#Privilege Escalation
All CosmicBytez Labs articles tagged #Privilege Escalation, across news, security advisories, how-to guides, and projects.
- News
China-Linked Hackers Exploited BeyondTrust Remote Support Zero-Day Since August
Armory Castle exploited CVE-2026-102764 (CVSS 9.3) in BeyondTrust Remote Support since late August, gaining root access and deploying webshells.
- Security
CVE-2026-103694: Mobile Builder Plugin Lets Any Registered User Become a WordPress Administrator
Mobile builder ≤ 1.4.2 fails to restrict which user meta keys a logged-in user can update via REST, enabling self-promotion to admin.
- Security
CVE-2026-107645: Blocksy Companion Disables Dokan's Nonce Check for Unauthenticated Vendor Takeover
An AJAX handler in Blocksy Companion disables Dokan's nonce check, letting unauthenticated attackers auto-register as a vendor (CVSS 9.1).
- Security
CVE-2026-107510: Infoblox NIOS Argument Injection Enables Privilege Escalation
Infoblox NIOS lets authenticated high-privilege users inject arguments into troubleshooting commands, escalating to full administrative control.
- News
Android's October 2026 Security Update Patches 25 Vulnerabilities, Including 7 Critical Bugs
Google's October 2026 Android patch level fixes 25 flaws across Framework and System, with seven rated critical and none exploited in the wild.
- Security
CVE-2026-61421: Hard-Coded JWT Signing Key in Dell CSM Authorization Enables Admin Token Forgery
A hard-coded JWT signing key in Dell CSM Authorization lets unauthenticated attackers forge admin tokens and seize control.
- Security
CVE-2026-63692: Dell CSM Authorization Proxy Missing Authentication Allows Cross-Tenant Admin Takeover
A missing authentication flaw in Dell CSM's authorization proxy lets unauthenticated attackers gain admin privileges across tenants.
- Security
CVE-2026-67269: Dell CSM Operator Flaw Lets Low-Privileged Users Escalate to Cluster Node Root
A Dell Container Storage Modules Operator flaw lets low-privileged Kubernetes users escalate to root via a crafted Custom Resource.
- News
Dell Patches Critical Root-Privilege Flaw in System Update Tool
Dell fixed a critical CVSS 9.6 path traversal bug (CVE-2026-86360) in its System Update CLI that lets attackers run code as root on PowerEdge servers.
- Security
CVE-2026-97644: Groundhogg Privilege Escalation via Contact Identity Rebinding
CVE-2026-97644 (CVSS 8.8): Groundhogg ≤ 4.9 lets Sales Person+ users rebind contact records to an Admin's user ID, enabling full account takeover.
- Security
CVE-2026-102489: Zammad Session Fixation Flaw Added to CISA KEV Catalog
CISA added CVE-2026-102489, a Zammad session fixation bug chaining to RCE as the zammad user, to its KEV catalog after active exploitation.
- Security
CVE-2026-102490: Zammad GmbH Zammad Improper Privilege Management Vulnerability
A local privilege escalation flaw lets the zammad user gain root on any Zammad instance; chainable with CVE-2026-102489, actively exploited, now in CISA KEV.
- News
Zammad Zero-Days Exploited in AI-Powered DIVD Hack
An autonomous AI agent chained two Zammad zero-days (CVE-2026-102489, CVE-2026-102490) to hijack sessions, gain RCE, and reach root in seconds.
- Security
CVE-2026-103752: Unauthenticated Admin Takeover in the WordPress Authorizer Plugin
Critical unauthenticated privilege escalation (CVSS 9.8) in WordPress's Authorizer plugin ≤3.15.3 lets attackers become admin via an Azure AD OAuth2 flaw.
- Security
CVE-2026-77203: WordPress Groups Plugin Privilege Escalation
A flaw in groups_join() lets Subscriber-level WordPress users self-enroll into admin groups, escalating to full Administrator privileges.
- Security
CVE-2026-85984: miniOrange OTP Login Plugin Authentication Bypass
Unauthenticated attackers can log in as any WordPress admin via a missing password check in miniOrange OTP Login ≤ 5.5.5 (CVSS 9.8).
- Security
Malcure Malware Shield Missing Authorization Enables Multisite File Write (CVE-2026-96896)
Malcure Malware Shield lacks an auth check on an AJAX action, letting subsite admins write or delete files network-wide on multisite.
- News
Elementor WordPress Flaw Lets Attackers Create Admin Accounts
A CSRF flaw in Elementor 4.3.0 and 4.3.1 (CVE-2026-62062) bypassed REST nonce checks, letting attackers create rogue WordPress admin accounts.
- Security
CVE-2026-14281: Unauthenticated Admin Takeover in WAWP WooCommerce Plugin
Missing REST permission checks in the WAWP plugin (≤4.8.6) let anyone register as a WordPress administrator via signup. CVSS 9.8, PoC public.
- Security
CVE-2026-65113: Hard-Coded Credentials Flaw in NVIDIA Infrastructure Controller for Linux
Critical CVSS 9.8 flaw in NVIDIA Infrastructure Controller for Linux lets attackers exploit hard-coded credentials for full system compromise.
- Security
CVE-2026-13355 — Meta Box AIO Unauthenticated Privilege Escalation to Administrator
Chained flaw in Meta Box AIO lets unauthenticated attackers inject a shortcode that grants WordPress Administrator access (CVSS 9.8).
- Security
CVE-2026-55567: BleachBit Windows Junction Flaw Enables Privilege Escalation
BleachBit fails to validate parent directories before deletion on Windows, letting a local attacker use junctions to delete arbitrary system files.
- Security
CVE-2026-57223: Suricata Unquoted Service Path on Windows
Suricata's Windows service installer can pass an unquoted ImagePath, allowing local privilege escalation to SYSTEM. Fixed in 7.0.17 and 8.0.6.
- Security
CVE-2026-45143: Chamilo LMS Stored XSS Enables Student-to-Admin Takeover
Unsanitized private messages in Chamilo LMS let a low-privilege student fire stored XSS at an admin's inbox, no link click required.
- Security
Unauthenticated Privilege Escalation in JetFormBuilder ≤ 3.6.2 Allows Admin Account Creation
A critical flaw in JetFormBuilder ≤ 3.6.2 lets unauthenticated attackers register admin accounts via a crafted form-ID request.
- News
LiteSpeed Enterprise Flaw Lets One Hosting Account Seize Root on Shared Servers
A LiteSpeed Web Server Enterprise flaw before v6.3.7 bypasses CageFS isolation, letting one low-privilege hosting account gain root on shared servers.
- News
Thai Broadband Provider Hacked via Fortinet Vulnerability
Hunt.io found 298 staged attack tools tied to a CVE-2024-21762 FortiGate SSL-VPN exploit used to breach Thai ISP 3BB and target RADIUS credentials.
- Security
CVE-2026-75092: Leapp RHEL Upgrade Flaw Lets a Compromised MySQL Account Escalate to Root
A flaw in leapp-repository's scan_mysql actor runs mysqld as root during RHEL 9-to-10 upgrades, letting a compromised mysql account escalate to full root.
- Security
CVE-2026-90566: Privilege Escalation via Unvalidated usertype in inventory-management-system
A CVSS 7.3 flaw in Rizwan17's inventory-management-system lets attackers set a privileged usertype during registration, escalating to admin access.
- Security
Mass Assignment Flaw in MemberPress Corporate Accounts Enables Admin Takeover
CVE-2026-15451 lets a corporate sub-account holder create rogue WordPress admins or hijack existing ones via unfiltered mass assignment.
- Security
Privilege Escalation in User Registration & Membership ≤ 5.2.7
CVE-2026-80071 lets Author-level WordPress users self-assign an arbitrary membership plan and escalate straight to Administrator.
- Security
CVE-2026-86406: User Registration & Membership Purchase Flaw Lets Any Subscriber Escalate to Administrator
A missing capability check in User Registration & Membership's purchase flow lets any Subscriber claim an Administrator-mapped plan for free.
- Security
Internet Download Manager's Kernel Driver Opens a Path to SYSTEM
CVE-2026-90493 lets a local attacker abuse IDM's idmwfp.sys IOCTL interface for privilege escalation; a public PoC is already out.
- Security
Code Monkeys Proposals Plugin Lets Any Subscriber Delete WordPress Files
CVE-2026-77005 allows low-privilege WordPress users to delete arbitrary server files, including wp-config.php, enabling full site takeover.
- Security
CVE-2026-84869: ConnectWise ScreenConnect Unauthorized File Transfer & Execution
A critical ScreenConnect client flaw lets attackers transfer and execute files through active remote sessions without host confirmation.
- Security
CVE-2026-86060: MikroTik RouterOS SSH Privilege Escalation
Unauthenticated attackers can escalate to full admin control on MikroTik RouterOS via a crafted SSH username; CISA lists it as actively exploited.
- Security
CVE-2026-19583: Velociraptor Permission Bypass via Client Monitoring Artifacts
Velociraptor fails to gate client monitoring artifacts, letting low-privileged users schedule restricted commands like Linux.Sys.BashShell.
- Security
CVE-2026-81963: Windows Link Following Flaw Lets Local Attackers Reach SYSTEM
CISA added an actively exploited Windows Update Stack privilege escalation flaw to its KEV catalog, giving federal agencies until Sep 22 to patch.
- Security
CVE-2026-75925: IXON VPN Client CRLF Injection Enables Root/SYSTEM Command Execution
IXON VPN Client before v1.4.7 lets a local attacker inject CRLF sequences into a config file consumed by a privileged process, gaining root or SYSTEM.
- News
New CrowdStrike 'FalconFlank' Zero-Day Grants SYSTEM Privileges
A researcher released a Falcon Sensor zero-day that abuses macro remediation to spawn SYSTEM shells on fully patched Windows 11 and Server 2025.
- News
FalconFlank PoC Claims Zero-Day Privilege Escalation in CrowdStrike Falcon
Researcher Chaotic Eclipse published FalconFlank, a public PoC abusing Falcon Sensor's macro remediation to claim SYSTEM-level access.
- Security
Unauthenticated Privilege Escalation in Authorizer ≤ 3.15.1
CVE-2026-81294 (CVSS 9.8) lets unauthenticated attackers gain elevated privileges in the Authorizer WordPress login/SSO plugin.
- Security
CVE-2026-77009: Subscriber-to-RCE via Exposed Debug Console in WatchMan-Site7
A critical code injection flaw in WatchMan-Site7 lets any authenticated subscriber run arbitrary PHP through the plugin's unrestricted debug console.
- Security
CVE-2026-18550: Nokri WordPress Theme Unauthenticated Account Takeover
A critical unauthenticated account-takeover flaw in the Nokri WordPress job board theme lets attackers reset any user's password, including admins.
- Security
CVE-2026-9055: Amelia WordPress Plugin Privilege Escalation Vulnerability
A validation flaw in Amelia's customer-update endpoint lets an attacker become a manager, then hijack an administrator account for full takeover.
- Security
CVE-2026-82857: hulumi Privilege Escalation via Weekly Integration IAM Policy
hulumi before 1.3.2 let attackers create persistent higher-privilege af-e2e-* roles in the sandbox account via a flawed IAM boundary.
- Security
Unauthenticated Privilege Escalation to Admin in WooCommerce Plugin (CVE-2026-15369)
CVE-2026-15369 (CVSS 9.8) lets unauthenticated attackers self-assign the Administrator role during WooCommerce checkout in Addify's plugin.
- Security
Critical Session Hijack Flaw in IBM Administration Runtime Expert for i
CVE-2026-18527 (CVSS 9.9) lets unauthenticated attackers hijack another user's session in IBM ARE for i's legacy GUI, gaining elevated privileges.
- Security
IBM Langflow OSS Flaw Lets Authenticated Users Escalate to Full RCE
CVE-2026-19295 (CVSS 9.9) lets an authenticated Langflow user run arbitrary OS commands by crafting a flow, bypassing the custom-component lockdown.
- Security
CVE-2026-50152: Ceph Monitor Flaw Exposes Cluster SSH Keys and Disk Encryption Secrets
A low-privilege, read-only CephX role can read Ceph's entire config-key store, exposing cephadm SSH keys and OSD LUKS passphrases.
- Security
CVE-2026-32566: Unauthenticated Privilege Escalation in ACPT (Pro) Custom Post Types Plugin
Critical unauthenticated privilege escalation (CVSS 9.8) in WordPress plugin ACPT (Pro) ≤ 2.0.63. No official patch yet — Patchstack has a mitigation rule.
- Security
CVE-2026-54523: Kyverno CEL Generator Bypasses Namespace Isolation
Critical Kyverno flaw lets a namespace-scoped policy invoke generator.apply() with an arbitrary namespace, creating RoleBindings in kube-system.
- Security
WordPress Jawn Theme Unauthenticated Privilege Escalation
CVE-2026-78477 allows unauthenticated attackers to escalate to WordPress administrator in Jawn theme versions up to 1.4.2, CVSS 9.8 critical.
- Security
CVE-2026-78155: Critical Privilege Escalation in StackGres Kubernetes Operator
A CVSS 9.9 flaw in the StackGres Kubernetes operator lets a low-privilege tenant escalate to full cluster admin rights.
- News
Named Pipes Under Attack: Securing Windows Interprocess Communication
Weak access controls on Windows named pipes let untrusted processes reach privileged services. Here's how endpoint verification and strict ACLs help.
- Security
CVE-2026-62940: Incus Migration Security Restriction Bypass (CVSS 9.9)
Critical Incus flaw allows privilege escalation via unrestricted config overrides during cross-cluster instance migration. Patch to v7.3.0.
- Security
CVE-2026-62941: Incus Cross-Project Copy Privilege Escalation (CVSS 9.9)
Critical TOCTOU flaw in Incus lets restricted project users escalate privileges by copying instances across projects. Fixed in v7.3.0.
- Security
CVE-2026-13097: FreeIPA Privilege Escalation via Kerberos Principal Uniqueness Bypass
A CVSS 9.1 flaw in FreeIPA allows users with LDAP write access to escalate privileges by exploiting duplicate Kerberos principal names in 389-ds.
- Security
CVE-2026-16576: Dokan WooCommerce Plugin Privilege Escalation to RCE
A missing capability check in the Dokan multivendor WooCommerce plugin allows Shop Managers to install arbitrary plugins, leading to full site compromise.
- Security
CVE-2026-67567: Critical Privilege Escalation in Multicloud Operators Subscription
A CVSS 9.9 flaw in multicloud-operators-subscription lets tenants bypass security controls via malicious HelmRelease CRs, enabling privileged Helm execution.
- Security
CVE-2026-75860: WordPress JSON Options Plugin Unauthenticated Options Update (CVSS 9.8)
Critical WordPress plugin flaw lets unauthenticated attackers update arbitrary options, enabling privilege escalation and full site takeover.
- Security
CVE-2026-15142: Real Estate Manager Pro Privilege Escalation via Capability Confusion
CVSS 7.5 flaw in Real Estate Manager Pro for WordPress lets attackers escalate privileges by exploiting an attachment ID and user ID confusion bug.
- Security
CVE-2026-19598: WordPress Pods Plugin Privilege Escalation via Authorization Bypass
CVSS 9.8 flaw in WordPress Pods plugin lets unauthenticated users escalate privileges via a flawed AJAX authorization router in versions up to 3.3.9.
- Security
CVE-2026-15303: WordPress 6Storage Rentals Authentication Bypass
Critical authentication bypass in 6Storage Rentals WordPress plugin v2.27.0 allows unauthenticated users to create privileged accounts via exposed AJAX handler.
- Security
CVE-2026-63700: Dell Wyse Management Suite Privilege Escalation
Dell patches a high-severity privilege escalation flaw in Wyse Management Suite allowing local attackers to achieve full system compromise.
- Security
CVE-2026-72822: Grav API Plugin 2FA Scope Bypass Allows Admin Account Takeover
Grav API plugin before 1.0.13 fails to enforce API key scope caps on the disable2fa endpoint, enabling privilege escalation.
- Security
CVE-2026-72824: Grav API Plugin Twig Toggle Bypass Escalates Least-Privilege Keys
Grav API plugin before 1.0.13 lets low-privilege API keys enable Twig processing on pages via a broken scope gate in PagesController.
- News
Microsoft Patches LegacyHive Windows Zero-Day That Grants Admin Privileges
CVE-2026-62832 in Windows User Profile Service lets local users hijack registry hives and escalate to admin. Patch now via August Patch Tuesday.
- Security
TypeBot OAuth Credential Takeover via Low-Privilege Collaborator
TypeBot versions before 3.17.0 allow a read-only collaborator to extract and overwrite workspace OAuth credentials, enabling full account takeover.
- Security
CVE-2026-68820: Windows WinSock Driver Use-After-Free Privilege Escalation
Actively exploited use-after-free in Windows afd.sys (WinSock driver) enables local privilege escalation to SYSTEM. CVSS 7.0. Patch immediately.
- Security
CVE-2026-28005: Critical Privilege Escalation in Kadence WooCommerce Email Designer
A critical unauthenticated privilege escalation flaw (CVSS 9.8) in Kadence WooCommerce Email Designer <= 1.5.19 allows attackers to gain admin access with...
- Security
CVE-2026-10059: Multicluster Engine ClusterCurator Token Escalation (CVSS 9.1)
A critical privilege escalation vulnerability in Red Hat's Multicluster Engine for Kubernetes allows a tenant administrator to exploit the ClusterCurator...
- Security
CVE-2026-10090: Red Hat ACM Helm Channel Privilege Escalation (CVSS 9.9)
A critical privilege escalation flaw in Red Hat Advanced Cluster Management for Kubernetes allows a namespace-scoped user to hijack cluster-admin...
- Security
CVE-2026-15414: WooCommerce Subscriptions Plugin Privilege Escalation (CVSS 8.8)
A high-severity privilege escalation vulnerability in the Subscriptions for WooCommerce plugin allows authenticated users to elevate their role to...
- Security
CVE-2025-10656: WooCommerce Plugin Missing Authorization Allows Unauthenticated Admin Account Creation
A critical missing authorization vulnerability in the Spreadsheet Price Changer for WooCommerce plugin allows unauthenticated attackers to create admin...
- Security
CVE-2026-14446: IBM WebSphere Admin Console Privilege Escalation
A critical broken access control flaw (CVSS 9.8) in IBM WebSphere Application Server 8.5 and 9.0 allows attackers to escalate privileges via the...
- Security
CVE-2026-12394: MemberGlut Plugin Lets Anyone Register as WordPress Admin
A critical privilege escalation flaw in the MemberGlut WordPress plugin allows unauthenticated users to register with any role — including administrator —...
- Security
CVE-2026-56163: Critical Auth Bypass in Azure Kubernetes Service Allows Privilege Escalation
A CVSS 10.0 vulnerability in Microsoft Azure Kubernetes Service allows unauthenticated attackers to escalate privileges over the network due to missing...
- Security
CVE-2026-57106: Critical SSRF in SAP Data Quality Enables Unauthenticated Privilege Escalation
A CVSS 10.0 server-side request forgery vulnerability in SAP Data Quality Management allows an unauthenticated attacker to escalate privileges over the...
- Security
CVE-2026-16232: Check Point SmartConsole Improper Authentication
A critical improper authentication flaw in Check Point SmartConsole allows unauthenticated remote attackers to steal login tokens and gain full admin...
- Security
CVE-2026-28302: SolarWinds Serv-U IDOR Leads to Root RCE
A critical CVSS 9.1 vulnerability in SolarWinds Serv-U allows group administrators to exploit an insecure direct object reference flaw to escalate...
- Security
CVE-2026-13439: WordPress Easy Form Builder Unauthenticated Privilege Escalation (CVSS 9.8)
A critical unauthenticated privilege escalation vulnerability in the Easy Form Builder by WhiteStudio WordPress plugin allows attackers to reset admin...
- Security
CVE-2026-44359: Meshtastic CI/CD Workflow Exposes Repository Secrets (CVSS 10.0)
A critical GitHub Actions misconfiguration in the Meshtastic open-source mesh networking project allows attacker-controlled fork code to execute with...
- Security
CVE-2026-47868: VMware Avi Load Balancer Local Privilege Escalation
A local privilege escalation vulnerability in VMware Avi Load Balancer allows malicious local users to execute code as root. Versions 22.x through 32.1.1...
- Security
CVE-2026-47870: VMware Avi Load Balancer Authenticated Remote Code Execution
An authenticated privilege escalation flaw in VMware Avi Load Balancer enables network-connected users to execute remote code. CVSS 7.1 High — all...
- Security
CVE-2026-47866: Authorization Bypass in VMware Avi Load Balancer
A CVSS 8.3 authorization bypass vulnerability in VMware Avi Load Balancer allows low-privileged authenticated users to access restricted Control Plane...
- News
New Windows LegacyHive Zero-Day Gives Hackers Admin Privileges
A security researcher has released a public Windows zero-day exploit called LegacyHive that allows local privilege escalation to SYSTEM on fully...
- Security
CVE-2026-15103: WPFunnels Plugin Privilege Escalation via Unauthenticated REST Endpoint
A high-severity privilege escalation flaw in WPFunnels for WordPress allows attackers to update arbitrary site options via an unvalidated REST callback,...
- Security
CVE-2026-15982: WordPress Aimogen Pro Plugin Privilege Escalation (CVSS 9.8)
Critical privilege escalation in the Aimogen Pro WordPress plugin (all versions up to 2.8.4) — missing capability check on AI function allows any...
- News
Researcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch Tuesday
Security researcher Chaotic Eclipse released LegacyHive, a proof-of-concept exploit for a Windows User Profile Service privilege escalation vulnerability,...
- Security
CVE-2026-56155: Microsoft AD FS Access Control Flaw Enables Golden SAML Attacks
Microsoft's July 2026 Patch Tuesday fixes CVE-2026-56155, an actively exploited privilege escalation flaw in Active Directory Federation Services....
- News
RedHook Android Malware Now Uses Wireless ADB for Shell Access
A new RedHook variant abuses Android's Wireless Debugging feature to gain shell-level privileges without a USB connection — a novel technique that...
- Security
Coolify CVE-2026-34037: CVSS 9.9 IDOR Enables Cross-Team Resource Takeover
A critical IDOR vulnerability in Coolify's cloneTo() Livewire action allows authenticated users to clone and take over resources across team boundaries...
- Security
Coolify CVE-2026-34048: Low-Privilege Terminal Escalation via WebSocket (CVSS 9.9)
A critical privilege escalation flaw in Coolify's terminal WebSocket routes lets any low-privileged team member connect to privileged server terminals by...
- Security
Privilege Escalation via Role Manipulation in Online Exam LMS (CVE-2026-14719)
A high-severity improper privilege management flaw in SourceCodester's Online Examination and Learning Management System 1.0 allows remote attackers to...
- News
New 'Bad Epoll' Linux Kernel Flaw Lets Unprivileged Users Gain Root, Hits Android
A use-after-free bug in the Linux kernel's epoll subsystem — CVE-2026-46242 — lets any local user escalate to root on Linux 6.4+ with ~99% reliability. A...
- Security
CVE-2026-41106: M365 Copilot Open Redirect Allows Unauthenticated Privilege Escalation
A critical open redirect vulnerability in Microsoft 365 Copilot rated CVSS 9.3 enables unauthenticated attackers to perform privilege escalation over the...
- Security
CVE-2026-45499: Azure OpenAI SSRF Enables Privilege Escalation — CVSS 9.9
A critical server-side request forgery vulnerability in Azure OpenAI rated CVSS 9.9 allows an authorized attacker to escalate privileges over the network,...
- Security
UniFi Talk SQL Injection Chain Enables Host Privilege Escalation CVE-2026-50747
Multiple authenticated SQL injection vulnerabilities in Ubiquiti's UniFi Talk Application can be chained to escalate privileges to host-level access on...
- Security
UniFi Access Improper Access Control Allows Host Privilege Escalation CVE-2026-54400
A critical improper access control vulnerability in Ubiquiti's UniFi Access Application enables high-privileged network attackers to further escalate...
- Security
CVE-2026-12073: ProfileGrid WordPress Plugin Critical Privilege Escalation
A critical CVSS 9.8 vulnerability in the ProfileGrid WordPress plugin allows unauthenticated attackers to take over any user account and escalate...
- Security
CVE-2026-12415: WordPress Invoice Generator Privilege Escalation (CVSS 9.8)
A critical unauthenticated privilege escalation flaw in the WordPress Invoice Generator plugin allows any attacker to take over administrator accounts via...
- Security
CVE-2026-46735: Dell DDPM Mac OS Command Injection Allows Local Privilege Escalation
A high-severity OS command injection flaw in Dell Display and Peripheral Manager for macOS (versions prior to 2.3) allows low-privileged local attackers...
- Security
CVE-2026-11807: Critical Authorization Bypass in Event-Driven Ansible WebSocket API
A missing authorization flaw (CVSS 9.6) in Red Hat's Event-Driven Ansible allows any authenticated user to forge WebSocket messages and access plaintext...
- News
LiteLLM Vulnerability Chain Lets Low-Privilege Users Take Over AI Gateway Servers
Researchers at Obsidian Security disclosed a chain of three vulnerabilities in the widely deployed LiteLLM open-source AI gateway that allows a default...
- Security
CVE-2026-47369: UniFi OS Privilege Escalation via Improper Input Validation
A critical CVSS 9.9 privilege escalation vulnerability in Ubiquiti UniFi OS allows a low-privileged network attacker to escalate privileges within UniFi...
- Security
CVE-2025-6254: WordPress Doctreat Core Plugin Privilege Escalation (CVSS 9.8)
A critical unauthenticated privilege escalation vulnerability in the Doctreat Core WordPress plugin allows attackers to register with elevated roles,...
- News
Microsoft Defender RoguePlanet Zero-Day Grants SYSTEM Access on Updated Windows
Anonymous researcher Chaotic Eclipse released a PoC exploit for a new Microsoft Defender zero-day named RoguePlanet. The race condition flaw grants SYSTEM...
- News
Microsoft Patches YellowKey, GreenPlasma, and MiniPlasma Zero-Days
Microsoft's June 2026 Patch Tuesday fixes three actively exploited Windows zero-days: two SYSTEM privilege escalation flaws and a BitLocker bypass...
- Security
CVE-2025-10263: ARM CPU Privilege Escalation Across Multiple Processor Families
Critical CVSS 9.1 flaw in ARM Cortex-X and Neoverse processors may allow writes to resources owned by a higher exception level.
- Security
CVE-2026-21029: Samsung Galaxy Editing Service Privilege Escalation
A high-severity vulnerability in Samsung's Galaxy Editing Service allows local attackers to execute privileged operations due to improper export of Android…
- Security
CVE-2026-9851: WordPress Booking Package Plugin Privilege Escalation via Account Takeover
A high-severity privilege escalation vulnerability in the Booking Package WordPress plugin allows unauthenticated or low-privileged attackers to take over…
- News
Cisco Warns of Unpatched SD-WAN Zero-Day Exploited in Attacks
Cisco has issued an emergency warning about an actively exploited, unpatched zero-day in Cisco Catalyst SD-WAN Manager (CVE-2026-20245) that enables root…
- Security
CVE-2026-50211: Leftover Engineering Diagnostics Grant Malicious Apps NVRAM Write Access
A critical CVSS 9.8 vulnerability exposes factory-level diagnostic interfaces left in retail firmware builds, allowing malicious applications to gain write…
- News
Critical Kirki Flaw Exploited to Hijack WordPress Admin Accounts
Hackers are actively exploiting a critical privilege escalation vulnerability (CVE-2026-8206) in the widely-used Kirki Customizer Framework plugin for…
- Security
CVE-2022-0492: Linux Kernel Improper Authentication Vulnerability
A Linux kernel vulnerability in the cgroups v1 release_agent feature allows local attackers to escalate privileges and escape containers. Added to CISA KEV…
- Security
CVE-2026-27788: Fujitsu ServerView Agents Privilege Escalation to SYSTEM
An incorrect permission assignment vulnerability in Fujitsu ServerView Agents for Windows V11.60.04 and earlier allows a local authenticated attacker to…
- Security
CVE-2026-8206: Kirki WordPress Plugin Critical Privilege Escalation via Account Takeover
The Kirki Freeform Page Builder plugin for WordPress (versions 6.0.0–6.0.6) allows unauthenticated attackers to take over any user account during password…
- Security
CVE-2026-8732: WP Maps Pro Privilege Escalation via Admin Account Creation
A critical unauthenticated privilege escalation flaw in WP Maps Pro for WordPress (CVSS 9.8) allows attackers to create administrator accounts without...
- News
CISA Urges Immediate Patching of Exploited LiteSpeed cPanel
CISA has added a LiteSpeed cPanel plugin zero-day to its Known Exploited Vulnerabilities catalog after active exploitation allowed attackers to execute scripts.
- Security
CVE-2026-7374: KubeVirt virt-handler Symlink RCE (CVSS 9.9)
A critical symlink validation flaw in KubeVirt's virt-handler lets authenticated OpenShift users with edit access in a single namespace escalate to arbitrary.
- News
LiteSpeed cPanel Plugin CVE-2026-48172 Exploited to Run
A maximum-severity vulnerability in the LiteSpeed User-End cPanel Plugin, tracked as CVE-2026-48172 with a CVSS score of 10.0, is under active...
- News
Microsoft Warns of Two Actively Exploited Defender
Microsoft has disclosed two Windows Defender vulnerabilities under active exploitation in the wild, including CVE-2026-41091 — a privilege escalation flaw...
- Security
CVE-2026-20223: Cisco Secure Workload REST API Auth Bypass
A CVSS 10.0 authentication bypass in Cisco Secure Workload allows unauthenticated remote attackers to access internal REST APIs with full Site Admin privileges.
- News
MiniPlasma Windows 0-Day Enables SYSTEM Privilege
A new Windows kernel privilege escalation zero-day dubbed MiniPlasma, released by researcher Chaotic Eclipse, grants SYSTEM-level access on fully patched...
- News
New Windows ''MiniPlasma'' Zero-Day Exploit Gives SYSTEM
A cybersecurity researcher has released a proof-of-concept exploit for a Windows privilege escalation zero-day dubbed MiniPlasma that lets attackers gain...
- Security
CVE-2026-8719: WordPress AI Engine Plugin Privilege
A missing WordPress capability check in the AI Engine plugin's MCP OAuth bearer-token path allows any authenticated user to escalate privileges to...
- News
Researcher Drops YellowKey, GreenPlasma Windows Zero-Days
A security researcher has publicly released two unpatched Windows zero-day exploits: YellowKey, a BitLocker bypass requiring physical access, and...
- News
Windows Zero-Days Expose BitLocker Bypasses and CTFMON
An anonymous researcher has publicly disclosed two new unpatched Windows zero-days — YellowKey enabling BitLocker bypass and GreenPlasma targeting CTFMON...
- News
Windows BitLocker Zero-Day Gives Access to Protected
A cybersecurity researcher has published proof-of-concept exploits for two unpatched Windows vulnerabilities — YellowKey (BitLocker bypass) and...
- Security
CVE-2021-47932: WordPress TheCartPress 1.5.3.6 Privilege
TheCartPress WordPress plugin 1.5.3.6 allows unauthenticated attackers to register new administrator accounts by exploiting the AJAX handler with a...
- News
New Linux 'Dirty Frag' Zero-Day Gives Root on All Major
A new unpatched Linux zero-day exploit dubbed 'Dirty Frag' allows local attackers to gain root privileges on virtually all major Linux distributions with...
- Security
CVE-2026-42296: Argo Workflows templateReferencing Strict
A high-severity security bypass in Argo Workflows (CVSS 8.1) allows users with Workflow creation permissions to escape templateReferencing: Strict mode,...
- News
CISA Adds Actively Exploited Linux Root Access Bug
The U.S. Cybersecurity and Infrastructure Security Agency has added CVE-2026-31431, a Linux kernel privilege escalation flaw enabling root access, to its...
- Security
CVE-2026-31431: Linux Kernel Privilege Escalation via Incorrect Resource Transfer
A Linux Kernel vulnerability involving incorrect resource transfer between spheres has been added to CISA's Known Exploited Vulnerabilities catalog,...
- Security
CVE-2026-35547: FreeBSD libnv Heap Buffer Overflow Allows
A critical heap buffer overflow in FreeBSD's libnv library allows an unprivileged program to write outside heap allocation bounds during message header...
- Security
CVE-2026-35155: Dell iDRAC10 Race Condition Enables
Dell iDRAC10 versions 1.20.70.50 and 1.30.05.10 contain a race condition vulnerability allowing authenticated low-privileged attackers to gain elevated...
- News
New 'Pack2TheRoot' Flaw Gives Hackers Root Linux Access
A newly disclosed vulnerability in the PackageKit daemon, dubbed Pack2TheRoot, allows local Linux users to escalate privileges to root by abusing the...
- Security
CVE-2026-21515: Azure IoT Central Elevation of Privilege
A critical CVSS 9.9 elevation of privilege vulnerability in Azure IoT Central allows an authenticated attacker to escalate privileges over a network by...
- Security
CVE-2026-41478: Saltcorn SQL Injection Allows Full Database
A critical SQL injection vulnerability in Saltcorn's mobile-sync routes allows any authenticated low-privilege user with read access to a single table to...
- Security
CVE-2026-24303: Microsoft Partner Center Privilege
A critical privilege escalation vulnerability in Microsoft Partner Center allows an authorized attacker to elevate their privileges over a network,...
- Security
CVE-2026-29646: OpenXiangShan NEMU RISC-V Hypervisor
A critical privilege escalation flaw in OpenXiangShan NEMU's RISC-V hypervisor extension allows a VS-mode guest write to the supervisor interrupt-enable...
- Security
CVE-2025-36568: Dell PowerProtect Data Domain BoostFS
A high-severity insufficiently protected credentials vulnerability in Dell PowerProtect Data Domain BoostFS allows low-privileged local attackers to...
- Security
CVE-2026-40285: WeGIA SQL Injection via PHP extract()
A high-severity SQL injection vulnerability in WeGIA, a web manager for charitable institutions, allows authenticated attackers to escalate privileges by...
- News
Recently Leaked Windows Zero-Days Now Exploited in Active
Threat actors are actively exploiting three recently disclosed Windows security vulnerabilities that allow attackers to gain SYSTEM or elevated...
- News
Three Microsoft Defender Zero-Days Actively Exploited; Two
Huntress is warning that threat actors are actively exploiting three privilege escalation vulnerabilities in Microsoft Defender — codenamed BlueHammer,...
- Security
CVE-2026-5412: Juju Controller Facade Allows Low-Privilege
An authorization flaw in Juju's Controller facade allows any authenticated low-privilege user to call the CloudSpec API and extract the cloud provider...
- Security
CVE-2026-34178: Canonical LXD Backup Import Path
A critical CVSS 9.1 vulnerability in Canonical LXD before 6.8 allows authenticated attackers to bypass project restrictions during backup import. The...
- Security
CVE-2026-39860: Nix Symlink Attack Allows Root File
A bypass of the CVE-2024-27297 patch in the Nix package manager allows attackers to follow symlinks during fixed-output derivation builds, enabling...
- Security
CVE-2026-4498: Kibana Fleet Plugin Privilege Escalation
A high-severity privilege escalation flaw in Kibana's Fleet plugin debug route handlers allows authenticated users with limited Fleet sub-feature...
- Security
CVE-2026-4003: WordPress Users Manager PN Plugin Privilege
A critical privilege escalation vulnerability in the Users Manager – PN WordPress plugin (v1.1.15 and below) allows unauthenticated attackers to update...
- Security
CVE-2026-1114: lollms JWT Weak Secret Key Allows Admin
A critical vulnerability (CVSS 9.8) in parisneo/lollms v2.1.0 allows attackers to brute-force the application's JWT secret key offline, forge...
- News
Disgruntled Researcher Leaks BlueHammer Windows Zero-Day
A security researcher operating under the aliases 'Chaotic Eclipse' and 'Nightmare-Eclipse' has publicly released exploit code for an unpatched Windows...
- News
GPUBreach: New Rowhammer Attack on GPU GDDR6 Memory Enables
Researchers from the University of Toronto have demonstrated GPUBreach, a novel attack that induces Rowhammer bit-flips in GPU GDDR6 memory to bypass...
- Security
CVE-2026-26135: Azure Custom Locations SSRF Enables
A critical server-side request forgery vulnerability in Azure Custom Locations Resource Provider allows an authorized attacker to elevate privileges over...
- News
Cisco Patches Critical and High-Severity Vulnerabilities
Cisco has released security advisories addressing a batch of critical and high-severity vulnerabilities across multiple products, covering flaws that...
- Security
CVE-2026-32987: OpenClaw Bootstrap Code Replay Enables
A critical CVSS 9.8 vulnerability in OpenClaw allows attackers to replay a valid bootstrap setup code multiple times before approval, escalating device...
- Security
CVE-2026-32922: OpenClaw Privilege Escalation via Token
A critical CVSS 9.9 privilege escalation vulnerability in OpenClaw allows operators with limited pairing scope to mint tokens with unrestricted admin...
- Security
CVE-2026-3629: WordPress User Import Plugin Privilege
The Import and export users and customers plugin for WordPress is vulnerable to privilege escalation in all versions up to 1.29.7, allowing authenticated...
- Security
CVE-2026-22172: OpenClaw Critical Authorization Bypass via WebSocket Scope Elevation
A critical CVSS 9.9 authorization bypass in OpenClaw allows authenticated users to self-declare elevated scopes over WebSocket connections without...
- Security
CVE-2026-25770: Wazuh Privilege Escalation to Root via Cluster Protocol File Write
A critical privilege escalation vulnerability (CVSS 9.1) in Wazuh versions 3.9.0–4.14.2 allows authenticated cluster nodes to overwrite the manager...
- Security
CVE-2016-20024: ZKTeco ZKTime.Net Insecure File Permissions
ZKTeco ZKTime.Net 3.0.1.6 ships with world-writable directory permissions on its installation folder, allowing any local unprivileged user to replace...
- Security
Critical RCE in Veeam Backup & Replication — Backup Viewer
A critical CVSS 9.9 vulnerability in Veeam Backup & Replication allows users with the lowest-privileged Backup Viewer role to execute arbitrary code as...
- Security
CVE-2026-21533: Windows Remote Desktop Services Zero-Day
Actively exploited zero-day in Windows RDS allows authenticated attackers with low privileges to escalate to SYSTEM. Public exploit code available....
- Security
Cisco IOS XE Web UI Privilege Escalation Actively Exploited
Cisco discloses a high-severity privilege escalation vulnerability in IOS XE Web UI that allows authenticated users to gain root access. Active...
- Security
WordPress Plugin Vulnerability (CVSS 10.0) Under Active
Maximum severity flaw in Modular DS WordPress plugin allows unauthenticated privilege escalation. All versions through 2.5.1 affected with active...