Total
3852 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-13618 | 2026-10-07 | N/A | 9.8 CRITICAL | ||
| The Mentoring plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.2.8. This is due to the plugin not properly restricting the roles that users can register with in the mentoring_process_registration() function. This makes it possible for unauthenticated attackers to register with administrator-level user accounts. | |||||
| CVE-2025-9912 | 2026-10-07 | N/A | 6.3 MEDIUM | ||
| Nokia SR Linux is vulnerable to a local privilege escalation vulnerability. Successful exploitation of this vulnerability may allow an authenticated user to execute arbitrary commands with superuser privilege. | |||||
| CVE-2025-5088 | 2026-10-07 | N/A | 8.3 HIGH | ||
| An authenticated Redis session could be used to obtain full root access to all servers in the CVX cluster. Note that this would require an attacker to have both network access to the Redis service on a CVX server and the Redis password. Please note that all Redis communication, including authentication, occurs over plaintext in the present day. TLS support is tracked under RFE1294850. | |||||
| CVE-2025-6254 | 2026-10-07 | N/A | 9.8 CRITICAL | ||
| The Doctreat Core plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.6.8. This is due to the doctreat_process_registration() function not properly restricting the roles that a user can register with. This makes it possible for unauthenticated attackers to register as an administrator user. | |||||
| CVE-2025-31272 | 1 Apple | 1 Macos | 2026-10-07 | N/A | 7.8 HIGH |
| The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4. An app may be able to bypass launch constraint protections and execute malicious code with elevated privileges. | |||||
| CVE-2026-45632 | 2026-10-06 | N/A | 9.9 CRITICAL | ||
| Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.26.7 and earlier, the schedule router does not enforce organization/role checks. As a result, any authenticated user can create, update, run, or delete schedules belonging to other organizations if they know the scheduleId/serverId. Schedule types server and dokploy-server write and execute scripts on the host or remote servers, enabling RCE on the Dokploy host or a target server. | |||||
| CVE-2026-55307 | 2026-10-06 | N/A | 4.4 MEDIUM | ||
| In kdn_set_sysregs_prot of hwcrypto-kdn.c, there is a possible information disclosure due to a logic error in the code. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2026-81445 | 1 Dell | 1 Openmanage Server Administrator | 2026-10-06 | N/A | 7.2 HIGH |
| Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Privilege Management vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges. | |||||
| CVE-2026-81442 | 1 Dell | 1 Openmanage Server Administrator | 2026-10-06 | N/A | 8.1 HIGH |
| Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Privilege Management vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information tampering and Unauthorized access. | |||||
| CVE-2026-82893 | 1 Ibm | 1 Guardium Data Protection | 2026-10-06 | N/A | 7.8 HIGH |
| IBM Guardium Data Protection 12.2 could allow a local attacker to gain elevated privileges due to improper privilege management. | |||||
| CVE-2026-84083 | 1 Ibm | 1 Guardium Data Protection | 2026-10-06 | N/A | 7.8 HIGH |
| IBM Guardium Data Protection 12.2 is vulnerable to local privilege escalation via the SUID-root nmap_wrapper binary on the Collector appliance. A local attacker with low-privileged access to the Collector can exploit insufficient argument validation in the SUID binary to execute arbitrary commands as root, resulting in full compromise of the Collector appliance. | |||||
| CVE-2026-84089 | 1 Ibm | 1 Guardium Data Protection | 2026-10-06 | N/A | 7.8 HIGH |
| IBM Guardium Data Protection 12.2 could allow a local attacker to gain elevated privileges due to improper privilege management. | |||||
| CVE-2026-105687 | 2026-10-06 | N/A | 4.9 MEDIUM | ||
| Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-team-member RPC allows a team administrator to remove any member other than themselves but does not protect the team owner. A non-owner administrator can delete the owner's team-profile-rel membership and lock the owner out of the team and its projects, files, fonts, and media. This issue is fixed in version 2.18.0. | |||||
| CVE-2026-105634 | 2026-10-06 | N/A | 8.1 HIGH | ||
| Plane is an open-source project management tool. Prior to 1.3.0, the ProjectMemberViewSet.partial_update method allows any project member, including a user with the lowest GUEST role, to modify another project member's role. The authorization check prevents assigning a role higher than the requester's role but does not prevent assigning a lower or equal role, allowing a Guest to demote Administrators and Members and deny them project control. This vulnerability is fixed in 1.3.0. | |||||
| CVE-2026-97644 | 2026-10-06 | N/A | 8.8 HIGH | ||
| The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation via Contact Identity Rebinding in all versions up to, and including, 4.9 The vulnerability exists because the `create_contact` function in the v3 REST endpoint (`POST /gh/v3/contacts`) is gated solely by the `add_contacts` capability and forwards the full request payload — including the security-bearing `user_id` column — into the upsert path of `Contacts_DB::add()`, which bypasses the ownership guard that `Contacts_DB::update()` enforces, allowing an attacker to rebind any existing contact record to an arbitrary WordPress user ID. This makes it possible for authenticated attackers with Sales Representative-level access and above to upsert their own contact row to point to an Administrator's user ID, then invoke the v4 email-test endpoint (`POST /gh/v4/emails/test`) — also accessible to the Sales Representative role via the `send_emails` capability — to generate an `{auto_login_url}` one-time permissions key bound to the rebound contact, and consume that link to call `wp_set_auth_cookie()` and gain a fully authenticated session as the WordPress Administrator. | |||||
| CVE-2026-92015 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-06 | N/A | 8.8 HIGH |
| Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. | |||||
| CVE-2026-92017 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-06 | N/A | 8.8 HIGH |
| Privilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. | |||||
| CVE-2026-105688 | 2026-10-06 | N/A | 6.7 MEDIUM | ||
| Penpot is an open-source design and prototyping platform. Prior to 2.18.0, create-team-invitations and the invitation acceptance path allow a non-owner team administrator to assign the owner role because invitation roles are persisted and applied without the role-ceiling check used by update-team-member-role. An administrator can invite another account as an owner, create multiple owners, and then use the new owner account to obtain owner-only control over the team. This issue is fixed in version 2.18.0. | |||||
| CVE-2026-104412 | 2026-10-06 | N/A | 4.3 MEDIUM | ||
| Ghost 0.5.0 before 6.64.0 does not correctly restrict staff role assignment, allowing users with the Editor or Super Editor role to assign their own role to other staff despite lacking permission to do so. An authenticated Editor or Super Editor can promote Author and Contributor users to Editor or Super Editor. | |||||
| CVE-2026-105126 | 2026-10-05 | N/A | 7.2 HIGH | ||
| LaraDashboard before 1.4.8 contains an improper privilege management vulnerability that allows authenticated Admin users to escalate to Superadmin by editing or renaming roles. Attackers with role.edit can rename their role to Superadmin or grant user.login_as permissions to take over accounts and reach core upgrade and module installation functions for code execution. | |||||