Privilege escalation.

Industrial Application Software IAS Canias ERP RMI iasGetServerInfoEvent improper authorization

• Industrial Application Software IAS Canias ERP
• Privilege escalation
• Broken access control

Dotouch XproUPF access control

• Dotouch XproUPF
• Privilege escalation
• Broken access control

Plainpad: Privilege Escalation via Writable Admin Field in Profile Update (Access Control)

• alextselegidis plainpad
• Privilege escalation

bubblewrap vulnerable to privilege escalation in setuid mode via ptrace

• containers bubblewrap
• Privilege escalation

SysReptor: Privilege Escalation from User Admin to Superuser

• Syslifters sysreptor
• Privilege escalation

People: Privilege Escalation via Missing Role Ceiling in Mail Domain Invitation

• suitenumerique people
• Privilege escalation

PredatorSense V3: Local Privilege Escalation (LPE) vulnerability

• Acer PredatorSense V3
• Path traversal
• Privilege escalation

NAVER MYBOX Explorer: NAVER MYBOX Explorer for Windows before 3.0.11.160 allows a local attacker to escalate…

• NAVER MYBOX Explorer
• Privilege escalation

eladmin Users API Endpoint UserController.java checkLevel access control

• eladmin
• Privilege escalation
• Broken access control

CISA manage.get.gov insecure portfolio administrative privileges

• CISA manage.get.gov
• Privilege escalation

Low-privileged Grav API users can create super-admin accounts via blueprint-upload

• Privilege escalation
• Unrestricted file upload

<2.0.0-beta.4 · fixed in 2.0.0-beta.4

Improper privilege management in Google Chrome

• Google Chrome
• Privilege escalation

Improper privilege management in Google Chrome

• Google Chrome
• Privilege escalation

Improper privilege management in Google Chrome

• Google Chrome
• Privilege escalation

Local privilege escalation vulnerability in ZTE PROCESS Guard service of the cloud computer client

• ZTE PROCESS Guard service
• Privilege escalation

ciguard: Container image runs as root (no USER directive)

• Privilege escalation

>=0.1.0, <0.8.2 · fixed in 0.8.2

Grav Vulnerable to Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic

• Privilege escalation
• Broken access control

<2.0.0-beta.2 · fixed in 2.0.0-beta.2

runZero Platform dashboard configuration exposure

• runZero Platform
• Privilege escalation

Mentoring <= 1.2.8 - Unauthenticated Privilege Escalation in mentoring_process_registration

• dreamstechnologies Mentoring
• Privilege escalation

OpenClaw's ACP child sessions inherit subagent security envelope constraints

• Privilege escalation
• CWE-277

<2026.4.22 · fixed in 2026.4.22

Apache HTTP Server: mod_rewrite elevation of privileges via ap_expr

• Apache Software Foundation Apache HTTP Server
• Privilege escalation

GeoVision LPC2011/LPC2211 Web Interface privilege escalation vulnerability

• GeoVision Inc. GV-LPC2011/LPC2211
• Privilege escalation

crocodilestick Calibre-Web-Automated Kobo auth-token Route kobo_auth.py generate_auth_token improper authorization

• crocodilestick Calibre-Web-Automated
• Privilege escalation
• Broken access control

janeczku Calibre-Web Endpoint kobo_auth.py generate_auth_token improper authorization

• janeczku Calibre-Web
• Privilege escalation
• Broken access control

eyeo Adblock Plus Legacy Premium Activation premium.preload.js postMessage access control

• eyeo Adblock Plus
• Privilege escalation
• Broken access control

ChatGPTNextWeb NextChat actions.ts addMcpServer improper authorization

• ChatGPTNextWeb NextChat
• Privilege escalation
• Broken access control

code-projects Online Hospital Management System Registration improper authorization

• code-projects Online Hospital Management System
• Privilege escalation
• Broken access control

Import and export users and customers <= 2.0.8 - Authenticated (Subscriber+) Privilege Escalation via Multisite Capability Meta Fields

• carazo Import and export users and customers
• Privilege escalation

JeecgBoot FillRuleUtil edit improper authorization

• JeecgBoot
• Privilege escalation
• Broken access control

AGL app-framework-binder (afb-daemon) through v19.90.0 contains a privilege escalation vulnerability in the supervision Do command.

• Privilege escalation

An issue in the component DirectIo64.sys of PassMark BurnInTest v11.0 Build 1011, OSForensics v11.1 Build 1007, and PerformanceTest v11.1 Build 1004 allows attackers to access kernel memory and escal…

• Privilege escalation
• CWE-20

nextlevelbuilder GoClaw/GoClaw Lite RPC improper authorization

• nextlevelbuilder GoClaw
• nextlevelbuilder GoClaw Lite
• Privilege escalation
• Broken access control

IBM Turbonomic Prometurbo agent used by IBM Turbonomic Application Resource Management is affected by a single vulnerability

• IBM Turbonomic prometurbo agent
• Privilege escalation

1024-lab smart-admin Demo Site index.html access control

• 1024-lab smart-admin
• Privilege escalation
• Broken access control

Improper Access Control in TUBITAK BILGEM's Pardus Software Center

• TUBITAK BILGEM Software Technologies Research Institute Pardus Software Center
• Privilege escalation
• Broken access control

An issue in the TVicPort64.sys component of EnTech Taiwan TVicPort Product v4.0, File v5.2.1.0 allows attackers to escalate privileges via sending crafted IOCTL 0x80002008 requests.

• Privilege escalation
• CWE-20

o2oa NodeAgent NodeAgent.java syncFile improper authorization

• o2oa
• Privilege escalation
• Broken access control

Privilege Escalation in multiple BinSoft products

• BinSoft mpGabinet
• BinSoft mpFirma
• Privilege escalation

LatePoint <= 5.4.1 - Authenticated (Agent+) Privilege Escalation to Administrator via 'connect-customer-to-wp-user' Ability

• LatePoint – Calendar Booking Plugin for Appointments and Events
• Privilege escalation

Wooey has an Incorrect Privilege Assignment issue

• Privilege escalation
• Broken access control

<0.13.3rc1 · fixed in 0.13.3rc1

Execution with unnecessary privileges in Dell Alienware Command Center (AWCC)

• Dell Alienware Command Center (AWCC)
• Privilege escalation

WordPress Directorist Social Login plugin < 2.1.4 - Privilege Escalation vulnerability

• Directorist Social Login
• Privilege escalation

code-projects Invoice System in Laravel API Endpoint item improper authorization

• code-projects Invoice System in Laravel
• Privilege escalation
• Broken access control

code-projects Invoice System in Laravel Invoice Endpoint invoice improper authorization

• code-projects Invoice System in Laravel
• Privilege escalation
• Broken access control

code-projects Invoice System in Laravel Profile profile improper authorization

• code-projects Invoice System in Laravel
• Privilege escalation
• Broken access control

code-projects Invoice System in Laravel User Management user improper authorization

• code-projects Invoice System in Laravel
• Privilege escalation
• Broken access control

Highland Software Custom Role Manager <= 1.0.0 - Authenticated (Subscriber+) Privilege Escalation

• jgrodgers Highland Software Custom Role Manager
• Privilege escalation

The Fan Control application V251 contains an improper privilege handling vulnerability in its Open File Dialog.

• Privilege escalation

vanna-ai vanna Legacy Flask API improper authorization

• vanna
• Privilege escalation
• Broken access control

Duplicate Advisory: OpenClaw: Gateway operator.write Can Reach Admin-Class Telegram Config and Cron Persistence via send

• Privilege escalation

<2026.3.28 · fixed in 2026.3.28

OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment

• Command injection
• Code injection

<2.0.3 · fixed in 2.0.3

OpenC3 COSMOS: Permissions Bypass Provides User Access to Unassigned Administrative Actions via Script Runner Tool

• Privilege escalation

<7.0.0-rc3 · fixed in 7.0.0-rc3

Multiple Vulnerabilities in IBM Guardium Key Lifecycle Manager

• IBM Guardium Key Lifecycle Manager
• Privilege escalation

IBM WebSphere Application Server Liberty is affected by identity spoofing

• IBM WebSphere Application Server - Liberty
• Privilege escalation

Missing large page handling in pmap_pkru_update_range()

• FreeBSD
• Privilege escalation
• Broken access control

Incorrect privilege assignment in Portal for ArcGIS

• Esri Portal for ArcGIS
• Privilege escalation

Incorrect privilege assignment in Portal for ArcGIS

• Esri Portal for ArcGIS
• Privilege escalation

Execution with unnecessary privileges in Oracle Corporation Oracle Java SE

• Oracle Corporation Oracle Java SE
• Privilege escalation

Neko has a Self-service Privilege Escalation for Authenticated Users

• Privilege escalation
• Broken access control

>=0.0.0-20250322225643-212bf8a60756, <0.0.0-20260406184107-c54bcf1ee211 || >=3.0.0, <3.0.11 · fixed in 0.0.0-20260406184107-c54bcf1ee211, 3.0.11

Privilege escalation in the Debugger component

• Mozilla Firefox
• Mozilla Thunderbird
• Privilege escalation