CVE-2025-29165

Privilege Escalation via /etc/shadow.sample on D-Link DIR-1253

An issue in D-Link DIR-1253 MESH V1.6.1684 allows an attacker to escalate privileges via the etc/shadow.sample component

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Dlink

Products

Dir-1253 Dir-1253 Firmware

CVE-2025-7784

Org.keycloak/keycloak-services: privilege escalation in keycloak admin console (fgapv2 enabled)

A flaw was found in the Keycloak identity and access management system when Fine-Grained Admin Permissions(FGAPv2) are enabled. An administrative user with the manage-users role can escalate their privileges to realm-admin due to improper privilege enforcement. This vulnerability allows unauthorized elevation of access rights, compromising the intended separation of administrative duties and posing a security risk to the realm.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Build Keycloak Build Of Keycloak Jboss Enterprise Application Platform and 2 more

CVE-2025-13618

Mentoring <= 1.2.8 - Unauthenticated Privilege Escalation in mentoring_process_registration

The Mentoring plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.2.8. This is due to the plugin not properly restricting the roles that users can register with in the mentoring_process_registration() function. This makes it possible for unauthenticated attackers to register with administrator-level user accounts.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Dreamstechnologies Wordpress

Products

Mentoring Wordpress

CVE-2026-7778

runZero Platform dashboard configuration exposure

An issue that could allow a dashboard configuration to be viewed from outside of the authorized organization scope has been resolved. This is an instance of CWE-269: Improper Privilege Management, and has an estimated CVSS score of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N (5.0, Medium). This issue was fixed in version v4.0.260416.0 of the runZero Platform.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Runzero

Products

Platform

CVE-2026-30769

Privilege Escalation via Crafted IOCTL in TVicPort64.sys Driver

An issue in the TVicPort64.sys component of EnTech Taiwan TVicPort Product v4.0, File v5.2.1.0 allows attackers to escalate privileges via sending crafted IOCTL 0x80002008 requests.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Entechtaiwan

Products

Tvicport

CVE-2026-24072

Apache HTTP Server: mod_rewrite elevation of privileges via ap_expr

An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user. Users are recommended to upgrade to version 2.4.67, which fixes this issue.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Http Server

CVE-2026-6389

IBM Turbonomic Prometurbo agent used by IBM Turbonomic Application Resource Management is affected by a single vulnerability

IBM Turbonomic prometurbo agent 8.16.0 through 8.17.6 IBM Turbonomic Application Resource Management grants excessive cluster‑wide permissions, including unrestricted read access to all secrets. An attacker that compromises the operator or its service account can exfiltrate sensitive credentials, escalate privileges, and potentially achieve full cluster compromise.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Turbonomic Prometurbo Agent

CVE-2025-52347

Kernel memory read and privilege escalation via crafted IOCTL in PassMark and OSForensics drivers

An issue in the component DirectIo64.sys of PassMark BurnInTest v11.0 Build 1011, OSForensics v11.1 Build 1007, and PerformanceTest v11.1 Build 1004 allows attackers to access kernel memory and escalate privileges via a crafted IOCTL 0x8011E044 call.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Osforensics Passmark

Products

Osforensics Burnintest Performancetest

CVE-2026-7641

Import and export users and customers <= 2.0.8 - Authenticated (Subscriber+) Privilege Escalation via Multisite Capability Meta Fields

The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 2.0.8 via the `save_extra_user_profile_fields()` function. This is due to an incomplete blocklist that correctly restricts capability meta keys for the primary site (e.g., `wp_capabilities`, `wp_user_level`) but fails to block the equivalent meta keys for any other subsite in a WordPress Multisite network (e.g., `wp_2_capabilities`, `wp_2_user_level`), allowing these keys to pass the `in_array()` check and be written directly to user meta via `update_user_meta()`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to escalate their privileges to Administrator on any subsite within the Multisite network by submitting a crafted profile update to `/wp-admin/profile.php`. Exploitation requires that an administrator has previously imported a CSV file containing multisite-prefixed capability column headers and has enabled the 'Show fields in profile?' option, which causes those keys to be stored in the `acui_columns` option and exposed as editable fields on the user profile page.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Carazo Wordpress

Products

Import And Export Users And Customers Wordpress

CVE-2026-6386

Missing large page handling in pmap_pkru_update_range()

In order to apply a particular protection key to an address range, the kernel must update the corresponding page table entries. The subroutine which handled this failed to take into account the presence of 1GB largepage mappings created using the shm_create_largepage(3) interface. In particular, it would always treat a page directory page entry as pointing to another page table page. The bug can be abused by an unprivileged user to cause pmap_pkru_update_range() to treat userspace memory as a page table page, and thus overwrite memory to which the application would otherwise not have access.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Freebsd

Products

Freebsd

CVE-2026-7106

Highland Software Custom Role Manager <= 1.0.0 - Authenticated (Subscriber+) Privilege Escalation

The Highland Software Custom Role Manager plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 1.0.0. This is due to insufficient authorization checks in the hscrm_save_user_roles() function, which is hooked to the personal_options_update action accessible by any authenticated user. This makes it possible for authenticated attackers, with Subscriber-level access or higher, to potentially modify user roles via the profile update form.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Jgrodgers Wordpress

Products

Highland Software Custom Role Manager Wordpress

CVE-2025-43248

Privilege Escalation via Logic Flaw in macOS Access Controls

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7. A malicious app may be able to gain root privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos Macos Sequoia Macos Sonoma

CVE-2024-37560

WordPress WP User Switch plugin <= 1.1.0 - Privilege Escalation vulnerability

Improper Privilege Management vulnerability in IqbalRony WP User Switch allows Privilege Escalation.This issue affects WP User Switch: from n/a through 1.1.0.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Iqbalrony

Products

Wp User Switch

CVE-2024-37952

WordPress BookYourTravel theme <= 8.18.17 - Subscriber+ Privilege Escalation vulnerability

Improper Privilege Management vulnerability in themeenergy BookYourTravel allows Privilege Escalation.This issue affects BookYourTravel: from n/a through 8.18.17.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Themeenergy

Products

Book Your Travel Bookyourtravel

CVE-2024-34370

WordPress EAN for WooCommerce plugin <= 4.8.9 - Arbitrary Option Update to Privilege Escalation vulnerability

Improper Privilege Management vulnerability in WPFactory EAN for WooCommerce allows Privilege Escalation.This issue affects EAN for WooCommerce: from n/a through 4.8.9.

CVSS 3.1 · 7.2 High EPSS 1.1% KEV · Not listed

Vendors

Wpfactory

Products

Ean For Woocommerce

CVE-2023-51425

WordPress Rencontre plugin <= 3.10.1 - Unauthenticated Account Takeover vulnerability

Improper Privilege Management vulnerability in Jacques Malgrange Rencontre – Dating Site allows Privilege Escalation.This issue affects Rencontre – Dating Site: from n/a through 3.10.1.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2023-51424

WordPress WebinarIgnition plugin <= 3.05.0 - Unauthenticated Privilege Escalation vulnerability

Improper Privilege Management vulnerability in Saleswonder Team WebinarIgnition allows Privilege Escalation.This issue affects WebinarIgnition: from n/a through 3.05.0.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Saleswonder

Products

Webinarignition

CVE-2023-47868

WordPress wpForo plugin <= 2.2.3 - Privilege Escalation vulnerability

Improper Privilege Management vulnerability in wpForo wpForo Forum allows Privilege Escalation.This issue affects wpForo Forum: from n/a through 2.2.3.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Gvectors

Products

Wpforo Forum

CVE-2023-46145

WordPress Themify Ultra theme <= 7.3.5 - Authenticated Privilege Escalation vulnerability

Improper Privilege Management vulnerability in Themify Themify Ultra allows Privilege Escalation.This issue affects Themify Ultra: from n/a through 7.3.5.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Themify

Products

Ultra

CVE-2023-41665

WordPress GiveWP plugin <= 2.33.0 - GiveWP Manager+ Privilege Escalation vulnerability

Improper Privilege Management vulnerability in GiveWP allows Privilege Escalation.This issue affects GiveWP: from n/a through 2.33.0.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Givewp

Products

Givewp