Privilege Escalation

Articles tagged Privilege Escalation

• 
  News

  Exploited Zammad helpdesk chain runs from session hijack to root

  CISA added two chained Zammad flaws to its KEV catalog: a session hijack giving code execution and a local root escalation, with a 5 October federal deadline.

  known-exploited-vulnerabilitieszammadhelpdesk +2

  2026-10-03
• 
  Vulnerability

  ACPT- Custom Post Types Plugin for WordPress Privilege Escalation (CVE-2026-32566)

  CVE-2026-32566 is a CVSS 9.8 unauthenticated privilege escalation flaw in the ACPT Pro WordPress plugin, reported exploited by VulnCheck KEV.

  acptwordpressprivilege-escalation +2

  2026-09-20
• 
  Vulnerability

  Acronis Backup plugin for cPanel & WHM Privilege Escalation (CVE-2026-87886)

  CVE-2026-87886 is a CVSS 7.8 local privilege escalation in Acronis Backup control-panel plugins, confirmed exploited per CISA KEV.

  acronisbackupprivilege-escalation +3

  2026-09-20
• 
  Vulnerability

  Adobe Commerce Privilege Escalation (CVE-2026-71362)

  CVE-2026-71362 is a CVSS 9.1 incorrect authorization flaw in Adobe Commerce enabling privilege escalation, reported exploited by VulnCheck KEV.

  adobecommercemagento +3

  2026-09-20
• 
  Vulnerability

  Affiliate Pro - Affiliate Program for WooCommerce & WordPress Privilege Escalation (CVE-2026-32558)

  CVE-2026-32558 is a CVSS 9.8 unauthenticated privilege escalation flaw in the Affiliate Pro WordPress plugin, reported exploited by VulnCheck KEV.

  redefiningthewebwordpresswoocommerce +3

  2026-09-20
• 
  Vulnerability

  Amelia Privilege Escalation (CVE-2026-9055)

  CVE-2026-9055 is a CVSS 9.8 flaw in the Amelia WordPress plugin allowing account takeover via password overwrite, reported exploited by VulnCheck.

  ameliawordpressprivilege-escalation +3

  2026-09-20
• 
  Vulnerability

  Google Pixel Privilege Escalation (CVE-2026-58704)

  CVE-2026-58704 is a CVSS 8.8 permission bypass in the Pixel cellular modem, confirmed exploited per CISA and VulnCheck KEV.

  googlepixelandroid +4

  2026-09-20
• 
  Vulnerability

  JetFormBuilder Privilege Escalation (CVE-2026-54196)

  CVE-2026-54196 is a CVSS 6.8 privilege escalation in the JetFormBuilder WordPress plugin, per VulnCheck alone.

  jetformbuildercrocoblockwordpress +3

  2026-09-20
• 
  Vulnerability

  Linux Kernel Privilege Escalation (CVE-2026-31635)

  CVE-2026-31635 is a CVSS 7.5 Linux kernel flaw in the rxrpc/rxgk network protocol, reported exploited by VulnCheck alone.

  linux-kernelrxrpcprivilege-escalation +3

  2026-09-20
• 
  Vulnerability

  MiniOrange SAML SP Single Sign On Privilege Escalation (CVE-2026-61979)

  CVE-2026-61979 is a CVSS 8.1 unauthenticated privilege escalation in a WordPress SAML SSO plugin, per VulnCheck alone.

  miniorangesamlwordpress +4

  2026-09-20
• 
  Vulnerability

  OPSWAT AppRemover Driverv2017.10.02.1551 and earlier Privilege Escalation (CVE-2026-36425)

  CVE-2026-36425 is a CVSS 6.5 improper privilege management flaw in the OPSWAT AppRemover kernel driver, per VulnCheck alone.

  opswatwindows-driverprivilege-escalation +2

  2026-09-20
• 
  Vulnerability

  Events Manager Privilege Escalation (CVE-2026-18366)

  CVE-2026-18366 is a CVSS 9.8 flaw in the Events Manager WordPress plugin allowing unauthenticated Administrator takeover, reported exploited by VulnCheck.

  pixelitewordpressevents-manager +3

  2026-09-20
• 
  Vulnerability

  Automatic Bug Reporting Tool Privilege Escalation (CVE-2015-5287)

  CVE-2015-5287 is a 2015 CVSS 7.8 symlink privilege escalation in Red Hat ABRT, added to CISA KEV in August 2026.

  red-hatabrtprivilege-escalation +3

  2026-09-20
• 
  Vulnerability

  Custom User Registration Fields for WooCommerce Privilege Escalation (CVE-2026-15369)

  CVE-2026-15369 is a CVSS 9.8 flaw in a WooCommerce checkout plugin allowing unauthenticated Administrator account creation, reported exploited by VulnCheck.

  addifywordpresswoocommerce +3

  2026-09-20
• 
  Vulnerability

  YITH WooCommerce Waitlist Premium Privilege Escalation (CVE-2026-14359)

  CVE-2026-14359 is a CVSS 8.8 privilege escalation in YITH WooCommerce Waitlist Premium, reported exploited by VulnCheck alone.

  yithwoocommercewordpress +4

  2026-09-20
• 
  Vulnerability

  Microsoft Windows Privilege Escalation (CVE-2026-81963)

  CVE-2026-81963 lets a local attacker elevate privileges via improper link resolution in the Windows Update Stack. Added to CISA KEV Sept. 8, 2026.

  microsoftwindowsprivilege-escalation +3

  2026-09-15
• 
  Vulnerability

  ConnectWise ScreenConnect Privilege Escalation (CVE-2026-84869)

  CVE-2026-84869 lets attackers transfer and execute files through an active ScreenConnect remote session without Host confirmation. Added to CISA KEV Sept. 11, 2026.

  connectwisescreenconnectprivilege-escalation +3

  2026-09-12
• 
  Vulnerability

  JFrog Artifactory Self-Hosted Privilege Escalation (CVE-2026-42016)

  CVE-2026-42016 lets attackers escalate privileges in JFrog Artifactory via a token-scope validation gap. CISA added it to KEV Sept. 11, 2026; Wiz reports in-the-wild exploitation.

  jfrogartifactoryprivilege-escalation +3

  2026-09-12
• 
  Vulnerability

  PostgreSQL Anonymizer Privilege Escalation (CVE-2026-19633)

  CVE-2026-19633 is a CVSS 8.8 high-severity privilege escalation in PostgreSQL Anonymizer, letting masked users run arbitrary code with elevated privileges via crafted masking rules.

  postgresqlprivilege-escalationcve-2026-19633

  2026-09-11
• 
  Vulnerability

  Microsoft Windows Privilege Escalation (CVE-2026-85880)

  CVE-2026-85880 is a heap-based buffer overflow in Windows ALPC allowing local privilege escalation. Added to CISA KEV Sept. 8, 2026, the same day as CVE-2026-81963.

  microsoftwindowsprivilege-escalation +2

  2026-09-10
• 
  Vulnerability

  2 Zohocorp ManageEngine Endpoint Central CVEs (CVE-2026-77697)

  Two Zohocorp ManageEngine Endpoint Central vulnerabilities (CVE-2026-77697, CVE-2026-77699) allow local privilege escalation via JAR extraction and untrusted DLL loading, fixed in recent point releases.

  manageenginezohoprivilege-escalation +1

  2026-09-02
• 
  Vulnerability

  2 PostgreSQL Anonymizer CVEs (CVE-2026-19634)

  Two more PostgreSQL Anonymizer vulnerabilities (CVE-2026-19634, CVE-2026-83534) let a table owner or masked user reach superuser-level code execution through the extension's import and parallel-anonymization functions.

  postgresqlprivilege-escalationsql-injection +1

  2026-08-28