Privilege escalation.

Razer RzUpdateService Named Pipe RzUpdateService.exe privileges management

• Razer RzUpdateService
• Privilege escalation

CVE-2026-15430

• Wellbia XIGNCODE3
• Privilege escalation
• Broken access control

Telenia TVox 26.5.3 Privilege Escalation via Insecure sudoers Configuration

• Telenia Software TVox
• Privilege escalation

Import and export users and customers < 2.4.2 - Custom Role Privilege Escalation to Administrator via CSV Import

• Import and export users and customers
• Privilege escalation

GL.iNet E5800/E750/X2000/X3000/XE3000/XE300 eSIM LPA API v1 improper authorization

• GL.iNet E5800
• GL.iNet E750
• Privilege escalation
• Broken access control

ArcadeDB before 26.7.3 Privilege Escalation via JavaScript Trigger

• ArcadeData arcadedb
• Privilege escalation

Pouco Import Users <= 1.0.0 - Unauthenticated Privilege Escalation

• POUCO Import Users
• Privilege escalation

Pronamic Pay <= 10.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms 'Update user role' Field

• Pronamic Pay
• Privilege escalation

Profile Builder < 3.16.4 - Unauthenticated Account Takeover via Auto-Login After Registration

• User Profile Builder
• Privilege escalation

Subscriptions for WooCommerce <= 2.0.0 - Authenticated (Contributor+) Privilege Escalation via '_wps_plan_user_role' Membership Plan Meta

• wpswings Subscriptions for WooCommerce
• Privilege escalation

Capsule has an incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation)

• Privilege escalation
• Broken access control

>=0.13.0, <0.13.8 · fixed in 0.13.8

Ultimate Member < 2.12.1 - Unauthenticated Privilege Escalation via Role Selection Field

• Ultimate Member
• Privilege escalation

Demi - One Click Demo Import, Backup & Site Migration < 0.0.7 - Unauthenticated Sensitive Data Exposure via Public Backup Directory

• Demi
• Privilege escalation

IBM WebSphere Application Server Liberty is affected by a cross-site request forgery

• IBM WebSphere Application Server - Liberty
• Privilege escalation

ProfileGrid < 5.9.9.8 - Unauthenticated Privilege Escalation via Unrestricted Group ID

• ProfileGrid
• Privilege escalation

Improper privilege management in Google Chrome

• Google Chrome
• Privilege escalation

Improper privilege management in Google Chrome

• Google Chrome
• Privilege escalation

Improper privilege management in Google Chrome

• Google Chrome
• Privilege escalation

Improper privilege management in Google Chrome

• Google Chrome
• Privilege escalation

Improper privilege management in Google Chrome

• Google Chrome
• Privilege escalation

Improper privilege management in Google Chrome

• Google Chrome
• Privilege escalation

Improper privilege management in Google Chrome

• Google Chrome
• Privilege escalation

Improper privilege management in Google Chrome

• Google Chrome
• Privilege escalation

Improper privilege management in Google Chrome

• Google Chrome
• Privilege escalation

Improper privilege management in Google Chrome

• Google Chrome
• Privilege escalation

Improper privilege management in Google Chrome

• Google Chrome
• Privilege escalation

fuse-overlayfs release-1.x preserves SUID/SGID bits after truncate/open(O_TRUNC)

• containers fuse-overlayfs
• Privilege escalation

Wholesale for WooCommerce <= 2.0.5 - Authenticated (Author+) Privilege Escalation via 'user_role_set' Parameter

• saadiqbal Wholesale for WooCommerce
• Privilege escalation

Fission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAP_SYS_TIME and cross-tenant node wall-clock corruption

• Privilege escalation
• Broken access control

<1.25.0 · fixed in 1.25.0

WP Password Policy <= 3.7.1 - Authenticated (Subscriber+) Privilege Escalation

• teydeastudio WP Password Policy
• Privilege escalation

Criu: criu: container escape via rseq critical section hijack during checkpoint/restore

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Privilege escalation

Execution with unnecessary privileges in EnterpriseDB pglogical

• EnterpriseDB pglogical
• Privilege escalation

Eazy Plugin Manager <= 4.4.1 - Authenticated (Subscriber+) Privilege Escalation via pos_get_option AJAX Action and admin/login REST Endpoint

• eazyplugins Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress
• Privilege escalation

TrueBooker Appointment Booking < 1.2.4 - Unauthenticated Account Takeover via Password Reset

• TrueBooker
• Privilege escalation

JFrog Platform contains an authorization flaw that may allow authenticated privilege escalation.

• jfrog artifactory
• Privilege escalation

phpMyFAQ before 4.1.6 Privilege Escalation via Group Membership

• thorsten phpMyFAQ
• Privilege escalation

Custom Fields Account Registration For WooCommerce < 1.4 - Unauthenticated Privilege Escalation

• Custom Fields Account Registration For Woocommerce
• Privilege escalation

MemberGlut < 1.1.5 - Unauthenticated Privilege Escalation to Administrator

• MemberGlut
• Privilege escalation

nanocoai NanoClaw add_mcp_server request.ts handleAddMcpServer improper authorization

• nanocoai NanoClaw
• Privilege escalation
• Broken access control

nanocoai NanoClaw MCP Server Approval chat-sdk-bridge.ts createChatSdkBridge.setup improper authorization

• nanocoai NanoClaw
• Privilege escalation
• Broken access control

NousResearch hermes-agent SimpleX Gateway Authorization adapter.py access control

• NousResearch hermes-agent
• Privilege escalation
• Broken access control

Budibase: Privilege escalation via public role assignment API missing app-level authorization

• Privilege escalation
• Broken access control

<=3.38.1 · no fixed version yet

Loytec LINX firmware: Improper Privilege Management in /usr/bin/ltsudo

• Loytec LIP-ME20xC
• Loytec L-INX
• Privilege escalation

Accountsservice: accountsservice: arbitrary file read via seticonfile for systemd-homed users

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Privilege escalation

Local privilege escalation in ESET security applications for macOS

• ESET spol. s.r.o. ESET Endpoint Security for macOS
• ESET spol. s.r.o. ESET Cyber Security for macOS
• Privilege escalation

Local privilege escalation in ESET security applications for macOS

• ESET spol. s.r.o. ESET Endpoint Security for macOS
• ESET spol. s.r.o. ESET Cyber Security for macOS
• Privilege escalation

CAFEHAUS API <= 1.0.0 - Unauthenticated Arbitrary User Password Reset

• CAFEHAUS API
• Privilege escalation

ProfilePress < 4.16.18 - Unauthenticated Privilege Escalation via Registration Role Selection

• Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content
• Privilege escalation

Rapid7 InsightVM, Nexpose, and Insight Agent Local Privilege Escalation via Unvalidated Executable Invocation

• Rapid7 InsightVM
• Rapid7 Nexpose
• Privilege escalation

WPify Woo <= 5.4.16 - Authenticated (Shop Manager+) Privilege Escalation via Arbitrary Option Update via save_option REST Endpoint

• WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce
• Privilege escalation

OWASP DefectDojo API/Web serializers.py UserSerializer privileges management

• OWASP DefectDojo
• Privilege escalation

victor Web - Priviledge Escalation

• Johnson Controls victor Web
• Privilege escalation

CVE-2026-15630

• Casdoor
• Privilege escalation
• Broken access control

Grav API Plugin 1.0.9 Privilege Escalation via Invitations groups

• grav
• Privilege escalation

WordPress TrueBooker plugin <= 1.2.3 - Privilege Escalation vulnerability

• themetechmount TrueBooker
• Privilege escalation

WordPress WP BASE Booking plugin <= 6.3.1 - Privilege Escalation vulnerability

• Hakan Ozevin WP BASE Booking
• Privilege escalation

WordPress SMS Alert Order Notifications plugin <= 3.9.6 - Privilege Escalation vulnerability

• Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications
• Privilege escalation

MDJM Event Management <= 1.7.8.4 - Authenticated (Subscriber+) Privilege Escalation via 'set-permissions' and 'change_role' Handlers

• MDJM Event Management
• Privilege escalation

An issue in Unistal Systems Pvt.

• Privilege escalation
• CWE-782

Deserialization of untrusted data in Oracle Corporation Oracle Platform Security for Java

• Oracle Corporation Oracle Platform Security for Java
• Privilege escalation
• Authentication bypass