Privilege Escalation

Privilege escalation in Red Hat OpenShift AI's training-operator enables any user holding a standard Kubernetes edit or admin role in any cluster namespace to break out of namespace isolation, impersonate service accounts, access the host filesystem, and achieve remote code execution. The root cause is a design flaw: the operator aggregates training job permissions onto native Kubernetes built-in ClusterRoles, and allows unrestricted PodTemplateSpec passthrough - meaning users can submit training jobs containing arbitrary pod configurations such as hostPath mounts or elevated service account tokens. No public exploit code or CISA KEV listing was identified at time of analysis, but the low access complexity and the broad availability of edit/admin roles in typical ML platform deployments make this an urgent remediation priority.

Privilege escalation in odh-dashboard, the web interface for Red Hat OpenShift AI (RHOAI), allows any authenticated dashboard user to gain cluster-admin or other highly privileged roles by manipulating the roleRef field when creating RoleBindings. The system performs no server-side validation on the roleRef value supplied through the dashboard, enabling an attacker holding only a standard user account to bind themselves to arbitrary Kubernetes ClusterRoles. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the CVSS 8.8 score and the direct, low-complexity path to cluster-admin access make this a high-priority remediation target for any RHOAI deployment.

Privilege escalation in odh-dashboard (Red Hat OpenShift AI) allows an attacker who has obtained the dashboard's Service Account token to abuse overly broad SA permissions and elevate to cluster-administrator level. Exploitation grants full access to secrets, credentials, and keys across the entire OpenShift cluster, while also breaking multi-tenant isolation between workloads. No public exploit code has been identified at time of analysis, and this CVE is not in CISA KEV, but the CVSS score of 8.8 and cluster-wide blast radius make it a high-priority remediation target for RHOAI deployments.

MySQL DSN parameter injection in Red Hat OpenShift AI's Data Science Pipelines Operator (DSPO) allows a namespace editor to enable the MySQL LOCAL INFILE feature via the unvalidated spec.database.customExtraParams field, enabling exfiltration of sensitive files - including Kubernetes service account tokens - from the operator pod. An attacker who exploits this can leverage the stolen token to impersonate the operator's service account and escalate privileges to cluster-admin level within the OpenShift cluster. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Overprivileged ClusterRole assignments in Red Hat OpenShift AI's Data Science Pipelines Operator (DSPO) create a cluster-wide privilege escalation path if the operator pod is compromised. The DSPO ClusterRole grants capabilities well beyond operational necessity - including pod exec and cluster-wide RBAC management - directly violating the principle of least privilege (CWE-250). Successful exploitation of a compromised DSPO pod would allow an attacker to assume full administrative control over the entire Kubernetes cluster; no public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS scope-change flag (S:C) confirms the blast radius extends far beyond the initial compromise boundary.

Privilege escalation to root in Dokploy (self-hosted PaaS) versions 0.29.2 through 0.29.12 lets a low-privilege organization member who has access to a single application escalate to full host command execution. Because schedule.create/schedule.update derive the internal serviceId from applicationId or composeId but only enforce the owner/admin host-schedule gate in the alternate branch, a member can bind their applicationId to a 'dokploy-server' (host-level) schedule and execute an arbitrary supplied script as root via schedule.runManually. No public exploit identified at time of analysis; fixed in 0.29.13.

Privilege escalation to host root in Dokploy self-hosted PaaS versions prior to 0.29.13 allows any authenticated organization member to hijack WebSocket terminal and log-streaming handlers that authenticate the session but never check the role/permission model enforced elsewhere. Because these handlers can open an interactive shell into any container - including the Dokploy container that mounts the Docker socket - a low-privileged tenant can obtain root on the host and cross every tenant boundary. No public exploit identified at time of analysis, though the upstream fix commit and a regression test are public. The CVSS is 9.9 driven by scope change and full CIA impact.

Privilege escalation in Apache Ranger versions 2.8.0 and earlier allows an attacker to elevate their effective permissions by manipulating a URL parameter, undermining the very access-control layer Ranger is meant to enforce across Hadoop-ecosystem services. Apache rates it CVSS 9.8 with a network, low-complexity, no-privilege vector, though the 'privilege escalation' framing implies a pre-existing foothold that is worth verifying. There is no public exploit identified at time of analysis, and the EPSS score is low (0.19%, 9th percentile), indicating no observed mass-exploitation activity yet.

Incorrect default permissions in Samsung Bixby prior to version 4.0.86.0 allow a local attacker with low privileges to execute arbitrary commands within the Bixby process context. The flaw exists in the out-of-box permission configuration - no special user-triggered setup is required to be vulnerable. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the local privilege escalation to Bixby's execution context presents meaningful risk for shared-device and enterprise fleet environments.

Privilege escalation in the Vitepos WordPress point-of-sale plugin allows any user holding the custom Outlet Manager role to reset the password of any WordPress account - including site administrators - and achieve full account takeover. The flaw stems from a missing per-target authorization check in the password-reset API endpoint, combined with the plugin granting the Outlet Manager role overly broad reset capabilities by default. A publicly available proof-of-concept exists per WPScan, though EPSS remains low (0.13%, 3rd percentile), suggesting exploitation has not yet been observed at scale.

Unauthenticated account takeover in the FoodBoxBooker WordPress plugin (versions before 1.0.7) lets remote attackers reset the password of any user - administrators included - because the plugin fails to properly validate password-reset requests. Successful exploitation yields full administrative control and effective site takeover. Publicly available exploit code exists; the flaw is not listed in CISA KEV and EPSS is low (0.15%, 4th percentile), indicating no confirmed mass exploitation yet.

Local privilege escalation in Kingston FURY CTRL RGB Control Software 2.0.65.0 allows a low-privileged local user to gain full system-level access through the NTIOLib_KSFX.sys kernel driver component. The driver's privilege management is improperly implemented (CWE-269), enabling manipulation that elevates attacker control without requiring user interaction or elevated starting privileges. A public proof-of-concept exploit has been released via Google Drive, and the vendor did not respond to disclosure - meaning no patch exists and the exploit is freely usable against unmitigated systems.

Unauthenticated privilege escalation to full site takeover in the AI Copilot - Content Generator plugin for WordPress (all versions through 1.5.6) lets remote attackers create an administrator account by saving and executing a malicious workflow whose wp_create_user action node specifies role=administrator. The plugin's only authorization barrier is a waic-nonce that is publicly emitted into frontend JavaScript (WAIC_DATA.waicNonce) on any page rendering the [aiwu-form] shortcode or public chatbot, so the nonce check provides no real protection. Reported by Wordfence with CVSS 9.8; no public exploit identified at time of analysis, but exploitation is trivial once the shortcode or chatbot is on a public page.

Privilege escalation in the XML-RPC API of Plesk before 18.0.80 allows an authenticated reseller-level account to obtain a fully administrative session for the root user, effectively taking over the entire hosting server. The flaw is a CWE-269 improper privilege management issue reported through HackerOne; no public exploit has been identified at time of analysis and it is not listed in CISA KEV. Because a reseller can cross the privilege boundary to root with low attack complexity, this is a high-impact server-takeover vector in multi-tenant hosting environments.

Privilege escalation in Sonatype Nexus Repository 3 allows an authenticated user holding privilege-management rights to elevate their own access to full administrator by exploiting a type-confusion flaw (CWE-843) in the REST privilege update endpoint. Exploitation is constrained to specific role configurations, but the network-accessible attack surface and high confidentiality and integrity impact (VC:H/VI:H per the CVSS 4.0 vector) make this a meaningful insider or compromised-account risk in enterprise DevOps environments. A vendor-released patch is available in the Nexus Repository 3.95.0 release; no public exploit code or CISA KEV listing has been identified at time of analysis.

Remote code execution in Subscriptions for WooCommerce WordPress plugin (before 2.0.1) is reachable by any authenticated Shop Manager through a missing capability check on a nonce-protected AJAX action that installs and activates arbitrary plugins from user-supplied slugs. Shop Managers, who by WordPress design are not granted plugin management capabilities, can exploit this gap to install a malicious plugin and achieve full server-side code execution. A publicly available proof-of-concept exists; however, EPSS is low (0.18%, 8th percentile) and the vulnerability is absent from CISA KEV, indicating exploitation remains opportunistic rather than widespread.

Local privilege escalation in PowerISO 9.3.0.0 on Windows exposes low-privileged local users to full system compromise via the scdemu.sys kernel driver's improper privilege management (CWE-269). The exploit - publicly detailed as arbitrary registry write or deletion through the driver's IOCTL interface - allows elevation to SYSTEM-level control with high confidentiality, integrity, and availability impact on the vulnerable host. No vendor patch exists; the vendor did not respond to responsible disclosure, and a public proof-of-concept has been released, lowering the skill threshold for exploitation.

Local privilege escalation in udisks2 exploits insufficient polkit authorization on the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method, allowing a low-privileged user with an active console session to spoof the 'as-user' parameter and mount filesystems on behalf of arbitrary users, including root. The attack specifically leverages fstab entries carrying 'user' or 'users' mount options, which are common on desktop Linux installations, to bypass the authorization check entirely. A vendor-released patch exists in udisks 2.11.2; no public exploit code or CISA KEV listing has been identified at time of analysis.

Privilege escalation in OpenReception's appointment booking platform (versions prior to 1.0.2) lets any TENANT_ADMIN promote an account to platform-wide GLOBAL_ADMIN with a single PUT request to the staff role-update endpoint. Because no policy check enforces that only an existing GLOBAL_ADMIN may grant that role, schema validation alone acts as the authorization gate, and after re-login the attacker's JWT carries platform-wide control over every tenant. No public exploit identified at time of analysis, but the fix is a one-line authorization guard, making the flaw trivially reproducible for anyone reading the GHSA advisory or patch commit.

Privilege escalation in Google Chrome's Contextual Tasks feature (prior to 151.0.7922.109) allows a remote attacker to escalate privileges by luring a victim to a crafted HTML page that delivers insufficiently validated untrusted input. The vulnerability carries a CVSS 8.8 score, reflecting high confidentiality, integrity, and availability impact with no prior authentication required from the attacker. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the low attack complexity and Chrome's ubiquitous deployment surface make prompt patching a priority.

OS-level privilege escalation in Google Chrome's Windows CredentialProvider component allows a local attacker to gain elevated system privileges by winning a race condition triggered via a malicious file. Affected are all Chrome for Windows builds prior to 151.0.7922.109. No public exploit code has been identified and CISA has not added this to the Known Exploited Vulnerabilities catalog, but the SSVC assessment rates technical impact as total, meaning successful exploitation yields full system compromise.

Local privilege escalation in Sophos Endpoint for macOS (before 2026.1.1) and Sophos Home for macOS (before 10.11.6) allows any local user to execute arbitrary code with root privileges. The flaw stems from improper authorization (CWE-285) in the security agent's privileged components, so a low-privileged or unprivileged local account can fully compromise the host. No public exploit identified at time of analysis, but the CVSS 9.3 rating and scope change to root make this a high-priority patch for macOS fleets.

Privilege escalation in the Frontend Admin by DynamiApps WordPress plugin (versions up to and including 3.29.10) lets remote unauthenticated attackers elevate their privileges, per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H vector rated 9.8 Critical. The flaw (CWE-266, Incorrect Privilege Assignment) stems from the plugin's frontend user-management forms exposing role/capability assignment without proper authorization, enabling an attacker to gain administrator-level access to the WordPress site. No public exploit identified at time of analysis and the CVE is not on CISA KEV, but the CVSS profile indicates trivially weaponizable network-based abuse.

Privilege escalation in Order Delivery Date for WooCommerce (versions ≤ 4.6.0) allows authenticated shop managers to exceed their intended role boundaries and gain elevated administrative access to the WordPress installation. Exploitation requires an existing shop manager account, confirmed by the CVSS:3.1 PR:H metric, limiting the attack surface to environments where untrusted or compromised accounts hold that role. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Unauthenticated privilege escalation in the AIWU (AI Copilot Content Generator) WordPress plugin versions 1.5.6 and earlier allows remote attackers with no authentication to gain elevated privileges within the WordPress site. Reported by Patchstack and tracked as EUVD-2026-53963, the flaw carries a CVSS 9.8 rating driven by network-reachable, no-interaction exploitation with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Editor-level privilege escalation in the PublishPress Capabilities WordPress plugin (versions ≤ 2.45.0) enables authenticated users holding an Editor role to exceed their intended permission boundary and gain unauthorized elevated capabilities. The root cause is incorrect privilege assignment (CWE-266) within the plugin's capability management logic, and with a CVSS base score of 7.2 (High) reflecting high impact across confidentiality, integrity, and availability, the flaw is most dangerous on multi-tenant or agency WordPress sites where Editor accounts are distributed to semi-trusted users. No public exploit code or CISA KEV listing has been identified at time of analysis.

Privilege escalation in the Forminator WordPress plugin (≤1.56.0) allows authenticated Contributor-level users to elevate their privileges to a higher role, potentially achieving administrative control over the WordPress installation. The flaw, rooted in CWE-266 (Incorrect Privilege Assignment), carries a CVSS score of 8.8 and a full High C/I/A impact rating, indicating that successful exploitation can result in complete compromise of confidentiality, integrity, and availability of the affected site. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-privilege entry bar and network accessibility make this an elevated priority for WordPress deployments using this plugin.

Privilege escalation in the Kadence WooCommerce Email Designer WordPress plugin (all versions up to and including 1.5.19) lets unauthenticated remote attackers gain elevated privileges due to a missing authorization check (CWE-862). Reported by Patchstack and tracked as EUVD-2026-53939, the flaw carries a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) rating, so no login or user interaction is required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is not confirmed in the wild.

Privilege escalation in WSO2 API Manager and related Carbon-based products allows a low-privileged user, using a validly issued token, to invoke product-level Admin REST APIs that should be restricted, potentially resulting in full administrative account takeover. The flaw stems from insufficient scope/privilege restriction on issued tokens (CWE-269) and affects API Manager, API Control Plane, Universal Gateway, Traffic Manager, and the Carbon REST API common/utility components. No public exploit identified at time of analysis; exploitation requires the attacker to already hold a low-privileged account and obtain a token for it.

Local privilege escalation in the NI-PAL kernel driver allows a low-privileged authenticated Windows user to escalate to SYSTEM-level and execute arbitrary code, as confirmed by the NI vendor advisory. Affected deployments include NI-PAL versions 26.3.1 and all prior releases running exclusively on Microsoft Windows. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog, but the low access complexity (AC:L, AT:N in CVSS 4.0) means exploitation requires no special conditions beyond a local user session.

Privilege escalation in Progress MarkLogic Server (versions before 11.3.6 and 12.0.3) lets an authenticated user holding only a low-privileged Hadoop integration role break out of that role and perform privileged operations against the internal Security database, effectively enabling full control over authentication and authorization data. Rated CVSS 9.9 with a changed scope, the flaw turns a minimal Hadoop-connector account into an administrative foothold. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Privilege escalation in Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user holding only a low-privileged REST role to abuse the REST API document patch operation, gaining the ability to run privileged operations against the internal Security database and effectively take over authorization data. Rated CVSS 9.9 with a changed scope, it is exploitable by any low-privileged REST account over the network. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and minimal privilege requirement make it a high-priority patch.

Privilege escalation in Progress MarkLogic Server before 11.3.6 and 12.0.3 lets an authenticated user holding only a low-privileged REST role elevate to administrator through the SQL, SPARQL, and Optic REST query interfaces, after which they can run privileged operations and read data they were never authorized to see. The flaw is remotely reachable and requires only valid low-tier credentials, driving a critical 9.9 CVSS score. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Privilege escalation in Progress MarkLogic Server's REST API document processing pipeline allows an authenticated user holding an administrative REST role to elevate their access to a higher privilege level, resulting in unauthorized disclosure of sensitive server-side data. Affected versions span both the 11.x and 12.x release trains, patched in 11.3.6 and 12.0.3 respectively per the vendor's August 2026 critical security bulletin. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, though the scope change (S:C) and high confidentiality and integrity impact in the CVSS vector underscore meaningful post-exploitation consequence within the MarkLogic environment.

Privilege escalation in Google SecOps (Chronicle SOAR) versions prior to 6.3.85 on Google Cloud Platform allows an authenticated attacker to forge a crafted internal authentication header and elevate from a low-privileged account to system-level administrative access. The flaw stems from improper validation of the origin/trust of an internal auth header (CWE-346), and carries a critical CVSS 4.0 base score of 9.4 driven by high confidentiality, integrity, and availability impact plus a scope change onto subsequent systems. There is no public exploit identified at time of analysis; Google patched the cloud-hosted service transparently and states no customer action is needed.

Privilege escalation in CCleaner's Uninstaller component on Windows allows a local low-privileged attacker to gain SYSTEM-level access by planting an NTFS symlink or directory junction before or during application uninstallation. The uninstaller executes file deletion with elevated (SYSTEM) integrity and follows the attacker-controlled link without validation, redirecting destructive operations to arbitrary system paths. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; Gen Digital has released a fix in CCleaner 7.10.1464.

Privilege escalation in Rancher's authorization (SAR) impersonation middleware lets an authenticated user holding only the default 'user' global role forge Impersonate-User and Impersonate-Group HTTP headers (e.g. impersonating cluster-admin or the system:masters group) to obtain full administrative control of the Rancher control plane and, transitively, every downstream cluster it manages. The flaw stems from the middleware trusting client-supplied impersonation headers instead of the authenticated identity in the request context. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the upstream fix in rancher/rancher PR #55983 and advisory GHSA-v584-7w32-jwpq confirm the root cause and remediation.

Privilege escalation to cluster-admin in Red Hat Advanced Cluster Management for Kubernetes (ACM) lets a user holding only namespace-scoped 'edit' rights on an ACM hub namespace take over the entire cluster. By creating a Channel pointing to an attacker-controlled Helm repository and a Subscription referencing it, the app-subscription controller (multicluster-operators-subscription) applies the chart with its own elevated authority and without enforcing the subscription-admin role or namespace confinement, letting the chart install cluster-scoped objects such as a ClusterRoleBinding to cluster-admin. No public exploit identified at time of analysis, and EPSS is low (0.25%), but the technical impact is total and the flaw directly contradicts ACM's documented namespace-confinement guarantee.

Privilege escalation in Red Hat's Multicluster Engine (MCE) for Kubernetes ClusterCurator controller allows a namespace-scoped tenant administrator to obtain cluster-wide administrative control. By creating a namespaced ClusterCurator resource, the tenant can cause the controller to mint an authentication token for a ServiceAccount holding cluster-admin authority, breaking tenant isolation. Rated CVSS 9.1 (scope-changed) by Red Hat; no public exploit identified at time of analysis and not listed in CISA KEV.

Privilege escalation in the Smart Popup by Supsystic WordPress plugin (all versions through 1.12.0) enables unauthenticated remote attackers to create persistent WordPress Administrator accounts with attacker-controlled credentials. Three compounding flaws are chained: a PHP `array_merge()` collision silently removes the `save` action from the popup module's permission blocklist, the subscription confirmation email leaks a reusable `pps_nonce` that the `wp_ajax_nopriv_save` endpoint accepts, and `createWpSubscriber()` applies no server-side role allowlist - allowing an attacker to freely set `params[tpl][sub_wp_create_user_role]=administrator`. No public exploit or CISA KEV listing is confirmed at time of analysis, but the attack chain is fully described in the CVE and the low complexity makes independent weaponization likely.

Privilege escalation in Dokan (WordPress multivendor marketplace plugin) versions up to and including 5.0.1 enables any authenticated vendor or seller to read, modify, or delete any WordPress user account - including site administrators - via REST API calls to `/wp-json/dokan/v1/customers/{id}`. The plugin's `CustomersController` re-registers WooCommerce's customer CRUD routes but replaces the native `manage_woocommerce` capability gate with a flawed check that inspects only the requesting user's role and never validates authorization against the target user. Setting the `password` parameter on an administrator's record via a PUT request yields full site takeover. No public exploit identified at time of analysis, though the attack is mechanically trivial for any Vendor-role account holder.

Missing authorization middleware on the PUT /api/v1/executions/:id endpoint in Flowise prior to 3.1.3 allows any authenticated workspace member, regardless of assigned RBAC role, to overwrite execution state, data, and metadata for any workflow execution in their workspace. The flaw is a straightforward RBAC enforcement gap - the checkAnyPermission() middleware present on all sibling GET and DELETE routes was omitted from the PUT handler - making privilege escalation trivially reproducible with a single authenticated API call. No confirmed active exploitation (not in CISA KEV), but a working proof-of-concept curl command is published in the vendor's GitHub security advisory, and a vendor-released patch is available in version 3.1.3.

Privilege escalation in the Android kernel VPU (Video Processing Unit) driver stems from a use-after-free in vpu_ioctl.c, allowing an attacker to elevate to kernel-level privileges without any additional execution privileges or user interaction. It affects Google Android devices (per the Pixel security bulletin for 2026-08-01), and Android's advisory states no user interaction is required; SSVC rates the technical impact as total and the flaw as automatable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the total-impact, no-interaction profile makes it a high-priority patch target.

Veeam ONE's Reporter service exposes an improper privilege management flaw (CWE-269) that enables a locally authenticated, high-privileged user to escalate into the Reporter service's security context, achieving full confidentiality, integrity, and availability impact on the vulnerable system. All versions of the product appear affected per the wildcard CPE string, and the vulnerability was responsibly disclosed via HackerOne. No public exploit code or active exploitation has been identified at time of analysis.

Privilege escalation in Liman MYS (HAVELSAN Inc.) versions 2.2.3 through pre-2.3.1 enables authenticated low-privilege users to gain administrator-level access via missing server-side authorization checks (CWE-862). The platform, a centralized Linux server management system used primarily in Turkish government and enterprise environments, fails to verify whether the requesting user has rights to perform privileged operations before executing them. No public exploit identified at time of analysis, but the CVSS 8.8 score with network vector and low privilege requirement makes this a high-priority patch target for any organization running the affected versions.

ASUSTOR Backup Plan (ABP) and EZSync (AES) background services run as NT AUTHORITY\SYSTEM and expose a file-based IPC channel whose AES encryption key is readable by standard users and recoverable via Windows DPAPI, allowing any authenticated local account to forge valid service requests. The services further fail to verify the identity of the requesting process and validate filesystem paths using an insufficient substring check, enabling directory traversal sequences to bypass path restrictions. A local attacker can chain these weaknesses to perform arbitrary file reads and writes as SYSTEM, achieving full local privilege escalation. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Privilege escalation in Adobe Campaign Classic (ACC) stems from an incorrect authorization flaw (CWE-863) that lets an attacker gain elevated privileges without any user interaction. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scores it 9.8 Critical, implying a network-reachable, low-complexity path to full compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so exploitation is currently theoretical based on the vendor advisory.

Server-Side Request Forgery in Adobe Campaign Classic (ACC) enables remote attackers to coerce the server into issuing crafted internal requests, resulting in privilege escalation without any user interaction. Adobe rates the flaw at the maximum CVSS 10.0 with a changed scope, indicating the SSRF pivots beyond the vulnerable component to compromise other systems or trust boundaries. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated, network-reachable nature makes it a top-priority patch.

Privilege escalation in Razer RzUpdateService 1.10.14.0 allows a local low-privileged user to gain SYSTEM-level access by manipulating the lpThreadParameter argument processed by the service's Named Pipe Handler. The service, which runs at elevated Windows privilege, fails to enforce proper privilege boundaries when handling named pipe input (CWE-269), enabling a local user to leverage the service's execution context against the underlying system. A public proof-of-concept is confirmed available; the vulnerability is not currently listed in CISA KEV, though the low attack complexity combined with the published POC elevates real-world risk in environments with Razer hardware deployed.

Authentication and authorization bypass in @fastify/aws-lambda 6.4.0 lets an unauthenticated remote attacker forge the entire AWS Lambda proxy event by setting a single client-controlled HTTP header. Because the request.awsLambda.event/context decoration reads the untrusted x-apigateway-event and x-apigateway-context headers before falling back to the trusted internal invocation token, any application that consults these values for identity or API Gateway authorizer claims can be tricked into granting attacker-chosen access, enabling full privilege escalation. Rated CVSS 9.1; no public exploit identified at time of analysis, but the attack is trivial and documented in the vendor advisory.

Privilege escalation in Telenia Software TVox allows any process running as the apache OS user to obtain full root-level command execution without a password, by exploiting a misconfigured vendor-supplied sudoers entry in /etc/sudoers.d/telenia that grants NOPASSWD execution of /bin/nice. Affected branches are 26.x up to and including 26.5.3, and 24.x up to and including 24.9.21. A public exploit is available via KarmaInsecurity advisory KIS-2026-16; no CISA KEV listing has been confirmed, though the trivial exploitation complexity and available proof-of-concept materially elevate real-world risk for any environment where the TVox web tier is reachable.

Incorrect default permissions in Synology Assistant before version 7.0.7-50095 expose locally created installation artifacts to unauthorized access, enabling low-privileged local users to read or write arbitrary files and trigger denial-of-service conditions during the installation window. The CVSS score of 7.3 (High) with C:H/I:H/A:H reflects the breadth of potential file system impact, though an EPSS of 0.13% (3rd percentile) and SSVC exploitation status of 'none' confirm no public exploitation activity at time of analysis. A vendor-released patch exists at version 7.0.7-50095, and no public exploit code has been identified.

Privilege escalation in the "Import and export users and customers" WordPress plugin before 2.4.2 lets a user who holds only the user-creation capability create a full administrator account and overwrite an existing administrator's password or email via the CSV import routine. The plugin fails to re-check WordPress role-assignment and per-user edit permissions on imported rows, so a low-tier account can seize total control of the site. Publicly available exploit code exists (reported by WPScan) and a vendor patch is available; EPSS is low (0.13%), indicating limited widescale exploitation so far despite the high CVSS of 9.1.

Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT7921, MT7922, MT7925, MT7927) due to a missing permission check (CWE-862) that allows a standard user-level process to invoke restricted driver operations. An attacker with low-privilege local access can fully compromise confidentiality, integrity, and availability of the affected system without any user interaction. No public exploit identified at time of analysis; EPSS at 0.15% (5th percentile) and SSVC exploitation status of 'none' confirm negligible current exploitation activity.

Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of its declared Android permissions - to invoke protected telephony operations by exploiting a missing authorization check (CWE-862). The flaw affects 35 MediaTek chipsets spanning the Helio and Dimensity families and yields high confidentiality and integrity impact over telephony functions such as call management and SMS routing. No public exploit has been identified and EPSS of 0.15% (5th percentile) indicates negligible current exploitation activity, though the zero-privilege-required nature of local exploitation lowers the attacker bar once device access is established.

Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges without credentials or user interaction on chipsets MT7986, MT7916, MT7915, MT7981, and MT6890. The missing bounds check in the driver's AP-mode frame processing allows memory corruption that yields high confidentiality and integrity impact on the affected device. No public exploit has been identified and EPSS remains very low at 0.17%, though SSVC rates technical impact as total - underscoring the severity if a capable, range-proximate attacker develops working exploit code.

Privilege escalation in ArcadeDB before 26.7.3 allows any user holding UPDATE_SCHEMA permission to create server-wide administrator accounts by crafting malicious JavaScript triggers. The root cause is that the real LocalDatabase object is bound into trigger execution contexts with GraalVM's HostAccess.ALL policy, exposing the full Java security API - including getSecurity().createUser() - without permission checks. No public exploit has been identified at time of analysis, but a vendor-released patch is available in 26.7.3 per the GitHub security advisory GHSA-38pf-6hp2-pxww.

Unauthenticated administrator account creation in the POUCO Import Users WordPress plugin (versions through 1.0.0) lets remote attackers register a fully privileged admin user and take over the site. The plugin exposes AJAX actions for account creation/update without capability or nonce checks and blindly trusts an attacker-supplied role value, so any visitor can escalate to administrator. Publicly available exploit code exists (reported by WPScan), though the EPSS score is low (0.15%, 5th percentile) and it is not on the CISA KEV list.

Privilege escalation in the Pronamic Pay WordPress plugin (all versions ≤10.1.0) enables authenticated Subscriber-level users to self-escalate to Administrator by submitting a tampered Gravity Forms field value that is passed unvalidated into WordPress's `WP_User::set_role()`. The flaw is in `maybe_update_user_role()` within the plugin's Gravity Forms extension, which performs no allowlist check, capability comparison, or permission verification before applying the attacker-supplied role string. Exploitation is gated on a specific administrator-configured Gravity Forms payment feed setup, but once that configuration exists, a low-privilege user can achieve full WordPress site compromise. No public exploit or CISA KEV listing confirmed at time of analysis; a patch was released in version 10.2.0.

Session hijacking in the User Profile Builder WordPress plugin (versions before 3.16.4) allows unauthenticated attackers to obtain an authenticated session for any arbitrary existing user - including site administrators - by exploiting improper account binding in the post-registration auto-login flow. Exploitation is constrained to sites running a supported but non-default plugin configuration, which explains the AC:H in the CVSS vector and the SSVC 'Automatable: no' designation despite total technical impact. A publicly available proof-of-concept exists per WPScan, though EPSS of 0.14% (4th percentile) and SSVC 'Exploitation: none' indicate no confirmed widespread exploitation at time of analysis.

Privilege escalation in the Subscriptions for WooCommerce WordPress plugin (versions up to and including 2.0.0) allows authenticated Contributors to elevate their accounts to Administrator by poisoning a membership plan's stored role meta. The `save_meta_boxes()` function accepts the `_wps_plan_user_role` POST parameter with no server-side allowlist blocking privileged roles; the only guards applied - `sanitize_key()` and `wp_roles()->is_role()` - both pass 'administrator' as valid. Full exploitation requires the companion Pro plugin to be active, as it is the component that reads the stored meta and calls `add_role()` during membership lifecycle events. No public exploit has been identified at time of analysis, though Wordfence has published full technical detail and the vulnerable source lines are publicly browsable.

Sensitive-credential disclosure leading to full node compromise in Pterodactyl Wings before v1.12.3 lets a low-privileged, authenticated panel user (a server owner or a subuser holding startup.update) smuggle a {{config.*}} placeholder through a user-editable egg variable, causing Wings to resolve it against its entire daemon configuration and write secrets - including the node daemon token, token_id, and Docker registry credentials - into a file the user can read via the file manager or SFTP. Because the daemon token is both the Panel⇆Wings API bearer and the HMAC signing key for every JWT the node issues, an attacker can then forge tokens and act against every server on the node. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS is 9.9 and the affected templating pattern is common across stock and community eggs.

Privilege escalation to WordPress administrator in Ultimate Member plugin before 2.12.1 permits unauthenticated registrants to self-assign a site-defined role carrying full administrator capabilities, resulting in complete site takeover. The plugin omits administrator-level roles from its registration form role-filter and ships with its post-registration elevation safeguard disabled by default, creating a two-layered failure that exposes affected sites when a custom admin-capable role exists alongside a role-selection field on a live registration form. A publicly available proof-of-concept is confirmed via WPScan; no public exploit identified at time of analysis as actively exploited (not in CISA KEV), and EPSS sits at 0.14%, reflecting the dependency on specific site configuration.

Sensitive information disclosure in the Demi WordPress plugin before 0.0.7 lets unauthenticated attackers retrieve full-site backup archives that the plugin writes to a publicly reachable path under a predictable filename with no access control. Because these archives contain the complete site database - including WordPress user password hashes - an attacker can crack or replay credentials to escalate toward administrative takeover. A public exploit exists (WPScan) and a fixed release (0.0.7) is available; EPSS was not supplied but the CVSS is 7.5 (High) and it is not on CISA KEV.

Privilege escalation in FeehiCMS v.2.1.1 exploits insufficient session expiration (CWE-613) across the session management module, authentication logic, and logout handler, allowing a network-based attacker to reuse captured session tokens even after legitimate user logout to gain elevated access. The CVSS 3.1 score of 7.4 (High) reflects high confidentiality and integrity impact under high attack complexity, with no authentication required on the attacker's side. A public proof-of-concept write-up exists on GitHub; however, EPSS sits at 0.20% (10th percentile) and no CISA KEV listing exists, suggesting limited observed exploitation despite available exploit documentation.

Confidential Active Directory attribute disclosure in Samba's Active Directory Domain Controller allows an authenticated low-privilege domain user to read protected directory attributes by abusing how LDAP Compare requests are handled. Because Samba fails to validate user-supplied attribute names (LDAP filter injection, CWE-90) and runs the resulting internal search in a trusted context, normal ACL enforcement is bypassed; in gMSA-enabled deployments this permits extraction of msKds-RootKeyData and offline derivation of Group Managed Service Account passwords, which can escalate to full domain compromise. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but a vendor patch is available.

Cross-site request forgery in IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 enables server-side request forgery with elevated privileges when the collectiveController-1.0 feature is active. An attacker who lures an authenticated Liberty administrator to a malicious web page can trigger forged requests that the server executes with the victim's elevated privileges, allowing the attacker to reach internal services ordinarily inaccessible from the network perimeter. No public exploit code exists and no confirmed active exploitation is recorded, though the SSVC framework rates the technical impact as total should exploitation occur.

Local privilege escalation in Phoenix Contact CHARX SEC EV charging controllers (SEC-3000/3050/3100/3150, versions 1.0.0 up to 1.9.1) allows a low-privileged local user to execute arbitrary commands as root through a vulnerable init-script for user-applications, yielding full system compromise. Reported by CERT@VDE and classified as OS command injection (CWE-78), the flaw carries a CVSS 4.0 base score of 8.5 (local vector, low privileges required). A vendor patch (1.9.1) is available; no public exploit identified at time of analysis.

Privilege escalation in Phoenix Contact CHARX SEC electric-vehicle charging controllers (SEC-3000/3050/3100/3150, versions 1.0.0 up to but excluding 1.9.1) lets a low-privileged local user inject and run arbitrary OS commands as root through the device's system configuration handling, yielding full compromise of the charging controller. The flaw is a CWE-78 OS command injection reported by CERT@VDE (advisory VDE-2026-008), and a vendor patch is available in version 1.9.1. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Local privilege escalation in the Phoenix Contact CHARX SEC EV charging controllers (SEC-3000/3050/3100/3150, firmware 1.0.0 through 1.9.0) lets the low-privileged local account 'charx-web' inject and run arbitrary OS commands as root via the udhcpc DHCP client, yielding full device takeover. The flaw is a CWE-78 OS command injection reported by CERT@VDE, and a vendor patch (1.9.1) is available. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Local privilege escalation in Phoenix Contact CHARX SEC-3000/3050/3100/3150 EV charging controllers (firmware 1.0.0 through versions before 1.9.1) lets a low-privileged local user inject OS commands through a network-configuration script and gain root, yielding full device compromise. The flaw is a classic CWE-78 command injection reachable by any authenticated local account (CVSS 4.0 8.5). No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Local privilege escalation in Phoenix Contact CHARX SEC electric-vehicle charging controllers (SEC-3000/3050/3100/3150, versions 1.0.0 through 1.9.0) lets a low-privileged local user inject OS commands via the user-application init-script and execute them as root, yielding full device compromise. The flaw was reported by CERT@VDE and is fixed in firmware 1.9.1; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV. EPSS data was not provided, so widespread automated exploitation cannot be confirmed.

Privilege escalation in the ProfileGrid WordPress plugin before 5.9.9.8 lets unauthenticated visitors self-register into any group through the front-end registration form, inheriting that group's configured WordPress role - up to Administrator where such a group exists. Publicly available exploit code exists (published by WPScan) and a vendor patch is available, though EPSS remains low at 0.15% (4th percentile), indicating limited observed exploitation attempts to date.

Local privilege escalation in the Google Chrome Updater on Windows (versions prior to 151.0.7922.72) lets a low-privileged local attacker win a race condition and substitute a malicious file to elevate privileges. The flaw carries a CVSS 7.0 score, and while Chromium rates its security severity as Low, the SSVC technical impact is Total. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Remote code execution within the browser's renderer sandbox affects Google Chrome desktop builds prior to 151.0.7922.72, stemming from an inappropriate implementation in the Passwords component (CWE-269). A remote attacker who lures a victim to a crafted HTML page can execute arbitrary code, but execution is confined to the sandbox - which is why Chromium rated the underlying issue Low severity despite the CVSS 8.8. No public exploit identified at time of analysis, and the fix is already shipping in the Stable channel.

Sandboxed remote code execution in Google Chrome desktop before 151.0.7922.72 lets a remote attacker run arbitrary code within the renderer sandbox when a victim opens a crafted HTML page. The flaw stems from an inappropriate implementation in Chrome's Scheduling component; Google rated it Chromium-Low severity and no public exploit has been identified, though the NVD CVSS of 8.8 reflects the high per-system impact once triggered. Exploitation requires user interaction (visiting a malicious page) and, because code executes inside the sandbox rather than escaping it, real-world impact is constrained absent a chained sandbox-escape bug.

Sandbox-constrained arbitrary code execution in Google Chrome's V8 JavaScript engine affects all desktop builds prior to 151.0.7922.72, where a crafted Chrome extension abuses an inappropriate V8 implementation to run attacker code inside the renderer sandbox. Exploitation requires convincing a user to install a malicious extension, and Google internally rated the Chromium security severity as Low. There is no public exploit identified at time of analysis and CISA SSVC records exploitation status as 'none'.

Remote code execution in Google Chrome on macOS prior to 151.0.7922.72 stems from an inappropriate implementation in the Safe Browsing component, where a remote attacker can trigger arbitrary code execution by luring a victim into opening or downloading a malicious file. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) requires no privileges but does require user interaction, and Google has shipped a fixed Stable channel build. Despite the 8.8 CVSS, Chromium rated the underlying issue Low severity, EPSS is only 0.20% (10th percentile), and there is no public exploit identified at time of analysis.

Privilege escalation in Google Chrome's Extensions component before 151.0.7922.72 lets an attacker who has already compromised the renderer process break out of that sandbox context by serving a crafted HTML page. Chromium rated the underlying issue Low severity, and there is no public exploit identified at time of analysis, though the fix ships in the July 2026 Stable channel desktop update. The bug stems from insufficient validation of untrusted input (CWE-20) crossing the extensions trust boundary.

Privilege escalation in Google Chrome desktop versions prior to 151.0.7922.72 allows a remote attacker who has already compromised the renderer process to escape its intended privilege boundary through insufficient policy enforcement in the Settings component, using a crafted HTML page. Chromium rated the security severity as Low, and there is no public exploit identified at time of analysis. The vulnerability is a second-stage flaw: it presumes a prior renderer compromise, so it is not directly exploitable against a fully intact browser.

Privilege escalation in Google Chrome's DevTools component (all desktop builds prior to 151.0.7922.72) lets a malicious browser extension bypass DevTools policy enforcement to gain capabilities beyond its declared permissions. Exploitation is not remote-in-a-vacuum: an attacker must first convince a victim to install a crafted extension, after which the flaw escalates that extension's effective privileges within the browser. Google fixed the issue in the stable channel and rated the Chromium security severity as Low; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Local OS-level privilege escalation in Google Chrome on Linux before 151.0.7922.72 stems from an inappropriate implementation in the Chromoting (Chrome Remote Desktop) component, letting a local attacker leverage malicious network traffic to gain elevated OS privileges. Rated CVSS 8.4 (Chromium severity Medium), the flaw carries total technical impact but no public exploit identified at time of analysis and a low EPSS of 0.11% (2nd percentile), indicating minimal current exploitation pressure. A vendor patch is available and no active exploitation has been reported.

Privilege escalation in Google Chrome's USB subsystem prior to 151.0.7922.72 allows a remote attacker who lures a victim to a crafted HTML page to escalate privileges within the browser through insufficient policy enforcement. Google rates the Chromium security severity as Medium, though the associated CVSS 3.1 score of 8.8 reflects high confidentiality, integrity, and availability impact contingent on user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Google confirms a fixed build is available.

Local OS-level privilege escalation in Google Chrome's Updater component on macOS versions prior to 151.0.7922.72 allows a local attacker to elevate privileges by planting a malicious file that the Updater processes with higher rights. The flaw stems from improper privilege management (CWE-269) in the auto-update workflow, requires local access plus user interaction, and carries a CVSS 7.8 (High) rating; no public exploit has been identified at time of analysis. Rated Medium severity by Chromium's own security team despite the High CVSS.

Local privilege escalation in Google Chrome on Windows prior to 151.0.7922.72 lets a local attacker gain elevated privileges through a malicious file that the victim opens or that Chrome processes, stemming from an inappropriate implementation in the Browser process. Google rates the Chromium security severity as Medium, while the NVD-style CVSS of 7.8 reflects high confidentiality, integrity, and availability impact once triggered. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor has shipped a fix.

Local privilege escalation in Google Chrome for Windows before 151.0.7922.72 stems from a use-after-free in the Tracing component (CWE-416), letting a local attacker who lures a user into opening a malicious file execute code that escalates to OS-level privileges. Chromium rates the security severity as Medium, but the assigned CVSS 3.1 score is 7.8 (High) reflecting full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though a vendor patch is available.

Local privilege escalation in Google Chrome's Updater component allows a local attacker who can plant a malicious file to gain OS-level privileges once the update process acts on it. The flaw stems from insufficient validation of untrusted input (CWE-20) and affects all Chrome desktop builds prior to 151.0.7922.72; Google rates the Chromium security severity as Medium while the CVSS base score is 7.8 (High). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Privilege escalation in Google Chrome on Android before 151.0.7922.72 lets a remote attacker who has already compromised the renderer process escape further via insufficient policy enforcement in the Speech component and a crafted HTML page. Rated Medium by Chromium but scored CVSS 7.5, it enables a second-stage sandbox/privilege boundary bypass rather than initial access. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Privilege escalation in Google Chrome's DevTools component (versions prior to 151.0.7922.72) lets an attacker who convinces a user to install a malicious extension escape the normal extension privilege boundary via a crafted Chrome Extension. Rooted in insufficient validation of untrusted input (CWE-20), the flaw carries a CVSS 8.8 rating reflecting high confidentiality, integrity, and availability impact once the extension is installed. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Chrome's ubiquity makes patch urgency high.

Sandboxed arbitrary code execution in Google Chrome's AdFilter component (versions prior to 151.0.7922.72 on desktop) allows a remote attacker to run code inside the renderer sandbox by luring a victim to a crafted HTML page. Rated Medium by Chromium and CVSS 8.8 by NVD, the flaw requires user interaction (visiting a malicious site) but no authentication; execution is confined to the sandbox rather than achieving full host compromise. There is no public exploit identified at time of analysis, and EPSS is low at 0.26% (17th percentile).