Privilege escalation.

Odh-training-operator-rhel9: [trainer v2 security] trn-02: rhoai overlay aggregates trainjobs crud into standard edit clusterrole

• Red Hat OpenShift AI 3.3
• Red Hat OpenShift AI 3.4
• Privilege escalation
• Broken access control

Odh-dashboard: odh-dashboard: confused-deputy privilege escalation via unchecked roleref in rolebinding creation

• Red Hat OpenShift AI 2.25
• Red Hat OpenShift AI 3.3
• Privilege escalation

Odh-dashboard: odh-dashboard: clusterrole grants cluster-wide crud on secrets and rbac management resources

• Red Hat OpenShift AI 2.25
• Red Hat OpenShift AI 3.3
• Privilege escalation

Feast-operator: feast: feast apply cronjob runs user python with feature-server sa — tenant code to sa token escalation

• Red Hat OpenShift AI 2.25
• Red Hat OpenShift AI 3.4
• Code injection
• Privilege escalation

Data-sciences-pipeline: dsp: v1 argo template path accepts arbitrary workflow spec, bypassing all v2 security hardening

• Red Hat OpenShift AI 2.25
• Red Hat OpenShift AI 3.3
• Privilege escalation

Data-science-pipelines-operator: dspo: operator clusterrole grants pods/exec:*, kubeflow.org */*, and clusterrole/binding crud cluster-wide

• Red Hat OpenShift AI 2.25
• Red Hat OpenShift AI 3.3
• Privilege escalation

Trustyai-service-operator: trustyai-service-operator: lmevaljob sidecar containers bypass protected environment variable filtering, allowing trust_remote_code policy override

• Red Hat OpenShift AI 2.25
• Red Hat OpenShift AI 3.3
• Privilege escalation

Dokploy: Non-admin member gains root on the host by bypassing the owner/admin check on server-level schedules (incomplete fix of CVE-2026-45632)

• dokploy
• Privilege escalation
• Broken access control

Dokploy: Missing authorization in WebSocket handlers allows a low-privilege member to gain root on the Docker host

• dokploy
• Privilege escalation
• Broken access control

systemd-homed: local privilege escalation via missing home-record signature verification on the authenticate path

• systemd-homed
• Privilege escalation
• Weak cryptography or TLS

Apache Ranger: Privilege Escalation via URL Parameter

• Apache Software Foundation Apache Ranger
• Privilege escalation
• Authentication bypass

Vitepos < 3.6.0 - Outlet Manager+ Privilege Escalation

• vitepos
• Privilege escalation

FoodBoxBooker < 1.0.7 - Unauthenticated Arbitrary Password Reset

• FoodBoxBooker
• Privilege escalation

Kingston FURY CTRL RGB Control Software Driver NTIOLib_KSFX.sys privileges management

• Kingston FURY CTRL RGB Control Software
• Privilege escalation

Uasoft Badaso File API api.php class permission

• Uasoft Badaso
• Privilege escalation
• CWE-275

wongcyrus ExcelLexBot Lambda Function ExcelLexBotS3TriggerFunction privileges management

• wongcyrus ExcelLexBot
• Privilege escalation

nxp-auto-goldvip gvip Lambda Function SitewiseCustomFunction access control

• nxp-auto-goldvip gvip
• Privilege escalation
• Broken access control

3CORESec Trapdoor DefaultFunction access control

• 3CORESec Trapdoor
• Privilege escalation
• Broken access control

AI Copilot – Content Generator <= 1.5.6 - Unauthenticated Privilege Escalation via Custom Workflow Route

• wupsales AI Copilot – Content Generator
• Privilege escalation

HKUDS nanobot MCP enabledTools Scope mcp.py connect_mcp_servers access control

• HKUDS nanobot
• Privilege escalation
• Broken access control

NexTOR IP Changer Unsafely Uses sudo and shell=True

• 0x5t4l1n NexTOR_IP_CHANGER
• Command injection
• Privilege escalation

Improper privilege management in WebPros Plesk

• WebPros Plesk
• Privilege escalation

Subscriptions for WooCommerce < 2.0.1 - Shop Manager+ Arbitrary Plugin Installation

• Subscriptions for WooCommerce
• Privilege escalation

V-Secure Jingyun Antivirus Kernel Driver ZyArk.sys access control

• V-Secure Jingyun Antivirus
• Privilege escalation
• Broken access control

Jiangmin Antivirus Minifilter Port kvcore.sys MessageNotifyCallback access control

• Jiangmin Antivirus
• Privilege escalation
• Broken access control

DeepCool DisplayService DeepCoolDisplayService.exe access control

• DeepCool DisplayService
• Privilege escalation
• Broken access control

StableBit DrivePool DrivePoolService DrivePool.Service.exe permission

• StableBit DrivePool
• Privilege escalation
• CWE-275

StableBit Scanner ScannerService Scanner.Service.exe permission

• StableBit Scanner
• Privilege escalation
• CWE-275

Power Sofware PowerISO Kernel Driver scdemu.sys privileges management

• Power Sofware PowerISO
• Privilege escalation

Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics

• Privilege escalation
• Broken access control

>=4.0.0-RC1, <4.18.1 || >=5.0.0-RC1, <5.10.3 · fixed in 4.18.1, 5.10.3

OpenReception: Tenant admin self-promotes to GLOBAL_ADMIN

• open-reception appointment-booking-software
• Privilege escalation

WordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Privilege Escalation vulnerability

• Shabti Kaplan Frontend Admin by DynamiApps
• Privilege escalation

WordPress Order Delivery Date for WooCommerce plugin <= 4.6.0 - Privilege Escalation vulnerability

• tychesoftwares Order Delivery Date for WooCommerce
• Privilege escalation

WordPress AIWU plugin <= 1.5.6 - Privilege Escalation vulnerability

• Sergey AIWU
• Privilege escalation

WordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability

• PublishPress Capabilities
• Privilege escalation

WordPress Forminator plugin <= 1.56.0 - Privilege Escalation vulnerability

• WPMU DEV Forminator
• Privilege escalation

Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover

• WSO2 API Manager
• WSO2 API Control Plane
• Privilege escalation

mf-yang openclaw-cn reply-elevated.ts isApprovedElevatedSender privileges management

• mf-yang openclaw-cn
• Privilege escalation

nanocoai NanoClaw Child-Agent Creation create-agent.ts handleCreateAgent privileges management

• nanocoai NanoClaw
• Privilege escalation

cosmicstack-labs mercury-agent delegate_task Tool sub-agent.ts SubAgent.run improper authorization

• cosmicstack-labs mercury-agent
• Privilege escalation
• Broken access control

cosmicstack-labs mercury-agent run_command permissions.ts PermissionManager.checkShellCommand privileges assignment

• cosmicstack-labs mercury-agent
• Privilege escalation

NousResearch hermes-agent Memory Toolset model_tools.py access control

• NousResearch hermes-agent
• Privilege escalation
• Broken access control

NousResearch hermes-agent disabled_toolsets agent_init.py get_tool_definitions privileges assignment

• NousResearch hermes-agent
• Privilege escalation

Improper privilege management in Jenkins Project Jenkins Horreum Plugin

• Jenkins Project Jenkins Horreum Plugin
• Privilege escalation

Langflow is affected by security vulnerabilities in Model Context Protocol features

• IBM Langflow OSS
• Privilege escalation

Cisco IOS XE Software Web-Based Management Interface Vulnerability

• Cisco IOS XE Software
• Privilege escalation

Cisco Terminal Services Agent Firewall Rules Bypass Vulnerability

• Cisco Terminal Services Agent
• Privilege escalation

Privilege escalation in Progress MarkLogic Server Hadoop integration

• Progress Software Corporation MarkLogic Server
• Privilege escalation

Privilege escalation in Progress MarkLogic Server REST document patch operation

• Progress Software Corporation MarkLogic Server
• Privilege escalation

Privilege escalation in Progress MarkLogic Server REST query interfaces

• Progress Software Corporation MarkLogic Server
• Privilege escalation

Privilege escalation in Progress MarkLogic Server REST API document processing

• Progress Software Corporation MarkLogic Server
• Privilege escalation

Keycloak-services: keycloak-services: ldap entry-dn user search bypasses configured users dn boundary

• Red Hat build of Keycloak 26.4
• Red Hat build of Keycloak 26.4.14
• Other injection
• Privilege escalation

Multicluster-operators-subscription: multicluster-operators-subscription: namespace edit user can deploy cluster-scoped clusterrolebinding and become cluster-admin via application subscription

• Red Hat Advanced Cluster Management for Kubernetes 2.11
• Red Hat Advanced Cluster Management for Kubernetes 2.13
• Privilege escalation

Cluster-curator-controller: cluster-curator-controller: namespace admin can escalate to cluster-wide curator authority via clustercurator serviceaccount token

• Red Hat multicluster engine for Kubernetes 2.1
• Red Hat multicluster engine for Kubernetes 2.11
• Privilege escalation

Smart Popup by Supsystic <= 1.12.0 - Unauthenticated Privilege Escalation to Administrator

• supsysticcom Smart Popup by Supsystic
• Privilege escalation

Baserow Inactive Non-Staff User serializers.py BaserowImpersonateAuthTokenSerializer improper authorization

• Baserow
• Privilege escalation
• Broken access control

Improper privilege management in Veeam ONE

• Veeam ONE
• Privilege escalation

An improper authentication and path traversal vulnerability exists in ASUSTOR Backup Plan and ASUSTOR EZ Sync.

• ASUSTOR Inc. ABP
• ASUSTOR Inc. AES
• Privilege escalation
• Authentication bypass

diaowen DWSurvey Survey Status up-survey-status.do improper authorization

• diaowen DWSurvey
• Privilege escalation
• Broken access control

kalcaddle kodbox msgWarning Plugin action improper authorization

• kalcaddle kodbox
• Privilege escalation
• Broken access control