Privilege Escalation

Sandboxed arbitrary code execution in Google Chrome's AdFilter component (versions prior to 151.0.7922.72 on desktop) allows a remote attacker to run code inside the renderer sandbox by luring a victim to a crafted HTML page. Rated Medium by Chromium and CVSS 8.8 by NVD, the flaw requires user interaction (visiting a malicious site) but no authentication; execution is confined to the sandbox rather than achieving full host compromise. There is no public exploit identified at time of analysis, and EPSS is low at 0.26% (17th percentile).

Sandbox escape in Google Chrome on Linux before 151.0.7922.72 lets a remote attacker break out of the renderer sandbox when a victim opens a crafted HTML page, abusing an inappropriate implementation in the File Input component (CWE-269, improper privilege management). Rated Medium by Chromium and scored CVSS 7.1 with a scope change, it requires user interaction (visiting a malicious page) but no authentication; there is no public exploit identified and EPSS exploitation probability is low at 0.21% (11th percentile).

Privilege escalation in Google Chrome's Updater component on macOS (versions before 151.0.7922.72) stems from a use-after-free (CWE-416) that a local attacker can trigger via malicious network traffic, letting them execute code in the context of the privileged updater process. Google rated the Chromium severity as High and has shipped a fixed stable-channel build; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.18%, 7th percentile). CISA's SSVC framework records no observed exploitation and marks the flaw as not automatable but with total technical impact.

Local OS-level privilege escalation in Google Chrome's Updater on macOS (versions prior to 151.0.7922.72) allows a local attacker who can plant a malicious file to exploit a race condition and elevate privileges on the host. Google rated the underlying Chromium bug Critical, though the CVSS base score is 7.8 (High) reflecting the local attack vector and required user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the Critical Chromium rating signals a high-quality, security-relevant defect.

Heap-based buffer overflow in schreibfaul1's ESP32-audioI2S library version 3.4.5 lets an attacker who controls audio stream metadata corrupt heap memory through the latinToUTF8() character-encoding routine, with SSVC rating the technical impact as total (potential code execution, information disclosure, DoS or privilege escalation). The flaw is demonstrated by publicly available exploit code but is not listed in CISA KEV, so it reflects a POC-stage issue rather than confirmed active exploitation. The library is a widely-used hobbyist Arduino/ESP32 audio component, so exposure is concentrated in embedded maker and IoT projects rather than enterprise fleets.

Privilege escalation in DriveLock via SQL injection lets authenticated remote attackers reach resources normally protected from their account. The flaw lives in the DriveLock web service listening on TCP port 4568 by default, where a user-supplied string is concatenated into a SQL query without proper validation (CWE-89), and it carries a CVSS 8.8. There is no public exploit identified at time of analysis and it is not on CISA KEV, though it was discovered and coordinated through the Zero Day Initiative (ZDI-CAN-28726 / ZDI-26-286).

Local privilege escalation in MSI Center's bundled NTIOLib_X64.sys kernel driver lets a low-privileged user execute arbitrary code as SYSTEM by issuing commands the driver fails to properly authenticate. The flaw (ZDI-CAN-28935 / ZDI-26-430) stems from the driver not validating the origin of incoming commands, so any local process can drive its privileged I/O primitives. There is no public exploit identified at time of analysis and it is not on CISA KEV, but ZDI's disclosure and the NTIOLib family's history of abuse make weaponization plausible.

Local privilege escalation in G DATA Total Security lets a low-privileged user abuse the Backup Service to delete an arbitrary file via a symbolic link (CWE-59 link following), which can be leveraged to run arbitrary code as NT AUTHORITY\SYSTEM. Discovered and reported through the Zero Day Initiative (ZDI-26-432, ZDI-CAN-28665); there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The vendor-assigned CVSS 3.0 base score is 7.8 (High), reflecting full SYSTEM-level compromise achievable by any authenticated local user.

Privilege escalation in the balbooa Gridbox extension for Joomla (versions before 2.20.2) lets unauthenticated actors self-register accounts while supplying arbitrary Joomla usergroup IDs, so an attacker can create an account placed directly into an administrative usergroup. Because the registration handler trusts client-supplied group assignments, exploitation grants full site takeover with no prior credentials. No public exploit has been identified at time of analysis, but the trivial network-based nature makes it high priority.

Unauthenticated remote code execution in the Streamit WordPress theme (versions up to and including 4.5.0) stems from a missing-authorization AJAX endpoint that invokes an attacker-supplied PHP function with attacker-supplied arguments, letting unauthenticated attackers create administrator accounts and run arbitrary code. Reported by WPScan and tracked as EUVD-2026-50115, it carries a CVSS 9.8 and publicly available exploit code exists, though there is no public exploit identified as being used in active attacks at time of analysis.

Privilege escalation in the Wholesale for WooCommerce WordPress plugin (all versions up to and including 2.0.5) lets any authenticated author-level user promote their own account to administrator, giving full control of the WordPress site. The save_requests_meta() handler runs the user_role_set POST parameter through only sanitize_text_field() and hands it straight to WP_User::add_role() with no allowlist of permitted wholesale roles and no current_user_can('promote_users') or manage_options check, while the request_user_role_nonce that gates the call is reachable by any author who has authored a wwp_requests post (obtainable through the plugin's own wholesale registration form). No public exploit identified at time of analysis - EPSS is 0.37% (29th percentile) and CISA SSVC records exploitation as 'none' - but the assessed technical impact is total once the low-privilege foothold requirement is satisfied, and the CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H is faithfully reflected here.

Unauthenticated administrative access in IBM WebSphere Application Server 9.0 and 8.5 due to broken access control allows remote attackers to gain full control of the server. The vulnerability resides in the administrative console and requires no credentials or user interaction, leading to complete confidentiality, integrity, and availability impact. No public exploit code is known, but a vendor patch is available to remediate this critical risk.

Privilege escalation in the WP Password Policy plugin for WordPress up to version 3.7.1 allows authenticated attackers with subscriber-level access to escalate to Administrator by submitting a crafted POST request to the password-reset form endpoint. The vulnerability results from missing authorization checks and nonce verification in the `get_user()` function of the `Module_Password_Hint` class, which unconditionally calls `set_role()` with an attacker-supplied role. At time of analysis, no active exploitation or public exploit code was identified.

Privilege escalation in CRIU allows a malicious container process to spoof credentials during checkpoint, resulting in elevated capabilities upon restore. On Red Hat platforms, effective exploitation is mitigated by mandatory access controls, user namespaces, and the requirement for privileged checkpoint initiation. No public exploit identified at time of analysis.

Privilege escalation in Adobe Bridge allows unauthorized read and write access via a malicious file opened by a victim. Affected versions up to 15.1.6 and 16.0.5 are susceptible. Exploitation requires user interaction; a scope change can impact other system components, though no public exploit or active exploitation has been identified at time of analysis.

Privilege escalation in pglogical allows a publisher to execute functions as superuser on the subscriber by exploiting default expression evaluation during replication of rows with missing columns. This affects deployments where non-superuser roles are permitted to create subscriptions, such as managed PostgreSQL services. No public exploit is known, and the path is distinct from CVE-2026-50736.

Privilege escalation in Pterodactyl Wings allows authenticated subusers to upload arbitrary files without the required file.create permission by reusing lower-privilege panel-signed JWTs (e.g., from websocket authentication or file downloads). A public proof-of-concept demonstrates how a subuser with only websocket.connect can upload files to the server, potentially compromising its container. Patches introduce JWT scoping in Panel 1.12.3 and Wings 1.12.2.

Silent traffic redirection in Appium Java Client 8.2.1 to 10.1.0 allows an unauthenticated rogue Appium server to redirect all session commands to an attacker-controlled endpoint when directConnect is enabled. The client does not validate the destination host, enabling network pivoting and credential theft. Publicly available exploit code exists, and a vendor-released patch (version 10.1.1) is available.

Privilege escalation in Anchore Enterprise's user management API allows authenticated attackers to modify user permissions, granting write access to read-only users. Versions 5.11.0 through 5.27.1 and 6.0.0 are affected; patches are available in 5.27.2 and 6.0.1. No public exploit or active exploitation has been reported.

We are tasked with synthesizing data about CVE-2026-14328 into a comprehensive analysis. The user provided a description, CVSS, CWE, tags, references, and multi-source intelligence note. Our output must be a JSON object with specific fields. Let's go step by step. First, I need to extract product name. The CVE is about "Eazy Plugin Manager - Powerful Plugin Management Solution for WordPress plugin for WordPress". That's a complex name. The product_name should be 1-3 words, specific. The plugin is called "Eazy Plugin Manager" (maybe the slug is "plugins-on-steroids"? from references, the plugin folder is "plugins-on-steroids", but the description says "Eazy Plugin Manager - Powerful Plugin Management Solution for WordPress". So the product is the Eazy Plugin Manager WordPress plugin. I'll use "Eazy Plugin Manager" as the product name. Confirm: references show paths like "plugins.trac.wordpress.org/browser/plugins-on-steroids/tags/4.4.1/...", so the plugin slug is "plugins-on-steroids" but the marketed name is "Eazy Plugin Manager". For product_name, use "Eazy Plugin Manager" (or "Eazy Plugin Manager for WordPress"? The requirement says 1-3 words, so likely "Eazy Plugin Manager". I'll use "Eazy Plugin Manager". Summary: Must not copy description, but original synthesis. Include impact, affected product, attacker capabilities. Mention if actively exploited, POC, EPSS. Input doesn't have KEV status or EPSS score explicitly. The user didn't provide EPSS or KEV. The description says "authenticated attackers, with Subscriber-level access and above". That's PR:L per CVSS vector (PR:L). So it requires a low-privileged user. No mention of exploitation in the wild, no KEV. POC? Not explicitly, but maybe from Wordfence advisory they might have details. The references are code links and the Wordfence threat intel page. I can't assume POC exists unless stated. The input just says "Tags: WordPress, Privilege Escalation". So I'll state "no public exploit identified at time of ana

Account takeover in TrueBooker WordPress plugin before 1.2.4 enables unauthenticated attackers to reset any user’s password via a front-end handler lacking ownership validation, compromising the entire site. Public proof-of-concept exploit code is available, though EPSS exploitation probability remains low (0.14%) and no CISA KEV listing confirms active exploitation.

Heap-based buffer overflow in ESP32-audioI2S version 3.4.5 allows remote attackers to execute arbitrary code, disclose information, crash the service, or escalate privileges by sending a malicious URL with an oversized path and query string to the vulnerable urlencode function. No active exploitation has been confirmed by CISA KEV, and no EPSS score is available at this time.

Heap-based buffer overflow in the schreibfaul1 ESP32-audioI2S library (version 3.4.5) exposes ESP32-based audio devices to remote code execution when they parse malicious HTML entities in streamed content. The flawed htmlToUTF8() decoder rearranges string data with memmove/memcpy without checking remaining buffer space, so an attacker who controls the HTML the device fetches (e.g. a web-radio stream or its metadata) can force an out-of-bounds heap write leading to code execution, memory disclosure, or a crash. Publicly available exploit code exists per the CISA SSVC 'poc' status, but the flaw is not listed in CISA KEV and carries a low EPSS score of 0.27% (19th percentile), indicating no evidence of widespread active exploitation yet.

A local privilege escalation vulnerability in macOS allows a malicious app to gain root privileges by exploiting incorrect default permissions. Affected macOS versions are prior to Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. No active exploitation or public exploit code has been reported, though the high CVSS score reflects potential for complete system compromise.

Local privilege escalation in Apple macOS due to incorrect default permissions (C

Privilege escalation vulnerability in JFrog Artifactory allows an attacker with an admin-provisioned account to temporarily gain platform administrator access. The flaw, reported by JFrog, is rated high severity (CVSS 7.2) and requires high privileges to exploit. No active exploitation or public exploit code is known at this time.

Privilege escalation in JFrog Artifactory Self-Hosted before 7.133.11 lets a low-privileged authenticated user leverage a valid token beyond its intended permissions, because the platform validates the token's signature and issuer but never enforces the token's scope. An attacker holding any legitimately issued token can therefore access resources or perform actions the token was never authorized for, yielding high confidentiality, integrity, and availability impact. This was reported by JFrog and there is no public exploit identified at time of analysis (EPSS 0.21%, percentile 11%).

Privilege escalation in phpMyFAQ before 4.1.6 allows administrators with only group-management permissions to add themselves to existing groups holding user-management rights without verification of required privileges, enabling unauthorized modification or deletion of user accounts. The vulnerability stems from missing authorization checks in GroupController::updateMembers(). No public exploit or active exploitation has been identified at the time of analysis.

Local privilege escalation in the Linux kernel's CAN Broadcast Manager (BCM) module allows an unprivileged local user to execute arbitrary code in kernel context. The flaw stems from an expired pointer dereference (CWE-825) in the handling of tasklets and timers, leading to use-after-free. No active exploitation or public exploit code has been identified, but successful exploitation results in full root compromise of the system.

An unauthenticated user registering on a WordPress site with the Custom Fields Account Registration for WooCommerce plugin before version 1.4 can exploit improperly protected custom fields to overwrite the user capabilities meta key, granting themselves the administrator role. This occurs on sites using a non-default database table prefix where a correspondingly named field has been configured. Publicly available exploit code exists, but active exploitation has not been confirmed by CISA KEV.

Unauthorized role assignment in MemberGlut WordPress plugin versions below 1.1.5 allows unauthenticated attackers to register accounts with arbitrary roles, including administrator, leading to complete site takeover. Publicly available exploit code exists. CVSS 9.8 indicates critical severity with low complexity and no required privileges.

Out-of-bounds access in the Linux kernel amdgpu VCE 1 driver allows a low-privileged local attacker on systems with older AMD GPU hardware to potentially corrupt kernel memory and escalate privileges. The drm/amdgpu/vce1 driver failed to account for the firmware offset when sizing the VCPU Buffer Object, omitted alignment of stack and data offsets to the 32K TLB boundary, and lacked bounds checks ensuring firmware microcode fits reserved space - creating conditions for OOB read/write in kernel space. No public exploit code exists and EPSS stands at 0.20%, placing this in the 10th percentile for exploitation probability despite the high CVSS score.

Use-after-free in the Linux kernel's usbio (USB I/O bridge) driver allows a local, low-privileged attacker to corrupt kernel slab memory during USB device disconnect, potentially achieving privilege escalation or triggering a kernel panic. The bug lies in usbio_disconnect(), which iterates the client list in reverse using list_for_each_entry_reverse() - a macro that reads client->link.prev after the loop body, but auxiliary_device_uninit() can free the current client before that read, dereferencing freed slab memory. Patches are confirmed in Linux stable branches 6.18.39, 7.1.4, and 7.2-rc3; no public exploit or active exploitation is identified at time of analysis.

Use-after-free in the Linux kernel Bluetooth MGMT subsystem allows a local attacker with low privileges to trigger kernel memory corruption via a race condition between add_device and remove_device operations. The flaw exists in add_device_complete(), which dereferences a hci_conn_params pointer without holding hci_dev_lock, while a concurrent MGMT_OP_REMOVE_DEVICE path frees the same object under that lock. KASAN confirms exploitation as slab-use-after-free; no public exploit or active exploitation (CISA KEV) has been identified, and patches have been released across multiple stable branches.

Use-after-free in the Linux kernel's idmouse USB fingerprint driver allows a low-privileged local attacker to corrupt kernel memory by racing a device disconnect against a file-descriptor release, potentially enabling local privilege escalation to root. The bug stems from `mutex_unlock()` accessing the freed driver-data structure after the lock is released, a documented non-atomic behavior; the fix introduces a `kref` reference counter to correctly manage object lifetime. Patches are available across all active stable branches; no active exploitation or public exploit has been reported.

Use-after-free in the Linux kernel's USB iowarrior driver exposes systems with Code Mercantile IO-Warrior USB devices to kernel memory corruption, potentially enabling local privilege escalation to root. The defect exists because submitted write URBs are not cancelled during close(), leaving them in-flight at disconnect time; the completion handler then fires against already-freed device structures. No public exploit code has been identified at time of analysis, and EPSS at 0.22% (13th percentile) reflects minimal observed exploitation pressure, though the C:H/I:H/A:H CVSS impact reflects genuine kernel-level consequence.

The Linux kernel's legousbtower USB driver contains a use-after-free race condition between the release() and disconnect() code paths, present since Linux 2.6.25. An authenticated local user with a LEGO USB Tower device attached can trigger the race at disconnect time to corrupt freed kernel memory, potentially gaining elevated privileges or crashing the system. Patches have been issued across all active stable branches (5.10, 5.15, 6.1, 6.6, 6.12, 6.18, 7.1); no public exploit code or CISA KEV listing exists at time of analysis.

Privilege escalation in Weintek cMT3092X HMI allows a low-privileged user to modify authentication tokens, gaining full administrative control over the device. The vulnerability affects firmware prior to 20210218 and EasyWeb prior to v2.1.20. No active exploitation is known and public exploit code has not been identified; EPSS indicates a low likelihood of exploitation.

Header injection in the cluster-proxy service-proxy component of Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE) allows an authenticated hub principal to escalate to cluster-admin across all managed spoke clusters. The service-proxy forwards Kubernetes impersonation group headers to spoke clusters without stripping caller-supplied values first; because the spoke ServiceAccount holds unrestricted impersonation rights, an injected Impersonate-Group header (e.g., system:masters) is honored by every downstream cluster API server. No public exploit has been identified at time of analysis, and EPSS sits at 0.23%, though SSVC rates technical impact as total given the blast radius across the entire managed fleet.

Local privilege escalation in Loytec building-automation controllers (L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD and LIP-ME20xC) through firmware 8.4.16 on the LINX-A64 platform lets an authenticated `larmapp` account escalate to root. The privileged helper `/usr/bin/larm_starter` follows a symlink at `/etc/lighttpd/ssl/server.pem` when it applies chown/chmod, so an attacker who replaces that path with a link to `/etc/passwd` can make `/etc/passwd` writable by the `larmapp` group and then add or modify a root-equivalent account. There is no public exploit identified at time of analysis and EPSS is low (0.14%), consistent with CISA SSVC rating exploitation as 'none' but technical impact as 'total'.

A local privilege escalation flaw in the ltsudo binary on Loytec LIP-ME201C and related L-Series building automation controllers allows an attacker with superadmin group membership to reset the password of any LARM user, including the larmapp service account, via the set-passwd subcommand. This can lead to full compromise of LINX-A64-based devices running firmware up to version 8.4.16. Exploitation requires local access and high privileges; no active exploitation or public exploit code is currently known, and EPSS indicates a very low probability of exploitation.

Privilege escalation and unauthorized data modification in the Grafana IRM cloud service allowed authenticated low-privilege users to perform operations on behalf of other users due to broken access controls, potentially leading to account takeover. The vulnerability affected cloud-only deployments of versions 1.0.0 through 1.164.0 and has been automatically resolved; self-hosted environments are not impacted. The EPSS exploitation probability is low (0.29%) and no active exploitation is known.

We are tasked with synthesizing data from multiple sources about CVE-2026-10610 into a comprehensive analysis in JSON format. The output must be a JSON object with the specified fields, all strings, and no arrays or objects. Let's extract relevant data: - CVE ID: CVE-2026-10610 - Description: "Local privilege escalation potentially allowed an attacker to execute arbitrary code as a privileged user." - CVSS Score: 8.5 (CVSS 4.0 score, base score 8.5) - CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CWE: CWE-269 (Improper Privilege Management) - EPSS Score: 0.14% (percentile 4%) - Reported by: ESET - CPE: cpe:2.3:a:eset_spol._s.r.o.:eset_endpoint_security_for_macos:*:*:*:*:*:*:*:*, cpe:2.3:a:eset_spol._s.r.o.:eset_cyber_security_for_macos:*:*:*:*:*:*:*:* - Tags: RCE, Privilege Escalation, Eset Endpoint Security For Macos, Eset Cyber Security For Macos - SSVC: Exploitation: none, Automatable: no, Technical Impact: total - ENISA EUVD ID: EUVD-2026-48558 - Affected versions (EUVD): - ESET Endpoint Security for macOS 0 ≤8.0.7200.0 - ESET Endpoint Security for macOS 9.0 ≤9.0.5400.0 - ESET Endpoint Security for macOS 8.1 ≤8.1.200.0 - ESET Cyber Security for macOS 0 ≤9.0.5300.0 - ESET Endpoint Security for macOS 9.1 ≤9.1.2500.0 - References: - [cveorg] (None) https://support.eset.com/en/ca8977-eset-customer-advisory-local-privilege-escalation-vulnerability-in-eset-security-applications-for-macos-fixed - [vuldb] (advisory) https://vuldb.com/vuln/382896 - [euvd] (advisory) https://nvd.nist.gov/vuln/detail/CVE-2026-10610 We also have "Reported by: ESET" likely meaning the vulnerability was reported by ESET, and the product is ESET's own software. Now, we need to produce fields. Let's go through each: 1. product_name: "1-3 words ONLY. The specific product or service name affected. Examples: 'Apache Tomcat', 'WordPre

Local privilege escalation in ESET Endpoint Security and Cyber Security for macOS allows a low-privileged local attacker to write arbitrary files with controlled content as root, leading to full system compromise. The vulnerability affects multiple versions of the macOS security applications and is addressed in a vendor patch. No active exploitation has been reported, and the EPSS score is low at 0.12%, but exploitation would give an attacker complete control over the system.

Privilege escalation in Imagination Technologies Graphics DDK allows a malicious guest VM with GPU access to send crafted commands that trigger out-of-bounds memory writes beyond the guest's virtualized GPU boundaries. Affected versions include 26.1 RTM1, 1.18 RTM2, 23.2 RTM2, 24.2 RTM2, and 25.1 RTM2 through 25.3 RTM. No active exploitation or public exploit has been observed; EPSS probability is 0.14% (very low) and CISA SSVC indicates neither exploitation nor automatable attack patterns, suggesting low real-world risk despite a high CVSS score of 7.8.

Out-of-bounds write in Imagination Technologies Graphics DDK allows a malicious guest VM to issue improper GPU commands via its kernel-mode driver, triggering memory corruption that escapes virtualization boundaries. Affected versions include 24.2, 25.1 through 25.3, 1.18, and 23.2 RTM2 releases. No public exploit code or active exploitation has been identified; EPSS probability is very low at 0.14%.

Account takeover in CAFEHAUS API plugin for WordPress allows unauthenticated attackers to arbitrarily reset any user password via a missing authorization endpoint. Versions up to 1.0.0 are affected, enabling complete site compromise by setting an administrator password and logging in. While a public proof-of-concept exists, no widespread exploitation has been confirmed by KEVCISA.

Unauthenticated privilege escalation in Paid Membership Plugin for WordPress before 4.16.18 allows an attacker to register an account with an elevated role such as Editor or Author, bypassing the configured restriction because the registration handler's role acceptance logic differs from the UI parser. The lack of a nonce on the public handler enables exploitation without user interaction. A public proof-of-concept exists, but no active exploitation has been reported via CISA KEV, and the EPSS score is low at 0.13%.

Local privilege escalation in Rapid7 InsightVM, Nexpose, and the Insight Agent allows a low-privileged user to gain elevated code execution by planting an executable in a location the scanner discovers and runs during an authenticated assessment. Because the products execute discovered executables without validating file ownership (CWE-250), the planted code runs as the scan credential on Scan Engine or as root/SYSTEM under the Insight Agent, yielding full local compromise. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV, but the vendor-confirmed root/SYSTEM outcome makes this a meaningful escalation path.

Privilege escalation in Exim versions 4.82 through 4.99.4 permits local users with shell access to execute arbitrary commands with elevated mail delivery privileges by crafting a malicious ~/.forward file that exploits mishandled force_command logic in the pipe transport. The affected deployment window is substantial - covering a wide span of Exim releases present across Debian, Ubuntu, and other Linux distributions. No confirmed active exploitation or public exploit code has been identified at the time of analysis; SSVC rates this as non-automatable with no observed exploitation, though technical impact is assessed as total given full CIA compromise upon success.

Privilege escalation in the Wpify Woo WordPress plugin (versions ≤ 5.4.16) lets authenticated Shop Manager users overwrite arbitrary WordPress options and promote themselves to Administrator. The vulnerable SettingsApi::save_option() REST route (POST /wp-json/wpify-woo/v1/option) forwards attacker-controlled 'option' and 'data' values straight into update_option() with no allowlist or sanitization, gated only by the manage_woocommerce capability. Reported by Wordfence with a CVSS of 8.0; no public exploit identified at time of analysis and not listed in CISA KEV.

Privilege management weakness in Johnson Controls victor Web (video management client) on Windows lets a high-privileged, authenticated actor abuse improper privilege controls (CWE-269 / CAPEC-233) to access information beyond its authorization boundary, with the impact crossing into a subsequent system component. It affects all victor Web releases before 7.1 and is fixed in 7.1. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS 4.0 base score is 7.1 with high attack complexity and a required attack condition, indicating exploitation is non-trivial.

Cross-tenant privilege escalation in Casdoor allows a non-global organization admin in one tenant to delete, create, or modify resources in any other tenant by exploiting an authorization mismatch between parameter-based access control and request-body actions. Versions up to and including 3.115.0 are affected. The vulnerability requires low-privilege authentication but leads to full compromise of all tenant data and operations.

Privilege escalation in Grav's API Plugin before 1.0.10 lets an authenticated caller holding only the api.users.write scope create invitation records that assign the invited account to groups granting api.super, so when the invite is accepted the new account inherits full super-admin API access the inviter never possessed. The flaw stems from InvitationsController::create() failing to validate the attacker-supplied groups field. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.

Privilege escalation in the TrueBooker (truebooker-appointment-booking) WordPress plugin through version 1.2.3 lets unauthenticated remote attackers gain elevated privileges via an incorrect privilege-assignment flaw (CWE-266). With a CVSS 9.8 network/no-auth vector, a successful attacker can escalate to a high-privilege account and fully compromise the affected WordPress site; no public exploit identified at time of analysis and the issue is not in CISA KEV.

Privilege escalation in the WP BASE Booking WordPress plugin (versions 6.3.1 and earlier) lets a low-privileged authenticated Subscriber elevate their permissions to a higher-privileged role. Because the CVSS vector is AV:N/PR:L with high confidentiality, integrity, and availability impact, an attacker holding any low-level account - trivially obtained on sites with open registration - can gain administrative-level control over the booking system and potentially the wider WordPress instance. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

Privilege escalation in the SMS Alert Order Notifications WordPress/WooCommerce plugin (versions 3.9.6 and earlier) allows unauthenticated attackers to gain elevated privileges, per a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N). Classified as CWE-266 (Incorrect Privilege Assignment) and reported by Patchstack, the flaw lets a remote actor with no credentials assume higher-privileged roles, potentially reaching administrative control of the site. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied in the source data.

Authentication bypass in the odh-dashboard web console of Red Hat OpenShift AI (RHOAI) lets a low-privileged actor already inside the cluster impersonate any user — including cluster administrators — by supplying an arbitrary access token to a component that was incorrectly bound to a reachable network interface. Because the impersonated identity is honored against the Kubernetes API, this escalates to arbitrary code execution, privilege escalation, and information disclosure across the cluster. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was provided, but the CVSS 8.8 (High) rating and full C/I/A impact make it a serious internal-threat priority.

Privilege escalation in the MDJM Event Management (Mobile DJ Manager) plugin for WordPress through version 1.7.8.4 lets attackers grant arbitrary MDJM capabilities to any registered role and pivot a low-privileged account up to Administrator. The flaw stems from a role-manipulation endpoint wired to the public WordPress init hook with no authentication gate, no nonce verification, and no allow-list validation of submitted roles. No public exploit identified at time of analysis, but the issue was reported by Wordfence and carries a CVSS of 8.8.

Local privilege escalation in Unistal Protegent 360 v2.0.0.4 allows a low-privileged local attacker to gain SYSTEM-level privileges via the kernel driver pgsecdl.sys. A proof-of-concept exploit is available, but no active exploitation has been confirmed (no CISA KEV listing). EPSS scores indicate a low probability of exploitation in the wild (0.24%).

Takeover of Oracle Platform Security for Java (OPSS) is possible where a low-privileged attacker with HTTP network access can fully compromise the confidentiality, integrity, and availability of the service. The flaw resides in the Centralized Thirdparty Jars component and affects Oracle Fusion Middleware releases 12.2.1.4.0 and 14.1.2.0.0. It carries a CVSS 3.1 base score of 8.8 and was disclosed in the Oracle Critical Patch Update of July 2026; no public exploit identified at time of analysis.

Full compromise of Oracle Platform Security for Java (OPSS) in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with network access over HTTP to take over the component, per Oracle's July 2026 Critical Patch Update. The flaw yields high confidentiality, integrity, and availability impact and is rated easily exploitable (CVSS 8.8), though no public exploit identified at time of analysis. Because OPSS underpins authentication, authorization, and credential management for the wider Fusion Middleware stack, a takeover has cascading security consequences.

Full compromise of Oracle Platform Security for Java (OPSS), a security framework within Oracle Fusion Middleware, is possible when a low-privileged attacker reaches the affected instance over HTTP via the Centralized Thirdparty Jars component. Oracle rates the flaw CVSS 3.1 8.8 and describes it as "easily exploitable," resulting in a complete takeover of OPSS with high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis and it is not in CISA KEV, but the low attack complexity and only a low-privilege authenticated prerequisite make it a strong candidate for prompt patching in Oracle environments.

Full compromise ("takeover") of Oracle Platform Security for Java (OPSS), a core security framework shipped inside Oracle Fusion Middleware, is possible by an unauthenticated remote attacker over HTTP against versions 12.2.1.4.0 and 14.1.2.0.0. Oracle rates this 9.8 with full confidentiality, integrity, and availability loss and describes it as "easily exploitable," so it should be treated as a top-priority patch in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitation profile (no authentication, no user interaction) makes it an attractive target once details or patches are reverse-engineered.

Full compromise of Oracle Platform Security for Java (OPSS) in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 is achievable by a low-privileged attacker over HTTP through the Centralized Thirdparty Jars component. Because the flaw carries a scope change, successful exploitation can result in complete takeover of OPSS and significantly impact additional connected products, earning a near-maximum CVSS 3.1 base score of 9.9. No public exploit has been identified at time of analysis, but the low attack complexity and minimal privilege requirement make this a high-priority patch.

Remote takeover of Oracle Platform Security for Java (OPSS), a security framework bundled with Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, allows an unauthenticated attacker with HTTP network access to fully compromise the component. Rated CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact, Oracle describes it as 'easily exploitable' via the Centralized Thirdparty Jars component. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a high-priority patch.

Complete takeover of Oracle Platform Security for Java (OPSS) in Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 is possible by an unauthenticated remote attacker over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw resides in the 'Centralized Thirdparty Jars' component and carries a maximum CVSS 3.1 base score of 10.0 with a scope change, meaning successful exploitation can significantly impact products beyond OPSS itself. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the perfect CVSS score and 'easily exploitable' vendor language make this a top-priority patch.

Local privilege escalation in Fujitsu openFT (managed file transfer) on GNU/Linux and Oracle Solaris allows an already-authenticated local user to gain root privileges on versions before 12.1D00. The flaw stems from improper privilege management (CWE-269) and carries a CVSS 4.0 base score of 8.5 (High). No public exploit identified at time of analysis; the intelligence was obtained internally by the Fsas Technologies PSIRT rather than from public disclosure.

Local privilege escalation in Analog Way Picturall Quad Compact Mark II firmware version 3.5.8 allows authenticated low-privileged users to gain root access via path traversal in a maintenance script. No active exploitation or public exploit code has been reported; vendor patch is available in version 3.5.9.

Privilege escalation in Check Point Gaia Portal allows an authenticated user holding only read-only administrative privileges to execute arbitrary commands as root, giving full compromise of the affected Quantum Security Gateway or Security Management appliance. The flaw (CWE-269, improper privilege management) is vendor-reported via advisory sk185153 and carries a CVSS 3.1 base score of 7.5 with high attack complexity. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Privilege escalation in the Grav CMS Login plugin (grav-plugin-login) <= 3.8.11 lets a low-privilege authenticated user promote their own account to super-admin by injecting privilege fields into a profile self-update request. The flaw lives in processUserProfile() (the update_user task), which — unlike the registration handler — fails to strip 'groups' and 'access' from user-submitted form data before persisting it. There is no public exploit identified at time of analysis and it is not in CISA KEV, but exploitation is trivial once the exposing configuration is present, and gaining super-admin unlocks admin panel access, scheduler-driven RCE, and Twig evaluation.

Privilege escalation and potential remote code execution affects n8n workflow-automation instances before 2.30.1 and 2.29.8 where both the Token Exchange module and Public API are enabled. Because JWTs issued via Token Exchange are granted the full set of Public API key scopes irrespective of the acting user's role, a low-privileged user holding a valid external JWT trusted by a configured issuer can invoke administrator-only operations - creating, deleting, or escalating users, and, where unverified Community Package installation is permitted, executing arbitrary code. No public exploit identified at time of analysis; VulnCheck-reported with a CVSS 4.0 base of 8.9.

Privilege escalation in n8n Enterprise SSO (versions before 1.123.64, 2.29.8, and 2.30.1) lets an SSO-authenticated user who controls their IdP-asserted instance-role claim be provisioned directly as global:owner, seizing full administrative control of workflows, credentials, users, and instance configuration. The instance-role provisioning path fails to block the owner role that the parallel token-exchange path explicitly rejects. Reported by VulnCheck with no public exploit identified at time of analysis; exploitation depends on a non-default configuration.

Privilege escalation in n8n workflow automation platform before 2.30.1 allows a low-privileged Project Viewer to abuse the AI Agents feature, where the node-execution (run-node) tool omits authorization checks. By chatting with an agent that has node tools enabled, the viewer can execute arbitrary nodes and read credential secrets they should not access. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Local privilege escalation in the servereye Windows agent (Sensorhub / ClientAgentContainerService) versions 20.15 and earlier lets any local standard user gain SYSTEM. The SYSTEM-level SE3Recovery service (EmergencyRecoveryService.exe) watches a world-writable directory for a trigger file and then runs UpdaterAction.exe, which performs an unvalidated file copy from a user-controlled source over a protected service binary, resulting in full system compromise. No public exploit identified at time of analysis; this was reported by NCSC.ch and is not listed in CISA KEV, so there is no evidence of active exploitation.

Local privilege escalation in Unistal Systems Protegent 360 v2.0.0.4 allows a low-privileged attacker to gain SYSTEM-level control through the sub_186f4 function. A publicly available proof-of-concept exists, but no active exploitation is currently reported and the EPSS estimate of 0.19% suggests low threat actor interest.

Local privilege escalation in Unistal Systems Protegent 360 v2.0.0.4 through its kernel driver pgsecdl.sys allows a low-privileged local attacker to gain complete system control. A proof-of-concept exploit is publicly available, but no active exploitation has been confirmed and the EPSS score is low (0.19%). The flaw stems from improper privilege management (CWE-269) in the driver.

Full compromise of Oracle HRMS (US) is possible in Oracle E-Business Suite versions 12.2.3 through 12.2.15 via the Internal Operations component, where a low-privileged attacker with local logon access to the hosting infrastructure can escalate to complete takeover of the HRMS module. The flaw yields high confidentiality, integrity, and availability impact (CVSS 3.1 7.8) and is fixed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Full compromise of the Oracle HRMS (US) module within Oracle E-Business Suite is achievable by a high-privileged attacker over HTTP against the Internal Operations component, affecting supported releases 12.2.3 through 12.2.15. A successful attack yields complete takeover of the HRMS (US) subsystem with high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; it was reported through Oracle's internal security alert channel and fixed in the July 2026 Critical Patch Update.

Privileged data compromise in Oracle Advanced Planning Command Center (Oracle E-Business Suite Internal Operations component, versions 12.2.3 through 12.2.15) lets an already high-privileged attacker with network HTTP access read all APCC-accessible data and perform limited unauthorized modifications. Because the flaw carries a scope change, successful attacks may significantly impact additional products beyond APCC itself. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 7.6; no public exploit identified at time of analysis.

Full compromise of Oracle Flow Manufacturing (Internal Operations component of Oracle E-Business Suite) is achievable by a low-privileged attacker over the network via HTTP, per Oracle's July 2026 Critical Patch Update. Any authenticated EBS user can leverage the flaw to take over the module, exposing and altering confidential manufacturing data (high confidentiality, integrity, and availability impact, CVSS 8.8). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle EBS is a recurring target for opportunistic and targeted attackers.

Full compromise of Oracle Yard Management (part of Oracle E-Business Suite, Internal Operations component) is possible for a low-privileged, network-authenticated attacker over HTTP, per Oracle's July 2026 Critical Patch Update. Affecting supported versions 12.2.6 through 12.2.15, the flaw carries a CVSS 3.1 base score of 8.8 and, on successful exploitation, results in complete takeover of the Yard Management application with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Takeover of Oracle Purchasing (a module of Oracle E-Business Suite, Internal Operations component) is possible for a low-privileged, network-authenticated attacker in supported releases 12.2.11 through 12.2.15. Successful attacks yield full confidentiality, integrity, and availability compromise of the Purchasing application per Oracle's July 2026 Critical Patch Update. Exploitation is rated high-complexity (AC:H), and no public exploit identified at time of analysis; the issue was reported internally by Oracle's security alert team rather than a public researcher.

Account takeover in Oracle Public Sector Financials (a module of Oracle E-Business Suite, Internal Operations component) allows a low-privileged, network-adjacent attacker to fully compromise the product over HTTP. Any authenticated user with minimal EBS privileges can escalate to complete control of the Public Sector Financials application (CVSS 8.8, high confidentiality/integrity/availability impact). There is no public exploit identified at time of analysis, but Oracle E-Business Suite is a recurring, high-value target for post-authentication attacks, and the July 2026 Critical Patch Update remediates it.

Account takeover in Oracle Public Sector Payroll (a component of Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged, network-adjacent attacker fully compromise the module over HTTP. The CVSS 3.1 base score of 8.8 reflects complete confidentiality, integrity, and availability impact, and the flaw resides in the Internal Operations component. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix ships in Oracle's Critical Patch Update for July 2026.

Full compromise of Oracle Payroll (Internal Operations component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) is achievable by a low-privileged, network-authenticated attacker over HTTP, per Oracle's July 2026 Critical Patch Update. Oracle rates the flaw 8.8 and characterizes it as 'easily exploitable' with a result of complete product takeover across confidentiality, integrity, and availability. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low complexity and low-privilege prerequisite make it a strong patching priority for EBS operators.

Unauthorized data compromise in the Oracle HRMS (UK) module of Oracle E-Business Suite (Internal Operations component) allows a low-privileged, network-authenticated attacker to read, create, delete, or modify critical HR data, with a scope change that lets attacks significantly impact other products beyond HRMS. Rated CVSS 3.1 8.2 (High) with high confidentiality and integrity impact but no availability impact, and flagged by Oracle as difficult to exploit (AC:H). At the time of analysis there is no public exploit identified and no CISA KEV listing, so exploitation appears theoretical rather than active.

Takeover of Oracle Trade Management (component: Claim LOV) within Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise confidentiality, integrity, and availability of the module. The flaw is easily exploitable (AC:L) and requires only a low level of authenticated access (PR:L), carrying a CVSS 3.1 base score of 8.8. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.

Full compromise of Oracle Lease and Finance Management (versions 12.2.14 through 12.2.15), a module of Oracle E-Business Suite's Internal Operations component, is possible for a network-based attacker who already holds high application privileges. Oracle rates this CVSS 3.1 7.2 with high confidentiality, integrity, and availability impact, describing successful attacks as resulting in complete takeover of the module. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the modest EPSS-relevant profile is consistent with the high-privilege precondition limiting mass exploitation.

Full compromise of the Oracle E-Business Suite TeleSales module (Internal Operations component) is possible over the network via HTTP by a low-privileged authenticated user. Affecting EBS releases 12.2.3 through 12.2.15, successful exploitation results in complete takeover of TeleSales with high confidentiality, integrity, and availability impact (CVSS 3.1 8.8). This flaw was disclosed in the Oracle July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.