Privilege-Escalation

Windows Media Player DLL Hijack -- Local Privilege Escalation (CVE-2026-21508) newCVE-2026-21508binaryHIGH 7.8Patched2026-08-16Ubuntu Linux Kernel PPPoL2TP Use-After-Free Local Privilege Escalation (CVE-2026-68398) newCVE-2026-68398binaryHIGH 7.8Patched2026-08-16Linux nf_tables Catchall Set Element UAF -- Local Privilege Escalation (CVE-2026-23111) newCVE-2026-23111binaryHIGH 7.8Patched2026-08-16Windows Kerberos — ResetNightmare: Arbitrary Password Reset via Change Password Protocol Validation Flaw (CVE-2026-27912) newCVE-2026-27912networkHIGH 8Unverified2026-08-11Windows Defender — ShieldBreak: RoguePlanet (CVE-2026-50656) Patch Bypass via Cloud Files Rehydration + Object Manager Symlinks new EPSS 11%Bypass of CVE-2026-50656binaryHIGH 7.8Unpatched2026-08-11Active Directory — SPN Unicode Collision Detection Scanner (CVE-2026-25177) newCVE-2026-25177networkHIGH 8.8Patched2026-08-11Check Point Security Management / Multi-Domain Server SmartConsole Authentication Bypass via Forged Application Certificate Bind (CVE-2026-16232) new KEV EPSS 72%CVE-2026-16232networkCRITICAL 9.1Patched2026-08-09Barrier 2.4.0 — barrierd.exe Unauthenticated IPC → SYSTEM Privilege Escalation (NotCVE-2026-0010) newNotCVE-2026-0010binaryHIGHUnverified2026-08-01Windows WalletService Known-Folder Redirection → ESE Persisted-Callback DLL Load Local Privilege Escalation (CVE-2026-49176) newCVE-2026-49176binaryHIGH 7.8Patched2026-07-27AD CS/AD FS Enrollment "cdc" Chase Attribute Abuse → Domain Controller Impersonation (CertiGhost, CVE-2026-54121) newCVE-2026-54121networkHIGH 8.8Patched2026-07-27wp2shell — WordPress Core Pre-Auth SQLi → Row Forgery → Admin Creation → RCE (CVE-2026-63030 + CVE-2026-60137) new KEV EPSS 97%CVE-2026-63030webCRITICAL 9.1Patched2026-07-19Cisco Unified Communications Manager WebDialer SSRF → Arbitrary File Write → Root (CVE-2026-20230) new KEV EPSS 88%CVE-2026-20230networkCRITICAL 8.6Patched2026-07-19Flowise Enterprise Authentication Bypass via Hardcoded Default JWT Secrets (CVE-2026-56271) newCVE-2026-56271webCRITICAL 9.8Patched2026-07-12WordPress Service Finder Bookings ≤ 6.0 Authentication Bypass via `original_user_id` Cookie (CVE-2025-5947) newCVE-2025-5947webCRITICAL 9.8Unverified2026-07-06WordPress Mobile Builder Plugin JWT Authentication Bypass to Admin Account Creation (CVE-2025-68860) newCVE-2025-68860webCRITICAL 9.8Unpatched2026-07-06TNC Toolbox: Web Performance Unauthenticated cPanel Credential Exposure (CVE-2025-12539) newCVE-2025-12539webCRITICAL 10Patched2026-07-06Sudo `chroot` Option Local Privilege Escalation (CVE-2025-32463) new KEV EPSS 59%CVE-2025-32463binaryCRITICAL 9.3Patched2026-07-06Sneeit Framework <= 8.3 Unauthenticated RCE via `call_user_func()` — Rogue Admin Creation (CVE-2025-6389) new EPSS 76%CVE-2025-6389webCRITICAL 9.8Unverified2026-07-06Simple User Registration WordPress Plugin — Unauthenticated Privilege Escalation (CVE-2025-4334) newCVE-2025-4334webCRITICAL 9.8Unverified2026-07-06Simple Business Directory Pro Unauthenticated Password Reset to Admin Takeover (CVE-2025-53580) newCVE-2025-53580webCRITICAL 9.8Patched2026-07-06Real Spaces WordPress Theme Unauthenticated Privilege Escalation via `imic_agent_register` (CVE-2025-6758) newCVE-2025-6758webCRITICAL 9.8Unverified2026-07-06Opal Estate Pro WordPress Plugin Unauthenticated Administrator Registration (CVE-2025-6934) new EPSS 25%CVE-2025-6934webCRITICAL 9.8Unverified2026-07-06Grafana Enterprise SCIM User ID Collision / Impersonation (CVE-2025-41115) new EPSS 19%CVE-2025-41115webCRITICAL 10Patched2026-07-06Frontend Admin by DynamiApps — Unauthenticated Administrator Account Creation (CVE-2025-13342) newCVE-2025-13342webCRITICAL 9.8Patched2026-07-06Fox LMS `createOrder` Unauthenticated Privilege Escalation to Administrator (CVE-2025-14156) newCVE-2025-14156webCRITICAL 9.8Unverified2026-07-06ConnectWise Automate Adversary-in-the-Middle Remote Code Execution (CVE-2025-11492) newCVE-2025-11492networkCRITICAL 9.6Patched2026-07-06AI Engine WordPress Plugin Unauthenticated MCP Token Disclosure to Admin Account Creation (CVE-2025-11749) new EPSS 75%CVE-2025-11749webCRITICAL 9.8Unverified2026-07-06ACF Extended (ACFE) `prepare_form()` Unauthenticated RCE via Privilege Escalation (CVE-2025-13486) new EPSS 68%CVE-2025-13486webCRITICAL 9.8Unverified2026-07-06YayMail WooCommerce Plugin Missing Authorization to Privilege Escalation — CVE-2026-1937 newCVE-2026-1937webHIGH 7.2Unverified2026-07-05WP Captcha PRO Subscriber-to-Administrator Authentication Bypass — CVE-2026-5415 newCVE-2026-5415webHIGH 8.8Unverified2026-07-05WordPress "Import and Export Users and Customers" Plugin Privilege Escalation (CVE-2026-3629) newCVE-2026-3629webCRITICALUnverified2026-07-05WooCommerce Wholesale Lead Capture — Unauthenticated Privilege Escalation & File Upload RCE (CVE-2026-27542 / CVE-2026-27540) newCVE-2026-27542webCRITICAL 9.8Unverified2026-07-05WooCommerce Frontend Registration Form Unauthenticated Admin Role Assignment — CVE-2026-54807 newCVE-2026-54807webINFOUnverified2026-07-05Windows Push Notification Service Use-After-Free Race (CVE-2026-42978) newCVE-2026-42978binaryHIGH 7.8Unverified2026-07-05Windows Kernel Local Privilege Escalation via SeDebugPrivilege Bit Corruption (CVE-2026-40369) newCVE-2026-40369binaryHIGHUnverified2026-07-05Windows Kerberos Reflection via Unicode SPN Normalization Bypass (CVE-2026-26128) newCVE-2026-26128networkCRITICALUnverified2026-07-05Windows Error Reporting Service ALPC Local Privilege Escalation (CVE-2026-20817) newCVE-2026-20817binaryHIGHUnverified2026-07-05Veno File Manager 4.4.9 — Arbitrary File Rename to Privilege Escalation (CVE-2026-37071) newCVE-2026-37071webHIGHUnverified2026-07-05User Registration & Membership Unauthenticated Admin Privilege Escalation (CVE-2026-1492) new EPSS 24%CVE-2026-1492webCRITICAL 9.8Unverified2026-07-05TP-Link Tapo C260 Unauthenticated-to-Root RCE Chain — CVE-2026-0651 newCVE-2026-0651networkCRITICALUnverified2026-07-05SonicWall SMA 8200v Cross-Parameter Blind SQL Injection to Root (CVE-2026-4112) newCVE-2026-4112networkHIGH 7.2Unverified2026-07-05Samsung Android AT-Command Filter Bypass to system_server Code Execution (CVE-2026-20980) newCVE-2026-20980binaryCRITICALUnverified2026-07-05samlify SAML AttributeValue XML Injection → Privilege Escalation (CVE-2026-46490) newCVE-2026-46490 / GHSA-34r5-q4jw-r36mwebHIGH 8.8Patched2026-07-05Rocket.Chat OAuth2 NoSQL Injection Privilege Escalation — CVE-2026-29198 newCVE-2026-29198webCRITICALPatched2026-07-05PostgreSQL pgcrypto PGP Heap Overflow to Superuser Escalation — CVE-2026-2005 newCVE-2026-2005binaryCRITICALUnverified2026-07-05Portwell Engineering Toolkits Driver Arbitrary Physical Memory R/W LPE (CVE-2026-3437) newCVE-2026-3437binaryHIGHUnverified2026-07-05Percona PMM Authenticated RCE via PostgreSQL COPY TO PROGRAM (CVE-2026-25212) newCVE-2026-25212webCRITICAL 9.9Patched2026-07-05Pardus Software Center Local Privilege Escalation via APT Option Injection (CVE-2026-14459 / CVE-2026-14460) newCVE-2026-14459binaryHIGH 8.8Patched2026-07-05PackageKit TOCTOU Local Privilege Escalation (CVE-2026-41651) newCVE-2026-41651binaryHIGHPatched2026-07-05pac4j JWT Authentication Bypass via Unsigned Token in JWE Wrapper — CVE-2026-29000 newCVE-2026-29000webCRITICAL 9.8Patched2026-07-05Nezha Dashboard Path Traversal → JWT Secret Leak → Token Forgery — CVE-2026-53519 newCVE-2026-53519webINFOPatched2026-07-05Microsoft Defender Link Following Local Privilege Escalation (CVE-2026-41091) new KEVCVE-2026-41091binaryHIGH 7.8Unpatched2026-07-05Masteriyo LMS Authenticated Privilege Escalation to Administrator (CVE-2026-4484) newCVE-2026-4484webHIGH 8.8Unverified2026-07-05MariaDB JSON_SCHEMA_VALID() Heap Overflow — Privilege Escalation to UDF RCE (CVE-2026-32710) newCVE-2026-32710binaryCRITICALPatched2026-07-05LiteSpeed cPanel/WHM Plugin Symlink Privilege Escalation — CVE-2026-54420 new KEVCVE-2026-54420networkHIGH 8.5Unverified2026-07-05LiteLLM Proxy Privilege Escalation via `/user/update` (CVE-2026-47102) newCVE-2026-47102webHIGH 8.8Patched2026-07-05Lenovo LDE (LdeApi.Server.exe) Unimpersonated Junction-Based Arbitrary File Write to SYSTEM (CVE-2026-0827) newCVE-2026-0827binaryHIGHUnverified2026-07-05LatePoint Calendar Booking Plugin Contributor-to-Administrator Privilege Escalation (CVE-2026-49083) newCVE-2026-49083webHIGH 8.8Unverified2026-07-05LatePoint Calendar Booking Plugin Agent-to-Administrator Privilege Escalation — CVE-2026-6741 newCVE-2026-6741webHIGH 8.8Patched2026-07-05LA-Studio Element Kit for Elementor — Unauthenticated Admin Account Creation (CVE-2026-0920) newCVE-2026-0920webCRITICAL 9.8Unverified2026-07-05Kubernetes `runAsNonRoot` Bypass via UID Integer Overflow (CVE-2026-46680) newCVE-2026-46680cloudHIGHPatched2026-07-05KillChain — Vulnerable Kernel Driver IOCTL Protected-Process Termination (CVE-2026-0828) newCVE-2026-0828binaryHIGHUnverified2026-07-05Grafana Dashboard Permissions Broken Access Control — Editor-to-Admin Privilege Escalation (CVE-2026-21721) newCVE-2026-21721webHIGHPatched2026-07-05GNU inetutils telnetd Local Privilege Escalation via NEW-ENVIRON Injection — CVE-2026-28372 newCVE-2026-28372binaryHIGH 7.4Patched2026-07-05FreeBSD setcred(2) Kernel Stack Buffer Overflow — Local Privilege Escalation (CVE-2026-45250) newCVE-2026-45250binaryCRITICALUnverified2026-07-05FreeBSD /dev/dsp (OSS) Negative-Offset mmap Kernel Memory Corruption LPE (CVE-2026-45258) newCVE-2026-45258binaryCRITICALUnverified2026-07-05ElementsKit Elementor Addons Authenticated Stored XSS via REST API (CVE-2026-2600) newCVE-2026-2600webMEDIUM 6.4Patched2026-07-05Easy Elements for Elementor Unauthenticated Privilege Escalation via `custom_meta` Overwrite (CVE-2026-9018) newCVE-2026-9018webHIGH 8.8Patched2026-07-05Divi Form Builder <= 5.1.2 Unauthenticated Privilege Escalation via Role Injection (CVE-2026-5118) newCVE-2026-5118webCRITICAL 9.8Unverified2026-07-05Branda White Label & Branding Plugin Unauthenticated Account Takeover — CVE-2026-11551 newCVE-2026-11551webCRITICAL 9.8Patched2026-07-05Balena Etcher Windows TOCTOU Privilege Escalation — CVE-2026-30332 newCVE-2026-30332binaryHIGHUnverified2026-07-05Azuriom CMS Broken Access Control — Account Takeover via AzLink Server Token — CVE-2026-54415 newCVE-2026-54415webHIGH 3.1Patched2026-07-05Appsmith Table Widget Stored XSS to Admin Account Takeover — CVE-2026-30862 newCVE-2026-30862webCRITICAL 9.1Patched2026-07-05Apache NiFi 2.8.0 — EXECUTE_CODE Permission Bypass to Groovy RCE (CVE-2026-39816) newCVE-2026-39816webCRITICALPatched2026-07-05Amazon WorkSpaces Skylight Workspace Config Service Local Privilege Escalation (CVE-2026-7791) newCVE-2026-7791cloudHIGHUnverified2026-07-05Advanced Custom Fields: Extended Unauthenticated Privilege Escalation via `_acf_post_id` Validation Bypass (CVE-2026-8809) newCVE-2026-8809webCRITICAL 9.8Unverified2026-07-05PostgreSQL Referential-Integrity Owner-Switched Implicit Cast RCE newNone assigned as of 2026-07-04networkHIGHUnverified2026-07-04MyBB 1.8.40 Limited Admin CP User-Manager to Full Administrator Privilege Escalation newNone assigned as of 2026-07-03webHIGHUnpatched2026-07-03Gogs Admin User Edit CSRF to Git Hook RCE newNone assigned as of 2026-07-03webCRITICALUnverified2026-07-03Gitea act_runner container.options Host Namespace Escape newNone assigned as of 2026-07-03cloudHIGHUnverified2026-07-03Discourse Scoped API Key Pre-Route Authorization Bypass newNone assigned as of 2026-07-03webHIGHUnverified2026-07-03AnyDesk Printer Pipe COM Impersonation Local Privilege Escalation newNone assigned as of 2026-07-03binaryHIGHUnverified2026-07-03Linux Kernel act_pedit Partial COW Page-Cache LPE (CVE-2026-46331) newCVE-2026-46331binaryHIGH 7.8Patched2026-06-30DirtyClone — Linux Kernel LPE via Cloned Packet Page-Cache Overwrite (CVE-2026-43503) newCVE-2026-43503binaryHIGH 8.8Patched2026-06-28Cisco Catalyst SD-WAN Manager Privilege Escalation (CVE-2026-20245) new KEV EPSS 25%CVE-2026-20245networkHIGH 7.8Unpatched2026-06-28Azure Networking Privilege Escalation via Missing Privilege Check newCVE-2025-54914cloudCRITICAL 10Patched2026-05-17Linux XFRM ESP-in-TCP Local Privilege Escalation (Fragnesia) newCVE-2026-46300binaryHIGH 7.8Patched2026-05-14