call, no special configuration) and high CVSS impact (8.8) make upgrading urgent for any deployment with untrusted project managers.

Path traversal in SSH.NET's ScpClient.Download() enables a malicious, compromised, or man-in-the-middle SCP server to write arbitrary files anywhere the client process has write access during recursive directory downloads. All SSH.NET NuGet package versions up to and including 2025.1.0 are affected; the vulnerability is analogous to CVE-2019-6111 in OpenSSH but extends to directory traversal. No public exploit code or CISA KEV listing has been identified at time of analysis, though the integrity impact is high given the file-write primitive can overwrite SSH authorized keys, shell rc files, or application binaries.

Privilege escalation in JFrog Artifactory enables an authenticated Project Resource Manager to acquire broader administrative privileges under unspecified triggering conditions. The flaw, rooted in CWE-269 (Improper Privilege Management), violates role boundary enforcement within Artifactory's access control system, potentially granting full control over repositories, artifacts, and platform configuration. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at the time of analysis, though the CVSS 7.2 High score with full confidentiality, integrity, and availability impact underscores the post-exploitation risk.

Privilege escalation in RustFS prior to version 1.0.0-beta.11 allows any authenticated user holding CreateServiceAccountAdminAction to create a root-parented service account by supplying an arbitrary target_user to the AddServiceAccount API, because the handler validates only the permission and never enforces scope - and prepare_service_account_auth automatically grants is_owner status to root-parented accounts. The resulting credential provides full owner-level access to all objects in the distributed storage cluster. No active exploitation has been confirmed (no CISA KEV listing), but the complete attack path is publicly documented in the fix PR, substantially lowering the exploitation barrier.

Local kernel privilege escalation and denial of service in NetBSD's hdaudio(4) driver arise from two compounding flaws: the /dev/hdaudioN device nodes enforce no access control, allowing any unprivileged local user to invoke HDAUDIO_FGRP_SETCONFIG, and the detach path in hdafg_detach() is not race-safe against concurrent DMA activity. A two-thread attack - one repeatedly reconfiguring the audio function group, one keeping DMA and IRQs live - wins a use-after-free race where a latched DMA interrupt dereferences a freed callback pointer, producing outcomes from audio-subsystem crashes and kernel panics to potential kernel-level privilege escalation. A public proof-of-concept is available, and no specific patched release version has been confirmed, leaving remediation dependent on source-level kernel rebuilds.

Privilege escalation and account takeover in the Events Manager WordPress plugin before 7.4.1 lets unauthenticated attackers reset passwords, promote accounts to Administrator, or delete accounts whose user ID collides with the ID of one of the plugin's own posts. The flaw stems from the plugin overriding WordPress's own capability decisions for unrelated privileged user actions. Publicly available exploit code exists (WPScan), EPSS is a notable 15%, and SSVC rates it automatable with total technical impact, though it is not currently listed in CISA KEV.

Confused-deputy privilege escalation in snowflake.core (Snowflake Python API) prior to version 1.13.0 enables attackers with low-privileged access to a downstream application to perform unauthorized Snowflake operations under the application's higher-privileged session. Two related input-sanitization weaknesses make this possible: path traversal via unencoded `..` segments in REST URL paths (CWE-22), and HTTP parameter pollution via injected `&`, `#`, or `=` characters in query strings (CWE-141), either of which can subvert swap, clone, or rename operations against unintended resources. No public exploit code has been identified at time of analysis and no CISA KEV listing is confirmed; the vendor-released fix is snowflake.core 1.13.0, available on PyPI and requiring manual upgrade.

Unauthorized cross-tenant Secret and ConfigMap access in the multicloud-operators-channel component of Red Hat Advanced Cluster Management for Kubernetes 2 allows a compromised managed-cluster agent to read all Secrets and ConfigMaps within any Channel namespace on the hub cluster. The Changed scope (S:C) in the CVSS vector confirms that exploitation pivots from a managed cluster context into the hub, exposing Git and Helm repository credentials belonging to other tenants. No public exploit has been identified at time of analysis, but the network-reachable, low-privilege vector makes this a high-priority finding in any multi-tenant RHACM deployment.

Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (multicloud-integrations / ArgoCD pull-model integration) lets a low-privileged hub tenant who can create Application CRs redirect propagation to arbitrary managed spoke clusters. Because the Application propagation controller trusts the attacker-supplied `ocm-managed-cluster` annotation without validation, an attacker forces ArgoCD on targeted spokes to sync attacker-controlled manifests, yielding code execution or privilege escalation there. CVSS 9.9 with scope change; no public exploit identified at time of analysis and it is not listed in CISA KEV.

AcyMailing WordPress plugin (all versions through 10.11.1) allows authenticated attackers with subscriber-level access to exploit an authorization bypass and silently overwrite the BCC field of the plugin's core notification template, redirecting all subsequent WordPress password-reset emails - including those for administrator accounts - to an attacker-controlled address. By then triggering the standard WordPress lost-password flow for any account, the attacker intercepts the one-time reset token and achieves full site administrator compromise without any victim interaction. No public exploit code or CISA KEV listing exists at time of analysis; exploitation is gated by a non-default plugin configuration that partially narrows the real-world attack surface below what the CVSS 8.8 score implies.

Sandbox escape in Cursor IDE for macOS (versions prior to 3.0.0) allows a malicious or prompt-injected AI agent operating in Auto-Run Sandbox mode to break container isolation by invoking the Dev Containers CLI to launch a privileged Docker container that mounts the host's virtiofs0 virtual filesystem. This grants the agent unrestricted read and write access to the user's entire home directory and enables arbitrary command execution at the user's privilege level - all without any additional permission prompt to the user. No public exploit code has been identified at time of analysis; a vendor-released patch is available as version 3.0.0.

Privilege escalation in Adobe Commerce and Magento Open Source (including Adobe Commerce B2B) lets a remote attacker gain elevated access to sensitive resources through an incorrect authorization flaw, with no user interaction required. All supported branches from 2.4.4 through 2.4.9 (and B2B 1.3.3-1.5.3) prior to the August 2026 patch set are affected, and the CVSS 9.1 rating reflects high confidentiality and integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but as an unauthenticated, low-complexity authorization bypass in a widely deployed storefront platform it warrants urgent patching.

Privilege escalation in Windows App Installer (the App Installer component of Windows Package Manager, aka winget) allows an authenticated local attacker with standard user privileges to fully compromise confidentiality, integrity, and availability of the affected system. The flaw stems from improper privilege management (CWE-269), meaning the application fails to correctly enforce privilege boundaries during its operations. No active exploitation is confirmed - CISA KEV does not list this CVE, SSVC rates exploitation as 'none', and EPSS sits at only 0.33% (26th percentile) - but the SSVC technical impact rating of 'total' reflects the severity of a successful local privilege escalation to full system control.

Privilege escalation in Microsoft High Performance Computing (HPC) Pack allows a network-authenticated attacker with low-privilege access to elevate privileges to a higher level, potentially achieving full system compromise. The flaw stems from CWE-250 (Execution with Unnecessary Privileges), meaning a component within HPC Pack runs with more rights than its function requires, providing a lever for a legitimately authenticated user to abuse. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, but the CVSS 8.8 score and full C/I/A impact triad indicate a serious risk in any environment where untrusted low-privilege users have network access to HPC Pack services.

Privilege escalation in Microsoft PowerShell 7.4.x, 7.5.x, and 7.6.x stems from incorrect default permissions (CWE-276), enabling a locally authenticated low-privilege attacker to gain full system control. Exploitation requires local shell access and a user interaction trigger - an already-privileged user or process must execute PowerShell after the attacker has tampered with an incorrectly permissioned file or directory. No public exploit code and no active exploitation have been identified; SSVC confirms exploitation status as none and the attack is not automatable. Microsoft has released patched versions across all three affected branches.

Privilege escalation in Adobe ColdFusion 2023 and 2025 allows a low-privileged local user to gain unauthorized read and write access through an Incorrect Authorization flaw (CWE-863). Exploitation requires only a low-privileged local account and no user interaction, yielding full confidentiality, integrity, and availability impact on the affected system. Adobe has published advisory APSB26-90; no public exploit code or CISA KEV listing has been identified at time of analysis.

Privilege escalation in Adobe ColdFusion 2023 and 2025 allows a low-privileged authenticated attacker to gain unauthorized read and write access beyond their authorized security scope by exploiting improper input validation in file processing. The attack requires social engineering - a victim with higher privileges must open a specially crafted malicious file - after which the attacker's effective permissions cross security boundaries (scope change, S:C) to reach resources outside the original ColdFusion component. No public exploit or CISA KEV listing has been identified at time of analysis, though the high CVSS score of 8.7 and scope-change impact warrant prompt remediation per Adobe advisory APSB26-90.

Privilege escalation in the Alias Checking Trusted Module (ACTM) firmware for certain Intel Xeon processors allows a local privileged attacker to escalate to System Management Mode (SMM) execution, achieving high confidentiality and integrity impact across both the directly compromised system and subsequent systems such as co-hosted hypervisors or tenant workloads. The attack requires high-complexity local technique combined with pre-existing privileged user access, placing it firmly in the advanced persistent threat actor category. No public exploit has been identified at time of analysis, and Intel has published advisory INTEL-SA-01439 to address this firmware flaw.

Privilege escalation in Intel PROSet/Wireless WiFi Software for Windows allows local unprivileged code operating within the Ring 2 privileged process boundary to elevate access rights due to improper privilege management (CWE-269), yielding high availability impact and limited confidentiality and integrity exposure on both the vulnerable and subsequent systems. The attack is constrained to local access and requires high complexity, but no prior authentication or user interaction is needed from the attacker. Intel has published advisory INTEL-SA-01468 to address this flaw; no public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Improper authentication (CWE-287) in Intel's Trust Domain Extensions (TDX) module allows a Ring-0 system software adversary with high privileges to breach Trust Domain isolation boundaries, enabling information disclosure and privilege escalation. Affects select Intel platforms running TDX with a high-complexity, locally-executed attack path - no user interaction required. No public exploit identified at time of analysis, but the confidential-computing trust model is fundamentally undermined if exploited: an adversary with hypervisor-level access could read or modify memory intended to be protected from exactly that privilege tier.

Privilege escalation in Intel PROSet/Wireless WiFi Software for Windows exposes local systems to code execution by unprivileged attackers via a Ring 2 (device driver layer) improper access control flaw. Any local process with no privileges required and no user interaction can leverage the driver's failure to enforce access boundaries to achieve local code execution, with follow-on high confidentiality impact on the broader system - consistent with a kernel-level scope change. No public exploit identified at time of analysis, and no CISA KEV listing; however, the low complexity and zero-privilege requirement make this a credible post-compromise escalation vector for threat actors with any form of local code execution already established.

Out-of-bounds read in Intel PROSet/Wireless WiFi Software at the Ring 2 device driver layer allows adjacent network attackers without authentication to escalate privileges on affected Windows systems. The flaw, tracked under CWE-125, can be triggered by a low-complexity attack from the same WiFi segment or Layer 2 broadcast domain, requiring no user interaction, and yields High availability impact alongside Low confidentiality and integrity exposure. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV, but the unauthenticated adjacent attack surface is meaningful for enterprise mobile workforces on untrusted networks.

Improper access control within Ring 3 (user application space) of Intel processors permits privilege escalation from authenticated local user-level access to higher system privilege levels, with high confidentiality and integrity impact on the vulnerable system. Exploitation demands local access, low-privilege authentication, high attack complexity, and specialized internal knowledge of Intel processor microarchitecture internals - substantially narrowing the realistic attacker population. No public exploit code has been identified and no CISA KEV listing exists at time of analysis, consistent with a threat relevant primarily to sophisticated, targeted adversaries.

Privilege escalation in CamaleonCMS 2.9.2 and earlier allows any authenticated low-privileged user to overwrite administrator passwords and achieve full site takeover via a parameter confusion flaw in the UsersController's updated_ajax endpoint. The authorization filter and the action body each resolve the target user from a different parameter key, enabling an attacker to pass their own ID to satisfy the self-authorization check while simultaneously directing the mutation at any victim account. No public exploit tool has been identified at time of analysis, but the upstream fix commit is available on GitHub (PR #1185, commit 2634503), with a formally tagged patched release not yet independently confirmed.

Local privilege escalation in Siemens License Server (SLS) versions prior to V5.1 allows a local attacker with elevated operating system privileges to execute arbitrary commands and write malicious files as root, resulting in full system compromise. The root cause is an insecure sudoers policy (CWE-732) that grants overly permissive command execution rights, enabling abuse of sudo rules to break out of intended privilege boundaries. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high-integrity and high-confidentiality impact on the vulnerable system underscores urgency for organizations running SLS in multi-user or shared infrastructure environments.

Server-Side Request Forgery in the OpenShift Console Helm catalog proxy allows low-privileged namespace tenants to plant a malicious ProjectHelmChartRepository resource pointing to an attacker-controlled URL, causing the console pod to issue server-side fetches that bypass tenant egress restrictions. Combined with Helm catalog metadata poisoning and subsequent admin-mediated chart installation, this multi-stage attack chain enables privilege escalation within the cluster. No CISA KEV listing or public exploit code has been identified at time of analysis, though the CVSS Scope:Changed rating correctly reflects that the console pod's cross-boundary requests extend impact beyond the originating namespace.

Privilege escalation in Authentik Security authentik through version 2026.5.6 allows an attacker holding a source-scoped SCIM provisioning token to take over any local account, including superuser accounts, by provisioning a SCIM user whose username matches an existing account. The SCIM user ingest function adopts pre-existing local accounts by username without enforcing scope boundaries, meaning a limited-privilege provisioning credential can rewrite or delete accounts entirely outside its intended scope. No public exploit has been identified at time of analysis, but the attack requires only network access and a valid SCIM token, making the exploitation bar low for any attacker who has obtained such a credential.

Privilege escalation in Authentik Security authentik through 2026.5.6 allows any holder of a source-scoped SCIM provisioning token to seize superuser control over the entire Identity Provider and permanently lock out all legitimate administrators. The root cause is the SCIM group ingest function's failure to validate whether the requesting token's source scope has authority over the target group - when an attacker provisions a SCIM group whose name matches an existing administrator group, authentik silently adopts and replaces that group's membership without authorization checks. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but the high CVSS score of 8.8 and the total-takeover impact warrant immediate remediation.

Privilege escalation in the `openvt -u` utility allows a local low-privileged attacker to obtain passwordless root login on Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. The flaw lies in `authenticate_user()`, which resolves VT ownership via `stat("/proc/<pid>/fd/0")` - a call that follows the symlink to the underlying TTY device node rather than inspecting the owning process, causing the check to read the device node's UID rather than the process owner's UID. When a privileged user logs out and TTY device node ownership reverts to root or the getty owner while an attacker's process still holds fd 0 on that TTY, the check incorrectly authorizes a passwordless `login -f root` execution. No public exploit is identified at time of analysis and there is no CISA KEV listing, but the root-level impact makes this a high priority for environments using the affected `kbrequest`/init deployment pattern.

Privilege escalation in MRTG (Multi Router Traffic Grapher) allows a local low-privileged attacker to gain elevated file ownership on the host system. When the MRTG daemon is launched as root and then drops privileges, a CWE-59 symlink-following flaw in PID file handling lets an attacker pre-place or manipulate a symlink at the expected PID file path, causing the root process to change ownership of an arbitrary existing file to the daemon user. Affected platforms include Red Hat Enterprise Linux 6 through 10; no public exploit code or CISA KEV listing has been identified at time of analysis.

Remote code execution via improper input validation in a VAPIX API parameter on Axis OS affects Axis network camera and edge device deployments. An attacker holding administrator-privileged service account credentials can send a crafted API parameter to trigger the flaw, execute arbitrary code on the device, and potentially escalate to higher privileges. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the full-impact CVSS score of 7.2 with network attack vector and high C/I/A ratings reflects the severity of a successful post-authentication compromise.

Privilege escalation via untrusted pointer dereference in ASUS GPU Tweak III, GPU Tweak II, AI Suite 3, and VGAdll exposes local attackers to arbitrary kernel memory writes through vulnerable IOCTL handlers in the associated kernel-mode drivers. The flaw (CWE-822) permits a caller supplying an attacker-controlled pointer to force the driver to write a specific value to an arbitrary memory address, enabling elevation of privileges. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the high CVSS 4.0 score of 8.4 and confirmed arbitrary-write primitive make this a meaningful local privilege escalation risk on affected systems.