# Privilege escalation. Gaining rights a user or process shouldn’t have. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Missing authentication in Oracle Corporation Oracle Process Manufacturing Product Development](https://agentprime.io/advisories/CVE-2026-46916.md) `CVE-2026-46916` · CVE record: Oracle Corporation Oracle Process Manufacturing Product Development · CVSS 8.8 High · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation, Broken access control, Authentication bypass - [Improper privilege management in Oracle Corporation Oracle Solaris](https://agentprime.io/advisories/CVE-2026-46914.md) `CVE-2026-46914` · CVE record: Oracle Corporation Oracle Solaris · CVSS 7.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation, Denial of service - [Missing authentication in Oracle Corporation JD Edwards EnterpriseOne Tools](https://agentprime.io/advisories/CVE-2026-46903.md) `CVE-2026-46903` · CVE record: Oracle Corporation JD Edwards EnterpriseOne Tools · CVSS 8.8 High · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation, Authentication bypass - [Improper access control in Oracle Corporation Oracle Enterprise Command Center Framework](https://agentprime.io/advisories/CVE-2026-46901.md) `CVE-2026-46901` · CVE record: Oracle Corporation Oracle Enterprise Command Center Framework · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation, Broken access control - [Improper access control in Oracle Corporation Oracle Enterprise Command Center Framework](https://agentprime.io/advisories/CVE-2026-46900.md) `CVE-2026-46900` · CVE record: Oracle Corporation Oracle Enterprise Command Center Framework · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation, Broken access control - [Improper access control in Oracle Corporation Oracle Enterprise Command Center Framework](https://agentprime.io/advisories/CVE-2026-46899.md) `CVE-2026-46899` · CVE record: Oracle Corporation Oracle Enterprise Command Center Framework · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation, Broken access control - [Improper access control in Oracle Corporation Oracle Enterprise Command Center Framework](https://agentprime.io/advisories/CVE-2026-46895.md) `CVE-2026-46895` · CVE record: Oracle Corporation Oracle Enterprise Command Center Framework · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation, Broken access control - [Improper privilege management in Oracle Corporation JD Edwards EnterpriseOne General Ledger](https://agentprime.io/advisories/CVE-2026-46893.md) `CVE-2026-46893` · CVE record: Oracle Corporation JD Edwards EnterpriseOne General Ledger · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation - [Improper privilege management in Oracle Corporation Siebel CRM Integration](https://agentprime.io/advisories/CVE-2026-46885.md) `CVE-2026-46885` · CVE record: Oracle Corporation Siebel CRM Integration · CVSS 8.8 High · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation - [Improper privilege management in Oracle Corporation Oracle VM VirtualBox](https://agentprime.io/advisories/CVE-2026-46877.md) `CVE-2026-46877` · CVE record: Oracle Corporation Oracle VM VirtualBox · CVSS 6.0 Medium · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation - [Improper privilege management in Oracle Corporation Oracle VM VirtualBox](https://agentprime.io/advisories/CVE-2026-46873.md) `CVE-2026-46873` · CVE record: Oracle Corporation Oracle VM VirtualBox · CVSS 7.5 High · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation - [Improper privilege management in Oracle Corporation Oracle Enterprise Manager Base Platform](https://agentprime.io/advisories/CVE-2026-46867.md) `CVE-2026-46867` · CVE record: Oracle Corporation Oracle Enterprise Manager Base Platform · CVSS 7.2 High · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation - [Improper privilege management in Oracle Corporation Oracle Enterprise Manager Base Platform](https://agentprime.io/advisories/CVE-2026-46852.md) `CVE-2026-46852` · CVE record: Oracle Corporation Oracle Enterprise Manager Base Platform · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation - [Improper privilege management in Oracle Corporation Oracle WebCenter Content](https://agentprime.io/advisories/CVE-2026-46804.md) `CVE-2026-46804` · CVE record: Oracle Corporation Oracle WebCenter Content · CVSS 8.7 High · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation - [Improper privilege management in Oracle Corporation Identity Manager Connector](https://agentprime.io/advisories/CVE-2026-46794.md) `CVE-2026-46794` · CVE record: Oracle Corporation Identity Manager Connector · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation - [Improper privilege management in Oracle Corporation WebLogic Server](https://agentprime.io/advisories/CVE-2026-35291.md) `CVE-2026-35291` · CVE record: Oracle Corporation WebLogic Server · CVSS 6.6 Medium · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation - [Improper privilege management in Oracle Corporation PeopleSoft Enterprise PT PeopleTools](https://agentprime.io/advisories/CVE-2026-35288.md) `CVE-2026-35288` · CVE record: Oracle Corporation PeopleSoft Enterprise PT PeopleTools · CVSS 8.2 High · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation - [Improper privilege management in Oracle Corporation PeopleSoft Enterprise PT PeopleTools](https://agentprime.io/advisories/CVE-2026-35272.md) `CVE-2026-35272` · CVE record: Oracle Corporation PeopleSoft Enterprise PT PeopleTools · CVSS 8.4 High · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation - [Improper privilege management in Dell EMC VxRail Appliance](https://agentprime.io/advisories/CVE-2024-38487.md) `CVE-2024-38487` · CVE record: Dell EMC VxRail Appliance · CVSS 7.0 High · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation - [Information disclosure, sandbox escape in the Security: Process Sandboxing component](https://agentprime.io/advisories/CVE-2026-12313.md) `CVE-2026-12313` · CVE record: Mozilla Firefox and 1 more · CVSS 4.7 Medium · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation - [Sandbox escape in the DOM: Workers component](https://agentprime.io/advisories/CVE-2026-12294.md) `CVE-2026-12294` · CVE record: Mozilla Firefox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation, CWE-693 - [Privilege escalation in the Graphics: WebRender component](https://agentprime.io/advisories/CVE-2026-12289.md) `CVE-2026-12289` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation - [LatePoint <= 5.5.1 - Authenticated (Agent+) Privilege Escalation to Administrator via IDOR in OsOrdersController::create_or_update + Unauthenticated Customer-Cabinet Password Reset](https://agentprime.io/advisories/CVE-2026-8176.md) `CVE-2026-8176` · CVE record: latepoint LatePoint – Calendar Booking Plugin for Appointments and Events · CVSS 7.5 High · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation - [A local privilege escalation vulnerability in Nokia SR Linux](https://agentprime.io/advisories/CVE-2025-9912.md) `CVE-2025-9912` · CVE record: Nokia Nokia SR Linux · CVSS 6.3 Medium · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation - [WordPress Dokan plugin <= 5.0.2 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-49780.md) `CVE-2026-49780` · CVE record: Dokan, Inc. Dokan · CVSS 8.8 High · Not analysed yet · Published 15 Jun 2026 · Tags: Privilege escalation - [WordPress LatePoint plugin <= 5.5.1 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-49083.md) `CVE-2026-49083` · CVE record: LatePoint LatePoint · CVSS 7.5 High · Not analysed yet · Published 15 Jun 2026 · Tags: Privilege escalation - [WordPress Listdom plugin <= 5.5.0 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-49063.md) `CVE-2026-49063` · CVE record: Webilia Inc. Listdom · CVSS 7.3 High · Not analysed yet · Published 15 Jun 2026 · Tags: Privilege escalation - [WordPress Amelia plugin <= 2.3 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-48889.md) `CVE-2026-48889` · CVE record: TMS Amelia · CVSS 8.8 High · Not analysed yet · Published 15 Jun 2026 · Tags: Privilege escalation - [WordPress WP BASE Booking plugin <= 5.9.0 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-39587.md) `CVE-2026-39587` · CVE record: Hakan Ozevin WP BASE Booking · CVSS 8.1 High · Not analysed yet · Published 15 Jun 2026 · Tags: Privilege escalation - [WordPress Datalogics Ecommerce Delivery plugin <= 2.6.62 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-39583.md) `CVE-2026-39583` · CVE record: Datalogics Datalogics Ecommerce Delivery · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jun 2026 · Tags: Privilege escalation - [WordPress B Blocks plugin <= 2.0.31 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-39579.md) `CVE-2026-39579` · CVE record: bPlugins B Blocks · CVSS 8.8 High · Not analysed yet · Published 15 Jun 2026 · Tags: Privilege escalation - [WordPress WooCommerce Cart Abandonment Recovery plugin < 2.1.0 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-39470.md) `CVE-2026-39470` · CVE record: Brainstorm Force WooCommerce Cart Abandonment Recovery · CVSS 7.2 High · Not analysed yet · Published 15 Jun 2026 · Tags: Privilege escalation - [WordPress iControlWP plugin <= 5.5.3 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-34901.md) `CVE-2026-34901` · CVE record: Paul iControlWP · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jun 2026 · Tags: Privilege escalation - [WordPress AI Engine plugin <= 3.4.9 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-27407.md) `CVE-2026-27407` · CVE record: Meow Apps AI Engine · CVSS 7.2 High · Not analysed yet · Published 15 Jun 2026 · Tags: Privilege escalation - [WordPress Masteriyo - LMS plugin <= 2.2.0 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-49111.md) `CVE-2026-49111` · CVE record: ThemeGrill Masteriyo - LMS · CVSS 8.8 High · Not analysed yet · Published 15 Jun 2026 · Tags: Privilege escalation - [DVDFab Virtual Drive Signed Kernel Driver dvdfabio.sys privileges management](https://agentprime.io/advisories/CVE-2026-12217.md) `CVE-2026-12217` · CVE record: DVDFab Virtual Drive · CVSS 8.5 High · Not analysed yet · Published 15 Jun 2026 · Tags: Privilege escalation - [hcengineering Huly Platform User Information operations.ts getAccountInfo improper authorization](https://agentprime.io/advisories/CVE-2026-12213.md) `CVE-2026-12213` · CVE record: hcengineering Huly Platform · CVSS 5.3 Medium · Not analysed yet · Published 15 Jun 2026 · Tags: Privilege escalation, Broken access control - [hcengineering Huly Platform RPC operations.ts getMailboxSecret access control](https://agentprime.io/advisories/CVE-2026-12212.md) `CVE-2026-12212` · CVE record: hcengineering Huly Platform · CVSS 5.3 Medium · Not analysed yet · Published 15 Jun 2026 · Tags: Privilege escalation, Broken access control - [IObit Malware Fighter DLL permission](https://agentprime.io/advisories/CVE-2026-12201.md) `CVE-2026-12201` · CVE record: IObit Malware Fighter · CVSS 4.8 Medium · Not analysed yet · Published 15 Jun 2026 · Tags: Privilege escalation, CWE-275 - [An issue in Iru, Inc Kandji Agent before v.4.7.5(5374) allows a local attacker to escalate privileges via a client validation gap to invoke restricted agent functionality.](https://agentprime.io/advisories/CVE-2026-39118.md) `CVE-2026-39118` · CVE record · CVSS 8.4 High · Not analysed yet · Published 15 Jun 2026 · Tags: Privilege escalation - [An issue in Microvirt MEmu Android Emulator 9.2.7.0 allows a local attacker to escalate privileges via the MemuService.exe component.](https://agentprime.io/advisories/CVE-2026-36213.md) `CVE-2026-36213` · CVE record · CVSS 7.8 High · Not analysed yet · Published 15 Jun 2026 · Tags: Privilege escalation - [ChromaDB allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection](https://agentprime.io/advisories/GHSA-2wm9-hf6c-p5cr.md) `GHSA-2wm9-hf6c-p5cr`, `CVE-2026-45830`, `PYSEC-2026-3813` · PyPI `chromadb`: affected `>=0.4.17, <=1.5.9`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 12 Jun 2026 · Tags: Privilege escalation, Broken access control - [MariaDB: FILE privilege was not checked for subqueries in the FROM clause](https://agentprime.io/advisories/CVE-2026-44173.md) `CVE-2026-44173` · CVE record: MariaDB server · CVSS 5.0 Medium · Not analysed yet · Published 12 Jun 2026 · Tags: Privilege escalation, Broken access control - [WordPress Hippoo Mobile App for WooCommerce plugin <= 1.9.4 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-49060.md) `CVE-2026-49060` · CVE record: Hippoo Hippoo Mobile App for WooCommerce · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Jun 2026 · Tags: Privilege escalation - [Protection mechanism failure in Google Chrome](https://agentprime.io/advisories/CVE-2026-12027.md) `CVE-2026-12027` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Jun 2026 · Tags: Privilege escalation, CWE-693 - [Improper privilege management in Google Chrome](https://agentprime.io/advisories/CVE-2026-12018.md) `CVE-2026-12018` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 11 Jun 2026 · Tags: Privilege escalation - [Idira Endpoint Privilege Manager Agent: Local Privilege Escalation via Internal Communication or File Operation Manipulation](https://agentprime.io/advisories/CVE-2026-45176.md) `CVE-2026-45176` · CVE record: CyberArk Software, a Palo Alto Networks Company Idira Endpoint Privilege Manager · CVSS 8.9 High · Not analysed yet · Published 11 Jun 2026 · Tags: Privilege escalation - [Improper privilege management in Apple macOS](https://agentprime.io/advisories/CVE-2025-31272.md) `CVE-2025-31272` · CVE record: Apple macOS · CVSS 7.8 High · Not analysed yet · Published 11 Jun 2026 · Tags: Privilege escalation - [Quest Bot: Manage Server users can configure AutoRole to grant Administrator to controlled joining accounts](https://agentprime.io/advisories/CVE-2026-47169.md) `CVE-2026-47169` · CVE record: duck-organization quest-bot · CVSS 7.5 High · Not analysed yet · Published 11 Jun 2026 · Tags: Privilege escalation - [Local Privilege Escalation in Symantec Endpoint Protection macOS CleanWipe Removal Tool](https://agentprime.io/advisories/CVE-2026-11626.md) `CVE-2026-11626` · CVE record: Broadcom Symantec Endpoint Protection CleanWipe Removal Tool · CVSS 5.4 Medium · Not analysed yet · Published 10 Jun 2026 · Tags: Privilege escalation - [Doctreat Core <= 1.6.8 - Unauthenticated Privilege Escalation](https://agentprime.io/advisories/CVE-2025-6254.md) `CVE-2025-6254` · CVE record: AmentoTech Doctreat Core · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Jun 2026 · Tags: Privilege escalation - [.NET SDK Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-45490.md) `CVE-2026-45490` · CVE record: Microsoft .NET 10.0 runtime and 2 more · CVSS 7.8 High · Not analysed yet · Published 9 Jun 2026 · Tags: Privilege escalation, Broken access control - [Race condition in Arm C1-Ultra and others](https://agentprime.io/advisories/CVE-2025-10263.md) `CVE-2025-10263` · CVE record: Arm C1-Ultra and 4 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jun 2026 · Tags: Privilege escalation, Race condition - [Execution with unnecessary privileges in Siemens SINEC INS](https://agentprime.io/advisories/CVE-2026-46748.md) `CVE-2026-46748` · CVE record: Siemens SINEC INS · CVSS 8.7 High · Not analysed yet · Published 9 Jun 2026 · Tags: Privilege escalation - [Events Calendar for GeoDirectory <= 2.3.28 - Authenticated (Subscriber+) Privilege Escalation](https://agentprime.io/advisories/CVE-2026-11616.md) `CVE-2026-11616` · CVE record: stiofansisland Events Calendar for GeoDirectory · CVSS 8.8 High · Not analysed yet · Published 9 Jun 2026 · Tags: Privilege escalation - [TOTOLINK EX200 vsftpd vsftpd.conf least privilege violation](https://agentprime.io/advisories/CVE-2026-11620.md) `CVE-2026-11620` · CVE record: TOTOLINK EX200 · CVSS 6.9 Medium · Not analysed yet · Published 9 Jun 2026 · Tags: Privilege escalation, CWE-272 - [Dolibarr ERP CRM Legacy Filemanager config.inc.php improper authorization](https://agentprime.io/advisories/CVE-2026-11619.md) `CVE-2026-11619` · CVE record: Dolibarr ERP CRM · CVSS 5.3 Medium · Not analysed yet · Published 9 Jun 2026 · Tags: Privilege escalation, Broken access control - [nebula-mesh's web UI lacks CSRF tokens on /ui/\* mutating endpoints](https://agentprime.io/advisories/GHSA-273q-qgh5-wrj6.md) `GHSA-273q-qgh5-wrj6`, `CVE-2026-47725`, `GO-2026-5049` · Go `github.com/juev/nebula-mesh`: affected `<0.3.3`, fixed in `0.3.3` · CVSS 6.9 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Privilege escalation, Cross-site request forgery (CSRF) - [actual Allows Electron to Run As Node](https://agentprime.io/advisories/GHSA-7rvm-xjpp-63r9.md) `GHSA-7rvm-xjpp-63r9`, `CVE-2026-42890` · npm `actual`: affected `<26.5.0`, fixed in `26.5.0` · CVSS 4.8 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Code injection, Privilege escalation, CWE-693 - [D-Link DGS-1100-08PD Web boa.conf least privilege violation](https://agentprime.io/advisories/CVE-2026-11555.md) `CVE-2026-11555` · CVE record: D-Link DGS-1100-08PD · CVSS 6.3 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Privilege escalation, CWE-272 Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .