CVE-2026-102247 | Medium | 6.8 | 2026-09-29 | A vulnerability was detected in FastAdmin 1.6.1.20250430/1.6.5.20260602. This affects an unknown function of the file application/database.php of the component… |
CVE-2026-88808 | High | 8.8 | 2026-09-28 | A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials… |
CVE-2026-87899 | | | 2026-09-23 | Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges. |
CVE-2026-19087 | Medium | 4.4 | 2026-09-23 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to achieve privilege escalation within the container due to improper… |
CVE-2026-84787 | High | 8.1 | 2026-09-23 | ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Privilege Escalation vulnerability that allowed an authe… |
CVE-2026-77521 | Critical | 10.0 | 2026-09-21 | MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.5-lts, assistants with a tool, MCP tool, skill, or sub-application use SandboxShellB… |
CVE-2026-92574 | High | 8.8 | 2026-09-21 | A vulnerability in CRI-O checkpoint restore allows a user who can create a pod from a malicious checkpointed container to bypass the destination Kubernetes sec… |
CVE-2026-54501 | | | 2026-09-17 | Browsertrix is a high-fidelity, browser-based crawling service for web archiving that can be self-hosted or used through Webrecorder's hosted instance. From 1… |
CVE-2026-55225 | High | 8.0 | 2026-09-15 | Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In Strimzi 1.0.0 and earlier, an attacke… |
CVE-2026-75092 | High | 7.3 | 2026-09-15 | A privilege escalation flaw was found in the scan_mysql actor of leapp-upgrade-el9toel10 (provided by leapp-repository). During RHEL 9 to RHEL 10 upgrades, the… |
CVE-2026-89259 | Critical | 9.8 | 2026-09-11 | Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's permission model, but TailwindCSS — included in the default security.exec… |
CVE-2026-79942 | Low | 3.4 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Execution with Unnecessary Privilege… |
CVE-2026-87506 | High | 8.3 | 2026-09-09 | Privilege elevation in WebUI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute… |
CVE-2026-69464 | High | 8.8 | 2026-09-08 | Execution with unnecessary privileges in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. |
CVE-2026-69409 | Medium | 6.5 | 2026-09-08 | Execution with unnecessary privileges in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. |
CVE-2026-80238 | Critical | 9.3 | 2026-09-07 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Execution with Unnecessary Privilege… |
CVE-2026-83534 | Medium | 6.4 | 2026-09-06 | PostgreSQL Anonymizer contains a vulnerability in the anon.anonymize_database_parallel() function that allows the owner of a table to run arbitrary code with s… |
CVE-2026-72654 | Medium | 6.5 | 2026-09-01 | Execution with Unnecessary Privileges (CWE-250) in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An o… |
CVE-2026-30512 | High | 7.8 | 2026-08-24 | A local privilege escalation vulnerability exists in the Restricted Access (Kiosk) Mode implementation of Scheidt & Bachmann entervo HMI prior to V2 R5 P0 M5… |
CVE-2026-76018 | High | 8.8 | 2026-08-20 | Privilege elevation in Import in Google Chrome prior to 151.0.7922.173 allowed a remote attacker leveraging social engineering to potentially execute arbitrary… |
CVE-2026-70496 | Critical | 9.9 | 2026-08-19 | A flaw was found in search-v2-operator. The operator's ClusterRole has permissions equivalent to a cluster administrator, allowing it to impersonate other enti… |
CVE-2026-24183 | High | 7.8 | 2026-08-18 | NVIDIA Cumulus Linux contains a vulnerability in the user management component, where an unprivileged user could use improper privilege management on the syste… |
CVE-2026-71846 | Medium | 6.5 | 2026-08-12 | A flaw was found in insights-client. The component's ServiceAccount is bound to a ClusterRole granting cluster-wide secrets get, list, and watch permissions, w… |
CVE-2026-72508 | Critical | 9.9 | 2026-08-12 | A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a namespace-admin… |
CVE-2026-17445 | High | 8.2 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of an attacker-supplied use… |
CVE-2026-18669 | High | 8.8 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to a privilege escalation as the result of a remote code execution vulnerability in the activation engine component… |
CVE-2026-17110 | High | 8.8 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands and obtain sensitive information due to improper privile… |
CVE-2026-59133 | High | 8.8 | 2026-08-11 | Execution with unnecessary privileges in Microsoft High Performance Computing (HPC) Pack allows an authorized attacker to elevate privileges over a network. |
CVE-2026-18982 | High | 8.8 | 2026-08-10 | A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit or admin roles in any Kubernetes namespace to escalate the… |
CVE-2026-18949 | High | 8.8 | 2026-08-10 | A flaw was found in odh-dashboard. This vulnerability allows an attacker, who has compromised the dashboard's Service Account (SA) token, to exploit overly bro… |
CVE-2026-18608 | High | 8.7 | 2026-08-10 | A flaw was found in the Data Science Pipelines Operator (DSPO). The operator's ClusterRole, which defines its permissions, includes extensive privileges beyond… |
CVE-2026-48098 | High | 7.3 | 2026-08-07 | NexTor IP Changer is a command-line tool that leverages the Tor network to periodically rotate a user's IP address. Versions prior to 2.0.0 execute privileged… |
CVE-2026-67609 | High | 7.8 | 2026-08-03 | Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain a privilege escalation vulnerability that allows attackers w… |
CVE-2026-50737 | High | 7.5 | 2026-07-28 | When applying replicated changes for a row that is missing one or more columns, pglogical evaluates the affected table's default expressions on the subscriber… |
CVE-2026-14172 | High | 7.8 | 2026-07-24 | Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated assessment without validating file ownership, allowing a l… |
CVE-2026-14985 | High | 7.8 | 2026-07-22 | The Analog Way Picturall Quad Compact Mark II version 3.5.8, contains a local privilege escalation vulnerability in the core firmware. This is due to improper… |
CVE-2026-8933 | High | 7.8 | 2026-07-21 | A local privilege escalation vulnerability exists in snap-confine, a set-capabilities core component used internally by Canonical snapd to construct the secure… |
CVE-2026-15226 | High | 8.4 | 2026-07-21 | A sandbox confinement bypass vulnerability exists in Canonical snapd within its internal execution environment compiler (snap-confine). The default seccomp sec… |
CVE-2026-13104 | High | 7.3 | 2026-07-16 | A potential vulnerability was reported in Lenovo App Store, distributed exclusively in the Chinese market, that could allow a local authenticated user to execu… |
CVE-2026-15584 | High | 7.5 | 2026-07-13 | A privilege escalation vulnerability was found in the incluster-checks tool for OpenShift. The tool creates privileged debug pods with host filesystem access i… |
CVE-2026-42486 | | | 2026-07-09 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]
XAPI can configure different u… |
CVE-2026-23562 | | | 2026-07-09 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]
XAPI can configure different u… |
CVE-2026-23561 | | | 2026-07-09 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]
XAPI can configure different u… |
CVE-2026-23560 | | | 2026-07-09 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]
XAPI can configure different u… |
CVE-2026-23559 | | | 2026-07-09 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]
XAPI can configure different… |
CVE-2026-54319 | Medium | 4.2 | 2026-06-23 | Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.186, a sandbox volume reference (volumeI… |
CVE-2026-48584 | Critical | 9.9 | 2026-06-19 | Execution with unnecessary privileges in Azure Synapse allows an authorized attacker to elevate privileges over a network. |
CVE-2026-12505 | High | 7.8 | 2026-06-18 | A flaw was found in the cifs-utils package where the cifs.upcall helper fails to securely drop its root privileges before looking up user information inside a… |
CVE-2026-47190 | Medium | 4.4 | 2026-06-12 | IPAM is the IP address Manager for Cluster API Provider Metal3. Prior to versions 1.11.7, 1.12.4, and 1.13.0, the IPAM controller's ClusterRole granted full CR… |
CVE-2026-12027 | Critical | 9.6 | 2026-06-11 | Inappropriate implementation in Headless in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potenti… |
CVE-2026-11626 | | | 2026-06-10 | CleanWipe Removal Tool (macOS), prior to 16.0.0.65, may be susceptible to an Local Privilege Escalation vulnerability, which is a type of issue whereby an atta… |
CVE-2026-50566 | Critical | 9.9 | 2026-06-10 | Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version… |
CVE-2026-50565 | Medium | 4.9 | 2026-06-10 | Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version… |
CVE-2026-46618 | | | 2026-06-10 | Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version… |
CVE-2026-46617 | | | 2026-06-10 | Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version… |
CVE-2026-46748 | High | 8.8 | 2026-06-09 | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The affected system includes a binary that is configured with the cap_dac_… |
CVE-2026-11167 | Critical | 9.6 | 2026-06-04 | Inappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process t… |
CVE-2026-10843 | High | 7.2 | 2026-06-04 | A flaw was found in the OpenShift Cloud Credential Operator Mint-mode IAM policies for AWS. Operator credentials are provisioned with account-wide scope for de… |
CVE-2025-12694 | High | 7.8 | 2026-06-04 | A local privilege escalation vulnerability exists in Forcepoint VPN Client that allows a local non-administrative user to escalate privileges to SYSTEM. This i… |
CVE-2026-42061 | High | 7.3 | 2026-06-03 | Local privilege escalation due to excessive permissions assigned to child processes. The following products are affected: Acronis DeviceLock DLP (Windows) befo… |
CVE-2026-44477 | Critical | 9.9 | 2026-05-28 | CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.29.1 and 1.28.3, the CloudNativePG metrics expor… |
CVE-2026-3623 | High | 7.8 | 2026-05-27 | IBM Netezza Performance Server Replication Services 3.0.2.0 through 3.0.5.0 allows an attacker with low‑privileged access to escalate their privileges to root… |
CVE-2026-8370 | | | 2026-05-19 | Execution with unnecessary privileges vulnerability in Broadcom Automic Automation Agent Unix on Linux x64, Linux Power 64 BE, Linux Power 64 LE, zLinux (zSeri… |
CVE-2026-29205 | High | 8.6 | 2026-05-13 | Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints. |
CVE-2026-32673 | High | 8.7 | 2026-05-13 | A vulnerability exists in BIG-IP scripted monitors that may allow an authenticated attacker with the Resource Administrator or Administrator role to execute ar… |
CVE-2026-32643 | High | 8.7 | 2026-05-13 | A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager role can modify con… |
CVE-2026-25710 | | | 2026-05-13 | The new upstream added a privileged D-Bus
helper called plasmaloginauthhelper, which suffers from multiple issues, e.g.aA compromised plasmalogin service accou… |
CVE-2026-42833 | Critical | 9.1 | 2026-05-12 | Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network. |
CVE-2026-40638 | Medium | 6.7 | 2026-05-12 | Dell PowerScale InsightIQ, versions 5.0.0 through 6.2.0, contains an execution with unnecessary privileges vulnerability. A high privileged attacker with local… |
CVE-2026-41900 | High | 8.8 | 2026-05-08 | OpenLearnX is an open-source, decentralized learning and assessment platform. Prior to version 2.0.3, a remote code execution (RCE) vulnerability was identifie… |
CVE-2026-42088 | Critical | 9.6 | 2026-05-04 | OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to version 7.0.0-rc3, the Script… |
CVE-2026-40550 | | | 2026-04-28 | mpGabinet is vulnerable to Privilege Escalation due to excessive database privileges assigned to the user used by the application. An attacker with access to a… |
CVE-2026-25908 | Medium | 6.7 | 2026-04-27 | Dell Alienware Command Center (AWCC), versions prior to 6.13.8.0, contain an Execution with Unnecessary Privileges vulnerability in the AWCC. A low privileged… |
CVE-2026-22008 | Low | 3.7 | 2026-04-21 | Vulnerability in Oracle Java SE (component: Libraries). The supported version that is affected is Oracle Java SE: 25.0.1. Difficult to exploit vulnerability… |
CVE-2026-4667 | | | 2026-04-15 | HP System Optimizer might potentially be vulnerable to escalation of privilege. HP is releasing an update to mitigate this potential vulnerability. |
CVE-2026-33793 | High | 7.8 | 2026-04-09 | An Execution with Unnecessary Privileges vulnerability in the User Interface (UI) of Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privile… |
CVE-2026-4498 | High | 7.7 | 2026-04-08 | Execution with Unnecessary Privileges (CWE-250) in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBA… |
CVE-2026-1346 | Critical | 9.3 | 2026-04-08 | IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 thr… |
CVE-2026-34877 | Critical | 9.8 | 2026-04-02 | An issue was discovered in Mbed TLS versions from 2.19.0 up to 3.6.5, Mbed TLS 4.0.0. Insufficient protection of serialized SSL context or session structures a… |
CVE-2026-25212 | Critical | 9.9 | 2026-04-02 | An issue was discovered in Percona PMM before 3.7. Because an internal database user retains specific superuser privileges, an attacker with pmm-admin rights c… |
CVE-2026-4606 | | | 2026-03-23 | GV Edge Recording Manager (ERM) v2.3.1 improperly runs application components with SYSTEM-level privileges, allowing any local user to gain full control of the… |
CVE-2025-69783 | High | 7.8 | 2026-03-16 | A local attacker can bypass OpenEDR's 2.5.1.0 self-defense mechanism by renaming a malicious executable to match a trusted process name (e.g., csrss.exe, edrsv… |
CVE-2025-12690 | High | 7.8 | 2026-03-11 | Execution with unnecessary privileges in Forcepoint NGFW Engine allows local privilege escalation.This issue affects NGFW Engine through 6.10.19, through 7.3.0… |
CVE-2026-3315 | High | 7.8 | 2026-03-10 | Incorrect Default Permissions, : Execution with Unnecessary Privileges, : Incorrect Permission Assignment for Critical Resource vulnerability in ASSA ABLOY Vis… |
CVE-2026-30225 | Medium | 5.3 | 2026-03-06 | OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authentication context confusion vulnerability in Resta… |
CVE-2026-20017 | Medium | 6.0 | 2026-03-04 | A vulnerability in the CLI of Cisco Secure FTD Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating… |
CVE-2026-21426 | Medium | 6.7 | 2026-03-04 | Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an execution with unnecessary privileges vulnerability. A hi… |
CVE-2026-21424 | Medium | 6.7 | 2026-03-04 | Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an execution with unnecessary privileges vulnerability. A hi… |
CVE-2026-21421 | Medium | 6.7 | 2026-03-04 | Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an execution with unnecessary privileges vulnerability. A hi… |
CVE-2026-21882 | High | 8.4 | 2026-03-02 | theshit is a command-line utility that automatically detects and fixes common mistakes in shell commands. Prior to version 0.2.0, improper privilege dropping a… |
CVE-2026-20037 | Medium | 4.4 | 2026-02-25 | A vulnerability in the NX-OS CLI privilege levels of Cisco UCS Manager Software could allow an authenticated, local attacker with read-only privileges to modif… |
CVE-2026-27208 | Critical | 9.2 | 2026-02-24 | bleon-ethical/api-gateway-deploy provides API gateway deployment. Version 1.0.0 is vulnerable to an attack chain involving OS Command Injection and Privilege E… |
CVE-2026-27002 | Critical | 9.8 | 2026-02-20 | OpenClaw is a personal AI assistant. Prior to version 2026.2.15, a configuration injection issue in the Docker tool sandbox could allow dangerous Docker option… |
CVE-2025-1790 | | | 2026-02-13 | Local privilege escalation in Genetec Sipelia Plugin. An authenticated low-privileged Windows user could exploit this vulnerability to gain elevated privileges… |
CVE-2026-25740 | | | 2026-02-09 | captive browser, a dedicated Chrome instance to log into captive portals without messing with DNS settings. In 25.05 and earlier, when programs.captive-browser… |
CVE-2026-0870 | High | 7.8 | 2026-02-09 | MacroHub developed by GIGABYTE has a Local Privilege Escalation vulnerability. Due to the MacroHub application launching external applications with improper pr… |
CVE-2026-25643 | Critical | 9.1 | 2026-02-06 | Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Prior to 0.16.4, a critical Remote Command Execution (RCE) vulne… |
CVE-2025-13375 | Critical | 9.8 | 2026-02-04 | IBM Common Cryptographic Architecture (CCA) 7.5.52 and 8.4.82 could allow an unauthenticated user to execute arbitrary commands with elevated privileges on the… |
CVE-2026-22549 | Medium | 4.9 | 2026-02-04 | A vulnerability exists in F5 BIG-IP Container Ingress Services that may allow excessive permissions to read cluster secrets. Note: Software versions which hav… |
CVE-2025-58383 | High | 7.2 | 2026-02-03 | A vulnerability in Brocade Fabric OS versions before 9.2.1c2 could allow an administrator-level user to execute the bind command, to escalate privileges and by… |