Privilege escalation.

Wholesale Market <= 2.2.2 - Authenticated (Subscriber+) Privilege Escalation via 'role_required' Parameter

• cedcommerce Wholesale Market
• Privilege escalation

bLoyal: Loyalty & Promotions by bLoyal <= 3.1.611.78 - Authenticated (Subscriber+) Privilege Escalation via Unprotected AJAX API URL Settings

• connectordev bLoyal: Loyalty & Promotions by bLoyal
• Privilege escalation

Propovoice: All-in-One Client Management System <= 1.7.8 - Authenticated (ndpv_manager+) Privilege Escalation via 'role' Parameter

• fassionstorage Propovoice: All-in-One Client Management System
• Privilege escalation

Microsoft Defender Elevation of Privilege Vulnerability

• Microsoft Malware Protection Engine
• Path traversal
• Privilege escalation

TRENDNET TEW-813DRU vsftpd vsftpd.conf default permission

• TRENDNET TEW-813DRU
• Privilege escalation
• Broken access control

Improper privilege management in Dell Wyse Management Suite (WMS)

• Dell Wyse Management Suite (WMS)
• Privilege escalation

Improper privilege management in Dell Wyse Management Suite (WMS)

• Dell Wyse Management Suite (WMS)
• Privilege escalation

CVE-2026-16772

• Akaunting
• Privilege escalation
• Broken access control

Webkul Bagisto Customer Item Deletion Endpoint access control

• Webkul Bagisto
• Privilege escalation
• Broken access control

Grav 1.0.6 through 1.0.11 Privilege Escalation via Scoped API Keys

• getgrav grav-plugin-api
• Privilege escalation

Grav API Plugin before 1.0.13 RCE via ConfigController scope bypass

• grav
• Privilege escalation

Grav before 1.0.13 API Key Scope Bypass via UsersController

• grav
• Privilege escalation

Grav before 1.0.13 API Key Scope Bypass via InvitationsController

• grav
• Privilege escalation

Grav API Plugin before 1.0.13 Scope Bypass via createApiKey

• getgrav grav-plugin-api
• Privilege escalation

Essential Addons for Elementor < 6.7.2 - Unauthenticated Privilege Escalation via Custom Profile Field Mass Assignment

• Essential Addons for Elementor
• Privilege escalation

OpenWrt LuCI luci-mod-system-mounts ACL Root RCE via Crontab Write

• openwrt luci
• Privilege escalation

filebrowser through 2.63.16 Privilege Escalation via Signup

• filebrowser
• Privilege escalation

FreePBX: Authenticated Arbitrary SSH Key Injection via Backup Module

• FreePBX backup
• Privilege escalation
• Broken access control

IBM i Is Affected By Multiple Vulnerabilities in IBM Java SDK and IBM Java Runtime

• i
• Privilege escalation

IBM i Is Affected By Multiple Vulnerabilities in IBM Java SDK and IBM Java Runtime

• i
• Privilege escalation

IBM i is Affected By Multiple Vulnerabilities in WebSphere Application Server Liberty

• i
• Privilege escalation

IBM i is Affected By An Improper Privilege Management Vulnerability in LDAP []

• i
• Privilege escalation

IBM i is Affected By Multiple Vulnerabilities in DRDA / DDM

• i
• Privilege escalation

IBM i is Affected By An Unauthorized Privileges Vulnerability in SQL []

• i
• Privilege escalation

Improper Privilege Management in Kibana Fleet Leading to Over-Scoped Elastic Agent API Keys

• Elastic Kibana
• Privilege escalation

IBM i is Affected By An Improper Management Vulnerability in HTTP Server []

• i
• Privilege escalation

Gitea runner registration-token GET endpoint performs a write under a read-only token scope

• Gitea Open Source Git Server
• Privilege escalation

WordPress Directories Pro plugin <= 2.0.5 - Privilege Escalation vulnerability

• Onokazu Directories Pro
• Privilege escalation

WordPress SMS Alert Order Notifications plugin <= 3.9.7 - Privilege Escalation vulnerability

• Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications
• Privilege escalation

WordPress SAML SP Single Sign On plugin <= 5.4.3 - Privilege Escalation vulnerability

• miniOrange SAML SP Single Sign On
• Privilege escalation

WordPress Service Finder Booking plugin <= 6.2 - Privilege Escalation vulnerability

• Aonetheme Service Finder Booking
• Privilege escalation

WordPress MStore API plugin <= 4.20.0 - Privilege Escalation vulnerability

• FluxBuilder MStore API
• Privilege escalation

KiviCare < 4.5.2 - Unauthenticated Privilege Escalation via Registration

• KiviCare
• Privilege escalation

UpSnap - Unauthenticated Initial-Superuser Takeover Chains to Root RCE via wake_cmd

• seriousm4x UpSnap
• Command injection
• Privilege escalation

Insights-client: insights-client: clusterrole grants cluster-wide secrets get/list/watch beyond least privilege

• Red Hat Advanced Cluster Management for Kubernetes 2.11
• Red Hat Advanced Cluster Management for Kubernetes 2.13
• Privilege escalation

Multicloud-operators-subscription: multicloud-operators-subscription: hub and spoke serviceaccounts bound to wildcard rbac (*/*/*)

• Red Hat Advanced Cluster Management for Kubernetes 2.11
• Red Hat Advanced Cluster Management for Kubernetes 2.13
• Privilege escalation

IBM i is Affected By Multiple Vulnerabilities in the Debug Server

• i
• Privilege escalation

IBM i is Affected By Improper Validation Vulnerability in Line Printer Daemon []

• i
• Privilege escalation

Incorrect Privilege Assignment in GitLab

• GitLab
• Privilege escalation

Cluster-curator-controller: cluster-curator-controller: tenant-controllable trigger creates clusterrolebinding granting cluster-wide secrets access to namespace-local sa

• Red Hat multicluster engine for Kubernetes 2.10
• Red Hat multicluster engine for Kubernetes 2.11
• Privilege escalation

IBM i is Affected By A Privilege Escalation Vulnerability []

• i
• Privilege escalation

IBM i is Affected By Multiple Vulnerabilities in SQL

• i
• Privilege escalation

IBM i is Affected By Multiple Vulnerabilities in Navigator for i

• i
• Privilege escalation

IBM i is Affected By Multiple Vulnerabilities in Navigator for i

• i
• Privilege escalation

IBM i is Affected By improper privilege management in Navigator for i

• i
• Privilege escalation

WebPros Plesk: Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2…

• WebPros Plesk
• Privilege escalation

Project Resource Managers may escalate privileges in JFrog Artifactory

• jfrog artifactory
• Privilege escalation

RustFS: AddServiceAccount Handler Allows Creation of Root-Parent Service Accounts

• rustfs
• Privilege escalation

Events Manager < 7.4.1 - Unauthenticated Privilege Escalation to Administrator

• Events Manager
• Privilege escalation

Multicloud-operators-channel: multicloud-operators-channel: auto-generated role grants every managed-cluster agent secrets:get,list,watch in channel namespaces

• Red Hat Advanced Cluster Management for Kubernetes 2.11
• Red Hat Advanced Cluster Management for Kubernetes 2.13
• Privilege escalation

Acm-search-v2-api-rhel9: search-v2-api: cross-user bearer-token reuse via global federation-config cache

• Red Hat Advanced Cluster Management for Kubernetes 2.11
• Red Hat Advanced Cluster Management for Kubernetes 2.13
• Privilege escalation

Improper Authorization in MongoDB profile Command Allows Unauthorized Modification of Server-Wide Diagnostic Settings

• MongoDB Server
• Privilege escalation

AcyMailing <= 10.11.1 - Authenticated (Subscriber+) Missing Authorization to Account Takeover via Notification Template Update

• acyba AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress
• Privilege escalation

Cursor: Sandbox escape via launching privileged containers

• cursor
• Privilege escalation

Windows Package Manager Elevation of Privilege Vulnerability

• Microsoft App Installer
• Privilege escalation

Microsoft High Performance Computing (HPC) Pack Elevation of Privilege Vulnerability

• Microsoft HPC Pack 2019
• Privilege escalation

Improper privilege management in Intel(R) PROSet/Wireless WiFi Software for Windows

• Intel(R) PROSet/Wireless WiFi Software for Windows
• Privilege escalation

Authentik Security authentik - Privilege Escalation

• authentik
• Privilege escalation

Authentik Security authentik - Privilege Escalation

• authentik
• Privilege escalation

Odh-training-operator-rhel9: rhoai fork aggregates training job create onto native edit/admin clusterroles

• Red Hat OpenShift AI 2.25
• Red Hat OpenShift AI 3.3
• Privilege escalation