# Privilege escalation. Gaining rights a user or process shouldn’t have. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Improper privilege management in Oracle Corporation Oracle One-to-One Fulfillment](https://agentprime.io/advisories/CVE-2026-83170.md) `CVE-2026-83170` · CVE record: Oracle Corporation Oracle One-to-One Fulfillment · CVSS 8.0 High · Not analysed yet · Published 15 Sept 2026 · Tags: Privilege escalation - [Improper privilege management in Oracle Corporation Oracle One-to-One Fulfillment](https://agentprime.io/advisories/CVE-2026-83169.md) `CVE-2026-83169` · CVE record: Oracle Corporation Oracle One-to-One Fulfillment · CVSS 8.1 High · Not analysed yet · Published 15 Sept 2026 · Tags: Privilege escalation - [Improper privilege management in Oracle Corporation Oracle Applications Manager](https://agentprime.io/advisories/CVE-2026-83168.md) `CVE-2026-83168` · CVE record: Oracle Corporation Oracle Applications Manager · CVSS 8.8 High · Not analysed yet · Published 15 Sept 2026 · Tags: Privilege escalation - [Improper privilege management in Oracle Corporation Oracle Application Testing Suite](https://agentprime.io/advisories/CVE-2026-83150.md) `CVE-2026-83150` · CVE record: Oracle Corporation Oracle Application Testing Suite · CVSS 7.0 High · Not analysed yet · Published 15 Sept 2026 · Tags: Privilege escalation - [Improper privilege management in Oracle Corporation Oracle Application Testing Suite](https://agentprime.io/advisories/CVE-2026-83148.md) `CVE-2026-83148` · CVE record: Oracle Corporation Oracle Application Testing Suite · CVSS 8.8 High · Not analysed yet · Published 15 Sept 2026 · Tags: Privilege escalation - [Improper privilege management in Oracle Corporation PeopleSoft Enterprise FIN Inventory Brazil](https://agentprime.io/advisories/CVE-2026-83147.md) `CVE-2026-83147` · CVE record: Oracle Corporation PeopleSoft Enterprise FIN Inventory Brazil · CVSS 7.8 High · Not analysed yet · Published 15 Sept 2026 · Tags: Privilege escalation - [Improper privilege management in Oracle Corporation Oracle Marketing](https://agentprime.io/advisories/CVE-2026-83121.md) `CVE-2026-83121` · CVE record: Oracle Corporation Oracle Marketing · CVSS 8.8 High · Not analysed yet · Published 15 Sept 2026 · Tags: Privilege escalation - [Improper privilege management in Oracle Corporation Oracle Alert](https://agentprime.io/advisories/CVE-2026-83120.md) `CVE-2026-83120` · CVE record: Oracle Corporation Oracle Alert · CVSS 8.8 High · Not analysed yet · Published 15 Sept 2026 · Tags: Privilege escalation - [Improper privilege management in Oracle Corporation Oracle User Management](https://agentprime.io/advisories/CVE-2026-83119.md) `CVE-2026-83119` · CVE record: Oracle Corporation Oracle User Management · CVSS 8.8 High · Not analysed yet · Published 15 Sept 2026 · Tags: Privilege escalation - [Improper privilege management in Oracle Corporation Applications DBA](https://agentprime.io/advisories/CVE-2026-83118.md) `CVE-2026-83118` · CVE record: Oracle Corporation Applications DBA · CVSS 7.8 High · Not analysed yet · Published 15 Sept 2026 · Tags: Privilege escalation - [Improper privilege management in Oracle Corporation Applications DBA](https://agentprime.io/advisories/CVE-2026-83117.md) `CVE-2026-83117` · CVE record: Oracle Corporation Applications DBA · CVSS 7.2 High · Not analysed yet · Published 15 Sept 2026 · Tags: Privilege escalation - [Improper privilege management in Oracle Corporation Oracle Quality](https://agentprime.io/advisories/CVE-2026-83114.md) `CVE-2026-83114` · CVE record: Oracle Corporation Oracle Quality · CVSS 7.5 High · Not analysed yet · Published 15 Sept 2026 · Tags: Privilege escalation - [Improper privilege management in Oracle Corporation Oracle Lease and Finance Management](https://agentprime.io/advisories/CVE-2026-83112.md) `CVE-2026-83112` · CVE record: Oracle Corporation Oracle Lease and Finance Management · CVSS 7.2 High · Not analysed yet · Published 15 Sept 2026 · Tags: Privilege escalation - [Authenticated Privilege Escalation Vulnerability in the Command Line Interface of HPE Networking EdgeConnect SD-WAN Gateways](https://agentprime.io/advisories/CVE-2026-76694.md) `CVE-2026-76694` · CVE record: Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways · CVSS 6.6 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Privilege escalation - [Authenticated Arbitrary File Write Leading to Remote Code Execution in EdgeConnect SD-WAN Orchestrator](https://agentprime.io/advisories/CVE-2026-76687.md) `CVE-2026-76687` · CVE record: Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways · CVSS 7.5 High · Not analysed yet · Published 15 Sept 2026 · Tags: Privilege escalation - [Authenticated Command Injection Vulnerability leads to Remote Code Execution in EdgeConnect SD-WAN Gateways](https://agentprime.io/advisories/CVE-2026-76678.md) `CVE-2026-76678` · CVE record: Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways · CVSS 8.8 High · Not analysed yet · Published 15 Sept 2026 · Tags: Privilege escalation - [Authorization Bypass Leading to Privilege Escalation in HPE Networking EdgeConnect SD-WAN Gateways](https://agentprime.io/advisories/CVE-2026-76677.md) `CVE-2026-76677` · CVE record: Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways · CVSS 8.8 High · Not analysed yet · Published 15 Sept 2026 · Tags: Privilege escalation - [Authorization Bypass Leading to Privilege Escalation in EdgeConnect SD-WAN Orchestrator](https://agentprime.io/advisories/CVE-2026-76670.md) `CVE-2026-76670` · CVE record: Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Privilege escalation - [Authorization Bypass Leading to Privilege Escalation in EdgeConnect SD-WAN Orchestrator](https://agentprime.io/advisories/CVE-2026-76669.md) `CVE-2026-76669` · CVE record: Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Privilege escalation - [Improper privilege management in Google Android](https://agentprime.io/advisories/CVE-2026-0179.md) `CVE-2026-0179` · CVE record: Google Android · CVSS 6.7 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Privilege escalation - [Flowise before 3.1.4 Cross-Tenant Organization Admin Takeover](https://agentprime.io/advisories/CVE-2026-91930.md) `CVE-2026-91930` · CVE record: FlowiseAI Flowise · CVSS 7.7 High · Not analysed yet · Published 15 Sept 2026 · Tags: Privilege escalation - [Consulting - Business, Finance WordPress Theme <= 6.7.16 - Authenticated (Subscriber+) Privilege Escalation via AJAX](https://agentprime.io/advisories/CVE-2026-14805.md) `CVE-2026-14805` · CVE record: StylemixThemes Consulting - Business, Finance WordPress Theme · CVSS 8.8 High · Not analysed yet · Published 15 Sept 2026 · Tags: Privilege escalation - [Privilege escalation in the Enterprise Policies component](https://agentprime.io/advisories/CVE-2026-92073.md) `CVE-2026-92073` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 15 Sept 2026 · Tags: Privilege escalation - [Privilege escalation in the Session Restore component](https://agentprime.io/advisories/CVE-2026-92062.md) `CVE-2026-92062` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 15 Sept 2026 · Tags: Privilege escalation - [Privilege escalation in the DevTools component](https://agentprime.io/advisories/CVE-2026-92055.md) `CVE-2026-92055` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 15 Sept 2026 · Tags: Privilege escalation - [Privilege escalation in the Graphics: CanvasWebGL component](https://agentprime.io/advisories/CVE-2026-92053.md) `CVE-2026-92053` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 15 Sept 2026 · Tags: Privilege escalation - [Privilege escalation in the Crash Reporting component](https://agentprime.io/advisories/CVE-2026-92047.md) `CVE-2026-92047` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 15 Sept 2026 · Tags: Privilege escalation - [Privilege escalation in Firefox for Android](https://agentprime.io/advisories/CVE-2026-92033.md) `CVE-2026-92033` · CVE record: Mozilla Firefox · CVSS 8.8 High · Not analysed yet · Published 15 Sept 2026 · Tags: Privilege escalation - [Privilege escalation in the DOM: Service Workers component](https://agentprime.io/advisories/CVE-2026-92017.md) `CVE-2026-92017` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 15 Sept 2026 · Tags: Privilege escalation - [Privilege escalation in the WebExtensions component](https://agentprime.io/advisories/CVE-2026-92015.md) `CVE-2026-92015` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 15 Sept 2026 · Tags: Privilege escalation - [Leapp-repository: leapp-upgrade-el9toel10: leapp-upgrade-el9toel10: scan_mysql runs mysqld --validate-config as root and can load mysql-writable plugins](https://agentprime.io/advisories/CVE-2026-75092.md) `CVE-2026-75092` · CVE record: Red Hat Red Hat Enterprise Linux 9 and 3 more · CVSS 7.3 High · Not analysed yet · Published 15 Sept 2026 · Tags: Privilege escalation - [Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.23 - Authenticated (Subscriber+) Privilege Escalation via map_meta_cap Filter](https://agentprime.io/advisories/CVE-2026-75983.md) `CVE-2026-75983` · CVE record: arraytics Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce · CVSS 7.5 High · Not analysed yet · Published 15 Sept 2026 · Tags: Privilege escalation - [SourceCodester College Notes Gallery Management System Registration Flow signup.php privileges management](https://agentprime.io/advisories/CVE-2026-90856.md) `CVE-2026-90856` · CVE record: SourceCodester College Notes Gallery Management System · CVSS 6.9 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Privilege escalation - [PHPGurukul Hostel Management System checklogin.php access control](https://agentprime.io/advisories/CVE-2026-90851.md) `CVE-2026-90851` · CVE record: PHPGurukul Hostel Management System · CVSS 5.3 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Privilege escalation, Broken access control - [Incorrect privilege assignment in the admin user-management component of Webkul Bagisto 2.4.9 allows an authenticated backend user holding only the settings.users.edit permission to escalate to full…](https://agentprime.io/advisories/CVE-2026-79411.md) `CVE-2026-79411` · CVE record · CVSS 8.8 High · Not analysed yet · Published 15 Sept 2026 · Tags: Privilege escalation - [Improper privilege management in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-86893.md) `CVE-2026-86893` · CVE record: Apple iOS and iPadOS and 3 more · CVSS 3.3 Low · Not analysed yet · Published 14 Sept 2026 · Tags: Privilege escalation - [Improper privilege management in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-86888.md) `CVE-2026-86888` · CVE record: Apple iOS and iPadOS and 4 more · CVSS 3.3 Low · Not analysed yet · Published 14 Sept 2026 · Tags: Privilege escalation - [Improper privilege management in Apple macOS](https://agentprime.io/advisories/CVE-2026-84587.md) `CVE-2026-84587` · CVE record: Apple macOS · CVSS 5.5 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Privilege escalation - [Improper privilege management in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-86884.md) `CVE-2026-86884` · CVE record: Apple iOS and iPadOS and 3 more · CVSS 5.5 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Privilege escalation - [Improper privilege management in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-65354.md) `CVE-2026-65354` · CVE record: Apple iOS and iPadOS and 1 more · CVSS 8.2 High · Not analysed yet · Published 14 Sept 2026 · Tags: Privilege escalation - [Improper privilege management in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-84603.md) `CVE-2026-84603` · CVE record: Apple iOS and iPadOS and 2 more · CVSS 5.5 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Privilege escalation - [Improper privilege management in Apple Safari and others](https://agentprime.io/advisories/CVE-2026-64753.md) `CVE-2026-64753` · CVE record: Apple Safari and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Privilege escalation - [cosmicstack-labs mercury-agent Shell Command Permission permissions.ts checkShellCommand privileges assignment](https://agentprime.io/advisories/CVE-2026-90812.md) `CVE-2026-90812` · CVE record: cosmicstack-labs mercury-agent · CVSS 5.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Privilege escalation - [cosmicstack-labs mercury-agent Shell Command Permission Check permissions.ts PermissionManager.checkShellCommand improper authorization](https://agentprime.io/advisories/CVE-2026-90810.md) `CVE-2026-90810` · CVE record: cosmicstack-labs mercury-agent · CVSS 5.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Privilege escalation, Broken access control - [Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center](https://agentprime.io/advisories/CVE-2026-86830.md) `CVE-2026-86830` · CVE record: AWS iam-identity-center-team · CVSS 8.6 High · Not analysed yet · Published 14 Sept 2026 · Tags: Privilege escalation, CWE-1220 - [October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls](https://agentprime.io/advisories/GHSA-xv9m-fm3w-8w5x.md) `GHSA-xv9m-fm3w-8w5x`, `CVE-2026-46696`, `PKSA-m19v-7rfv-5pmv` · Packagist `october/system`: affected `<3.7.17 || >=4.0.0, <4.2.23`, fixed in `3.7.17`, `4.2.23` · CVSS 3.3 Low · Not analysed yet · Published 14 Sept 2026 · Tags: Privilege escalation, Broken access control - [Soarkey StudentManagement Registration Workflow register.html RegisterServlet.doPost privileges management](https://agentprime.io/advisories/CVE-2026-90787.md) `CVE-2026-90787` · CVE record: Soarkey StudentManagement · CVSS 6.9 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Privilege escalation - [Apache Syncope: Delegating users can grant unowned Roles](https://agentprime.io/advisories/CVE-2026-73470.md) `CVE-2026-73470` · CVE record: Apache Software Foundation Apache Syncope · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Privilege escalation - [Apache Syncope: Privilege escalation for admin user via JWT authentication](https://agentprime.io/advisories/CVE-2026-78330.md) `CVE-2026-78330` · CVE record: Apache Software Foundation Apache Syncope · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Privilege escalation - [Parallels Desktop local privilege escalation via appliance extract argument injection](https://agentprime.io/advisories/CVE-2026-90894.md) `CVE-2026-90894` · CVE record: Parallels Parallels Desktop for Mac · CVSS 7.8 High · Not analysed yet · Published 14 Sept 2026 · Tags: Command injection, Privilege escalation - [Local privilege escalation in the Logi Options+ updater service on Windows](https://agentprime.io/advisories/CVE-2026-12518.md) `CVE-2026-12518` · CVE record: Logitech Logi Options+ · CVSS 8.5 High · Not analysed yet · Published 14 Sept 2026 · Tags: Privilege escalation - [Rizwan17 inventory-management-system Registration register.php createUserAccount improper authorization](https://agentprime.io/advisories/CVE-2026-90566.md) `CVE-2026-90566` · CVE record: Rizwan17 inventory-management-system · CVSS 6.9 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Privilege escalation, Broken access control - [Rizwan17 inventory-management-system dashboard.php access control](https://agentprime.io/advisories/CVE-2026-90565.md) `CVE-2026-90565` · CVE record: Rizwan17 inventory-management-system · CVSS 6.9 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Privilege escalation, Broken access control - [jaychouchannel Tourism-Management-System User Register Endpoint UsersController.java privileges management](https://agentprime.io/advisories/CVE-2026-90523.md) `CVE-2026-90523` · CVE record: jaychouchannel Tourism-Management-System · CVSS 6.9 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Privilege escalation - [jaychouchannel Tourism-Management-System Authorization Interceptor AuthorizationInterceptor.java improper authorization](https://agentprime.io/advisories/CVE-2026-90520.md) `CVE-2026-90520` · CVE record: jaychouchannel Tourism-Management-System · CVSS 5.3 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Privilege escalation, Broken access control - [PHPGurukul Bank Locker Management System sidebar.php access control](https://agentprime.io/advisories/CVE-2026-90518.md) `CVE-2026-90518` · CVE record: PHPGurukul Bank Locker Management System · CVSS 5.3 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Privilege escalation, Broken access control - [vvbbnn00 WARP-Clash-API Subscription subscription.py get_surge_subscription access control](https://agentprime.io/advisories/CVE-2026-90507.md) `CVE-2026-90507` · CVE record: vvbbnn00 WARP-Clash-API · CVSS 5.3 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Privilege escalation, Broken access control - [lenve vhr HrMapper.xml HrInfoController.updateHr privileges management](https://agentprime.io/advisories/CVE-2026-90501.md) `CVE-2026-90501` · CVE record: lenve vhr · CVSS 5.3 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Privilege escalation - [lenve vhr Password Update pass HrInfoController.updatePass improper authorization](https://agentprime.io/advisories/CVE-2026-90499.md) `CVE-2026-90499` · CVE record: lenve vhr · CVSS 5.3 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Privilege escalation, Broken access control - [Simple Membership < 4.7.8 - Subscriber+ Membership Level Escalation via PayPal Standard subsc_ref](https://agentprime.io/advisories/CVE-2026-88764.md) `CVE-2026-88764` · CVE record: Unknown Simple Membership · CVSS 5.4 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Privilege escalation Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .