# Privilege escalation. Gaining rights a user or process shouldn’t have. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [IM-Magic Partition Resizer Kernel Driver MDA_NTDRV.sys access control](https://agentprime.io/advisories/CVE-2026-12784.md) `CVE-2026-12784` · CVE record: IM-Magic Partition Resizer · CVSS 8.5 High · Not analysed yet · Published 21 Jun 2026 · Tags: Privilege escalation, Broken access control - [EaseUS Partition Master Kernel Driver EUEDKEPM.sys access control](https://agentprime.io/advisories/CVE-2026-12782.md) `CVE-2026-12782` · CVE record: EaseUS Partition Master · CVSS 8.5 High · Not analysed yet · Published 21 Jun 2026 · Tags: Privilege escalation, Broken access control - [EaseUS Partition Master Kernel Driver epmntdrv.sys access control](https://agentprime.io/advisories/CVE-2026-12781.md) `CVE-2026-12781` · CVE record: EaseUS Partition Master · CVSS 8.5 High · Not analysed yet · Published 21 Jun 2026 · Tags: Privilege escalation, Broken access control - [AOMEI Backupper Kernel Driver amwrtdrv.sys access control](https://agentprime.io/advisories/CVE-2026-12780.md) `CVE-2026-12780` · CVE record: AOMEI Backupper · CVSS 8.5 High · Not analysed yet · Published 21 Jun 2026 · Tags: Privilege escalation, Broken access control - [AOMEI Dynamic Disk Manager Kernel Driver ddmdrv.sys access control](https://agentprime.io/advisories/CVE-2026-12779.md) `CVE-2026-12779` · CVE record: AOMEI Dynamic Disk Manager · CVSS 8.5 High · Not analysed yet · Published 21 Jun 2026 · Tags: Privilege escalation, Broken access control - [AOMEI Partition Assistant Kernel Driver ampa10.sys access control](https://agentprime.io/advisories/CVE-2026-12778.md) `CVE-2026-12778` · CVE record: AOMEI Partition Assistant · CVSS 8.5 High · Not analysed yet · Published 21 Jun 2026 · Tags: Privilege escalation, Broken access control - [LiteLLM: M2M JWT Handler Has Improper Authorization](https://agentprime.io/advisories/GHSA-qmf3-4767-5fg3.md) `GHSA-qmf3-4767-5fg3`, `CVE-2026-12771`, `PYSEC-2026-4075` · PyPI `litellm`: affected `<=1.82.2`, no fixed version yet · CVSS 2.3 Low · Not analysed yet · Published 21 Jun 2026 · Tags: Privilege escalation, Broken access control - [LiteLLM: Admin Key Handler Has Improper Authorization](https://agentprime.io/advisories/GHSA-6qr3-3g89-m4jj.md) `GHSA-6qr3-3g89-m4jj`, `CVE-2026-12770`, `PYSEC-2026-4068` · PyPI `litellm`: affected `<=1.63.1`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 21 Jun 2026 · Tags: Privilege escalation, Broken access control - [Capgo - Scope Escalation via API Key Creation in /functions/v1/apikey](https://agentprime.io/advisories/CVE-2026-56216.md) `CVE-2026-56216` · CVE record: Capgo Capgo · CVSS 8.7 High · Not analysed yet · Published 20 Jun 2026 · Tags: Privilege escalation - [Capgo - Improper 2FA Enforcement Logic via Team Security Settings](https://agentprime.io/advisories/CVE-2026-56212.md) `CVE-2026-56212` · CVE record: Capgo Capgo · CVSS 5.1 Medium · Not analysed yet · Published 20 Jun 2026 · Tags: Privilege escalation - [Microsoft Azure Synapse Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-48584.md) `CVE-2026-48584` · CVE record: Microsoft Azure Synapse · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Jun 2026 · Tags: Privilege escalation - [OpenClaw: Active Memory write scope could mutate global config](https://agentprime.io/advisories/GHSA-x629-46cc-7xgw.md) `GHSA-x629-46cc-7xgw`, `CVE-2026-53847` · npm `openclaw`: affected `<2026.5.6`, fixed in `2026.5.6` · CVSS 5.3 Medium · Not analysed yet · Published 18 Jun 2026 · Tags: Privilege escalation - [OpenClaw: Bootstrap token replay could widen pending pairing scopes](https://agentprime.io/advisories/GHSA-9v8j-9c9g-w66c.md) `GHSA-9v8j-9c9g-w66c`, `CVE-2026-53862` · npm `openclaw`: affected `<2026.5.12`, fixed in `2026.5.12` · CVSS 2.3 Low · Not analysed yet · Published 18 Jun 2026 · Tags: Privilege escalation, CWE-345 - [OpenClaw: Shell positional parameters could weaken strict inline-eval checks](https://agentprime.io/advisories/GHSA-5cj2-3jr2-5h77.md) `GHSA-5cj2-3jr2-5h77`, `CVE-2026-53855` · npm `openclaw`: affected `<2026.4.2`, fixed in `2026.4.2` · CVSS 7.6 High · Not analysed yet · Published 18 Jun 2026 · Tags: Command injection, Privilege escalation, Broken access control, CWE-184 - [Daytona: Path traversal in sandbox volume id mounts arbitrary host paths into the sandbox — cross-tenant data access and host escape](https://agentprime.io/advisories/GHSA-fjv8-j4p5-cr9m.md) `GHSA-fjv8-j4p5-cr9m`, `CVE-2026-54319`, `GO-2026-5367` · Go `github.com/daytonaio/daytona`: affected `<0.186.0`, fixed in `0.186.0` · CVSS 4.2 Medium · Not analysed yet · Published 18 Jun 2026 · Tags: Path traversal, Privilege escalation, CWE-20 - [PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable](https://agentprime.io/advisories/GHSA-6jcq-6546-qrrw.md) `GHSA-6jcq-6546-qrrw`, `CVE-2026-57144`, `PYSEC-2026-3504` · PyPI `praisonai`: affected `>=4.5.110, <4.6.61`, fixed in `4.6.61` · CVSS 8.8 High · Not analysed yet · Published 18 Jun 2026 · Tags: Privilege escalation, Information disclosure, CWE-693 - [Strimzi: Unrestricted access to all Secrets within namespace watched by the Topic operator](https://agentprime.io/advisories/GHSA-r427-j2h7-wv3m.md) `GHSA-r427-j2h7-wv3m`, `CVE-2026-55226` · Maven `io.strimzi:strimzi`: affected `<1.0.1`, fixed in `1.0.1` · CVSS 5.4 Medium · Not analysed yet · Published 18 Jun 2026 · Tags: Privilege escalation, CWE-272 - [Strimzi: Cross-namespace privilege escalation via \`Kafka.spec.entityOperator\`](https://agentprime.io/advisories/GHSA-mw9r-p8xp-wx96.md) `GHSA-mw9r-p8xp-wx96`, `CVE-2026-55225` · Maven `io.strimzi:strimzi`: affected `<1.0.1`, fixed in `1.0.1` · CVSS 8.0 High · Not analysed yet · Published 18 Jun 2026 · Tags: Privilege escalation, CWE-441 - [Cifs-utils: local privilege escalation via forged cifs.spnego key description in cifs.upcall](https://agentprime.io/advisories/CVE-2026-12505.md) `CVE-2026-12505` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.8 High · Not analysed yet · Published 18 Jun 2026 · Tags: Privilege escalation - [SourceCodester CET Automated Grading System with AI Predictive Analytics Student Self-Registration Endpoint index.php access control](https://agentprime.io/advisories/CVE-2026-12529.md) `CVE-2026-12529` · CVE record: SourceCodester CET Automated Grading System with AI Predictive Analytics · CVSS 6.9 Medium · Not analysed yet · Published 17 Jun 2026 · Tags: Privilege escalation, Broken access control - [Cisco Umbrella Virtual Appliance Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2026-20246.md) `CVE-2026-20246` · CVE record: Cisco Cisco Umbrella Insights Virtual Appliance · CVSS 6.0 Medium · Not analysed yet · Published 17 Jun 2026 · Tags: Privilege escalation - [Broken Access Control in Azuriom CMS Server Routes Allows Account Takeover](https://agentprime.io/advisories/CVE-2026-54415.md) `CVE-2026-54415` · CVE record: Azuriom Azuriom CMS · CVSS 8.6 High · Not analysed yet · Published 17 Jun 2026 · Tags: Privilege escalation, Broken access control - [WordPress Registration Form for WooCommerce plugin <= 1.0.9 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-54807.md) `CVE-2026-54807` · CVE record: ThemeGrill Registration Form for WooCommerce · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jun 2026 · Tags: Privilege escalation - [WordPress Falang multilanguage plugin <= 1.4.2 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-54805.md) `CVE-2026-54805` · CVE record: sbouey Falang multilanguage · CVSS 8.8 High · Not analysed yet · Published 17 Jun 2026 · Tags: Privilege escalation - [WordPress JetFormBuilder plugin <= 3.6.1 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-54196.md) `CVE-2026-54196` · CVE record: Jetmonsters JetFormBuilder · CVSS 6.8 Medium · Not analysed yet · Published 17 Jun 2026 · Tags: Privilege escalation - [WordPress LoginPress Pro plugin <= 6.2.2 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-49058.md) `CVE-2026-49058` · CVE record: LoginPress LoginPress Pro · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jun 2026 · Tags: Privilege escalation - [WordPress MultiLoca plugin <= 4.2.15 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-39546.md) `CVE-2026-39546` · CVE record: Techspawn MultiLoca · CVSS 7.6 High · Not analysed yet · Published 17 Jun 2026 · Tags: Privilege escalation - [WordPress Support Ticket Management System plugin <= 1.9 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2025-69179.md) `CVE-2025-69179` · CVE record: Theme passion Support Ticket Management System · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jun 2026 · Tags: Privilege escalation - [WordPress Genemy theme <= 1.6.6 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2025-69138.md) `CVE-2025-69138` · CVE record: Jthemes Genemy · CVSS 8.8 High · Not analysed yet · Published 17 Jun 2026 · Tags: Privilege escalation - [WordPress Sonaar theme <= 4.27.4 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2025-59563.md) `CVE-2025-59563` · CVE record: SONAAR MUSIC Sonaar · CVSS 8.8 High · Not analysed yet · Published 17 Jun 2026 · Tags: Privilege escalation - [Contest Gallery <= 30.0.2 - Authenticated (Author+) Privilege Escalation via 'RegistryUserRole' Parameter](https://agentprime.io/advisories/CVE-2026-12165.md) `CVE-2026-12165` · CVE record: contest-gallery Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe · CVSS 8.8 High · Not analysed yet · Published 17 Jun 2026 · Tags: Privilege escalation - [Improper privilege management in Google Android](https://agentprime.io/advisories/CVE-2026-0063.md) `CVE-2026-0063` · CVE record: Google Android · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jun 2026 · Tags: Privilege escalation - [Improper privilege management in Google Android](https://agentprime.io/advisories/CVE-2026-0019.md) `CVE-2026-0019` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 17 Jun 2026 · Tags: Privilege escalation - [Improper privilege management in Google Chrome](https://agentprime.io/advisories/CVE-2026-12450.md) `CVE-2026-12450` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 17 Jun 2026 · Tags: Privilege escalation - [Improper privilege management in Google Chrome](https://agentprime.io/advisories/CVE-2026-12448.md) `CVE-2026-12448` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 17 Jun 2026 · Tags: Privilege escalation - [Duplicate Advisory: Bootstrap token replay could widen pending pairing scopes](https://agentprime.io/advisories/GHSA-h9h6-pwqv-j9hv.md) `GHSA-h9h6-pwqv-j9hv` · npm `openclaw`: affected `<=2026.5.10-beta.2`, no fixed version yet · CVSS 4.2 Medium · Withdrawn · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation - [Duplicate Advisory: Active Memory write scope could mutate global config](https://agentprime.io/advisories/GHSA-58wc-8wrv-xp9j.md) `GHSA-58wc-8wrv-xp9j` · npm `openclaw`: affected `<=2026.5.5`, no fixed version yet · CVSS 5.4 Medium · Withdrawn · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation - [WordPress Support Board plugin < 3.8.9 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-27395.md) `CVE-2026-27395` · CVE record: Schiocco Support Board · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation - [Missing authentication in Oracle Corporation Oracle Outsourced Mfg for Discrete Industries](https://agentprime.io/advisories/CVE-2026-46973.md) `CVE-2026-46973` · CVE record: Oracle Corporation Oracle Outsourced Mfg for Discrete Industries · CVSS 8.8 High · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation, Authentication bypass - [Missing authentication in Oracle Corporation Oracle Outsourced Mfg for Discrete Industries](https://agentprime.io/advisories/CVE-2026-46972.md) `CVE-2026-46972` · CVE record: Oracle Corporation Oracle Outsourced Mfg for Discrete Industries · CVSS 8.8 High · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation, Authentication bypass - [Improper privilege management in Oracle Corporation Oracle HR Intelligence](https://agentprime.io/advisories/CVE-2026-46970.md) `CVE-2026-46970` · CVE record: Oracle Corporation Oracle HR Intelligence · CVSS 7.2 High · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation - [Missing authentication in Oracle Corporation Oracle Universal Work Queue](https://agentprime.io/advisories/CVE-2026-46966.md) `CVE-2026-46966` · CVE record: Oracle Corporation Oracle Universal Work Queue · CVSS 7.5 High · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation, Broken access control, Authentication bypass - [Improper access control in Oracle Corporation Oracle Universal Work Queue](https://agentprime.io/advisories/CVE-2026-46964.md) `CVE-2026-46964` · CVE record: Oracle Corporation Oracle Universal Work Queue · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation, Broken access control, Authentication bypass - [Missing authentication in Oracle Corporation Oracle Project Portfolio Analysis](https://agentprime.io/advisories/CVE-2026-46962.md) `CVE-2026-46962` · CVE record: Oracle Corporation Oracle Project Portfolio Analysis · CVSS 8.8 High · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation, Authentication bypass - [Missing authentication in Oracle Corporation Oracle Project Portfolio Analysis](https://agentprime.io/advisories/CVE-2026-46961.md) `CVE-2026-46961` · CVE record: Oracle Corporation Oracle Project Portfolio Analysis · CVSS 8.8 High · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation, Authentication bypass - [Missing authentication in Oracle Corporation Oracle Subledger Accounting](https://agentprime.io/advisories/CVE-2026-46959.md) `CVE-2026-46959` · CVE record: Oracle Corporation Oracle Subledger Accounting · CVSS 7.5 High · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation, Broken access control, Authentication bypass - [Missing authentication in Oracle Corporation Oracle Subledger Accounting](https://agentprime.io/advisories/CVE-2026-46958.md) `CVE-2026-46958` · CVE record: Oracle Corporation Oracle Subledger Accounting · CVSS 7.5 High · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation, Broken access control, Authentication bypass - [Improper privilege management in Oracle Corporation Oracle HRMS (UK)](https://agentprime.io/advisories/CVE-2026-46953.md) `CVE-2026-46953` · CVE record: Oracle Corporation Oracle HRMS (UK) · CVSS 7.2 High · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation - [Missing authentication in Oracle Corporation Oracle Quality](https://agentprime.io/advisories/CVE-2026-46952.md) `CVE-2026-46952` · CVE record: Oracle Corporation Oracle Quality · CVSS 8.8 High · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation, Authentication bypass - [Missing authentication in Oracle Corporation Oracle Quality](https://agentprime.io/advisories/CVE-2026-46951.md) `CVE-2026-46951` · CVE record: Oracle Corporation Oracle Quality · CVSS 8.8 High · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation, Authentication bypass - [Missing authentication in Oracle Corporation Oracle Process Manufacturing Process Planning](https://agentprime.io/advisories/CVE-2026-46942.md) `CVE-2026-46942` · CVE record: Oracle Corporation Oracle Process Manufacturing Process Planning · CVSS 8.8 High · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation, Broken access control, Authentication bypass - [Missing authentication in Oracle Corporation Oracle Cost Management](https://agentprime.io/advisories/CVE-2026-46940.md) `CVE-2026-46940` · CVE record: Oracle Corporation Oracle Cost Management · CVSS 8.8 High · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation, Broken access control, Authentication bypass - [Missing authentication in Oracle Corporation Oracle iSetup](https://agentprime.io/advisories/CVE-2026-46937.md) `CVE-2026-46937` · CVE record: Oracle Corporation Oracle iSetup · CVSS 8.8 High · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation, Authentication bypass - [Missing authentication in Oracle Corporation Oracle Complex Maintenance, Repair and Overhaul](https://agentprime.io/advisories/CVE-2026-46935.md) `CVE-2026-46935` · CVE record: Oracle Corporation Oracle Complex Maintenance, Repair and Overhaul · CVSS 7.5 High · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation, Broken access control, Authentication bypass - [Missing authentication in Oracle Corporation Oracle Complex Maintenance, Repair and Overhaul](https://agentprime.io/advisories/CVE-2026-46934.md) `CVE-2026-46934` · CVE record: Oracle Corporation Oracle Complex Maintenance, Repair and Overhaul · CVSS 7.5 High · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation, Broken access control, Authentication bypass - [Improper access control in Oracle Corporation Oracle Applications Manager](https://agentprime.io/advisories/CVE-2026-46933.md) `CVE-2026-46933` · CVE record: Oracle Corporation Oracle Applications Manager · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation, Broken access control, Authentication bypass - [Missing authentication in Oracle Corporation Oracle Cost Management](https://agentprime.io/advisories/CVE-2026-46929.md) `CVE-2026-46929` · CVE record: Oracle Corporation Oracle Cost Management · CVSS 8.8 High · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation, Broken access control, Authentication bypass - [Missing authentication in Oracle Corporation Oracle Spares Management](https://agentprime.io/advisories/CVE-2026-46928.md) `CVE-2026-46928` · CVE record: Oracle Corporation Oracle Spares Management · CVSS 8.8 High · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation, Authentication bypass - [Missing authentication in Oracle Corporation Oracle HR Intelligence](https://agentprime.io/advisories/CVE-2026-46922.md) `CVE-2026-46922` · CVE record: Oracle Corporation Oracle HR Intelligence · CVSS 7.2 High · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation, Broken access control, Authentication bypass - [Missing authentication in Oracle Corporation Siebel CRM Cloud Applications](https://agentprime.io/advisories/CVE-2026-46921.md) `CVE-2026-46921` · CVE record: Oracle Corporation Siebel CRM Cloud Applications · CVSS 8.8 High · Not analysed yet · Published 16 Jun 2026 · Tags: Privilege escalation, Broken access control, Authentication bypass Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .