agentprime: Privilege escalationEvery new Privilege escalation Advisory and CVE.https://agentprime.io/CVE-2026-100363: SuiteCRM: Privilege escalation via V8 REST modules (ACLRoles, ACLActions, Administration)https://agentprime.io/advisories/CVE-2026-100363/https://agentprime.io/advisories/CVE-2026-100363/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:47:05 GMTCVECVE-2026-77439: Immich: Album Editor can escalate to Owner role and remove Owner-role members via unguarded API endpointshttps://agentprime.io/advisories/CVE-2026-77439/https://agentprime.io/advisories/CVE-2026-77439/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 17:25:59 GMTCVECVE-2026-114233: Apache OFBiz: Incorrect Privilege Assignment in Order Manager Enables Unauthorized Modification of Approved Ordershttps://agentprime.io/advisories/CVE-2026-114233/https://agentprime.io/advisories/CVE-2026-114233/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 13:35:47 GMTCVECVE-2026-95652: Improper Device Validation Allows Privileged Disk Formatting in TÜBİTAK BİLGEM's pardus-usb-formatterhttps://agentprime.io/advisories/CVE-2026-95652/https://agentprime.io/advisories/CVE-2026-95652/CVSS 6.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 12:15:43 GMTCVECVE-2026-118193: GiveWP <= 4.19.1 - Authenticated (Custom+) Privilege Escalation to 'donor_default_user_role' Parameterhttps://agentprime.io/advisories/CVE-2026-118193/https://agentprime.io/advisories/CVE-2026-118193/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 04:48:07 GMTCVECVE-2026-122313: Kyverno 1.17.0 before 1.19.2 Cross-Namespace Privilege Escalation via NamespacedMutatingPolicyhttps://agentprime.io/advisories/CVE-2026-122313/https://agentprime.io/advisories/CVE-2026-122313/CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 02:25:15 GMTCVEcriticalCVE-2026-122312: Kyverno 1.19.1 before 1.19.2 Namespace Isolation Bypass via APICall URLPath Query Stringhttps://agentprime.io/advisories/CVE-2026-122312/https://agentprime.io/advisories/CVE-2026-122312/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 02:25:14 GMTCVECVE-2026-122302: Kyverno before 1.19.2 Privilege Escalation via Generate Rule Permission Checkhttps://agentprime.io/advisories/CVE-2026-122302/https://agentprime.io/advisories/CVE-2026-122302/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 02:25:07 GMTCVEcriticalCVE-2026-122158: InvoiceShelf MemberService.php create access controlhttps://agentprime.io/advisories/CVE-2026-122158/https://agentprime.io/advisories/CVE-2026-122158/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 02:00:29 GMTCVECVE-2026-109849: Incorrect privilege assignment issue exists in Hinemos.https://agentprime.io/advisories/CVE-2026-109849/https://agentprime.io/advisories/CVE-2026-109849/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 00:40:01 GMTCVECVE-2026-54382: VitaFit Cloud API AWS IAM Misconfiguration via Cognito S3 Accesshttps://agentprime.io/advisories/CVE-2026-54382/https://agentprime.io/advisories/CVE-2026-54382/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 22:18:18 GMTCVECVE-2026-122016: yangzongzhuan RuoYi-Vue Permission Service SysPermissionService.java SysPermissionService.getMenuPermission privileges managementhttps://agentprime.io/advisories/CVE-2026-122016/https://agentprime.io/advisories/CVE-2026-122016/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 21:30:14 GMTCVECVE-2026-119481: WordPress JetFormBuilder plugin <= 3.6.7.1 - Privilege Escalation vulnerabilityhttps://agentprime.io/advisories/CVE-2026-119481/https://agentprime.io/advisories/CVE-2026-119481/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 12:08:34 GMTCVEcriticalCVE-2026-65555: WordPress Uncanny Toolkit for LearnDash plugin <= 3.8.2 - Privilege Escalation vulnerabilityhttps://agentprime.io/advisories/CVE-2026-65555/https://agentprime.io/advisories/CVE-2026-65555/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 12:08:34 GMTCVEcriticalCVE-2026-104799: Mobile builder <= 1.4.2 - Authenticated (Subscriber+) Privilege Escalation to wcfm-profile-settings REST Route 'key'/'data' Parametershttps://agentprime.io/advisories/CVE-2026-104799/https://agentprime.io/advisories/CVE-2026-104799/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 11:26:23 GMTCVECVE-2025-11229: Privilege Escalation via Client Credentials Grant Type in WSO2 Identity Serverhttps://agentprime.io/advisories/CVE-2025-11229/https://agentprime.io/advisories/CVE-2025-11229/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 05:29:57 GMTCVECVE-2026-121539: miroslavpejic85 MiroTalk P2P Socket I/O server.js CheckPassword access controlhttps://agentprime.io/advisories/CVE-2026-121539/https://agentprime.io/advisories/CVE-2026-121539/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 22:30:15 GMTCVECVE-2026-121514: EasySoft ZenTao PMS User model.php checkGroupChange privileges managementhttps://agentprime.io/advisories/CVE-2026-121514/https://agentprime.io/advisories/CVE-2026-121514/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 20:45:16 GMTCVECVE-2026-121234: Execution with unnecessary privileges in Google Chromehttps://agentprime.io/advisories/CVE-2026-121234/https://agentprime.io/advisories/CVE-2026-121234/CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 20:42:42 GMTCVEcriticalCVE-2026-121196: Execution with unnecessary privileges in Google Chromehttps://agentprime.io/advisories/CVE-2026-121196/https://agentprime.io/advisories/CVE-2026-121196/Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 20:42:41 GMTCVECVE-2026-121090: Improper privilege management in Google Chromehttps://agentprime.io/advisories/CVE-2026-121090/https://agentprime.io/advisories/CVE-2026-121090/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 20:42:28 GMTCVECVE-2026-119922: Babelfish for PostgreSQL Privilege Escalationhttps://agentprime.io/advisories/CVE-2026-119922/https://agentprime.io/advisories/CVE-2026-119922/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 18:08:48 GMTCVECVE-2026-121559: GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 Privilege Escalation via User Cloninghttps://agentprime.io/advisories/CVE-2026-121559/https://agentprime.io/advisories/CVE-2026-121559/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 15:17:15 GMTCVECVE-2026-121419: SurrealDB 3.1.0 before 3.3.0 MCP Session Hijack via BoundSubject Collisionhttps://agentprime.io/advisories/CVE-2026-121419/https://agentprime.io/advisories/CVE-2026-121419/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 14:28:16 GMTCVECVE-2026-115231: User-mode module can post forged callback requests to another module's callback queue, running its code with that module's privilegehttps://agentprime.io/advisories/CVE-2026-115231/https://agentprime.io/advisories/CVE-2026-115231/CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 08:23:02 GMTCVECVE-2026-58974: Improper privilege management in Google Androidhttps://agentprime.io/advisories/CVE-2026-58974/https://agentprime.io/advisories/CVE-2026-58974/CVSS 8.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 19:54:34 GMTCVECVE-2026-58962: Improper privilege management in Google Androidhttps://agentprime.io/advisories/CVE-2026-58962/https://agentprime.io/advisories/CVE-2026-58962/CVSS 8.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 19:54:25 GMTCVECVE-2026-91893: Improper privilege management in Dell Alienware Command Center (AWCC)https://agentprime.io/advisories/CVE-2026-91893/https://agentprime.io/advisories/CVE-2026-91893/CVSS 7.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 19:50:01 GMTCVECVE-2026-94290: Privilege escalation to cluster-admin on the Rancher local cluster through Fleet's agent management controllerhttps://agentprime.io/advisories/CVE-2026-94290/https://agentprime.io/advisories/CVE-2026-94290/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 15:29:41 GMTCVEcriticalCVE-2026-110535: Apache Syncope: AuthProfile value escalation via self-service updatehttps://agentprime.io/advisories/CVE-2026-110535/https://agentprime.io/advisories/CVE-2026-110535/Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 13:06:00 GMTCVECVE-2026-120338: Prefab UI Pyodide sandbox escape to host RCEhttps://agentprime.io/advisories/CVE-2026-120338/https://agentprime.io/advisories/CVE-2026-120338/CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Sun, 01 Nov 2026 15:24:54 GMTCVEcriticalCVE-2026-120306: Beta9 build sandbox escape via chroot-only isolationhttps://agentprime.io/advisories/CVE-2026-120306/https://agentprime.io/advisories/CVE-2026-120306/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Sun, 01 Nov 2026 12:49:05 GMTCVEcriticalCVE-2026-120224: Oray Pugongying X5 Pro API Authorization run_async_task improper authorizationhttps://agentprime.io/advisories/CVE-2026-120224/https://agentprime.io/advisories/CVE-2026-120224/CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Sun, 01 Nov 2026 10:15:16 GMTCVEcriticalCVE-2026-120185: ken678 YznCMS Auth Group Group.php Backend privileges managementhttps://agentprime.io/advisories/CVE-2026-120185/https://agentprime.io/advisories/CVE-2026-120185/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 31 Oct 2026 22:15:20 GMTCVECVE-2026-120070: User Frontend <= 4.3.13 - Authenticated (Subscriber+) Privilege Escalation via post_content Parameterhttps://agentprime.io/advisories/CVE-2026-120070/https://agentprime.io/advisories/CVE-2026-120070/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 31 Oct 2026 07:46:53 GMTCVECVE-2026-104012: Rox Appointment Booking <= 1.3.1 - Unauthenticated Privilege Escalation via Mass Assignment to Mass Assignment via '/public/booking' Endpointhttps://agentprime.io/advisories/CVE-2026-104012/https://agentprime.io/advisories/CVE-2026-104012/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 31 Oct 2026 07:46:47 GMTCVECVE-2026-120040: Mail logging & Catcher <= 2.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure to Privilege Escalation to Mail Log Viewer / Password-Reset Email Disclosurehttps://agentprime.io/advisories/CVE-2026-120040/https://agentprime.io/advisories/CVE-2026-120040/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 31 Oct 2026 06:44:18 GMTCVECVE-2026-110808: Essential Addons for Elementor 6.6.0 - 6.8.7 - Author+ Privilege Escalation via register_user_rolehttps://agentprime.io/advisories/CVE-2026-110808/https://agentprime.io/advisories/CVE-2026-110808/CVSS 4.2 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 31 Oct 2026 06:00:21 GMTCVECVE-2026-63339: IXP Manager has authenticated non-administrator privilege escalationhttps://agentprime.io/advisories/CVE-2026-63339/https://agentprime.io/advisories/CVE-2026-63339/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 22:35:32 GMTCVECVE-2026-62990: Shopper: same-origin SVG and HTML uploads enable stored XSS and persistent administrator creationhttps://agentprime.io/advisories/CVE-2026-62990/https://agentprime.io/advisories/CVE-2026-62990/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 21:05:51 GMTCVECVE-2026-40573: NovumOS: Nova Interpreter Privilege Escalationhttps://agentprime.io/advisories/CVE-2026-40573/https://agentprime.io/advisories/CVE-2026-40573/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 20:31:13 GMTCVECVE-2026-61850: Kargo: Privilege escalation via Project RBAC management in the Kargo APIhttps://agentprime.io/advisories/CVE-2026-61850/https://agentprime.io/advisories/CVE-2026-61850/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 19:33:01 GMTCVEcriticalCVE-2026-118086: WordPress WP BASE Booking plugin <= 6.5.2 - Privilege Escalation vulnerabilityhttps://agentprime.io/advisories/CVE-2026-118086/https://agentprime.io/advisories/CVE-2026-118086/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 18:30:54 GMTCVECVE-2026-116386: WordPress SMS Alert Order Notifications plugin <= 4.0.2 - Privilege Escalation vulnerabilityhttps://agentprime.io/advisories/CVE-2026-116386/https://agentprime.io/advisories/CVE-2026-116386/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 18:30:46 GMTCVEcriticalCVE-2026-54854: WordPress Profile Builder plugin <= 4.0.5 - Privilege Escalation vulnerabilityhttps://agentprime.io/advisories/CVE-2026-54854/https://agentprime.io/advisories/CVE-2026-54854/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 18:30:38 GMTCVECVE-2026-105894: Ak Framework <= 2.9.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Options Updatehttps://agentprime.io/advisories/CVE-2026-105894/https://agentprime.io/advisories/CVE-2026-105894/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 17:15:32 GMTCVECVE-2026-118205: Essential Addons for Elementor <= 6.8.7 - Unauthenticated Privilege Escalation to 'page_id' Parameter via Elementor Revisionhttps://agentprime.io/advisories/CVE-2026-118205/https://agentprime.io/advisories/CVE-2026-118205/CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 17:15:30 GMTCVECVE-2026-119599: AxonHub through 1.0.0-beta11 Privilege Escalation via Service Account API Key Scopeshttps://agentprime.io/advisories/CVE-2026-119599/https://agentprime.io/advisories/CVE-2026-119599/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 13:18:18 GMTCVECVE-2026-101213: Improper privilege management in Dell OpenManage Enterprisehttps://agentprime.io/advisories/CVE-2026-101213/https://agentprime.io/advisories/CVE-2026-101213/CVSS 7.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 11:53:35 GMTCVECVE-2026-59386: Credential exposure to space supporterhttps://agentprime.io/advisories/CVE-2026-59386/https://agentprime.io/advisories/CVE-2026-59386/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 08:35:20 GMTCVE