Overview 391 matches · 11 in Waratek scope · 1 protected · 10 exploited · 0 CISA KEV · 2 public PoC · 0 EPSS ≥ 0.5
391matches
11in Waratek scope2.8%
1protected0.3%
10exploited2.6%
0CISA KEV0.0%
2public PoC0.5%
0EPSS ≥ 0.50.0%
Protected by Waratek
1
0.3%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
10
2.6%
Outside Waratek scope
7
1.8%
Not applicable
373
95.4%
Withdrawn CVE
0
0.0%
blocked by ARMR today
1
0.3%
partly blocked
0
0.0%
not blocked
390
99.7%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 176 / year
20141
Protected by Waratek1
High1
blocked by ARMR today1
No public exploit1
20151
No exploit published1
High1
not blocked1
No public exploit1
20160
20171
Not applicable1
High1
not blocked1
No public exploit1
20184
No exploit published1
Not applicable3
High4
not blocked4
Proof of concept only1
No public exploit3
20195
No exploit published1
Outside Waratek scope1
Not applicable3
High5
not blocked5
Working exploit published1
Proof of concept only1
No public exploit3
202015
No exploit published2
Not applicable13
High15
not blocked15
No public exploit15
202113
No exploit published2
Outside Waratek scope2
Not applicable9
High13
not blocked13
No public exploit13
202214
Outside Waratek scope1
Not applicable13
High14
not blocked14
Proof of concept only3
No public exploit11
202316
Outside Waratek scope1
Not applicable15
High16
not blocked16
Exploited1
No public exploit15
202458
Outside Waratek scope1
Not applicable57
High58
not blocked58
Exploited3
Proof of concept only6
No public exploit49
202587
No exploit published1
Not applicable86
High87
not blocked87
Exploited1
Proof of concept only15
No public exploit71
2026176
No exploit published2
Outside Waratek scope1
Not applicable173
High176
not blocked176
Exploited5
Proof of concept only32
No public exploit139
2014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-95613 | High | 2026-11-13 | Not applicable | No public exploit | The pREST database REST API in Zenitel Connect firmware before 1.11.0 signs and verifies JWTs with the platform CA private key, which is stored on a data volume shared between containers, and sets the PostgreSQL session role from the unvalidated sub claim of each request while connected to the database as the "postgres" superuser, which allows local attackers who can read the platform CA private key from the container filesystem to execute database operations as the PostgreSQL superuser, including reading the master encryption key and password hashes, via a forged JWT with sub=postgres sent to the pREST API. |
| CVE-2026-126404 | High | 2026-11-13 | Not applicable | No public exploit | Coder 2.28.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before 2.38.4 does not restrict new API keys to the creating token's scopes, allow list, or expiry. A scoped API key or OAuth2 token holding key-creation permission can call POST /api/v2/users/{user}/keys/tokens to mint longer-lived coder:all keys, gaining the user's full privileges. |
| CVE-2026-67541 | High | 2026-11-11 | Not applicable | No public exploit | Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.70, team-member management (add / remove / update) is gated only on team membership, not on the team creator/admin role — and TeamMember has no role column. Any non-creator member can seat an attacker account into the team; because credential team-shares are scoped only by TeamMember.user_id, the newly-added attacker can then decrypt every credential shared into that team (provider API keys, OAuth tokens. This issue has been patched in version 0.0.70. |
| CVE-2026-100307 | High | 2026-11-11 | Not applicable | No public exploit | Missing authorization in the external management API in Amazon mcp-gateway-registry 1.0.9 through 1.24.7 might allow an authenticated remote user to assign the registry administrator scope to their own identity group and obtain administrative control of every registered gateway asset via a crafted group import request. To remediate this issue, users should upgrade to version 1.25.0. |
| CVE-2026-125879 | High | 2026-11-10 | Not applicable | No public exploit | Incorrect privilege assignment vulnerability in N-able N-central allows Privilege Escalation. This issue affects N-central: before 26.4.1. |
| CVE-2026-121576 | High | 2026-11-09 | Not applicable | No public exploit | Incorrect Privilege Assignment vulnerability in AtlasAiDev MCP Server for WordPress ai-workflow-automation-ai-agent-hub allows Privilege Escalation.This issue affects MCP Server for WordPress: from n/a through 2.0.1. |
| CVE-2026-120834 | High | 2026-11-09 | Not applicable | No public exploit | Incorrect Privilege Assignment vulnerability in Tobias WP2LEADS wp2leads allows Privilege Escalation.This issue affects WP2LEADS: from n/a through 3.5.17. |
| CVE-2026-124429 | High | 2026-11-08 | Not applicable | No public exploit | Craft CMS from 5.0.0 before 5.11.2 contains a privilege escalation vulnerability that allows unauthenticated public registrants to reclaim deactivated non-admin accounts while retaining their direct permissions. Attackers can register using a deactivated account, set a new password, and inherit permissions stored in userpermissions_users, enabling privileged account takeover when email verification is disabled. |
| CVE-2026-114233 | High | 2026-11-05 | Not applicable | No public exploit | Incorrect Privilege Assignment in the Order Manager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user who holds only order view permissions (ORDERMGR_VIEW), without ORDERMGR_UPDATE or any role on the order, to modify approved orders, changing a ship group's shipping address and shipment method or appending items with an overridden price, via the updateShipGroupShipInfo and appendOrderItem services. Users are recommended to upgrade to version 24.09.08, which fixes this issue. |
| CVE-2026-109849 | High | 2026-11-05 | Not applicable | No public exploit | Incorrect privilege assignment issue exists in Hinemos. If this vulnerability is exploited, an attacker who can access the password change API with specific permissions that can be assigned to non-administrative users may change the password of an administrative user. |
| CVE-2026-119922 | High | 2026-11-03 | Not applicable | No public exploit | Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish may allow remote authenticated users to elevate their privileges. To remediate this issue, we recommend users upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later. Customers using Amazon Aurora PostgreSQL with Babelfish should upgrade their cluster to Aurora PostgreSQL 13.9.16 (1.5.5), 13.23.3 (1.17.2), 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0), 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0), 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0), 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0), 18.3.4 (6.0.2), 18.4.1 (6.1.0) or later, and apply any pending maintenance to ensure they are on the latest patch. |
| CVE-2026-120224 | High | 2026-11-01 | Not applicable | Proof of concept only | A security flaw has been discovered in Oray Pugongying X5 Pro up to 7.6.1. Affected is the function run_apis_by_json/run_async_task of the component API Authorization. The manipulation results in improper authorization. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2026-118086 | High | 2026-10-30 | Not applicable | No public exploit | Subscriber Privilege Escalation in WP BASE Booking <= 6.5.2 versions. |
| CVE-2026-118082 | High | 2026-10-29 | Not applicable | No public exploit | Subscriber Privilege Escalation in Buddyboss Platform <= 3.5.0 versions. |
| CVE-2026-57144 | High | 2026-10-23 | Not applicable | Proof of concept only | PraisonAI is a multi-agent teams system. From version 4.5.110 to before version 4.6.61, praisonai.sandbox.SandlockSandbox is documented and implemented as the kernel-enforced sandbox backend for untrusted code. Its SandboxConfig.native() path lets callers configure allowed filesystem paths and network=False. On systems where the optional sandlock module imports but reports that Landlock is unavailable, SandlockSandbox.execute() and run_command() do not fail closed. They silently fall back to SubprocessSandbox(self.config). That fallback keeps the same high-level native policy object but does not enforce the native filesystem or network boundary during code execution. A sandboxed payload can read files outside the configured allowed path and open network connections despite network=False. This issue has been patched in version 4.6.61. |
| CVE-2026-112242 | High | 2026-10-22 | Not applicable | No public exploit | Incorrect Privilege Assignment vulnerability in Cozmoslabs Profile Builder profile-builder allows Privilege Escalation.This issue affects Profile Builder: from n/a through 4.0.4. |
| CVE-2026-112407 | High | 2026-10-20 | Not applicable | No public exploit | Incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications 1.0.7 through 1.0.10 allows remote authenticated users with push access to the application source repository to escalate privileges and access or modify resources outside the application stack in the same AWS account via application templates deployed by the toolchain pipeline. To remediate this issue, users should upgrade existing toolchain stacks to version 1.0.11 or later. |
| CVE-2026-110373 | High | 2026-10-18 | Not applicable | No public exploit | Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Privilege Escalation.This issue affects Login with phone number: from n/a through 1.8.77. |
| CVE-2026-96627 | High | 2026-10-16 | Not applicable | No public exploit | Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password change for the global administrator, replace the administrator password, and authenticate as that account, resulting in complete global administrator account takeover. This issue is fixed in version 2.6.0. |
| CVE-2026-109693 | High | 2026-10-15 | Not applicable | No public exploit | Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation.This issue affects Fluent CRM: from n/a through 3.2.5. |
| CVE-2026-73804 | High | 2026-10-14 | Not applicable | Proof of concept only | Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account. API requests signed with the corresponding private key authenticate as that account through HTTP Signature without API token scope information, causing route-level token scope checks to be skipped. This converts a user-scoped token into an unscoped API authentication method while retaining the account's normal role and repository permissions. |
| CVE-2026-59241 | High | 2026-10-13 | Not applicable | No public exploit | A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions < V8.0 Update 11), SIMATIC WinCC V8.1 (All versions < V8.1 Update 7). The affected application does not sufficiently restrict the permissions assigned to a database role. This could allow an authenticated remote attacker with database access to escalate privileges and execute arbitrary commands on the host system where SIMATIC WinCC is installed, potentially leading to a compromise of the system. |
| CVE-2026-96341 | High | 2026-10-10 | Not applicable | No public exploit | Incorrect Privilege Assignment vulnerability in WPMU DEV Forminator forminator allows Privilege Escalation.This issue affects Forminator: from n/a through 1.57.3. |
| CVE-2026-106608 | High | 2026-10-10 | Not applicable | No public exploit | Incorrect Privilege Assignment vulnerability in Automattic WooCommerce woocommerce allows Privilege Escalation.This issue affects WooCommerce: from 9.8.0 through 11.1.2. |
| CVE-2026-106145 | High | 2026-10-09 | Not applicable | No public exploit | In Progress® Telerik® Report Server prior to version 12.2.26.1007, incorrect privilege assignment in the service-agent SignalR hub allows an authenticated user, including a low-privilege or guest account with a valid bearer token, to register as a trusted service agent. On the next server settings-synchronization event, the rogue agent receives storage settings and encryption private keys. This privilege escalation enables disclosure of protected secrets, including stored data-source credentials and connection strings, and allows agent impersonation and interference with task dispatch. |
| CVE-2026-95594 | High | 2026-10-06 | Not applicable | No public exploit | Incorrect Privilege Assignment vulnerability in Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications sms-alert allows Privilege Escalation.This issue affects SMS Alert Order Notifications: from n/a through 4.0.0. |
| CVE-2026-48197 | High | 2026-10-06 | Not applicable | No public exploit | Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affects PublishPress Capabilities: from n/a through 2.45.0. |
| CVE-2026-39775 | High | 2026-10-06 | Not applicable | No public exploit | Subscriber Privilege Escalation in JobZilla - Job Board WordPress Theme <= 2.2 versions. |
| CVE-2026-39774 | High | 2026-10-06 | Not applicable | No public exploit | Unauthenticated Privilege Escalation in Tourfic Pro <= 1.17.3 versions. |
| CVE-2026-39765 | High | 2026-10-06 | Not applicable | No public exploit | Shop Manager Privilege Escalation in Challan <= 3.7.88 versions. |
| CVE-2026-105070 | High | 2026-10-06 | Not applicable | No public exploit | Unauthenticated Privilege Escalation in Salon booking system <= 10.31.7 versions. |
| CVE-2026-105058 | High | 2026-10-06 | Not applicable | No public exploit | Subscriber Privilege Escalation in WP User Profiles <= 2.7.3 versions. |
| CVE-2026-104757 | High | 2026-10-06 | Not applicable | No public exploit | Editor Privilege Escalation in Import and export users and customers <= 2.5.5 versions. |
| CVE-2026-104405 | High | 2026-10-06 | Not applicable | No public exploit | Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions. |
| CVE-2026-103286 | High | 2026-10-01 | Not applicable | No public exploit | Ghost versions from 2.21.0 before 6.56.0 contain a privilege escalation vulnerability in the notifications system that allows low-privilege staff users to escalate to higher-privilege staff roles. Attackers with low-privilege staff access can exploit the notifications system to gain elevated privileges without proper authorization checks. |
| CVE-2026-103068 | High | 2026-10-01 | Not applicable | No public exploit | Subscriber Privilege Escalation in ByteCoreStack – MCP Connector for AI Tools <= 1.2.2 versions. |
| CVE-2026-97245 | High | 2026-09-30 | Not applicable | No public exploit | Shop Worker Privilege Escalation in SureCart <= 4.7.2 versions. |
| CVE-2026-96815 | High | 2026-09-30 | Not applicable | No public exploit | Custom role Privilege Escalation in Vitepos <= 3.5.0 versions. |
| CVE-2026-94178 | High | 2026-09-30 | Not applicable | No public exploit | Subscriber Privilege Escalation in Import and export users and customers <= 2.5.2 versions. |
| CVE-2026-102129 | High | 2026-09-30 | Not applicable | No public exploit | A user-provisioning interface in Kiteworks Core did not verify that the requesting administrator was entitled to grant the role being assigned. An administrator whose delegated permissions covered role changes alone could therefore raise an account to full system-administrator privileges. |
| CVE-2026-102674 | High | 2026-09-29 | Not applicable | No public exploit | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, windows opened from a sandboxed top-level document did not inherit that document's active HTML sandbox restrictions. Untrusted content in a sandboxed top-level document that was permitted to open popups could therefore create a window with the Electron application's full origin instead of the restricted origin intended by the sandbox. Applications that deny such popups with setWindowOpenHandler are not affected. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5. |
| CVE-2026-101860 | High | 2026-09-29 | Not applicable | Proof of concept only | A vulnerability was found in RaspAP raspap-webgui up to 3.5.5. Affected by this issue is the function PluginInstaller::addSudoers of the file src/RaspAP/Plugins/PluginInstaller.php of the component sudo Configuration. Performing a manipulation results in improper privilege management. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2026-100619 | High | 2026-09-26 | Not applicable | Proof of concept only | Capgo (capgo.app) blocks direct user inserts into the public.manifest table with a RESTRICTIVE row-level security policy, but that restriction can be bypassed indirectly. A principal holding an app-scoped upload/write/all API key (upload+ rights) or an authenticated user with write+ rights on an app can update public.app_versions.manifest on a version whose storage_provider is 'r2-direct', which is not covered by the bundle content-lock check. The on_version_update async worker trusts record.manifest and, using the service-role Supabase client, inserts the attacker-controlled file_name, file_hash, and s3_path into public.manifest before clearing app_versions.manifest. When a channel points to the crafted version, the /updates endpoint returns the service-role-created manifest entry as a client-facing download_url, enabling OTA manifest poisoning through a trusted async worker path. All versions are affected; no patch was available at the time of publication. |
| CVE-2026-86583 | High | 2026-09-23 | Not applicable | No public exploit | The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.4.17 via the plugin's own export and re-import workflow. The vulnerability exists because the exporter writes CSV cells using fputcsv() with a NUL byte (\0) as the escape character, while the importer parses the same file using SplFileObject::fgetcsv() with only a single delimiter argument, causing PHP's default backslash escape character to be applied instead; because the export column layout places display_name immediately before the role column and nickname immediately after, an attacker can store crafted values in those two profile fields — saved by WordPress core via the standard profile page — such that the escape mismatch causes the parser to merge the display_name cell into the role field and rebalance the column count via nickname, yielding administrator as the parsed role for their own row when it reaches the import_user function's add_role function. This makes it possible for authenticated attackers with Subscriber-level access or above to escalate their privileges to Administrator. Exploitation requires a site administrator to trigger the plugin's documented export re-import migration with both "Update existing users" and "Update roles for existing users" set to "yes". |
| CVE-2026-94036 | High | 2026-09-20 | Not applicable | Proof of concept only | A security flaw has been discovered in D-Link DIR-X1860 and DIR-X1860Z up to 1.0.2.220120.165402. The impacted element is an unknown function of the file /ubus of the component routerd. The manipulation of the argument passwd_set results in improper access controls. The attack must originate from the local network. The exploit has been released to the public and may be used for attacks. |
| CVE-2026-63349 | High | 2026-09-18 | Not applicable | No public exploit | AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. In 4.14.0, AnyIO accepts the POSIX extra_groups argument in anyio.run_process() and anyio.open_process(), but open_process() forwards the group argument to the backend instead of extra_groups. A caller that supplies extra_groups=[] to clear inherited supplementary groups can therefore launch a child that retains the parent process groups, undermining a privilege-dropping boundary. If group is also supplied, the integer group value is passed where an iterable of supplementary groups is expected and the launch can fail with TypeError. This issue affects POSIX applications that rely on AnyIO subprocess helpers to launch less-privileged child processes. This issue is fixed in version 4.14.2. |
| CVE-2026-91930 | High | 2026-09-15 | Not applicable | Proof of concept only | Flowise before 3.1.4 fails to scope enterprise organization and workspace membership APIs to the caller's tenant, allowing authenticated users to supply arbitrary organization IDs. Attackers can add themselves as organization owners, create workspaces, and gain administrative access to victim organizations by exploiting insufficient tenant isolation in the organizationuser and workspace endpoints. |
| CVE-2026-86830 | High | 2026-09-14 | Not applicable | No public exploit | Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center solution before version 1.5.1 might allow an authenticated remote user with application-level access to read, approve, modify, or revoke arbitrary access requests, thereby obtaining unintended temporary elevated access to the AWS accounts accessed using the TEAM deployment. This issue has been addressed in TEAM version 1.5.1 or later. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. |
| CVE-2026-90493 | High | 2026-09-13 | Not applicable | Proof of concept only | A vulnerability was detected in Tonec Internet Download Manager up to 6.42 Build 63 on Windows. The impacted element is an unknown function of the file idmwfp.sys of the component Kernel Driver. The manipulation results in improper access controls. Attacking locally is a requirement. Internet Download Manager for Windows up to and including 6.42 Build 63 installs idmwfp.sys, a Windows kernel driver that exposes the \.\IDMWFP device interface to authenticated local users. The device object is created with an access control descriptor equivalent to D:P(A;;GA;;;AU), granting Authenticated Users generic access to the driver. The driver's IOCTL 0x12C028 handler accepts registry-operation subcommands 0x0C through 0x0F and processes caller-controlled registry paths and values. These handlers do not authenticate the caller, do not enforce the caller's registry permissions, and do not restrict operations to IDM-owned registry namespaces. A low-privileged local authenticated user can therefore read, create, modify, and delete arbitrary registry values under HKLM and HKU through the kernel driver. This includes registry configuration consumed by privileged Windows services and drivers and enables Local Privilege Escalation, high-privilege persistence, unauthorized system configuration disclosure or modification, and compromise of system confidentiality, integrity, and availability. Exploitation requires local access, low privileges, and no user interaction. A public proof of concept is available. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2026-8303 | High | 2026-09-11 | Not applicable | No public exploit | Incorrect privilege assignment vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus-software allows Privilege Escalation. This issue affects Pardus-software: before 1.0.5. |
| CVE-2026-62106 | High | 2026-09-11 | Not applicable | No public exploit | Subscriber Privilege Escalation in SMS Alert Order Notifications <= 3.9.9 versions. |
| CVE-2026-62102 | High | 2026-09-11 | Not applicable | No public exploit | Subscriber Privilege Escalation in Gato GraphQL <= 19.2.3 versions. |
| CVE-2026-81805 | High | 2026-09-10 | Not applicable | No public exploit | Unauthenticated Privilege Escalation in SiteSkite <= 2.1.5 versions. |
| CVE-2026-15140 | High | 2026-09-09 | Not applicable | No public exploit | A privilege-escalation issue in the Portworx Operator when deployed on Red Hat OpenShift (OCP). Only under specific conditions during the initial provisioning of a Portworx storage cluster, a user holding only limited, namespace-scoped permissions could cause the operator to grant broader access than intended, potentially resulting in elevated privileges within the Kubernetes cluster. |
| CVE-2026-85400 | High | 2026-09-08 | Not applicable | No public exploit | Backend administrators without system maintainer privileges were able to schedule any of the configuration:read, configuration:set, and configuration:show commands. This allowed them to modify arbitrary system configuration, which is normally limited to system maintainers. As a consequence, this allowed them, for example, to gain system maintainer privileges or cause a denial of service. Exploiting this vulnerability requires an administrator-level backend user account. This issue affects TYPO3 CMS versions 14.2.0-14.3.6. |
| CVE-2026-86482 | High | 2026-09-07 | Not applicable | No public exploit | In JetBrains YouTrack before 2026.2.18634, insufficient validation of role assignments allowed privilege escalation |
| CVE-2026-84756 | High | 2026-09-03 | Not applicable | No public exploit | Subscriber Privilege Escalation in WCFM Membership <= 2.11.11 versions. |
| CVE-2026-81769 | High | 2026-09-02 | Not applicable | No public exploit | Incorrect Privilege Assignment vulnerability in LiquidThemes Booking Hub allows Privilege Escalation. This issue affects Booking Hub: from n/a through 1.3.1. |
| CVE-2026-82807 | High | 2026-08-31 | Not applicable | Proof of concept only | A vulnerability was determined in ieungSoft Ultra RAMDisk Pro 1.82. This issue affects some unknown processing in the library URDSCSI.sys of the component Kernel Driver. This manipulation causes improper privilege management. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2026-81297 | High | 2026-08-31 | Not applicable | No public exploit | Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack <= 6.2.12 versions. |
| CVE-2026-78271 | High | 2026-08-27 | Not applicable | No public exploit | Editor Privilege Escalation in FluentCRM Pro <= 3.1.12 versions. |
| CVE-2026-32561 | High | 2026-08-24 | Not applicable | No public exploit | Subscriber Privilege Escalation in Booking Hub <= 1.3.0 versions. |
| CVE-2026-21756 | High | 2026-08-24 | Not applicable | No public exploit | HCL Hive is affected by a broken access control vulnerability which could allow an attacker or unauthorized user to introduce unverified, malicious, or broken code directly into production environments. |
| CVE-2026-75910 | High | 2026-08-20 | Not applicable | No public exploit | Incorrect privilege assignment in the ClickHouse connector deployment template in Amazon Athena Federated Query prior to v2026.17.1 could allow an authenticated remote user to read arbitrary AWS Secrets Manager secrets in the deploying account by pointing the connector's connection string at an unrelated secret and at a database endpoint under the user's control, causing the connector to transmit the secret to that endpoint. To remediate this issue, users should upgrade to aws-athena-query-federation connectors version v2026.17.1 or later and ensure that any forked or derivative code is patched to incorporate the new fixes. Alternatively, to remediate this issue, users should redeploy the connector with the current template and supply a non-empty SecretNamePrefix value. |
| CVE-2026-73350 | High | 2026-08-18 | Not applicable | No public exploit | Unauthenticated Broken Authentication in SupportCandy <= 3.5.1 versions. |
| CVE-2026-67846 | High | 2026-08-18 | Not applicable | No public exploit | Berkeley Out-of-Order Machine (BOOM) commit 5223e44cfeb26f41380057a2eb4d651197475f69 contains a potential incorrect privilege assignment issue in the v3 and v4 NBDTLB implementations. The raw mstatus.SUM value participates in the read and write permission logic without an explicit local satp.MODE validity check at the use site |
| CVE-2026-28191 | High | 2026-08-18 | Not applicable | No public exploit | Incorrect Privilege Assignment vulnerability in ThemeOne The Grid allows Privilege Escalation. This issue affects The Grid: from n/a through 2.8.0. |
| CVE-2026-15218 | High | 2026-08-17 | Not applicable | No public exploit | A flaw was found in the maas-api and maas-controller ServiceAccounts within Red Hat OpenShift AI. These ServiceAccounts are granted cluster-wide permissions that exceed their operational requirements. An attacker who compromises the identity of these ServiceAccounts, either through a remote code execution vulnerability or by creating a malicious pod in the same namespace, could exploit these excessive permissions. This could lead to full cluster administrator privileges through the creation of new ClusterRoleBindings or the disclosure of sensitive information by accessing all secrets across the cluster. |
| CVE-2026-72826 | High | 2026-08-14 | Not applicable | Proof of concept only | The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subset of the caller's scopes in createApiKey. The self-target path of requireApiKeyPermission() requires only the baseline api.access scope, and the new key's scopes are read directly from the request body with no subset check. An attacker holding a minimal-scope API key on a super account can submit an empty scopes array to mint an unscoped, full-access super key, bypassing scope restrictions (and enabling further chains such as configuration write to RCE). |
| CVE-2026-72840 | High | 2026-08-13 | Not applicable | Proof of concept only | OpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts that grants write access to /etc/crontabs/root to users intended only for mount configuration. Authenticated users with only the mount-configuration ACL group can append arbitrary cron entries via ubus file.write, which the default busybox crond daemon executes as root within one minute. |
| CVE-2026-66661 | High | 2026-08-13 | Not applicable | No public exploit | Subscriber Privilege Escalation in Directories Pro <= 2.0.5 versions. |
| CVE-2026-61979 | High | 2026-08-13 | Not applicable | Exploited | Unauthenticated Privilege Escalation in SAML SP Single Sign On <= 5.4.3 versions. |
| CVE-2026-28161 | High | 2026-08-13 | Not applicable | No public exploit | Subscriber Privilege Escalation in Service Finder Booking <= 6.2 versions. |
| CVE-2026-27543 | High | 2026-08-13 | Not applicable | No public exploit | Unauthenticated Privilege Escalation in MStore API <= 4.20.0 versions. |
| CVE-2026-19381 | High | 2026-08-10 | Not applicable | Proof of concept only | A security flaw has been discovered in Kingston FURY CTRL RGB Control Software 2.0.65.0. The impacted element is an unknown function in the library NTIOLib_KSFX.sys of the component Driver. Performing a manipulation results in improper privilege management. The attack needs to be approached locally. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2026-18950 | High | 2026-08-10 | Not applicable | No public exploit | A flaw was found in odh-dashboard. An authenticated user of the dashboard can exploit a vulnerability related to how RoleBindings are created. The system does not properly validate the `roleRef` field, allowing a user to specify an arbitrary role, including highly privileged ones like `cluster-admin`. This can lead to privilege escalation, where an attacker gains unauthorized elevated access within their namespace and potentially persistent control over the system. |
| CVE-2026-18621 | High | 2026-08-10 | Not applicable | No public exploit | A flaw was found in Data Science Pipelines (DSP). An attacker with namespace editor privileges can bypass security hardening by submitting a malicious Argo Workflow through the V1 API path. This allows the API server to create pods with elevated privileges, acting as a 'confused deputy' on behalf of the attacker. Successful exploitation grants the attacker node-root access, enabling arbitrary code execution and full control over the underlying node. |
| CVE-2026-15467 | High | 2026-08-10 | Not applicable | No public exploit | A flaw was found in the trustyai-service-operator's LMEvalJob controller. An authenticated user within the cluster can exploit this vulnerability by configuring a sidecar container to bypass existing security policies. This allows the user to enable and execute untrusted remote code, leading to arbitrary code execution within the cluster. |
| CVE-2026-19195 | High | 2026-08-07 | Not applicable | Proof of concept only | A vulnerability has been found in V-Secure Jingyun Antivirus 2.4.2.39. The affected element is an unknown function in the library ZyArk.sys of the component Kernel Driver. The manipulation leads to improper access controls. The attack needs to be performed locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2026-19193 | High | 2026-08-07 | Not applicable | Proof of concept only | A flaw has been found in Jiangmin Antivirus 21. Impacted is the function MessageNotifyCallback in the library kvcore.sys of the component Minifilter Port. Executing a manipulation can lead to improper access controls. The attack needs to be launched locally. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2026-19192 | High | 2026-08-07 | Not applicable | Proof of concept only | A vulnerability was detected in DeepCool DisplayService 1.2.12. This issue affects some unknown processing of the file C:\DeepCool\resources\service\x64\DeepCoolDisplayService.exe. Performing a manipulation results in improper access controls. The attack must be initiated from a local position. The exploit is now public and may be used. |
| CVE-2026-19191 | High | 2026-08-07 | Not applicable | Proof of concept only | A security vulnerability has been detected in StableBit DrivePool 2.3.13.1687. This vulnerability affects unknown code of the file C:\Program Files\StableBit\DrivePool\DrivePool.Service.exe of the component DrivePoolService. Such manipulation leads to permission issues. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. |
| CVE-2026-19190 | High | 2026-08-07 | Not applicable | Proof of concept only | A weakness has been identified in StableBit Scanner 2.6.13.4088. This affects an unknown part of the file C:\Program Files (x86)\StableBit\Scanner\Service\Scanner.Service.exe of the component ScannerService. This manipulation causes permission issues. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. |
| CVE-2026-19189 | High | 2026-08-07 | Not applicable | Proof of concept only | A security flaw has been discovered in Power Sofware PowerISO 9.3.0.0. Affected by this issue is some unknown functionality in the library C:\Windows\System32\drivers\scdemu.sys of the component Kernel Driver. The manipulation results in improper privilege management. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2026-65559 | High | 2026-08-06 | Not applicable | No public exploit | Shop manager Privilege Escalation in Order Delivery Date for WooCommerce <= 4.6.0 versions. |
| CVE-2026-28183 | High | 2026-08-06 | Not applicable | No public exploit | Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affects PublishPress Capabilities: from n/a through 2.45.0. |
| CVE-2026-28111 | High | 2026-08-06 | Not applicable | No public exploit | Contributor Privilege Escalation in Forminator <= 1.56.0 versions. |
| CVE-2026-17626 | High | 2026-08-05 | Not applicable | No public exploit | IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow an authenticated attacker to read, modify, or expose sensitive host files via Docker-based MCP servers due to incomplete filtering of dangerous Docker volume-mount and device-mapping arguments. |
| CVE-2026-18606 | High | 2026-08-03 | Not applicable | Proof of concept only | A weakness has been identified in Razer RzUpdateService 1.10.14.0. Affected by this vulnerability is an unknown functionality of the file C:\Program Files (x86)\Razer\RzUpdateEngineService\RzUpdateService.exe of the component Named Pipe Handler. Executing a manipulation of the argument lpThreadParameter can lead to improper privilege management. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure. |
| CVE-2026-59541 | High | 2026-07-23 | Not applicable | No public exploit | Subscriber Privilege Escalation in WP BASE Booking <= 6.3.1 versions. |
| CVE-2026-47237 | High | 2026-07-21 | Not applicable | Proof of concept only | Kubeflow Community Distribution helps users to install Kubeflow Platform in popular Kubernetes clusters. Prior to version 26.03-rc.1, a Kubeflow setup based on the official manifests or most other packaged Kubeflow distributions is vulnerable to authorization token stealing from any user of the Kubeflow UI or APIs, such as the Dashboard, Pipelines API, or Notebooks. With this token, the attacker can take over the user's account and the data that is processed by that user. The attacker needs a valid user with the ``kubeflow-edit`` role / Contributor role in a random Kubeflow namespace to perform this attack. This is given if _Automatic Profile Creation_ is enabled. Version 26.03-rc.1 fixes the issue. |
| CVE-2026-21824 | High | 2026-07-20 | Not applicable | No public exploit | HCL Commerce contains an privilege escalation vulnerability that could allow denial of service, disclosure of user personal data, and performing of unauthorized administrative operations. |
| CVE-2026-57768 | High | 2026-07-13 | Not applicable | No public exploit | Incorrect Privilege Assignment vulnerability in favethemes Houzez Login Register houzez-login-register allows Privilege Escalation.This issue affects Houzez Login Register: from n/a through <= 3.3.3. |
| CVE-2026-57410 | High | 2026-07-13 | Not applicable | No public exploit | Incorrect Privilege Assignment vulnerability in MailerPress Team MailerPress mailerpress allows Privilege Escalation.This issue affects MailerPress: from n/a through <= 2.0.2. |
| CVE-2026-57386 | High | 2026-07-13 | Not applicable | No public exploit | Incorrect Privilege Assignment vulnerability in Kodezen LLC aBlocks ablocks allows Privilege Escalation.This issue affects aBlocks: from n/a before 2.9.1. |
| CVE-2026-33390 | High | 2026-07-09 | Not applicable | No public exploit | An Incorrect Privilege Assignment vulnerability was discovered in the synchronization functionality due to Arc sensors receiving CLI permissions. An authenticated user with limited privileges can push administrative CLI commands through the sync, altering the device configuration, and/or affecting its availability. |
| CVE-2026-15271 | High | 2026-07-09 | Not applicable | No public exploit | A security vulnerability has been detected in TOTOLINK A3000RU, A3100R, A950RG, AC1200T10, CP450, CS185R_T10 and EX200 up to 20260906. Affected by this issue is some unknown functionality of the file /etc/boa/boa.conf of the component Web Interface. The manipulation leads to least privilege violation. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitation is known to be difficult. |
| CVE-2026-59093 | High | 2026-07-02 | Not applicable | No public exploit | Weaviate before 1.38.0 does not verify that a principal performing an RBAC role assignment holds the permissions granted by the assigned role. The assignRoleToUser and assignRoleToGroup handlers (POST /authz/users/{id}/assign and /authz/groups/{id}/assign) authorize only that the caller may assign roles to the target user or group, not the permissions contained in the assigned roles, unlike role creation which enforces that a user can only create roles with permissions less than or equal to its own. A user holding only the delegated assign_and_revoke_users or assign_and_revoke_groups permission can assign the built-in admin role, or any high-privilege custom role, to itself or others, escalating to full administrative control of the database. |
| CVE-2026-53902 | High | 2026-07-01 | Not applicable | No public exploit | MCO does not properly enforce authorization checks in the /customer/servlet/mco/webapi/profile-sections/group-membership endpoint. An authenticated user can modify their group membership without proper authorization checks, allowing privilege escalation. An attacker can add themselves to arbitrary groups by supplying a valid group ID, which can be obtained via other application functionalities (e.g. /customer/servlet/mco/webapi/group/picker/groups), provided he has necessary permissions, or potentially inferred through brute-force techniques. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 25.3.3.1 but may also affect other versions. |
| CVE-2026-5136 | High | 2026-07-01 | Outside Waratek scope | No public exploit | A flaw was found in Foreman. The Usergroup model in Foreman does not properly validate role assignments against the calling user's permissions. This allows an authenticated user with usergroup management permissions to attach arbitrary roles, including administrative roles, to a user group and then add themselves as a member. Successful exploitation of this vulnerability leads to full privilege escalation, granting the attacker administrator-level access. |