Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 11,139

Export CSV
CVE-2026-8145

WholesaleX <= 3.0.8 - Unauthenticated Limited Privilege Escalation via 'process_registration'

The WholesaleX – B2B & Wholesale Plugin for WooCommerce with Wholesale Prices plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 3.0.8 via the 'process_registration' due to missing validation on the 'wholesalex_registration_role' parameter. This makes it possible for unauthenticated attackers to register as any existing WholesaleX role. The vulnerability was partially patched in version 2.3.8.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-109892

WordPress Frontend Admin by DynamiApps plugin <= 3.29.13 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-element allows Privilege Escalation.This issue affects Frontend Admin by DynamiApps: from n/a through 3.29.13.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-109567

Rapyd Admin from 9.0.0 before 9.20.0 Privilege Escalation via UsersEdit Component

Rapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege management vulnerability in the UsersEdit Livewire component that allows users with the edit users permission to assign themselves the admin role. Attackers holding roles such as the shipped operator role can submit the admin role ID for their own account, lifting tenant scoping, bypassing per-record authorization, and enabling impersonation.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Zofe
Products
Rapyd-admin
CVE-2026-102674

Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, windows opened from a sandboxed top-level document did not inherit that document's active HTML sandbox restrictions. Untrusted content in a sandboxed top-level document that was permitted to open popups could therefore create a window with the Electron application's full origin instead of the restricted origin intended by the sandbox. Applications that deny such popups with setWindowOpenHandler are not affected. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Electron Electronjs
Products
Electron Electron
CVE-2026-102676

Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, an Electron <webview> guest could enable nodeIntegrationInWorker for its Web Workers even when the unsandboxed embedder had Node.js integration disabled, allowing untrusted guest content to create a Node-enabled worker with more privilege than the embedder granted. Applications that do not enable the <webview> tag or that keep the embedder sandboxed are not affected. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Electron Electronjs
Products
Electron Electron
CVE-2026-109145

User Rights Access Manager <= 1.1.3 - Unauthenticated Privilege Escalation via AJAX Registration Handler

The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role that was created as a copy of the administrator role, allowing unauthenticated attackers to register an administrator-equivalent account and take over the site.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-104749

Bit integrations <= 2.10.6 - Unauthenticated Privilege Escalation via Identity-Confused Log Re-execution to Account Takeover via Log Re-execution of Anonymous-Captured Field Data

The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Privilege Escalation via Log Re-execution in all versions up to, and including, 2.10.6 The vulnerability exists because `IntegrationHandler::executeWithCapture()` stores raw, attacker-controlled field values — including `user_pass` and `user_email` — verbatim into `wp_btcbi_log.field_data` on anonymous front-end requests with no capability check, and `LogHandler::reexecute()` feeds that stored payload back through `Flow::execute()` inside the replaying administrator's session without validating the identity that originally produced the data, causing `RegistrationController::updateUser()` to resolve the target user ID to the administrator and write the attacker-supplied password via `wp_update_user()`. This makes it possible for unauthenticated attackers to overwrite the administrator's password and fully take over the administrator account. Exploitation requires that an administrator has configured a flow mapping a user-supplied form field to the `user_pass` parameter of the WP User Registration "Update User" action, and that the administrator subsequently clicks "Re-execute" on the failure log row produced by the anonymous submission from the plugin's log screen.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-109317

Grav API Plugin before 1.0.36 Privilege Escalation via Scalar Access Grants

Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing positive scalar admin or api parent grants. Attackers with api.users.write can edit account access maps or invitations so the inheriting permission resolver satisfies requireSuper checks, accessing super-only API endpoints.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Getgrav
Products
Grav-plugin-api
CVE-2026-18343

IBM i is Affected By An Improper Privilege Management Vulnerability

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to modify the BOOTP table due to improper authorization.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
I
CVE-2023-26604

systemd: privilege escalation via the less pager

systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the "systemctl status" command may be executed. Specifically, systemd does not set LESSSECURE to 1, and thus other programs may be launched from the less program. This presents a substantial security risk when running systemctl from Sudo, because less executes as root when the terminal size is too small to show the complete systemctl output.

CVSS 3.1 · 7.8 High EPSS 1.1% KEV · Not listed
Vendors
Debian Redhat Systemd Project
Products
Debian Linux Enterprise Linux Rhel Els and 2 more
CVE-2026-65199

Huawei openUBMC low-privilege SNMP to administrator privilege escalation

openUBMC assigns the full privilege set to pseudo-identities representing SNMP callers. An authenticated, but low-privilege, SNMP user can therefore invoke mapped backend operations as an administrative identity. In `route_mapper/account.lua`, `get_user_privilege` returns the complete nine-privilege set for a `special_users` group that includes the `SNMPv1_v2c` pseudo-user.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-108788

deepseek-ai deepseek-harness Sandbox spawn sandbox

A vulnerability was determined in deepseek-ai deepseek-harness up to 0.1.1-rc.2. The impacted element is the function spawn of the component Sandbox. Executing a manipulation of the argument Profile can lead to sandbox issue. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Deepseek-ai
Products
Deepseek-harness
CVE-2026-102851

Visual Studio Code Security Feature Bypass Vulnerability

Incorrect privilege assignment in Visual Studio Code allows an authorized attacker to bypass a security feature locally.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Visual Studio Code
CVE-2014-0119

Tomcat/JBossWeb: XML parser hijack by malicious web application

Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.

CVSS 2.0 · 4.3 Medium EPSS 7.6% KEV · Not listed
Vendors
Apache Redhat
Products
Tomcat Enterprise Linux Jboss Bpms and 7 more
CVE-2014-0096

Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs

java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CVSS 2.0 · 4.3 Medium EPSS 6.9% KEV · Not listed
Vendors
Apache Redhat
Products
Tomcat Enterprise Linux Jboss Bpms and 7 more
CVE-2026-109739

Privilege escalation in the WebExtensions component

Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox
CVE-2026-109704

Privilege escalation in the Application Update component

Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Thunderbird
CVE-2026-109605

SourceCodester Simple Cafe Billing System User Management admin_class.php save_user improper authorization

A security vulnerability has been detected in SourceCodester Simple Cafe Billing System 1.0. This affects the function Action::save_user of the file admin_class.php of the component User Management. The manipulation of the argument Type leads to improper authorization. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Sourcecodester
Products
Simple Cafe Billing System
CVE-2026-94578

Remote Authenticated Privilege Escalation via AAA Integration in Brocade Fabric OS

Brocade Fabric OS versions before 10.0.1 contain an authorization logic vulnerability in the AAA (Authentication, Authorization, and Accounting) integration framework allows remote authenticated users to gain root-equivalent chassis access controls. By returning specific, crafted Vendor-Specific Attributes (VSAs) or directory claims from an external identity provider (such as RADIUS, LDAP, TACACS+, or Federated IDP), an account can bypass administrative role restriction checks during session establishment.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Broadcom Brocade
Products
Fabric Operating System Fabric Os
CVE-2026-104661

Incorrect Privilege Assignment in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 17.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user holding a custom role with compliance framework administration permissions to configure and execute a specially crafted compliance pipeline across group projects due to improper privilege assignment.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gitlab
Products
Gitlab