CVE-2026-15142 | High | 7.5 | 2026-08-15 | The Real Estate Manager Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 12.8.6. This is due to improper ca… |
CVE-2026-14279 | High | 8.8 | 2026-08-15 | The Wholesale Market plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.2.2 via the ced_wholesale_request_send AJAX… |
CVE-2026-15312 | High | 8.8 | 2026-08-15 | The Propovoice: All-in-One Client Management System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8. Thi… |
CVE-2026-15001 | High | 8.8 | 2026-08-15 | The bLoyal: Loyalty & Promotions by bLoyal plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.611.78. This is… |
CVE-2026-63701 | Medium | 6.3 | 2026-08-14 | Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Improper Deserialization of Untrusted Data vulnerability. A low privileged attacker wi… |
CVE-2026-63700 | High | 7.8 | 2026-08-14 | Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Incorrect Default Permission vulnerability. A low privileged attacker with local acces… |
CVE-2026-16772 | High | 8.1 | 2026-08-14 | In Akaunting versions <= 3.1.21, low‑privileged authenticated users can modify their own account to assign themselves the admin role ID, granting full administ… |
CVE-2026-72833 | High | 8.8 | 2026-08-14 | The Grav API plugin (getgrav/grav-plugin-api) versions >= 1.0.6 and <= 1.0.11 contain a privilege escalation vulnerability. A scoped API key minted on a super-… |
CVE-2026-72830 | Critical | 9.8 | 2026-08-14 | Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowing scoped keys to write scheduler config… |
CVE-2026-72829 | Critical | 9.8 | 2026-08-14 | The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API-key scope-cap bypass in UsersController's create() and update() methods. These meth… |
CVE-2026-72828 | High | 7.2 | 2026-08-14 | Grav Plugin API (getgrav/grav-plugin-api) before 1.0.13 fails to enforce API-key scope caps in InvitationsController. The strip-super and accept-groups decisio… |
CVE-2026-18039 | High | 8.1 | 2026-08-14 | The Essential Addons for Elementor WordPress plugin before 6.7.2 does not prevent user-supplied registration fields from overwriting reserved account attribut… |
CVE-2026-73842 | Critical | 9.0 | 2026-08-13 | OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api… |
CVE-2026-73664 | | | 2026-08-13 | FreePBX is an open source IP PBX. From 17.0.5.34 until 17.0.11, the publicKeySave AJAX endpoint in Backup.class.php accepts an authenticated administrator's SS… |
CVE-2026-73305 | High | 8.8 | 2026-08-13 | Budibase is an open-source low-code platform. Prior to 3.39.24, POST /api/public/v1/roles/assign called validateGlobalRoleUpdate without checking appBuilder.ap… |
CVE-2026-18249 | High | 8.4 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to improper validation of pointers read from Java-cont… |
CVE-2026-18193 | High | 8.9 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to bypass security restrictions due to improper validation of user-controlled addresses. |
CVE-2026-18101 | High | 8.8 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to improper management of thread authority swaps. |
CVE-2026-17438 | Medium | 4.4 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to obtain sensitive information or modify data due to improper privilege management. |
CVE-2026-17074 | Low | 3.1 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper privilege management. |
CVE-2026-72631 | Medium | 6.5 | 2026-08-13 | Improper Privilege Management (CWE-269) in Kibana Fleet can lead to privilege escalation via Privilege Escalation (CAPEC-233). An integration policy may option… |
CVE-2026-16722 | High | 8.8 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain unauthorized privileges due to improper privilege management. |
CVE-2026-18071 | High | 7.8 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to improper privilege management. |
CVE-2026-24059 | Medium | 6.5 | 2026-08-13 | The GET /api/v1/user/actions/runners/registration-token endpoint (and its owner- and repository-level equivalents) creates a new runner registration token if n… |
CVE-2026-13610 | High | 7.5 | 2026-08-13 | The KiviCare WordPress plugin before 4.5.2 does not restrict the roles assignable through its unauthenticated registration endpoint, allowing unauthenticated… |
CVE-2026-49819 | Critical | 9.8 | 2026-08-13 | UpSnap is a wake on lan web app. Versions 4.4.1 through 5.3.5 are vulnerable to a missing-authentication / privilege-escalation chain in `pb.HandlerInitSuperus… |
CVE-2026-73269 | Critical | 9.9 | 2026-08-12 | A flaw was found in the cluster-curator-controller component. A local user, by creating a ClusterCurator resource with a specific naming convention, can trigge… |
CVE-2026-17082 | High | 8.8 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to improper validation of a client-supplied profile na… |
CVE-2026-18713 | High | 8.8 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to privilege escalation via Navigator for i. An authenticated user could elevate privileges to a root user to execute… |
CVE-2026-17276 | Critical | 9.6 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to escalate privileges due to improper authorization in the handling of high-authority… |
CVE-2026-16904 | High | 8.1 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper privilege management during monitor owne… |
CVE-2026-73293 | High | 8.8 | 2026-08-12 | Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, ProjectMiddleware and GetProjectOrGloba… |
CVE-2026-73284 | High | 8.8 | 2026-08-12 | RustFS is a distributed object storage system built in Rust. RustFS AddServiceAccount in rustfs/src/admin/handlers/service_account.rs accepts an attacker-contr… |
CVE-2026-68752 | High | 7.2 | 2026-08-12 | A Project Resource Manager may gain broader administrative privileges under specific conditions. |
CVE-2026-18366 | Critical | 9.8 | 2026-08-12 | The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already mad… |
CVE-2026-73122 | High | 7.7 | 2026-08-12 | A flaw was found in the multicloud-operators-channel component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a compromised agent fr… |
CVE-2026-18702 | Medium | 6.4 | 2026-08-11 | An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnostic logging settings that affect the ent… |
CVE-2026-15426 | High | 8.8 | 2026-08-11 | The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to authorization bypass in al… |
CVE-2026-73218 | | | 2026-08-11 | Cursor is a code editor built for programming with AI. Prior to 3.0.0, Cursor IDE for macOS allows an agent running in Auto-Run Sandbox mode, when Docker Deskt… |
CVE-2026-68821 | High | 7.3 | 2026-08-11 | Improper privilege management in Windows Package Manager allows an authorized attacker to elevate privileges locally. |
CVE-2026-20890 | | | 2026-08-11 | Improper privilege management for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Privileged Process may allow an escalation of privileg… |
CVE-2026-72537 | High | 8.8 | 2026-08-11 | A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with a source-scoped SCIM provisioning token to take o… |
CVE-2026-72534 | High | 8.8 | 2026-08-11 | A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with a source-scoped SCIM provisioning token to gain s… |
CVE-2026-18950 | High | 8.8 | 2026-08-10 | A flaw was found in odh-dashboard. An authenticated user of the dashboard can exploit a vulnerability related to how RoleBindings are created. The system does… |
CVE-2026-72886 | Critical | 9.9 | 2026-08-10 | Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.2 until 0.29.13, schedule.create and schedule.update in apps/dokploy/server/api/router… |
CVE-2026-72863 | Critical | 9.9 | 2026-08-10 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy's WebSocket handlers (in-app terminals and log streamers) authenticate… |
CVE-2026-16742 | Medium | 6.7 | 2026-08-10 | systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user |
CVE-2026-40920 | Critical | 9.8 | 2026-08-10 | Privilege Escalation via URL Parameter is reported in Apache Ranger versions <= 2.8.0.
Users are recommended to upgrade to version 2.9.0, which fixes this iss… |
CVE-2026-16298 | Critical | 9.8 | 2026-08-10 | The FoodBoxBooker WordPress plugin before 1.0.7 does not properly validate the password reset request, allowing unauthenticated attackers to reset the password… |
CVE-2026-14237 | High | 7.2 | 2026-08-10 | The vitepos WordPress plugin before 3.6.0, Vitepos WordPress plugin before 3.5.0 do not perform a per-target authorization check in their point-of-sale passwo… |
CVE-2026-19381 | High | 7.8 | 2026-08-10 | A security flaw has been discovered in Kingston FURY CTRL RGB Control Software 2.0.65.0. The impacted element is an unknown function in the library NTIOLib_KSF… |
CVE-2026-19360 | Medium | 4.7 | 2026-08-09 | A vulnerability was detected in wongcyrus ExcelLexBot up to 0.0.3. This affects the function ExcelLexBotS3TriggerFunction of the component Lambda Function Hand… |
CVE-2026-14526 | Critical | 9.8 | 2026-08-08 | The AI Copilot – Content Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.6. This is due to the p… |
CVE-2026-64637 | Critical | 9.9 | 2026-08-07 | Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative session for the root use… |
CVE-2026-15215 | High | 8.8 | 2026-08-07 | The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify the user's capability before installing and activating a Subscriptions for WooC… |
CVE-2026-19189 | High | 7.8 | 2026-08-07 | A security flaw has been discovered in Power Sofware PowerISO 9.3.0.0. Affected by this issue is some unknown functionality in the library C:\Windows\System32\… |
CVE-2026-48086 | Critical | 9.9 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, a TENANT_ADMIN promotes the… |
CVE-2026-1728 | Critical | 9.8 | 2026-08-06 | Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs.
Exploitation of this… |
CVE-2026-19007 | Medium | 6.3 | 2026-08-06 | A vulnerability was determined in mf-yang openclaw-cn up to 0.2.1. This vulnerability affects the function isApprovedElevatedSender of the file src/auto-reply/… |
CVE-2026-19005 | Medium | 6.3 | 2026-08-06 | A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. Affected is the function handleCreateAgent of the file src/modules/agent-to-agent/create-agent… |
CVE-2026-70443 | Medium | 4.3 | 2026-08-05 | Jenkins Horreum Plugin 0.16.162.v33b_4a_a_b_5f828 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configu… |
CVE-2026-20308 | Medium | 4.3 | 2026-08-05 | A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, remote attacker with low privileges to perform a d… |
CVE-2026-9193 | Critical | 9.9 | 2026-08-05 | An improper privilege management vulnerability in the Hadoop integration of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user wit… |
CVE-2026-8709 | Critical | 9.9 | 2026-08-05 | An improper privilege management vulnerability in the REST API document patch operation of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authent… |
CVE-2026-7329 | Critical | 9.9 | 2026-08-05 | An improper privilege management vulnerability in the SQL, SPARQL, and Optic REST query interfaces of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows… |
CVE-2026-7327 | High | 8.1 | 2026-08-05 | An improper privilege management vulnerability in the REST API document processing pipeline of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an aut… |
CVE-2026-16071 | Medium | 5.4 | 2026-08-05 | A flaw was found in the LDAP storage provider of Keycloak, which is used to federate user identities from external directories. The issue occurs when a delegat… |
CVE-2026-18322 | High | 8.8 | 2026-08-05 | The Smart Popup by Supsystic plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.12.0. This is due to a permissi… |
CVE-2026-64634 | | | 2026-08-04 | A vulnerability allowing local privilege escalation to the Reporter service context. |
CVE-2026-18759 | | | 2026-08-04 | The background service of ABP or AES runs as NT AUTHORITY\SYSTEM and implements a file-based inter-process communication (IPC) mechanism protected by AES encry… |
CVE-2026-18606 | High | 7.8 | 2026-08-03 | A weakness has been identified in Razer RzUpdateService 1.10.14.0. Affected by this vulnerability is an unknown functionality of the file C:\Program Files (x86… |
CVE-2026-15430 | Medium | 6.2 | 2026-08-03 | Improper access control in the IRP_MJ_WRITE command interface in
Wellbia XIGNCODE3 xhunter2.sys, version 2026.6.1.192, allows a local, unprivileged attacker t… |
CVE-2026-16534 | Critical | 9.1 | 2026-08-03 | The Import and export users and customers WordPress plugin before 2.4.2 does not enforce WordPress's role-assignment and per-user edit permissions during CSV i… |
CVE-2026-67356 | High | 8.8 | 2026-08-02 | ArcadeDB before 26.7.3 binds the real LocalDatabase object into JavaScript trigger contexts with HostAccess.ALL, allowing schema-admins to call getSecurity().c… |
CVE-2026-16256 | Critical | 9.8 | 2026-08-02 | The POUCO Import Users WordPress plugin through 1.0.0 does not perform any capability or nonce checks on AJAX actions available to unauthenticated users that c… |
CVE-2026-16635 | High | 8.8 | 2026-08-01 | The Pronamic Pay plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.1.0 This is due to the `maybe_update_user_… |
CVE-2026-15368 | High | 8.1 | 2026-08-01 | The User Profile Builder WordPress plugin before 3.16.4 does not correctly bind the automatic login performed after user registration to the newly created acc… |
CVE-2026-15414 | High | 8.8 | 2026-08-01 | The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.0.0. This is due to the `save_… |
CVE-2026-14333 | High | 7.5 | 2026-07-31 | The Demi WordPress plugin before 0.0.7 stores its full-site backup archives in a publicly accessible location under a predictable filename and without access… |
CVE-2026-12251 | High | 8.1 | 2026-07-31 | The Ultimate Member WordPress plugin before 2.12.1 does not filter administrator-level capabilities from the roles it makes selectable on its registration for… |
CVE-2026-65835 | Medium | 6.6 | 2026-07-30 | Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.8, after the incomplete CVE-2026-22872 fix, TenantResource RawItem… |
CVE-2026-14980 | High | 8.3 | 2026-07-30 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to perform SSRF… |
CVE-2026-12687 | High | 7.5 | 2026-07-30 | The ProfileGrid WordPress plugin before 5.9.9.8 does not restrict which group an anonymous visitor may register into through its front-end registration, allow… |
CVE-2026-17969 | High | 8.8 | 2026-07-30 | Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a cr… |
CVE-2026-17956 | High | 8.8 | 2026-07-30 | Inappropriate implementation in Scheduling in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a c… |
CVE-2026-17952 | High | 7.5 | 2026-07-30 | Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to execute… |
CVE-2026-17950 | High | 8.8 | 2026-07-30 | Inappropriate implementation in Safebrowsing in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code via a malicious… |
CVE-2026-17877 | High | 8.4 | 2026-07-30 | Inappropriate implementation in Chromoting in Google Chrome on Linux prior to 151.0.7922.72 allowed a local attacker to perform OS-level privilege escalation v… |
CVE-2026-17868 | High | 8.8 | 2026-07-30 | Insufficient policy enforcement in USB in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform privilege escalation via a crafted HTML pag… |
CVE-2026-17864 | High | 7.8 | 2026-07-30 | Inappropriate implementation in Updater in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to perform OS-level privilege escalation via a… |
CVE-2026-17863 | High | 7.8 | 2026-07-30 | Inappropriate implementation in Browser in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perform privilege escalation via a malic… |
CVE-2026-17816 | High | 7.5 | 2026-07-30 | Insufficient policy enforcement in Speech in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-17751 | High | 8.8 | 2026-07-30 | Inappropriate implementation in AdFilter in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a cra… |
CVE-2026-17744 | High | 7.1 | 2026-07-30 | Inappropriate implementation in File Input in Google Chrome on Linux prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape v… |
CVE-2026-12144 | High | 8.8 | 2026-07-29 | The Wholesale for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.5. This is due to the `save_… |
CVE-2026-18107 | High | 7.8 | 2026-07-28 | A flaw was found in CRIU's handling of restartable sequences (rseq) during checkpoint/restore. A malicious process inside a container can register an rseq crit… |
CVE-2026-15992 | High | 8.8 | 2026-07-28 | The WP Password Policy plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 3.7.1. This is due to missing authorizati… |
CVE-2026-14328 | High | 8.8 | 2026-07-28 | The Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, a… |
CVE-2026-14545 | Critical | 9.8 | 2026-07-28 | The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handler… |
CVE-2026-66015 | High | 7.2 | 2026-07-27 | An authenticated privilege-escalation vulnerability in JFrog Platform may be exploited under admin-provisioned account conditions. Successful exploitation may… |