Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 11,141

Export CSV
CVE-2025-15027

JAY Login & Register <= 2.6.03 - Unauthenticated Privilege Escalation via jay_login_register_ajax_create_final_user

The JAY Login & Register plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.6.03. This is due to the plugin allowing a user to update arbitrary user meta through the 'jay_login_register_ajax_create_final_user' function. This makes it possible for unauthenticated attackers to elevate their privileges to that of an administrator.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2025-4085

Potential information leakage and privilege escalation in UITour actor

An attacker with control over a content process could potentially leverage the privileged UITour actor to leak sensitive information or escalate privileges. This vulnerability was fixed in Firefox 138 and Thunderbird 138.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Thunderbird
CVE-2025-12141

Grafana Alerting Editors can edit destination of webhooks they did not create

In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions “alert.notifications:write” or “alert.notifications.receivers:test” that are granted as part of the fixed role "Contact Point Writer", which is part of the basic role Editor - can edit contact points created by other users, modify the endpoint URL to a controlled server. By invoking the test functionality, attackers can capture and extract redacted secure settings, such as authentication credentials for third-party services (e.g., Slack tokens). This leads to unauthorized access and potential compromise of external integrations.

CVSS 4.0 · 1.3 Low EPSS < 1% KEV · Not listed
Vendors
Grafana
Products
Grafana
CVE-2025-6994

Reveal Listing <= 3.3 - Unauthenticated Privilege Escalation

The Reveal Listing plugin by smartdatasoft for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.3. This is due to the plugin allowing users who are registering new accounts to set their own role or by supplying 'listing_user_role' field. This makes it possible for unauthenticated attackers to gain elevated privileges by creating an account with the administrator role.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Smartdatasoft Wordpress
Products
Reveal Listing Wordpress
CVE-2025-6758

Real Spaces - WordPress Properties Directory Theme <= 3.6 - Unauthenticated Privilege Escalation to Administrator via 'imic_agent_register'

The Real Spaces - WordPress Properties Directory Theme theme for WordPress is vulnerable to privilege escalation via the 'imic_agent_register' function in all versions up to, and including, 3.6. This is due to a lack of restriction in the registration role. This makes it possible for unauthenticated attackers to arbitrarily choose their role, including the Administrator role, during user registration.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-8572

Truelysell Core <= 1.8.7 - Unauthenticated Privilege Escalation via Registration

The Truelysell Core plugin for WordPress is vulnerable to privilege escalation in versions less than, or equal to, 1.8.7. This is due to insufficient validation of the user_role parameter during user registration. This makes it possible for unauthenticated attackers to create accounts with elevated privileges, including administrator access.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Dreamstechnologies Wordpress
Products
Truelysell Core Wordpress
CVE-2026-40484

ChurchCRM: Authenticated Remote Code Execution via Unrestricted PHP File Write in Database Restore Function

ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the database backup restore functionality extracts uploaded archive contents and copies files from the Images/ directory into the web-accessible document root using recursiveCopyDirectory(), which performs no file extension filtering. An authenticated administrator can upload a crafted backup archive containing a PHP webshell inside the Images/ directory, which is then written to a publicly accessible path and executable via HTTP requests, resulting in remote code execution as the web server user. The restore endpoint also lacks CSRF token validation, enabling exploitation through cross-site request forgery targeting an authenticated administrator. This issue has been fixed in version 7.2.0.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Churchcrm
Products
Churchcrm
CVE-2025-7779

Local Privilege Escalation via Insecure XPC Service Configuration in Acronis True Image for macOS

Local privilege escalation due to insecure XPC service configuration. The following products are affected: Acronis True Image (macOS) before build 42389, Acronis True Image for SanDisk (macOS) before build 42198, Acronis True Image for Western Digital (macOS) before build 42197, Acronis True Image OEM (macOS) before build 42571.

CVSS 3.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Acronis Apple
Products
True Image True Image Agent Macos
CVE-2025-14329

Privilege escalation in the Netmonitor component

Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Firefox Esr Thunderbird
CVE-2025-5687

Local privilege escalation vulnerability in Mozilla VPN clients for macOS v2.27.0 and below.

A vulnerability in Mozilla VPN on macOS allows privilege escalation from a normal user to root. *This bug only affects Mozilla VPN on macOS. Other operating systems are unaffected.*. This vulnerability was fixed in Mozilla VPN 2.28.0 (macOS).

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Mozilla Vpn Vpn
CVE-2025-67246

Local Driver Vulnerability Allows Unprivileged Physical Memory Read and Privilege Escalation

A local information disclosure vulnerability exists in the Ludashi driver before 5.1025 due to a lack of access control in the IOCTL handler. This driver exposes a device interface accessible to a normal user and handles attacker-controlled structures containing the lower 4GB of physical addresses. The handler maps arbitrary physical memory via MmMapIoSpace and copies data back to user mode without verifying the caller's privileges or the target address range. This allows unprivileged users to read arbitrary physical memory, potentially exposing kernel data structures, kernel pointers, security tokens, and other sensitive information. This vulnerability can be further exploited to bypass the Kernel Address Space Layout Rules (KASLR) and achieve local privilege escalation.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Ludashi
Products
Driver Ludashi Driver
CVE-2026-33906

Ella Core has Privilege Escalation via Database Restore by NetworkManager role

Ella Core is a 5G core designed for private networks. Prior to version 1.7.0, the NetworkManager role was granted backup and restore permission. The restore endpoint accepted any valid SQLite file without verifying its contents. A NetworkManager could replace the production database with a tampered copy to escalate to Admin, gaining access to user management, audit logs, debug endpoints, and operator identity configuration that the role was explicitly denied. In version 1.7.0, backup and restore permissions have been removed from the NetworkManager role.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Ellanetworks
Products
Core Ella Core
CVE-2026-23477

Rocket.Chat Unauthorized Access to OAuth App Details

Rocket.Chat is an open-source, secure, fully customizable communications platform. In Rocket.Chat versions up to 6.12.0, the API endpoint GET /api/v1/oauth-apps.get is exposed to any authenticated user, regardless of their role or permissions. This endpoint returns an OAuth application, as long as the user knows its ID, including potentially sensitive fields such as client_id and client_secret. This vulnerability is fixed in 6.12.0.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Rocket.chat Rocketchat
Products
Rocket.chat Rocket.chat
CVE-2026-23800

WordPress Modular DS plugin <= 2.5.2 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in Modular DS modular-connector allows Privilege Escalation.This issue affects Modular DS: from 2.5.2 before 2.6.0.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Modular Wordpress
Products
Modular Wordpress
CVE-2026-21988

Local Privilege Escalation in Oracle VM VirtualBox Leading to Full Compromise

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Oracle
Products
Vm Virtualbox
CVE-2026-24894

FrankenPHP leaks session data between requests in worker mode

FrankenPHP is a modern application server for PHP. Prior to 1.11.2, when running FrankenPHP in worker mode, the $_SESSION superglobal is not correctly reset between requests. This allows a subsequent request processed by the same worker to access the $_SESSION data of the previous request (potentially belonging to a different user) before session_start() is called. This vulnerability is fixed in 1.11.2.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Php
Products
Frankenphp
CVE-2026-2459

Installer Role Exploit Allows Unauthorized Directory Access in Hitachi Energy REB500

A vulnerability exists in REB500 for an authenticated user with Installer role to access and alter the contents of directories that the role is not authorized to do so.

CVSS 4.0 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Hitachienergy
Products
Reb500 Reb500 Firmware Relion Reb500
CVE-2025-70795

Kernel‑Space Process Termination via Unsanitized IOCTL in Safetica STProcessMonitor

STProcessMonitor 11.11.4.0, part of the Safetica Application suite, allows an admin-privileged user to send crafted IOCTL requests to terminate processes that are protected through a third-party implementation. This is caused by insufficient caller validation in the driver's IOCTL handler, enabling unauthorized processes to perform those actions in kernel space. Successful exploitation can lead to denial of service by disrupting critical third-party services or applications. Unauthorized processes load the driver and send a crafted IOCTL request (0xB822200C) to terminate processes protected by a third-party implementation. This action exploits insufficient caller validation in the driver's IOCTL handler, allowing unauthorized processes to perform termination operations in kernel space. Successful exploitation can lead to denial of service by disrupting critical third-party services or applications.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Safetica
Products
Stprocessmonitor
CVE-2026-22916

Low‑Privilege Reboot/Factory Reset in SICK TDC‑X401GL Controllers

An attacker with low privileges may be able to trigger critical system functions such as reboot or factory reset without proper restrictions, potentially leading to service disruption or loss of configuration.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Sick Sick Ag
Products
Tdc-x401gl Tdc-x401gl Firmware Tdc-x401gl
CVE-2026-21957

Local Privilege Escalation in Oracle VM VirtualBox Due to Improper Privilege Management

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Oracle
Products
Vm Virtualbox