Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,607 results · page 1 of 113
Oct 31, 2026Rox Appointment Booking – Appointment Booking Scheduling Solution: Privilege EscalationCVE-2026-104012 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Rox Appointment Booking – Appointment Booking Scheduling Solution plugin for WordPress is vulnerable to Privilege Escalation via Mass Assignment in all versions up to, and including, 1.3.1 This is due to the public `/rox-appointment-booking/v1/public/booking` REST endpoint performing mass-assignment of the raw request body into a new customer row while `CustomerModel::$fillable` includes the internal `wp_user_id` column, allowing an unauthenticated attacker to persist an arbitrary WordPress user ID alongside an attacker-controlled email address with no authorization check. When an administrator subsequently opens the poisoned customer record and clicks Update Customer, `SaveCustomer::handleRequest()` passes the stored `wp_user_id` and attacker-supplied email to `wp_update_user()` — succeeding because `LinkedAccount::canChange()` unconditionally returns true when the acting user holds the `edit_users` capability — thereby overwriting the targeted administrator's email address and enabling full account takeover via a standard WordPress password-reset request. Successful exploitation requires an administrator to open and save the poisoned record, and the attacker must know or gues
- Product
- Rox Appointment Booking – Appointment Booking Scheduling Solution
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Rox Appointment Booking – Appointment Booking Scheduling Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddownloads.wordpress.orgplugins.trac.wordpress.org
Oct 30, 2026Hydra is a layer-two scalability solution for Cardano.CVE-2026-62162 · Other software · cardano-scaling · reported by GitHubHigh 8.2
Hydra is a layer-two scalability solution for Cardano. Prior to 2.1.0, the `Claim` branch in `hydra-plutus/validators/deposit.ak` checks only that `datum.head_id` matches the attacker-controlled `redeemer.currencySymbol` and that the transaction is valid before the deposit deadline. It neither requires spending the Head state-token UTxO in the same transaction nor constrains outputs. After a deposit made through `POST /commit` is confirmed, any third party able to build a Cardano transaction can observe and consume the pending deposit UTxO before its deadline and redirect the assets to an arbitrary address. A standalone deposit spend invokes no Head validator, bypassing its safety checks; historical head-ID binding and the Aiken rewrite retained this missing invariant. The default deadline is three times depositPeriod, so the described attack applies to pending deposits before that deadline. This issue is fixed in version 2.1.0.
- Product
- hydra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Contributor Privilege Escalation in Profile Builder <= 4.0.5 versions.CVE-2026-54854 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Contributor Privilege Escalation in Profile Builder <= 4.0.5 versions.
- Affected
- up to 4.0.5
- What to do
- Affects up to 4.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Subscriber Privilege Escalation in WP BASE Booking <= 6.5.2 versions.CVE-2026-118086 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Subscriber Privilege Escalation in WP BASE Booking <= 6.5.2 versions.
- Affected
- up to 6.5.2
- What to do
- Affects up to 6.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 versions.CVE-2026-116386 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 versions.
- Affected
- up to 4.0.2
- What to do
- Affects up to 4.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Essential Addons for Elementor – Popular Elementor Templates & Widgets: Privilege EscalationCVE-2026-118205 · WordPress plugins & themes · reported by WordfenceHigh 7.4
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.8.7 via the `page_id` parameter of the `register_user()` function. The vulnerability exists because the handler's post status deny-list rejects `future`, `draft`, and `pending` but admits `inherit` — the status carried by every WordPress revision — allowing an attacker to substitute a revision ID for a live page ID, while a flawed "last saved by administrator" check reads `post_author` on revisions (which reflects the editing administrator) rather than the `_edit_last` meta that is never copied to revisions, and the nonce gate is rendered ineffective because any unauthenticated visitor can freely obtain a valid nonce via the `wp_ajax_nopriv_eael_get_token` endpoint. This makes it possible for unauthenticated attackers to register an account with a role as high as Editor — gaining capabilities including `edit_others_posts`, `publish_pages`, `upload_files`, and `unfiltered_html` — by naming a revision whose `_elementor_data` contains an elevated role an administrator previously saved and later reverted on a page
- Product
- Essential Addons for Elementor – Popular Elementor Templates & Widgets
- Affected
- up to 6.8.7
- What to do
- Affects up to 6.8.7. Update Essential Addons for Elementor – Popular Elementor Templates & Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 30, 2026The Ak Framework plugin for WordPress, included in the Newsy - Viral News & Magazine WordPress Theme, is vulnerable to Privilege Escalation in all versions up tCVE-2026-105894 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Ak Framework plugin for WordPress, included in the Newsy - Viral News & Magazine WordPress Theme, is vulnerable to Privilege Escalation in all versions up to, and including, 2.9.8. This is due to missing capability checks in the ajax_refresh_nonce and ak_admin_ajax handlers before passing attacker-controlled option names and values to update_option(). This makes it possible for unauthenticated attackers to update arbitrary WordPress options including users_can_register and default_role to escalate privileges to administrator by enabling user registration with administrator as the default role.
- Product
- Newsy - Viral News & Magazine
- Affected
- up to 2.9.8
- What to do
- Affects up to 2.9.8. Update Newsy - Viral News & Magazine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddocs.akbilisim.comwordfence.com
Oct 30, 2026DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate privileges by calling administrative roleCVE-2026-119654 · Other software · devlive-community · reported by VulnCheckHigh 8.7
DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate privileges by calling administrative role and menu management APIs. Attackers, including self-registered accounts, can send PUT requests to /api/v1/user/allocationRole to assign themselves the administrator role and gain full control of the instance.
- Product
- DataCap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerability that allows project users to assign system-level scopes by creating service_account ACVE-2026-119599 · Other software · looplj · reported by VulnCheckMedium 5.3
AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerability that allows project users to assign system-level scopes by creating service_account API keys with unvalidated scopes. Attackers holding write_api_keys can mint keys with read_channels and query /admin/graphql to read every channel's configuration, including base URLs and model lists.
- Product
- AxonHub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Export and Import Users and Customers: Privilege EscalationCVE-2026-104368 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Export and Import Users and Customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.7.5 via the plugin's own export and re-import workflow. The vulnerability exists because of a CSV escape-character mismatch between the exporter and the importer: class-csvwriter.php writes cells with fputcsv() using PHP's default backslash (\) escape character, while class-csvreader.php parses the same file with fgetcsv() using a double-quote (") as the escape character. As a result, a crafted value stored in a Subscriber's Biographical Info field — containing a backslash-quote sequence followed by a newline — is written as a single quoted CSV field but parsed back as two separate rows on import. The injected second row is then processed by hf_create_customer() as a new user record whose user_login, user_pass, user_email, and role are entirely attacker-controlled, allowing the creation of an arbitrary Administrator account. This makes it possible for authenticated attackers with Subscriber-level access and above to escalate their privileges to Administrator.
- Product
- Export and Import Users and Customers
- Affected
- up to 2.7.5
- What to do
- Affects up to 2.7.5. Update Export and Import Users and Customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 30, 2026Privilege Defined With Unsafe Actions vulnerability in Drupal Custom Formatters allows Privilege Escalation.CVE-2026-114524 · Websites & servers · Drupal · reported by mlhess@drupal.org
Privilege Defined With Unsafe Actions vulnerability in Drupal Custom Formatters allows Privilege Escalation. This issue affects Custom Formatters versions: from 0.0.0 to 4.2.1.
- Product
- Custom Formatters
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026A malicious actor with local access and high privileges could exploit an Improper Access Control vulnerability found in WiFiman Desktop for macOS to escalate prCVE-2026-119251 · Network & remote access · Ubiquiti Inc · reported by fe490ce8-0395-4072-90d8-2707e1bdf984Medium 6.7
A malicious actor with local access and high privileges could exploit an Improper Access Control vulnerability found in WiFiman Desktop for macOS to escalate privileges on the host device.
- Product
- WiFiman Desktop for macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows.CVE-2026-118761 · Other software · kubeflow · reported by GitHubHigh 7.5
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server decompressed uploaded pipeline archives without adequately bounding expanded data while locating or reading the pipeline file. A small ZIP or gzip-compressed tar archive can consume disproportionately large memory and exhaust API-server resources. Multipart pipeline and pipeline-version upload processing performs decompression before namespace authorization, so a reachable caller does not need a successful pipeline-create authorization decision. URL-import handlers authorize before fetching and decompressing a remote archive. The amount of expansion required to interrupt service depends on deployment resource limits and concurrent activity, and no specific archive is guaranteed to crash every deployment. This issue is fixed in version 2.18.0.
- Product
- pipelines
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows.CVE-2026-118760 · Other software · kubeflow · reported by GitHubMedium 6.5
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. From 0.5.1 until 2.17.0, the frontend artifact routes did not check whether an authenticated user was authorized to access the requested namespace. A user who can reach the frontend and knows an artifact location can select another tenant's namespace, or omit the namespace and reach an unguarded direct handler, to read artifact contents such as datasets, models, or pipeline outputs. The issue applies to multi-user deployments that rely on Kubeflow Pipelines authorization for tenant isolation. Authentication at ingress identifies the caller but does not authorize access to the selected artifact namespace. The issue does not establish arbitrary Kubernetes Secret disclosure, storage modification, or server-side code execution. This issue is fixed in version 2.17.0.
- Product
- pipelines
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows.CVE-2026-118759 · Other software · kubeflow · reported by GitHubHigh 7.5
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server's GET /apis/v1alpha1/runs/{run_id}/nodes/{node_id}/log handler retrieved logs without authorizing the caller against the selected run. A caller who can reach the backend and knows a victim run ID and suitable pod or node identifier can read live or archived logs with the API server's permissions. For live logs, the caller-controlled node ID was also accepted as a pod name without verifying that the pod belonged to the requested run, allowing a known run ID to select the namespace of an unrelated pod and read its main container logs. The handler does not authenticate requests itself, although an external authentication gate or network policy can limit reachability. Exposed logs can contain sensitive workload data or credentials. This issue is fixed in version 2.18.0.
- Product
- pipelines
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows.CVE-2026-118758 · Other software · kubeflow · reported by GitHubHigh 7.5
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the volume artifact handler for GET /artifacts/get?source=volume did not confine a caller-supplied file path to the selected volume. A caller who can reach the route and identify an existing mounted volume can use path traversal to read files outside that volume when the artifact-serving process can read them. The frontend pod serves the request when artifact proxying is disabled, while the selected namespace's artifact-service pod serves it when proxying is enabled. A deployment with authentication disabled requires no application credentials; in multi-user deployments, the caller ordinarily must be authorized for the supplied namespace. This issue is fixed in version 2.18.0.
- Product
- pipelines
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Subscriber Privilege Escalation in Buddyboss Platform <= 3.5.0 versions.CVE-2026-118082 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Subscriber Privilege Escalation in Buddyboss Platform <= 3.5.0 versions.
- Affected
- up to 3.5.0
- What to do
- Affects up to 3.5.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation viaCVE-2026-115707 · Other software · Elastic · reported by security@elastic.coMedium 6.4
Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Retrieve Embedded Sensitive Data (CAPEC-37). After the ECE certificate rotation procedure runs, data that it retains contains platform credentials and certificate authority private keys, and lower-privileged platform components can read this data. An attacker who controls any host in the installation can use this data to get full control of the ECE control plane and of the deployments that it manages.
- Product
- Elastic Cloud Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Authorization Bypass Through User-Controlled Key (CWE-639) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Privilege Abuse (CAPEC-122).CVE-2026-115706 · Other software · Elastic · reported by security@elastic.coMedium 6.8
Authorization Bypass Through User-Controlled Key (CWE-639) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Privilege Abuse (CAPEC-122). An attacker who controls any host in an ECE installation can obtain credentials that are reserved for other platform roles. These credentials can give the attacker full control of the ECE control plane and of the deployments that it manages.
- Product
- Elastic Cloud Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026Alpine iLX-F511 Fiv.System Exposed Dangerous Method Local Privilege Escalation Vulnerability.CVE-2026-118602 · Other software · Alpine · reported by zdi-disclosures@trendmicro.comHigh 7.8
Alpine iLX-F511 Fiv.System Exposed Dangerous Method Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Alpine iLX-F511. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Fiv service. The issue results from an exposed dangerous method. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-29095.
- Product
- iLX-F511
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026GFI KerioConnect (Kerio Connect) Outlook Connector (Offline Edition), 'KOFF', before 10.0.9 Patch 2 contains a local privilege escalation vulnerability caused bCVE-2026-112357 · Other software · GFI USA, LLC · reported by VulnCheckHigh 8.5
GFI KerioConnect (Kerio Connect) Outlook Connector (Offline Edition), 'KOFF', before 10.0.9 Patch 2 contains a local privilege escalation vulnerability caused by weak installer permissions that leave the product directory writable by the built-in Users group. A local non-administrative attacker can replace the searchd.exe service binary used by the bundled KOFFIndexingService, which runs as LocalSystem, to execute arbitrary code with NT AUTHORITY\SYSTEM privileges upon the next service start or reboot.
- Product
- GFI KerioConnect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026Local privilege escalation due to improper authentication.CVE-2025-30414 · Other software · Acronis · reported by security@acronis.comHigh 7.1
Local privilege escalation due to improper authentication. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 42569, Acronis Cyber Protect 17 (Windows) before build 42587.
- Product
- Acronis Cyber Protect Cloud Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-advisory.acronis.com
Oct 28, 2026Mage Eventpress: Privilege escalationCVE-2026-109381 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.8 This is due to the mep_grant_shop_manager_access() function hooking user_has_cap and unconditionally granting manage_options whenever an attacker-controllable request marker matches — most notably $_GET['page'] starting with 'mep_' or 'mpwem_', which is never validated against an actually registered EventPress screen. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to elevate their privileges to Administrator by appending ?page=mep_x to core admin URLs (options-general.
- Product
- Mage Eventpress
- Affected
- up to 5.7.8
- What to do
- Affects up to 5.7.8. Update Mage Eventpress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 27, 2026Tanium addressed a local privilege escalation vulnerability in End-User Notifications.CVE-2026-108306 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512High 7.8
Tanium addressed a local privilege escalation vulnerability in End-User Notifications.
- Product
- Endpoint Configuration Toolset Solution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Tanium addressed a local privilege escalation vulnerability in End-User Notifications.CVE-2026-108305 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512High 7.8
Tanium addressed a local privilege escalation vulnerability in End-User Notifications.
- Product
- Endpoint Configuration Toolset Solution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Tanium addressed a local privilege escalation vulnerability in End-User Notifications.CVE-2026-108304 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512High 7.8
Tanium addressed a local privilege escalation vulnerability in End-User Notifications.
- Product
- Endpoint Configuration Toolset Solution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026A vulnerability in Veeam Agent for Linux allows for local privilege escalation.CVE-2026-105477 · Other software · Veeam · reported by support@hackerone.comHigh 7.3
A vulnerability in Veeam Agent for Linux allows for local privilege escalation. Only installations that are managed by a Veeam Backup & Replication instance are affected.
- Product
- Agent for Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Privilege escalation in the DOM: Navigation component.CVE-2026-118008 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 27, 2026Privilege escalation due to use-after-free in the WebRTC: Signaling component.CVE-2026-118006 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Privilege escalation due to use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 27, 2026Privilege escalation in the DOM: UI Events & Focus Handling component.CVE-2026-117995 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Privilege escalation in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 27, 2026Privilege escalation in the Toolkit component.CVE-2026-117981 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Privilege escalation in the Toolkit component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 27, 2026Privilege escalation due to use-after-free in the WebRTC: Networking component.CVE-2026-117892 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Privilege escalation due to use-after-free in the WebRTC: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 27, 2026Privilege escalation due to use-after-free in the Graphics: Canvas2D component.CVE-2026-117866 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Privilege escalation due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 27, 2026Privilege escalation due to incorrect boundary conditions in the Networking component.CVE-2026-117862 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Privilege escalation due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 27, 2026In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full system Administrator.CVE-2026-117466 · Other software · Octopus Deploy · reported by security@octopus.comHigh 8.6
In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full system Administrator.
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.com
Oct 27, 2026A logic flaw in the BMC IPMI implementation may allow an attacker to send specially crafted RAKP+ messages and escalate an account to administrator privileges.CVE-2026-65220 · Other software · SMCI · reported by def9a96e-e099-41a9-bfac-30fd4f82c411High 8.8
A logic flaw in the BMC IPMI implementation may allow an attacker to send specially crafted RAKP+ messages and escalate an account to administrator privileges.
- Product
- MBD-X12SPI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Kirki: Privilege EscalationCVE-2026-75891 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Object Injection in all versions up to, and including, 6.2.5 via deserialization of untrusted input through the 'get-single-symbol' branch of the kirki_post_apis() AJAX dispatcher due to a missing capability check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to overwrite an administrator's password and gain administrative access.
- Product
- Kirki
- Affected
- up to 6.2.5
- What to do
- Affects up to 6.2.5. Update Kirki to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 26, 2026Pyrus Sync for Windows contains a local privilege escalation vulnerability caused by missing authorization controls in its PyrusSyncService Windows service, whiCVE-2026-116596 · Other software · Pyrus · reported by cret@cert.org
Pyrus Sync for Windows contains a local privilege escalation vulnerability caused by missing authorization controls in its PyrusSyncService Windows service, which allow an attacker with unprivileged access to create files using the ISyncService contract.
- Product
- Pyrus Sync
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026An issue in WCH CH340/CH341 USB-to-Serial Windows Driver setup package CH341SER.EXE version 4.0 allows a local attacker to escalate privileges.CVE-2026-106781 · Other software · reported by MITREHigh 7.8
An issue in WCH CH340/CH341 USB-to-Serial Windows Driver setup package CH341SER.EXE version 4.0 allows a local attacker to escalate privileges.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2026aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder: Privilege EscalationCVE-2026-110018 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.17.0 via the `/ablocks/v1/form-builder/registration` REST endpoint. The vulnerability exists because the endpoint is registered with `permission_callback => __return_true` and the `register()` handler reads `roleSlug` directly from attacker-controlled block attributes in `post_content` without ever verifying that the block's `formType` is `registration` — a condition that `RegistrationFormSanitizer::verify()` imposes only at save-time, meaning a Contributor can preserve an arbitrary `roleSlug` by saving a block with `formType='login'` and then triggering the endpoint via a valid `wp_rest` nonce and post-ownership check. This makes it possible for authenticated attackers, with Contributor-level access and above, to escalate their WordPress role to Editor or any other non-administrator role and receive a fully authenticated session at the elevated privilege level via `WP_User::set_role()` and `wp_set_auth_cookie()`. Escalation is bounded below administrator-tier roles because `is_safe
- Product
- aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder
- Affected
- up to 2.17.0
- What to do
- Affects up to 2.17.0. Update aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 24, 2026User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor: Limited Privilege EscalationCVE-2026-115807 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 4.0.3. This is due to the Gutenberg Register block passing the attacker-controlled Assigned Role attribute directly into the `[wppb-register]` shortcode without server-side authorization. The role guard in the form builder only downgrades roles that carry the manage_options or remove_users capability, leaving the Editor role and other privileged non-Administrator roles completely unrestricted. This makes it possible for authenticated attackers with Author-level access and above to create new WordPress accounts bearing the Editor role (or any other role that lacks the two guarded capabilities).
- Product
- User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
- Affected
- up to 4.0.3
- What to do
- Affects up to 4.0.3. Update User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 23, 2026GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schemas.CVE-2026-115887 · Other software · graphql-hive · reported by GitHubHigh 7.5
GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schemas. From 1.24.1 until 2.0.1, GraphQLPhoneNumber in src/scalars/PhoneNumber.ts uses ambiguous nested digit quantifiers that backtrack exponentially when a PhoneNumber value contains a run of digits followed by a character that makes the match fail. GraphQL evaluates parseLiteral during document validation and parseValue during variable coercion before resolver authentication or authorization, so a small unauthenticated request can block the Node.js event loop and stall the server process. serialize is also affected when unvalidated stored values are returned through the scalar. This issue is fixed in version 2.0.1.
- Product
- graphql-scalars
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026A potential security vulnerability has been identified in HP One Agent for certain HP PC products, which might allow for escalation of privilege CVE-2026-91093 · Other software · HP Inc. · reported by hp-security-alert@hp.comHigh 8.5
A potential security vulnerability has been identified in HP One Agent for certain HP PC products, which might allow for escalation of privilege and/or arbitrary code execution. HP is releasing software updates to mitigate the potential vulnerability.
- Product
- HP One Agent Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to access files wCVE-2026-93640 · Email & office · Zimbra · reported by cve@rapid7.comHigh 7.8
A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to access files with root privileges. The passwordless sudo policy permits arbitrary arguments to zmunbound, whose wrapper forwards them to Unbound without restricting the configuration path. An attacker can supply a configuration that retains root privileges and disables the chroot. Include directives expose root-readable file contents through parser errors, while an attacker-selected logfile path creates a root-owned file or appends Unbound log records to an existing file. This can disclose password hashes and private keys and corrupt privileged configuration files, preventing affected services from starting with the modified configuration. The affected configuration is present in ZCS 10.1.16 and 10.1.21 dnscache packages.
- Product
- Zimbra Collaboration Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.zimbra.comrapid7.com
Oct 23, 2026A local privilege escalation vulnerability in the Zimbra Collaboration Suite (ZCS) MTA package allows the Unix zimbra account to execute arbitrary commands as rCVE-2026-50057 · Email & office · Zimbra · reported by cve@rapid7.comHigh 7.8
A local privilege escalation vulnerability in the Zimbra Collaboration Suite (ZCS) MTA package allows the Unix zimbra account to execute arbitrary commands as root. The installed sudo policy permits passwordless root execution of Postfix administration commands without restricting their arguments. An attacker can select a zimbra-controlled daemon_directory in the Postfix configuration and invoke postfix set-permissions, causing Postfix to execute the attacker's post-install program as root. The Postfix configuration directory is also writable by zimbra, so restricting postconf alone does not remove the execution path. Exploitation requires local command execution as zimbra on an MTA node. ZCS 10.1.16 and 10.1.21 are affected.
- Product
- Zimbra Collaboration Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.zimbra.comrapid7.com
Oct 23, 2026A local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to execute arbitraryCVE-2026-50056 · Email & office · Zimbra · reported by cve@rapid7.comHigh 7.8
A local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to execute arbitrary commands as root. The passwordless sudo interface accepts JVM arguments that are not adequately restricted. An attacker can postpone Jetty's privilege drop, register an OnOutOfMemoryError command and force heap exhaustion during startup, causing the command to execute while the JVM still runs as root. Exploitation requires local command execution as zimbra on a mailbox server and interrupts mailboxd during the malicious restart. ZCS 10.1.16 and 10.1.21 are affected.
- Product
- Zimbra Collaboration Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.zimbra.comrapid7.com
Oct 23, 2026Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image bluespice/wiki) allows privilege escalation.CVE-2026-25784 · Other software · Hallo Welt! GmbH · reported by security@bluespice.comCritical 9.3
Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image bluespice/wiki) allows privilege escalation. The default value of $mwsgTokenAuthenticatorServiceCIDR in the container's LocalSettings.php was intended to restrict internal service authentication to the container network, but evaluated to an empty string when the environment variable WIKI_SERVICE_TOKEN_AUTH_ALLOWED was not set. An empty value disables the IP restriction in the token authenticator component (mwstake/mediawiki-component-token-authenticator). As a result, any user with read access to the wiki (anonymous users on publicly readable wikis) could obtain an application token from the REST API and use it to get a session with sysop privileges as the internal service user. This issue affects BlueSpice: from 5.2.3 before 5.2.7, and the 5.2.7 container images published before 2026-10-19 15:37 UTC.
- Product
- BlueSpice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorden.wiki.bluespice.comgithub.com
Oct 23, 2026CGM CLININET is vulnerable to local privilege escalation.CVE-2025-30054 · Other software · CGM · reported by cvd@cert.plCritical 9.3
CGM CLININET is vulnerable to local privilege escalation. The service that processes incoming HL7 messages runs with root privileges, but due to incorrect permissions, its scripts and configuration files can be modified by the uhcapache user. An attacker with uhcapache privileges can modify these files to execute arbitrary code as root. The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.
- Product
- CGM CLININET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility Checker allows Privilege Escalation.CVE-2026-96390 · Websites & servers · reported by mlhess@drupal.orgMedium 4.3
Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility Checker allows Privilege Escalation. This issue affects Editoria11y Accessibility Checker versions: from 0.0.0 to 2.2.23, from 3.0.0 to 3.0.9.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026Local privilege escalation in Checkmk 2.5.0p14 allows a local user with write access to the Oracle client library directory of an Oracle home listed in the 'oraCVE-2026-113461 · Other software · Checkmk GmbH · reported by security@checkmk.comMedium 5.2
Local privilege escalation in Checkmk 2.5.0p14 allows a local user with write access to the Oracle client library directory of an Oracle home listed in the 'oratab' file or to the 'oratab' file itself to execute code as root if an agent has the 'mk-oracle' plugin enabled.
- Product
- Checkmk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.