# Privilege escalation. Gaining rights a user or process shouldn’t have. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Odh-training-operator-rhel9: \[trainer v2 security\] trn-02: rhoai overlay aggregates trainjobs crud into standard edit clusterrole](https://agentprime.io/advisories/CVE-2026-18951.md) `CVE-2026-18951` · CVE record: Red Hat Red Hat OpenShift AI 3.3 and 2 more · CVSS 8.8 High · Not analysed yet · Published 10 Aug 2026 · Tags: Privilege escalation, Broken access control - [Odh-dashboard: odh-dashboard: confused-deputy privilege escalation via unchecked roleref in rolebinding creation](https://agentprime.io/advisories/CVE-2026-18950.md) `CVE-2026-18950` · CVE record: Red Hat Red Hat OpenShift AI 2.25 and 3 more · CVSS 8.8 High · Not analysed yet · Published 10 Aug 2026 · Tags: Privilege escalation - [Odh-dashboard: odh-dashboard: clusterrole grants cluster-wide crud on secrets and rbac management resources](https://agentprime.io/advisories/CVE-2026-18949.md) `CVE-2026-18949` · CVE record: Red Hat Red Hat OpenShift AI 2.25 and 2 more · CVSS 8.8 High · Not analysed yet · Published 10 Aug 2026 · Tags: Privilege escalation - [Feast-operator: feast: feast apply cronjob runs user python with feature-server sa — tenant code to sa token escalation](https://agentprime.io/advisories/CVE-2026-18942.md) `CVE-2026-18942` · CVE record: Red Hat Red Hat OpenShift AI 2.25 and 2 more · CVSS 5.5 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: Code injection, Privilege escalation - [Data-sciences-pipeline: dsp: v1 argo template path accepts arbitrary workflow spec, bypassing all v2 security hardening](https://agentprime.io/advisories/CVE-2026-18621.md) `CVE-2026-18621` · CVE record: Red Hat Red Hat OpenShift AI 2.25 and 3 more · CVSS 7.6 High · Not analysed yet · Published 10 Aug 2026 · Tags: Privilege escalation - [Data-science-pipelines-operator: dspo: operator clusterrole grants pods/exec:\*, kubeflow.org \*/\*, and clusterrole/binding crud cluster-wide](https://agentprime.io/advisories/CVE-2026-18608.md) `CVE-2026-18608` · CVE record: Red Hat Red Hat OpenShift AI 2.25 and 3 more · CVSS 8.7 High · Not analysed yet · Published 10 Aug 2026 · Tags: Privilege escalation - [Trustyai-service-operator: trustyai-service-operator: lmevaljob sidecar containers bypass protected environment variable filtering, allowing trust_remote_code policy override](https://agentprime.io/advisories/CVE-2026-15467.md) `CVE-2026-15467` · CVE record: Red Hat Red Hat OpenShift AI 2.25 and 3 more · CVSS 8.1 High · Not analysed yet · Published 10 Aug 2026 · Tags: Privilege escalation - [Dokploy: Non-admin member gains root on the host by bypassing the owner/admin check on server-level schedules (incomplete fix of CVE-2026-45632)](https://agentprime.io/advisories/CVE-2026-72886.md) `CVE-2026-72886` · CVE record: Dokploy dokploy · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Aug 2026 · Tags: Privilege escalation, Broken access control - [Dokploy: Missing authorization in WebSocket handlers allows a low-privilege member to gain root on the Docker host](https://agentprime.io/advisories/CVE-2026-72863.md) `CVE-2026-72863` · CVE record: Dokploy dokploy · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Aug 2026 · Tags: Privilege escalation, Broken access control - [systemd-homed: local privilege escalation via missing home-record signature verification on the authenticate path](https://agentprime.io/advisories/CVE-2026-16742.md) `CVE-2026-16742` · CVE record: systemd systemd-homed · CVSS 6.7 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: Privilege escalation, Weak cryptography or TLS - [Apache Ranger: Privilege Escalation via URL Parameter](https://agentprime.io/advisories/CVE-2026-40920.md) `CVE-2026-40920` · CVE record: Apache Software Foundation Apache Ranger · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Aug 2026 · Tags: Privilege escalation, Authentication bypass, CWE-20 - [Vitepos < 3.6.0 - Outlet Manager+ Privilege Escalation](https://agentprime.io/advisories/CVE-2026-14237.md) `CVE-2026-14237` · CVE record: Unknown vitepos and 1 more · CVSS 7.2 High · Not analysed yet · Published 10 Aug 2026 · Tags: Privilege escalation - [FoodBoxBooker < 1.0.7 - Unauthenticated Arbitrary Password Reset](https://agentprime.io/advisories/CVE-2026-16298.md) `CVE-2026-16298` · CVE record: Unknown FoodBoxBooker · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Aug 2026 · Tags: Privilege escalation - [Kingston FURY CTRL RGB Control Software Driver NTIOLib_KSFX.sys privileges management](https://agentprime.io/advisories/CVE-2026-19381.md) `CVE-2026-19381` · CVE record: Kingston FURY CTRL RGB Control Software · CVSS 8.5 High · Not analysed yet · Published 10 Aug 2026 · Tags: Privilege escalation - [Uasoft Badaso File API api.php class permission](https://agentprime.io/advisories/CVE-2026-19376.md) `CVE-2026-19376` · CVE record: Uasoft Badaso · CVSS 6.9 Medium · Not analysed yet · Published 9 Aug 2026 · Tags: Privilege escalation, CWE-275 - [wongcyrus ExcelLexBot Lambda Function ExcelLexBotS3TriggerFunction privileges management](https://agentprime.io/advisories/CVE-2026-19360.md) `CVE-2026-19360` · CVE record: wongcyrus ExcelLexBot · CVSS 5.1 Medium · Not analysed yet · Published 9 Aug 2026 · Tags: Privilege escalation - [nxp-auto-goldvip gvip Lambda Function SitewiseCustomFunction access control](https://agentprime.io/advisories/CVE-2026-19359.md) `CVE-2026-19359` · CVE record: nxp-auto-goldvip gvip · CVSS 5.1 Medium · Not analysed yet · Published 9 Aug 2026 · Tags: Privilege escalation, Broken access control - [3CORESec Trapdoor DefaultFunction access control](https://agentprime.io/advisories/CVE-2026-19358.md) `CVE-2026-19358` · CVE record: 3CORESec Trapdoor · CVSS 5.3 Medium · Not analysed yet · Published 9 Aug 2026 · Tags: Privilege escalation, Broken access control - [AI Copilot – Content Generator <= 1.5.6 - Unauthenticated Privilege Escalation via Custom Workflow Route](https://agentprime.io/advisories/CVE-2026-14526.md) `CVE-2026-14526` · CVE record: wupsales AI Copilot – Content Generator · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Aug 2026 · Tags: Privilege escalation - [HKUDS nanobot MCP enabledTools Scope mcp.py connect_mcp_servers access control](https://agentprime.io/advisories/CVE-2026-19244.md) `CVE-2026-19244` · CVE record: HKUDS nanobot · CVSS 5.1 Medium · Not analysed yet · Published 7 Aug 2026 · Tags: Privilege escalation, Broken access control - [NexTOR IP Changer Unsafely Uses sudo and shell=True](https://agentprime.io/advisories/CVE-2026-48098.md) `CVE-2026-48098` · CVE record: 0x5t4l1n NexTOR_IP_CHANGER · CVSS 7.3 High · Not analysed yet · Published 7 Aug 2026 · Tags: Command injection, Privilege escalation - [Improper privilege management in WebPros Plesk](https://agentprime.io/advisories/CVE-2026-64637.md) `CVE-2026-64637` · CVE record: WebPros Plesk · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Aug 2026 · Tags: Privilege escalation - [Subscriptions for WooCommerce < 2.0.1 - Shop Manager+ Arbitrary Plugin Installation](https://agentprime.io/advisories/CVE-2026-15215.md) `CVE-2026-15215` · CVE record: Unknown Subscriptions for WooCommerce · CVSS 8.8 High · Not analysed yet · Published 7 Aug 2026 · Tags: Privilege escalation - [V-Secure Jingyun Antivirus Kernel Driver ZyArk.sys access control](https://agentprime.io/advisories/CVE-2026-19195.md) `CVE-2026-19195` · CVE record: V-Secure Jingyun Antivirus · CVSS 8.5 High · Not analysed yet · Published 7 Aug 2026 · Tags: Privilege escalation, Broken access control - [Jiangmin Antivirus Minifilter Port kvcore.sys MessageNotifyCallback access control](https://agentprime.io/advisories/CVE-2026-19193.md) `CVE-2026-19193` · CVE record: Jiangmin Antivirus · CVSS 8.5 High · Not analysed yet · Published 7 Aug 2026 · Tags: Privilege escalation, Broken access control - [DeepCool DisplayService DeepCoolDisplayService.exe access control](https://agentprime.io/advisories/CVE-2026-19192.md) `CVE-2026-19192` · CVE record: DeepCool DisplayService · CVSS 8.5 High · Not analysed yet · Published 7 Aug 2026 · Tags: Privilege escalation, Broken access control - [StableBit DrivePool DrivePoolService DrivePool.Service.exe permission](https://agentprime.io/advisories/CVE-2026-19191.md) `CVE-2026-19191` · CVE record: StableBit DrivePool · CVSS 8.5 High · Not analysed yet · Published 7 Aug 2026 · Tags: Privilege escalation, CWE-275 - [StableBit Scanner ScannerService Scanner.Service.exe permission](https://agentprime.io/advisories/CVE-2026-19190.md) `CVE-2026-19190` · CVE record: StableBit Scanner · CVSS 8.5 High · Not analysed yet · Published 7 Aug 2026 · Tags: Privilege escalation, CWE-275 - [Power Sofware PowerISO Kernel Driver scdemu.sys privileges management](https://agentprime.io/advisories/CVE-2026-19189.md) `CVE-2026-19189` · CVE record: Power Sofware PowerISO · CVSS 8.5 High · Not analysed yet · Published 7 Aug 2026 · Tags: Privilege escalation - [Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics](https://agentprime.io/advisories/GHSA-rvmm-v933-jgxq.md) `GHSA-rvmm-v933-jgxq`, `CVE-2026-14794`, `PKSA-1412-5vdy-cd6w` · Packagist `craftcms/cms`: affected `>=4.0.0-RC1, <4.18.1 || >=5.0.0-RC1, <5.10.3`, fixed in `4.18.1`, `5.10.3` · CVSS 5.3 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Privilege escalation, Broken access control - [OpenReception: Tenant admin self-promotes to GLOBAL_ADMIN](https://agentprime.io/advisories/CVE-2026-48086.md) `CVE-2026-48086` · CVE record: open-reception appointment-booking-software · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Aug 2026 · Tags: Privilege escalation - [WordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-66662.md) `CVE-2026-66662` · CVE record: Shabti Kaplan Frontend Admin by DynamiApps · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Aug 2026 · Tags: Privilege escalation - [WordPress Order Delivery Date for WooCommerce plugin <= 4.6.0 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-65559.md) `CVE-2026-65559` · CVE record: tychesoftwares Order Delivery Date for WooCommerce · CVSS 7.2 High · Not analysed yet · Published 6 Aug 2026 · Tags: Privilege escalation - [WordPress AIWU plugin <= 1.5.6 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-65507.md) `CVE-2026-65507` · CVE record: Sergey AIWU · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Aug 2026 · Tags: Privilege escalation - [WordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-28183.md) `CVE-2026-28183` · CVE record: PublishPress PublishPress Capabilities · CVSS 7.2 High · Not analysed yet · Published 6 Aug 2026 · Tags: Privilege escalation - [WordPress Forminator plugin <= 1.56.0 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-28111.md) `CVE-2026-28111` · CVE record: WPMU DEV Forminator · CVSS 8.8 High · Not analysed yet · Published 6 Aug 2026 · Tags: Privilege escalation - [Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover](https://agentprime.io/advisories/CVE-2026-1728.md) `CVE-2026-1728` · CVE record: WSO2 WSO2 API Manager and 4 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Aug 2026 · Tags: Privilege escalation - [mf-yang openclaw-cn reply-elevated.ts isApprovedElevatedSender privileges management](https://agentprime.io/advisories/CVE-2026-19007.md) `CVE-2026-19007` · CVE record: mf-yang openclaw-cn · CVSS 5.3 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Privilege escalation - [nanocoai NanoClaw Child-Agent Creation create-agent.ts handleCreateAgent privileges management](https://agentprime.io/advisories/CVE-2026-19005.md) `CVE-2026-19005` · CVE record: nanocoai NanoClaw · CVSS 5.3 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Privilege escalation - [cosmicstack-labs mercury-agent delegate_task Tool sub-agent.ts SubAgent.run improper authorization](https://agentprime.io/advisories/CVE-2026-18998.md) `CVE-2026-18998` · CVE record: cosmicstack-labs mercury-agent · CVSS 5.3 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Privilege escalation, Broken access control - [cosmicstack-labs mercury-agent run_command permissions.ts PermissionManager.checkShellCommand privileges assignment](https://agentprime.io/advisories/CVE-2026-18996.md) `CVE-2026-18996` · CVE record: cosmicstack-labs mercury-agent · CVSS 5.3 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Privilege escalation - [NousResearch hermes-agent Memory Toolset model_tools.py access control](https://agentprime.io/advisories/CVE-2026-18993.md) `CVE-2026-18993` · CVE record: NousResearch hermes-agent · CVSS 5.3 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Privilege escalation, Broken access control - [NousResearch hermes-agent disabled_toolsets agent_init.py get_tool_definitions privileges assignment](https://agentprime.io/advisories/CVE-2026-18976.md) `CVE-2026-18976` · CVE record: NousResearch hermes-agent · CVSS 5.3 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Privilege escalation - [Improper privilege management in Jenkins Project Jenkins Horreum Plugin](https://agentprime.io/advisories/CVE-2026-70443.md) `CVE-2026-70443` · CVE record: Jenkins Project Jenkins Horreum Plugin · CVSS 4.3 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Privilege escalation - [Langflow is affected by security vulnerabilities in Model Context Protocol features](https://agentprime.io/advisories/CVE-2026-17626.md) `CVE-2026-17626` · CVE record: IBM Langflow OSS · CVSS 8.8 High · Not analysed yet · Published 5 Aug 2026 · Tags: Privilege escalation - [Cisco IOS XE Software Web-Based Management Interface Vulnerability](https://agentprime.io/advisories/CVE-2026-20308.md) `CVE-2026-20308` · CVE record: Cisco Cisco IOS XE Software · CVSS 4.3 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Privilege escalation - [Cisco Terminal Services Agent Firewall Rules Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-20028.md) `CVE-2026-20028` · CVE record: Cisco Cisco Terminal Services Agent · CVSS 5.0 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Privilege escalation - [Privilege escalation in Progress MarkLogic Server Hadoop integration](https://agentprime.io/advisories/CVE-2026-9193.md) `CVE-2026-9193` · CVE record: Progress Software Corporation MarkLogic Server · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Aug 2026 · Tags: Privilege escalation - [Privilege escalation in Progress MarkLogic Server REST document patch operation](https://agentprime.io/advisories/CVE-2026-8709.md) `CVE-2026-8709` · CVE record: Progress Software Corporation MarkLogic Server · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Aug 2026 · Tags: Privilege escalation - [Privilege escalation in Progress MarkLogic Server REST query interfaces](https://agentprime.io/advisories/CVE-2026-7329.md) `CVE-2026-7329` · CVE record: Progress Software Corporation MarkLogic Server · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Aug 2026 · Tags: Privilege escalation - [Privilege escalation in Progress MarkLogic Server REST API document processing](https://agentprime.io/advisories/CVE-2026-7327.md) `CVE-2026-7327` · CVE record: Progress Software Corporation MarkLogic Server · CVSS 8.1 High · Not analysed yet · Published 5 Aug 2026 · Tags: Privilege escalation - [Keycloak-services: keycloak-services: ldap entry-dn user search bypasses configured users dn boundary](https://agentprime.io/advisories/CVE-2026-16071.md) `CVE-2026-16071` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 5.4 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Other injection, Privilege escalation - [Multicluster-operators-subscription: multicluster-operators-subscription: namespace edit user can deploy cluster-scoped clusterrolebinding and become cluster-admin via application subscription](https://agentprime.io/advisories/CVE-2026-10090.md) `CVE-2026-10090` · CVE record: Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11 and 4 more · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Aug 2026 · Tags: Privilege escalation - [Cluster-curator-controller: cluster-curator-controller: namespace admin can escalate to cluster-wide curator authority via clustercurator serviceaccount token](https://agentprime.io/advisories/CVE-2026-10059.md) `CVE-2026-10059` · CVE record: Red Hat multicluster engine for Kubernetes 2.1 and 4 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Aug 2026 · Tags: Privilege escalation - [Smart Popup by Supsystic <= 1.12.0 - Unauthenticated Privilege Escalation to Administrator](https://agentprime.io/advisories/CVE-2026-18322.md) `CVE-2026-18322` · CVE record: supsysticcom Smart Popup by Supsystic · CVSS 8.8 High · Not analysed yet · Published 5 Aug 2026 · Tags: Privilege escalation - [Baserow Inactive Non-Staff User serializers.py BaserowImpersonateAuthTokenSerializer improper authorization](https://agentprime.io/advisories/CVE-2026-18817.md) `CVE-2026-18817` · CVE record: Baserow · CVSS 2.1 Low · Not analysed yet · Published 4 Aug 2026 · Tags: Privilege escalation, Broken access control - [Improper privilege management in Veeam ONE](https://agentprime.io/advisories/CVE-2026-64634.md) `CVE-2026-64634` · CVE record: Veeam ONE · CVSS 8.4 High · Not analysed yet · Published 4 Aug 2026 · Tags: Privilege escalation - [An improper authentication and path traversal vulnerability exists in ASUSTOR Backup Plan and ASUSTOR EZ Sync.](https://agentprime.io/advisories/CVE-2026-18759.md) `CVE-2026-18759` · CVE record: ASUSTOR Inc. ABP and 1 more · CVSS 8.5 High · Not analysed yet · Published 4 Aug 2026 · Tags: Privilege escalation, Authentication bypass - [diaowen DWSurvey Survey Status up-survey-status.do improper authorization](https://agentprime.io/advisories/CVE-2026-18723.md) `CVE-2026-18723` · CVE record: diaowen DWSurvey · CVSS 5.3 Medium · Not analysed yet · Published 4 Aug 2026 · Tags: Privilege escalation, Broken access control - [kalcaddle kodbox msgWarning Plugin action improper authorization](https://agentprime.io/advisories/CVE-2026-18720.md) `CVE-2026-18720` · CVE record: kalcaddle kodbox · CVSS 6.9 Medium · Not analysed yet · Published 4 Aug 2026 · Tags: Privilege escalation, Broken access control Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .