CVE-2026-18343

IBM i is Affected By An Improper Privilege Management Vulnerability

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to modify the BOOTP table due to improper authorization.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

I

CVE-2023-26604

systemd: privilege escalation via the less pager

systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the "systemctl status" command may be executed. Specifically, systemd does not set LESSSECURE to 1, and thus other programs may be launched from the less program. This presents a substantial security risk when running systemctl from Sudo, because less executes as root when the terminal size is too small to show the complete systemctl output.

CVSS 3.1 · 7.8 High EPSS 1.1% KEV · Not listed

Vendors

Debian Redhat Systemd Project

Products

Debian Linux Enterprise Linux Rhel Els and 2 more

CVE-2026-109739

Privilege escalation in the WebExtensions component

Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-109704

Privilege escalation in the Application Update component

Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-94578

Remote Authenticated Privilege Escalation via AAA Integration in Brocade Fabric OS

Brocade Fabric OS versions before 10.0.1 contain an authorization logic vulnerability in the AAA (Authentication, Authorization, and Accounting) integration framework allows remote authenticated users to gain root-equivalent chassis access controls. By returning specific, crafted Vendor-Specific Attributes (VSAs) or directory claims from an external identity provider (such as RADIUS, LDAP, TACACS+, or Federated IDP), an account can bypass administrative role restriction checks during session establishment.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Broadcom Brocade

Products

Fabric Operating System Fabric Os

CVE-2026-109667

Frappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation

Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type from the request and inserts the record with permission checks disabled. Any authenticated user, including one holding no operational role, can supply a privileged record type to create privileged accounts and take full control of the site.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Frappe

Products

Erpnext

CVE-2026-76266

Local Privilege Escalation through Linux Package Upgrades in Splunk Enterprise

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15 on Linux, a local user who can run commands as the user account running Splunk Enterprise could cause an affected Linux package upgrade to run attacker-controlled operating-system commands with root privileges. The vulnerability is possible because the Linux package maintainer script trusts existing Splunk Enterprise installation content when it performs upgrade operations with root privileges. The vulnerability requires an affected Linux package upgrade to occur after the local user modifies the installation. The local user should not be able to elevate privileges at will.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Linux Splunk

Products

Linux Kernel Splunk Splunk Enterprise

CVE-2026-85956

Improper privilege management in Progress MarkLogic Server backup and restore operations

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with delegated database-administrator privileges to perform backup or restore operations on forests outside the authorized database scope, which could result in unauthorized access to or modification of security-critical data.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Progress Software Corporation

Products

Marklogic Server

CVE-2026-85955

Improper privilege management in Progress MarkLogic Server xdmp:eval-in

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with query-execution access to invoke an XQuery evaluation function without the additional required evaluation privilege, which could result in server-side code execution with elevated permissions.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Progress Software Corporation

Products

Marklogic Server

CVE-2026-85954

Improper privilege management in Progress MarkLogic Server higher-order XQuery functions

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 can evaluate user-controlled values supplied to certain higher-order XQuery functions in an elevated security context, which could result in privilege escalation beyond the attacker's granted permissions.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Progress Software Corporation

Products

Marklogic Server

CVE-2026-85950

Improper privilege management in Progress MarkLogic Server REST extensions

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw that could allow a remote attacker with administrative privileges to access authentication material associated with higher-privileged users, potentially resulting in unauthorized administrative access.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Progress Software Corporation

Products

Marklogic Server

CVE-2026-85948

Improper privilege management in Progress MarkLogic Server Management API

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an XQuery injection flaw in a deprecated Management API package path. A remote attacker with manage-user-level privileges could exploit this flaw to obtain persistent unauthorized administrative control.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Progress Software Corporation

Products

Marklogic Server

CVE-2026-85947

Improper privilege management in Progress MarkLogic Server forest operations

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw in certain forest-management operations. A remote attacker with forest-management privileges could exploit this flaw to create a persistent unauthorized administrator account, potentially resulting in complete unauthorized administrative control of the server.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Progress Software Corporation

Products

Marklogic Server

CVE-2020-13776

systemd: Mishandles numerical usernames beginning with decimal digits or 0x followed by hexadecimal digits

systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Netapp Redhat and 1 more

Products

Fedora Active Iq Unified Manager Solidfire \& Hci Management Node and 3 more

CVE-2026-109756

Privilege escalation in the DOM: Navigation component

Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-109778

Privilege escalation in the WebExtensions component

Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-57458

Vikunja: Scoped API token can mint unrestricted OAuth session credentials

Vikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token limited to the `oauth.authorize` permission can call `POST /api/v1/oauth/authorize`, obtain an OAuth authorization code, and exchange the code at `POST /api/v1/oauth/token` for a normal bearer JSON Web Token (JWT) and refresh token. The resulting credentials are not restricted by the original API token's permissions, allowing access to routes outside its declared scope for the same user. Version 2.4.0 fixes the vulnerability.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Go-vikunja

Products

Vikunja

CVE-2026-18513

IBM Maximo Application Suite - Location Service for Esri Component Improper Privilege Management

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper access control due to a schema-less Custom Resource Definition.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Maximo Application Suite Location Service For Esri Component

CVE-2024-58390

Frappe before 15.41.0 Privilege Escalation via Document Action

Frappe before 14.81.4 and 15.x before 15.41.0 contains an improper privilege management vulnerability involving a certain document action that permits escalation from the Website User role to System Manager. Authenticated attackers with Website User access can combine this document action with additional steps to obtain administrative System Manager privileges in the Frappe application.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Frappe

Products

Frappe

CVE-2026-100824

Privilege escalation in the Places component

Privilege escalation in the Places component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird