Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,607 results · page 3 of 113
Oct 12, 2026IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due to improper validation of sub-requests.CVE-2026-19622 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.8
IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due to improper validation of sub-requests.
- Product
- Planning Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type frCVE-2026-109667 · Other software · frappe · reported by VulnCheckHigh 8.7
Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type from the request and inserts the record with permission checks disabled. Any authenticated user, including one holding no operational role, can supply a privileged record type to create privileged accounts and take full control of the site.
- Product
- erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 12, 2026Open WebUI from 0.8.6 before 0.11.4 contains a privilege escalation vulnerability in the terminal proxy that allows authenticated users to reach the Terminals aCVE-2026-109572 · Other software · open-webui · reported by VulnCheckHigh 7.2
Open WebUI from 0.8.6 before 0.11.4 contains a privilege escalation vulnerability in the terminal proxy that allows authenticated users to reach the Terminals administrator API with the shared key attached. Attackers can send requests through /api/v1/terminals/{server_id}/{path} to list or stop other users' terminals and modify terminal policies, injecting environment variables into other users' terminals.
- Product
- open-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Frappe before 14.81.4 and 15.x before 15.41.0 contains an improper privilege management vulnerability involving a certain document action that permits escalatioCVE-2024-58390 · Other software · frappe · reported by VulnCheckHigh 8.7
Frappe before 14.81.4 and 15.x before 15.41.0 contains an improper privilege management vulnerability involving a certain document action that permits escalation from the Website User role to System Manager. Authenticated attackers with Website User access can combine this document action with additional steps to obtain administrative System Manager privileges in the Frappe application.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 12, 2026IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation.CVE-2026-96012 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.9
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation. An authenticated attacker could craft a malicious request that bypasses additional authorization and input validation checks to execute malicious code. An attacker could exploit this vulnerability to obtain elevated privileges on the system.
- Product
- Db2 Mirror for i
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a local privilege escalation via the db2pd utility.CVE-2026-78404 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a local privilege escalation via the db2pd utility.
- Product
- Db2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation when db2locssh is enabled with the db2 instance.CVE-2026-105465 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.8
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation when db2locssh is enabled with the db2 instance.
- Product
- Db2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026ZITADEL 3.0.0 before 4.19.2 contains a privilege escalation vulnerability in OIDC token exchange that allows end-user impersonators to impersonate administratorCVE-2026-109374 · Other software · zitadel · reported by VulnCheckMedium 5.1
ZITADEL 3.0.0 before 4.19.2 contains a privilege escalation vulnerability in OIDC token exchange that allows end-user impersonators to impersonate administrators including IAM_OWNER by bypassing the admin.impersonation check. Attackers holding IAM_END_USER_IMPERSONATOR or ORG_END_USER_IMPERSONATOR roles can sign in to relying applications as administrators with their roles and claims.
- Product
- zitadel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 12, 2026Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing posCVE-2026-109317 · Other software · getgrav · reported by VulnCheckHigh 8.6
Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing positive scalar admin or api parent grants. Attackers with api.users.write can edit account access maps or invitations so the inheriting permission resolver satisfies requireSuper checks, accessing super-only API endpoints.
- Product
- grav-plugin-api
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 12, 2026FreeRDP from 3.9.0 before 3.32.0 contains an out-of-bounds read vulnerability in the RDPEAR NDR scalar readers, which check value length before consuming alignmCVE-2026-109253 · Other software · FreeRDP · reported by VulnCheckMedium 6
FreeRDP from 3.9.0 before 3.32.0 contains an out-of-bounds read vulnerability in the RDPEAR NDR scalar readers, which check value length before consuming alignment padding. Malicious or compromised RDP servers can send crafted unaligned RDPEAR payloads, such as CreateApReqAuthenticatorReq messages, to clients using Remote Credential Guard, causing over-reads and potentially crashing the client process.
- Product
- FreeRDP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 11, 2026GoatCounter through 2.7.0 contains a mass assignment privilege escalation vulnerability in the userPrefSave handler that allows logged-in users to modify protecCVE-2026-108740 · Other software · arp242 · reported by VulnCheckHigh 7.2
GoatCounter through 2.7.0 contains a mass assignment privilege escalation vulnerability in the userPrefSave handler that allows logged-in users to modify protected account fields via form-encoded requests. Attackers with read-only access can POST user.access[all]=* and user.email_verified=true to /user/pref, bypassing readonly tags to gain superuser or admin access.
- Product
- GoatCounter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026Unauthenticated Privilege Escalation in Tonda Membership <= 1.0.1 versions.CVE-2026-62022 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Tonda Membership <= 1.0.1 versions.
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Subscriber Privilege Escalation in AIWU <= 1.5.9 versions.CVE-2026-39801 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Subscriber Privilege Escalation in AIWU <= 1.5.9 versions.
- Affected
- up to 1.5.9
- What to do
- Affects up to 1.5.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Groundhogg — CRM, Newsletters, and Marketing Automation: Privilege EscalationCVE-2026-92975 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.3 via the `create_support_user()` function. This is due to the function identifying the support account solely by matching against publicly hardcoded constants — `user_login` `'groundhogg'` and email addresses `'support@groundhogg.io'` / `'help@groundhogg.io'` — where the `in_array()` email-equality check at line 238 is not a security boundary because any user fully controls their own email value. This makes it possible for an attacker with an account whose `user_login` is `'groundhogg'` and whose `user_email` matches one of the hardcoded support constants to have that account silently promoted to administrator — and additionally to super admin on multisite when the triggering administrator holds `manage_network_options` — resulting in full site takeover. Exploitation requires a two-actor flow: the attacker must first obtain or pre-plant an account with the hardcoded credentials (possible when open user registration is enabled or another account-creation path exists), after which a legitimate administrator must invoke the s
- Product
- Groundhogg — CRM, Newsletters, and Marketing Automation
- Affected
- up to 4.8.3
- What to do
- Affects up to 4.8.3. Update Groundhogg — CRM, Newsletters, and Marketing Automation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 10, 2026FooSales – Point of Sale (POS) for WooCommerce: Privilege escalationCVE-2026-77183 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The FooSales – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.43.0. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it possible for authenticated attackers, with FooSales Cashier-level access and above, to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
- Product
- FooSales – Point of Sale (POS) for WooCommerce
- Affected
- up to 1.43.0
- What to do
- Affects up to 1.43.0. Update FooSales – Point of Sale (POS) for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 10, 2026Appointment Booking Plugin – LatePoint | Calendar & Scheduling for: Privilege EscalationCVE-2026-104766 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.7.3. This is due to the `OsSettingsController::update()` handler iterating over attacker-supplied `settings` parameters without an allowlist of permitted setting names or values, and `OsSettingsHelper::prepare_value()` performing no role allowlist validation before persisting the `default_wp_role_for_customer` setting — a restriction that exists only in the UI dropdown and is never enforced server-side. This makes it possible for authenticated attackers holding a LatePoint role with the `settings__edit` capability (such as an agent or custom role) to overwrite the default WordPress role for new customers with `administrator`, causing any subsequently self-registered LatePoint customer account to be created with full WordPress administrator privileges. Exploitation requires that a WordPress administrator has granted the `settings__edit` capability to a LatePoint agent or custom role, and that a new customer account is registered through LatePoint after the malicious setting change is persisted.
- Product
- Appointment Booking Plugin – LatePoint | Calendar & Scheduling for
- Affected
- up to 5.7.3
- What to do
- Affects up to 5.7.3. Update Appointment Booking Plugin – LatePoint | Calendar & Scheduling for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 10, 2026Groundhogg — CRM, Newsletters, and Marketing Automation: Privilege EscalationCVE-2026-104725 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9 This is due to a missing ownership and capability check on the `user` parameter within the `process_edit()` function, which allows any authenticated user with the `edit_contacts` capability to reassign a contact record's linked WordPress user ID to any arbitrary account without requiring the `edit_users` or `promote_users` capabilities. This makes it possible for authenticated attackers, with sales_rep-level access and above, to escalate their privileges to administrator by linking a contact to an administrator's WordPress user ID, then creating a note containing the `{auto_login_link}` replacement tag to trigger generation of a valid auto-login permissions-key URL for the administrator-linked contact, and finally visiting that URL to authenticate as the targeted administrator. The auto-login URL is stored in the note content and is readable back by the attacker via the `view_notes` and `add_notes` capabilities that the sales_rep role holds by default.
- Product
- Groundhogg — CRM, Newsletters, and Marketing Automation
- Affected
- up to 4.9
- What to do
- Affects up to 4.9. Update Groundhogg — CRM, Newsletters, and Marketing Automation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 10, 2026Blocksy Companion: Privilege escalationCVE-2026-107645 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.1.58 This is due to the implement_user_registration() AJAX handler explicitly disabling Dokan's vendor-registration nonce check (via add_filter('dokan_register_nonce_check', '__return_false')) and then trusting an attacker-supplied $_POST['role'] value when invoking wc_create_new_customer() and wc_set_customer_auth_cookie(). This makes it possible for unauthenticated attackers to elevate their privileges to a Dokan 'seller' (vendor) account — including sites where the Dokan vendor signup is explicitly turned off — and to be auto-authenticated into that account, which grants publishing capabilities beyond those of a normal customer.
- Product
- Blocksy Companion
- Affected
- up to 2.1.58
- What to do
- Affects up to 2.1.58. Update Blocksy Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 9, 2026Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning: Privilege EscalationCVE-2026-104022 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.0.3. This is due to the `add_child()` function calling `add_role('academy_student')` on any existing account resolved from the attacker-supplied `email` parameter before `Store::link()` validates the guardian-ward relationship, and failing to roll back that role write when `Store::link()` returns a `WP_Error`. This makes it possible for authenticated attackers with the `academy_guardian` role or higher to elevate any existing WordPress account — including their own — to the `academy_student` role, gaining `edit_posts` (Contributor-equivalent) capabilities and, when the student file-upload setting is enabled, `upload_files` (Author-equivalent) capabilities not granted to the guardian role. When a guardian supplies their own email address, `email_exists()` resolves to their own user ID, causing `Store::link()` to reject the self-link, but because the `add_role()` call has already executed and is never reversed, the academy_student role grant on their own account persists permanently.
- Product
- Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning
- Affected
- up to 4.0.3
- What to do
- Affects up to 4.0.3. Update Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 9, 2026SmarterMail before build 9777 contains a privilege escalation vulnerability where JWT access and refresh tokens embed a role claim at issuance that is not revalCVE-2026-104084 · Other software · Smartertools · reported by VulnCheckHigh 8.7
SmarterMail before build 9777 contains a privilege escalation vulnerability where JWT access and refresh tokens embed a role claim at issuance that is not revalidated against the account's current role when redeemed through POST /api/v1/auth/refresh-token. Attackers who capture a refresh token issued before an administrator demotion, or a demoted user whose session was not actively polling at the time of demotion, can replay the stale token to obtain a new access token retaining the higher-privilege role (such as DomainAdmin or SysAdmin) until natural token expiry.
- Product
- Smartermail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.evan.latsmartertools.com
Oct 9, 2026Redux Framework: Privilege escalationCVE-2025-14123 · WordPress plugins & themes · reported by WordfenceMedium 6.8
The Redux Framework plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.5.11. This is due to the plugin saving arbitrary meta keys under a registered option name without sufficient capability checks or key allowlist / restrictions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to set an arbitrary role (e.g., Administrator) when performing a profile update if a plugin or theme using this framework has added at least one user profile field that leverages Redux_Users::set_profile/set_section/set_field.
- Product
- Redux Framework
- Affected
- up to 4.5.11
- What to do
- Affects up to 4.5.11. Update Redux Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 8, 2026Deskin through 3.3.4.3 contains a privilege escalation vulnerability in the com.deskin.service.installer XPC service that allows local unprivileged attackers toCVE-2026-11318 · Other software · Zuler Technology · reported by VulnCheckHigh 8.5
Deskin through 3.3.4.3 contains a privilege escalation vulnerability in the com.deskin.service.installer XPC service that allows local unprivileged attackers to execute arbitrary installer packages as root by connecting to the root-owned service without authentication. Attackers can invoke the privileged installer method to run an attacker-supplied installer, achieving full root compromise of the macOS host.
- Product
- DeskIn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026IBM Guardium Data Protection 12.2 is vulnerable to a local privilege escalation in the cp_wrapper component.CVE-2026-84245 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.8
IBM Guardium Data Protection 12.2 is vulnerable to a local privilege escalation in the cp_wrapper component. A low-privileged local user could exploit this vulnerability to gain root privileges and access or modify sensitive system files.
- Product
- Guardium Data Protection
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026A kernel buffer overflow vulnerability in HP Sure Click versions prior to 4.4.33 may allow local privilege escalation or arbitrary code execution.CVE-2026-106177 · Other software · HP Inc · reported by hp-security-alert@hp.comMedium 6.4
A kernel buffer overflow vulnerability in HP Sure Click versions prior to 4.4.33 may allow local privilege escalation or arbitrary code execution. HP has released version 4.4.33 to address this vulnerability.
- Product
- HP Sure Click Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026Local privilege escalation in Checkmk 2.5.0 before 2.5.0p10 allows a user with access to edit the Oracle Instant Client referenced by the agent plugin 'mk-oraclCVE-2026-105331 · Other software · Checkmk GmbH · reported by security@checkmk.comMedium 5.2
Local privilege escalation in Checkmk 2.5.0 before 2.5.0p10 allows a user with access to edit the Oracle Instant Client referenced by the agent plugin 'mk-oracle' to escalate their privileges if an agent has this plugin enabled.
- Product
- Checkmk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026An authenticated high privilege user can inject arguments in troubleshooting commands resulting in privilege escalation.CVE-2026-107510 · Other software · Infoblox · reported by f84ca5ce-fbe7-4668-8724-994599108a02Critical 9.1
An authenticated high privilege user can inject arguments in troubleshooting commands resulting in privilege escalation.
- Product
- NIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaumlayer.comsupport.infoblox.com
Oct 8, 2026A privilege escalation vulnerability exists in the internal Command-Line Interface (CLI) authorization handling mechanism of Brocade Fabric OS versions before 9CVE-2026-94577 · Other software · Brocade · reported by sirt@brocade.comHigh 7.3
A privilege escalation vulnerability exists in the internal Command-Line Interface (CLI) authorization handling mechanism of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user or local process that can manipulate the process execution environment can bypass Role-Based Access Control (RBAC) validation checks. Successful exploitation allows an attacker to elevate privileges to root
- Product
- Fabric OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026An authentication logic and privilege escalation vulnerability exists in the account management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0CVE-2026-94576 · Other software · Brocade · reported by sirt@brocade.comMedium 5.9
An authentication logic and privilege escalation vulnerability exists in the account management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. Under specific conditions, an authenticated user can bypass authorization restrictions intended to prevent modifying another account's access privileges. Exploitation allows a lower-privileged user to assign administrative roles to a target account, leading to localized privilege escalation.
- Product
- Fabric OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026A local privilege escalation vulnerability exists in the system logging daemon of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1.CVE-2026-87674 · Other software · Brocade · reported by sirt@brocade.comHigh 8.5
A local privilege escalation vulnerability exists in the system logging daemon of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. Insufficient access controls on internal inter-process communication (IPC) channels allow an unprivileged local user to submit malformed logging configurations. Due to improper input sanitization during configuration file generation, an attacker can inject arbitrary directives that execute with elevated privileges when the logging service reloads, leading to local privilege escalation.
- Product
- Fabric OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026A local privilege escalation vulnerability exists in the ClearPass client software.CVE-2026-79813 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 6.7
A local privilege escalation vulnerability exists in the ClearPass client software. Successful exploitation could allow a low-privileged local user to execute commands with elevated privileges on the affected system, if certain conditions outside of the attacker's control are met.
- Product
- ClearPass Policy Manager (CPPM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026A privilege escalation vulnerability in the ClearPass Policy Manager OnGuard Linux agent could allow malicious users on a Linux instance to elevate their user pCVE-2026-79806 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.8
A privilege escalation vulnerability in the ClearPass Policy Manager OnGuard Linux agent could allow malicious users on a Linux instance to elevate their user privileges. A successful exploit allows a malicious user to escalate to root privileges on the affected Linux client.
- Product
- ClearPass Policy Manager (CPPM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026A privilege escalation vulnerability exists in the API of AOS-S.CVE-2026-76748 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 8.8
A privilege escalation vulnerability exists in the API of AOS-S. Successful exploitation could allow an authenticated read-only user to escalate their privileges and gain administrative access to the affected system.
- Product
- AOS-Switch (AOS-S)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced dCVE-2026-103007 · Other software · Elastic · reported by security@elastic.coHigh 7.2
Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticsearch contains an incorrect authorization weakness in a configurable, non-default privilege that lets an administrator delegate limited role-management capability to another user, scoped to specific indices. The authorization check that enforces this scoping does not correctly account for a role-definition setting that can expand the matched index set. A user holding this delegated privilege with a broadly-scoped index pattern can exploit this inconsistency by updating their own assigned role to gain access to indices that should remain restricted, including internal security data. This can enable further escalation up to full administrative control of the cluster.
- Product
- Elasticsearch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Subscriber Privilege Escalation in JobZilla - Job Board WordPress Theme <= 2.2 versions.CVE-2026-39775 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Subscriber Privilege Escalation in JobZilla - Job Board WordPress Theme <= 2.2 versions.
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Privilege Escalation in Tourfic Pro <= 1.17.3 versions.CVE-2026-39774 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Unauthenticated Privilege Escalation in Tourfic Pro <= 1.17.3 versions.
- Affected
- up to 1.17.3
- What to do
- Affects up to 1.17.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Privilege Escalation in Doctreat Core <= 1.7.0 versions.CVE-2026-39773 · WordPress plugins & themes · reported by PatchstackCritical 10
Unauthenticated Privilege Escalation in Doctreat Core <= 1.7.0 versions.
- Affected
- up to 1.7.0
- What to do
- Affects up to 1.7.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Shop Manager Privilege Escalation in Challan <= 3.7.88 versions.CVE-2026-39765 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Shop Manager Privilege Escalation in Challan <= 3.7.88 versions.
- Affected
- up to 3.7.88
- What to do
- Affects up to 3.7.88. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Privilege Escalation in Meta Box AIO <= 3.7.1 versions.CVE-2026-39761 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Meta Box AIO <= 3.7.1 versions.
- Affected
- up to 3.7.1
- What to do
- Affects up to 3.7.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Privilege Escalation in Taskbot <= 6.6 versions.CVE-2026-39753 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Taskbot <= 6.6 versions.
- Affected
- up to 6.6
- What to do
- Affects up to 6.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Privilege Escalation in Salon booking system <= 10.31.7 versions.CVE-2026-105070 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Unauthenticated Privilege Escalation in Salon booking system <= 10.31.7 versions.
- Affected
- up to 10.31.7
- What to do
- Affects up to 10.31.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Subscriber Privilege Escalation in WP User Profiles <= 2.7.3 versions.CVE-2026-105058 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Subscriber Privilege Escalation in WP User Profiles <= 2.7.3 versions.
- Affected
- up to 2.7.3
- What to do
- Affects up to 2.7.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Editor Privilege Escalation in Import and export users and customers <= 2.5.5 versions.CVE-2026-104757 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Editor Privilege Escalation in Import and export users and customers <= 2.5.5 versions.
- Affected
- up to 2.5.5
- What to do
- Affects up to 2.5.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions.CVE-2026-104405 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions.
- Affected
- up to 4.17.0
- What to do
- Affects up to 4.17.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Canimaan Software ClamXAV versions 3.3 - 3.11 contains a local privilege escalation vulnerability in the Privileged Helper Tool caused by a race condition and iCVE-2026-105773 · Other software · Canimaan Software · reported by 9119a7d8-5eab-497f-8521-727c672e3725High 7.3
Canimaan Software ClamXAV versions 3.3 - 3.11 contains a local privilege escalation vulnerability in the Privileged Helper Tool caused by a race condition and insufficient file validation, allowing a local attacker to execute arbitrary code with system privileges. Fixed in 3.11.1.
- Product
- ClamXAV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordclamxav.comraw.githubusercontent.com
Oct 4, 2026In mtee, there is a possible escalation of privilege due to a missing bounds check.CVE-2026-20588 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 6.7
In mtee, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11383899; Issue ID: MSV-9607.
- Product
- MediaTek chipset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2026In mtee, there is a possible escalation of privilege due to type confusion.CVE-2026-20587 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 6.7
In mtee, there is a possible escalation of privilege due to type confusion. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11383899; Issue ID: MSV-9608.
- Product
- MediaTek chipset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2026In aidl, there is a possible escalation of privilege due to a missing permission check.CVE-2026-20535 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 6.7
In aidl, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11185216; Issue ID: MSV-9039.
- Product
- MediaTek chipset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2026In display, there is a possible escalation of privilege due to an integer overflow.CVE-2026-20533 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 6.7
In display, there is a possible escalation of privilege due to an integer overflow. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11296678; Issue ID: MSV-9167.
- Product
- MediaTek chipset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2026In Video HAL, there is a possible escalation of privilege due to a missing bounds check.CVE-2026-20521 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comHigh 8.4
In Video HAL, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11375674; Issue ID: MSV-9571.
- Product
- MediaTek chipset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2026ezBookkeeping 1.2.0 before 2.0.1 contains a privilege escalation vulnerability that allows attackers holding an API token to obtain a full session token via /apCVE-2026-105131 · Other software · mayswind · reported by VulnCheckMedium 5.3
ezBookkeeping 1.2.0 before 2.0.1 contains a privilege escalation vulnerability that allows attackers holding an API token to obtain a full session token via /api/v1/tokens/refresh.json. Because TokenRefreshHandler never checks token type, attackers can exchange short-lived or IP-restricted API tokens for 30-day normal session tokens that bypass API token expiry and allowlists.
- Product
- ezBookkeeping
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.