Privilege escalation.

TDengine: Standard User permission unexpect

• taosdata TDengine
• Privilege escalation

CVE-2026-14961

• Pegatron Corp. Tdelo64.sys
• Privilege escalation
• CWE-20

CVE-2026-14960

• Pegatron Corp. Tdelo64.sys
• Privilege escalation
• Broken access control

FastGPT: Untrusted PR artifacts are pushed and deployed by privileged preview workflows

• labring FastGPT
• Privilege escalation
• CWE-494

phpMyFAQ - Privilege Escalation via Missing SuperAdmin Guard in user/add Endpoint

• phpMyFAQ
• Privilege escalation

Improper privilege management in Dell PowerScale OneFS

• Dell PowerScale OneFS
• Privilege escalation

Woodpecker: Privilege escalation via unrestricted serviceAccountName in the Kubernetes backend

• Privilege escalation
• Broken access control

>=1.0.0, <=1.0.4 · no fixed version yet

Windows Group Policy Elevation of Privilege Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• Privilege escalation

Microsoft Install Service Elevation of Privilege Vulnerability

• Microsoft Windows 10 Version 1809
• Microsoft Windows 10 Version 21H2
• Privilege escalation

Windows Zero Trust DNS Security Feature Bypass Vulnerability

• Microsoft Windows 11 Version 24H2
• Microsoft Windows 11 Version 25H2
• Privilege escalation

Windows WalletService Elevation of Privilege Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• Path traversal
• Privilege escalation

Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges

• Citrix Secure Access Client for Windows
• Citrix Endpoint Analysis Client for Windows
• Privilege escalation

waooAI waoowaoo Media hash.ts stablePublicIdFromStorageKey improper authorization

• waooAI waoowaoo
• Privilege escalation
• Broken access control

Shiori Authenticated Privilege Escalation via PATCH /api/v1/auth/account

• shiori
• Privilege escalation

Apache Airflow FAB provider: FAB auth manager: a DAG named "DAGs" hijacks the global all-DAGs permission (access_control privilege escalation via resource_name() collision)

• Apache Software Foundation Apache Airflow FAB provider
• Privilege escalation

Redhatinsights/incluster-checks: incluster-checks: privileged host-chroot debug pods created in shared default namespace enable privilege escalation to node root

• Pen Drive Powered by Red Hat Lightspeed
• Privilege escalation

WordPress MailOptin plugin <= 1.2.77.3 - Privilege Escalation vulnerability

• properfraction MailOptin
• Privilege escalation

WordPress Houzez Login Register plugin <= 3.3.3 - Privilege Escalation vulnerability

• favethemes Houzez Login Register
• Privilege escalation

WordPress MailerPress plugin <= 2.0.2 - Privilege Escalation vulnerability

• MailerPress
• Privilege escalation

WordPress aBlocks plugin < 2.9.1 - Privilege Escalation vulnerability

• Kodezen LLC aBlocks
• Privilege escalation

An issue in D-Link DIR-1253 v.1.0.1.250923.142435 allows an attacker to escalate privileges via the etc/shadow component file

• Privilege escalation

Leantime API saveSetting improper authorization

• Leantime
• Privilege escalation
• Broken access control

Leantime JSON-RPC Endpoint addUser improper authorization

• Leantime
• Privilege escalation
• Broken access control

OpenWrt luci-app-samba4 read ACL remote code execution via smbd

• openwrt luci
• Privilege escalation

AstrBotDevs AstrBot Scheduled Task cron_tools.py FutureTaskTool.call improper authorization

• AstrBot
• Privilege escalation
• Broken access control

QILING Disk Master Kernel Driver diskbckp.sys access control

• QILING Disk Master
• Privilege escalation
• Broken access control

MiniTool Partition Wizard Signed Kernel Driver pwdrvio.sys access control

• MiniTool Partition Wizard
• Privilege escalation
• Broken access control

Eleveo Call Recording Software audio.jsp improper authorization

• Eleveo Call Recording Software
• Privilege escalation
• Broken access control

Eleveo Call Recording Software Recorded Calls restoreCallAction.do improper authorization

• Eleveo Call Recording Software
• Privilege escalation
• Broken access control

Eleveo Call Recording Software composeEmailAction.do improper authorization

• Eleveo Call Recording Software
• Privilege escalation
• Broken access control

Eleveo Call Recording Software pci_dss_status.jsp improper authorization

• Eleveo Call Recording Software
• Privilege escalation
• Broken access control

Eleveo Call Recording Software group.jsp improper authorization

• Eleveo Call Recording Software
• Privilege escalation
• Broken access control

Simple JWT Login <= 3.6.6 - Authenticated (Subscriber+) Authentication Bypass to Privilege Escalation via 'payload' Parameter

• nicu_m Simple JWT Login – Allows you to use JWT on REST endpoints.
• Privilege escalation

WP Grid Builder <= 2.3.3 - Authenticated (Subscriber+) Privilege Escalation via 'key' Parameter

• WP Grid Builder
• Privilege escalation

Eleveo Call Recording Software sendlogfile improper authorization

• Eleveo Call Recording Software
• Privilege escalation
• Broken access control

Eleveo Call Recording Software statisticReportAction.do improper authorization

• Eleveo Call Recording Software
• Privilege escalation
• Broken access control

Eleveo Call Recording Software LDAP User users_ldap.jsp improper authorization

• Eleveo Call Recording Software
• Privilege escalation
• Broken access control

Eleveo Call Recording Software Group roleAddAction.do improper authorization

• Eleveo Call Recording Software
• Privilege escalation
• Broken access control

Eleveo Call Recording Software userAddAction.do improper authorization

• Eleveo Call Recording Software
• Privilege escalation
• Broken access control

Apache IoTDB: Authenticated users can escalate to full tree-path access by renaming themselves to __internal_auditor

• Apache Software Foundation Apache IoTDB
• Privilege escalation
• Broken access control

Sipeed PicoClaw Launcher access_control.go IPAllowlist access control

• Sipeed PicoClaw
• Privilege escalation
• Broken access control

An issue in Invixium IXM WEB v.2.3.85.25 allows an attacker to escalate privileges via the /SystemUsers/CreateAppUser components

• Privilege escalation

Zen: Context-menu "Open link in glance" / "Split link in new tab" loads a page-controlled link with the System principal, bypassing the web-content scheme restriction

• zen-browser desktop
• Privilege escalation

Discourse: Signup-time primary_group_id assignment grants whisperer access

• discourse
• Privilege escalation

TOTOLINK EX200 Web boa.conf least privilege violation

• TOTOLINK A3000RU
• TOTOLINK A3100R
• Privilege escalation
• CWE-272

D-link DIR-823G Web boa.conf least privilege violation

• D-link DIR-823G
• Privilege escalation
• CWE-272

Prisma Browser: Local Privilege Escalation on macOS

• Palo Alto Networks Prisma Browser
• Privilege escalation

Cortex XDR Broker VM: Privilege Escalation (PE) Vulnerability

• Palo Alto Networks Cortex XDR Broker VM
• Privilege escalation

Multiple RBAC issues in XAPI

• Xen XAPI
• Privilege escalation

Multiple RBAC issues in XAPI

• Xen XAPI
• Privilege escalation

manjurulhoque django-job-portal Employee Dashboard Endpoint views.py EditEmployeeProfileAPIView access control

• manjurulhoque django-job-portal
• Privilege escalation
• Broken access control

Multiple RBAC issues in XAPI

• Xen XAPI
• Privilege escalation

Multiple RBAC issues in XAPI

• Xen XAPI
• Privilege escalation

Multiple RBAC issues in XAPI

• Xen XAPI
• Privilege escalation

Incorrect privilege assignment for Arc sensors in Guardian/CMC before 26.2.0

• Nozomi Networks Guardian
• Nozomi Networks CMC
• Privilege escalation

Frigate viewer can read logs exposing admin and camera credentials

• blakeblackshear frigate
• Privilege escalation
• Information disclosure

Themehunk Login Registration <= 1.0.2 - Unauthenticated Privilege Escalation via 'role' Parameter

• themehunk TH Login Registration
• Privilege escalation

多说社会化评论框 <= 1.2 - Unauthenticated Privilege Escalation via api.php 'option'/'value' Parameters

• shen2 多说社会化评论框
• Privilege escalation

Backstage <= 1.4.2 - Unauthenticated Privilege Escalation via Permissive Demo Role Capabilities

• pixelgrade Backstage – Customizer Demo Access
• Privilege escalation

FluxInk Color Management Driver local privilege escalation

• FluxInk Color Management Driver
• Privilege escalation