Base de CVEs

CVE-2026-23599 Alta · 7.8 CWE-269 17/02/2026

Local Privilege Escalation Vulnerability in HPE Aruba Networking Clear Pass Policy Manager OnGuard for Linux

A local privilege-escalation vulnerability has been discovered in the HPE Aruba Networking ClearPass OnGuard Software for Linux. Successful exploitation of this vulnerability could allow a local attacker to achieve arbitrary code execution with root privileges.

CVE-2025-67905 Alta · 8.7 CWE-269 17/02/2026

Malwarebytes AdwCleaner before v.8.7.0 runs as Administrator and performs an insecure…

Malwarebytes AdwCleaner before v.8.7.0 runs as Administrator and performs an insecure log file delete operation in which the target location is user-controllable, allowing a non-admin user to escalate privileges to SYSTEM via a symbolic link, a related issue to CVE-2023-28892. To exploit this, an attacker must create a file in a given folder path and intercept the application log file deletion flow.

CVE-2026-26369 Alta · 8.8 CWE-269 15/02/2026

JUNG eNet SMART HOME server 2.2.1/2.3.1 Privilege Escalation via setUserGroup

eNet SMART HOME server 2.2.1 and 2.3.1 contains a privilege escalation vulnerability due to insufficient authorization checks in the setUserGroup JSON-RPC method. A low-privileged user (UG_USER) can send a crafted POST request to /jsonrpc/management specifying their own username to elevate their account to the UG_ADMIN group, bypassing intended access controls and gaining administrative capabilities such as modifying device configurations, network settings, and other smart home system functions.

CVE-2026-1750 Alta · 8.8 CWE-269 15/02/2026

Ecwid by Lightspeed Ecommerce Shopping Cart <= 7.0.7 - Authenticated (Subscriber+) Privilege Escalation via ec_store_admin_access

The Ecwid by Lightspeed Ecommerce Shopping Cart plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.0.7. This is due to a missing capability check in the 'save_custom_user_profile_fields' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to supply the 'ec_store_admin_access' parameter during a profile update and gain store manager access to the site.

CVE-2025-8572 Crítica · 9.8 CWE-269 14/02/2026

Truelysell Core <= 1.8.7 - Unauthenticated Privilege Escalation via Registration

The Truelysell Core plugin for WordPress is vulnerable to privilege escalation in versions less than, or equal to, 1.8.7. This is due to insufficient validation of the user_role parameter during user registration. This makes it possible for unauthenticated attackers to create accounts with elevated privileges, including administrator access.

CVE-2026-2144 Alta · 8.1 CWE-269 14/02/2026

Magic Login Mail or QR Code <= 2.05 - Unauthenticated Privilege Escalation via Insecure QR Code File Storage

The Magic Login Mail or QR Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.05. This is due to the plugin storing the magic login QR code image with a predictable, static filename (QR_Code.png) in the publicly accessible WordPress uploads directory during the email sending process. The file is only deleted after wp_mail() completes, creating an exploitable race condition window. This makes it possible for unauthenticated attackers to trigger a login link request for any user, including administrators, and then exploit the race condition between QR code file creation and deletion to obtain the login URL encoded in the QR code, thereby gaining unauthorized access to the targeted user's account.

CVE-2026-24894 Alta · 7.5 CWE-269 12/02/2026

FrankenPHP leaks session data between requests in worker mode

FrankenPHP is a modern application server for PHP. Prior to 1.11.2, when running FrankenPHP in worker mode, the $_SESSION superglobal is not correctly reset between requests. This allows a subsequent request processed by the same worker to access the $_SESSION data of the previous request (potentially belonging to a different user) before session_start() is called. This vulnerability is fixed in 1.11.2.

CVE-2025-46310 Média · 6.0 CWE-269 11/02/2026

Improper Privilege Management em Apple Macos

This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26. An attacker with root privileges may be able to delete protected system files.

CVE-2024-50619 Alta · 8.8 CWE-269 11/02/2026

Improper Privilege Management em Cipplanner Cipace

Vulnerabilities in the My Account and User Management components in CIPPlanner CIPAce before 9.17 allows attackers to escalate their access levels. A low-privileged authenticated user can gain access to other people's accounts by tampering with the client's user id to change their account information. A low-privileged authenticated user can elevate his or her system privileges by modifying the information of a user role that is disabled in the client.

CVE-2026-26010 Alta · 7.6 CWE-269 11/02/2026

Leaky JWTs in OpenMetadata exposing highly-privileged bot users

OpenMetadata is a unified metadata platform. Prior to 1.11.8, calls issued by the UI against /api/v1/ingestionPipelines leak JWTs used by ingestion-bot for certain services (Glue / Redshift / Postgres). Any read-only user can gain access to a highly privileged account, typically which has the Ingestion Bot Role. This enables destructive changes in OpenMetadata instances, and potential data leakage (e.g. sample data, or service metadata which would be unavailable per roles/policies). This vulnerability is fixed in 1.11.8.

CVE-2025-64487 Alta · 7.6 CWE-269 11/02/2026

Outline is vulnerable to privilege escalation vulnerability in document sharing

Outline is a service that allows for collaborative documentation. Prior to 1.1.0, a privilege escalation vulnerability exists in the Outline document management system due to inconsistent authorization checks between user and group membership management endpoints. This vulnerability is fixed in 1.1.0.

CVE-2026-21533 Alta · 7.8 KEV Alta · 61 Exploit público CWE-269 10/02/2026

Microsoft Windows Improper Privilege Management Vulnerability

Improper privilege management in Windows Remote Desktop allows an authorized attacker to elevate privileges locally.

CVE-2025-15100 Alta · 8.8 CWE-269 07/02/2026

JAY Login & Register <= 2.6.03 - Authenticated (Subscriber+) Privilege Escalation via jay_panel_ajax_update_profile

The JAY Login & Register plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.6.03. This is due to the plugin allowing a user to update arbitrary user meta through the 'jay_panel_ajax_update_profile' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator.

CVE-2025-15027 Crítica · 9.8 CWE-269 07/02/2026

Escalonamento de Privilégios no Plugin JAY Login & Register para WordPress (CWE-269)

O plugin JAY Login & Register para WordPress é vulnerável a Escalonamento de Privilégios em todas as versões até a 2.6.03, inclusive. Isso ocorre porque o plugin permite que um usuário atualize metadados de usuário arbitrários por meio da função 'jay_login_register_ajax_create_final_user'. Isso possibilita que atacantes não autenticados elevem seus privilégios para os de administrador.

CVE-2025-69875 Alta · 7.8 CWE-269 03/02/2026

Improper Privilege Management em Quickheal Total Security

A vulnerability exists in Quick Heal Total Security 23.0.0 in the quarantine management component where insufficient validation of restore paths and improper permission handling allow a low-privileged local user to restore quarantined files into protected system directories. This behavior can be abused by a local attacker to place files in high-privilege locations, potentially leading to privilege escalation.

CVE-2025-66374 Alta · 7.8 CWE-269 03/02/2026

Improper Privilege Management em Cyberark Endpoint Privilege Manager

CyberArk Endpoint Privilege Manager Agent through 25.10.0 allows a local user to achieve privilege escalation through policy elevation of an Administration task.

CVE-2025-15030 Crítica · 9.8 CWE-269 02/02/2026

Plugin User Profile Builder para WordPress: Redefinição de Senha Insegura Permite Acesso a Contas (CVE-2025-15030)

O plugin User Profile Builder para WordPress anterior à versão 3.15.2 não possui um processo adequado de redefinição de senha, permitindo que algumas poucas requisições não autenticadas redefinam a senha de qualquer usuário conhecendo seu nome de usuário, como os de administradores, e assim obter acesso à conta.

CVE-2025-6723 Média · 5.8 CWE-269 30/01/2026

Untrusted user data can lead to privilege escalation

Chef InSpec versions up to 5.23 and before 7.0.107 creates named pipes with overly permissive default Windows access controls. A local attacker may interfere with the pipe connection process and exploit the insufficient access restrictions to assume the InSpec execution context, potentially resulting in elevated privileges or operational disruption. This issue affects Chef Inspec: through 5.23 and before 7.0.107

CVE-2025-13176 Alta · 8.4 CWE-269 30/01/2026

Local privilege escalation in ESET Inspect Connector for Windows

Planting a custom configuration file in ESET Inspect Connector allow load a malicious DLL.

CVE-2026-23896 Alta · 8.8 CWE-269 29/01/2026

immich API Key Privilege Escalation vulnerability

immich is a high performance self-hosted photo and video management solution. Prior to version 2.5.0, API keys can escalate their own permissions by calling the update endpoint, allowing a low-privilege API key to grant itself full administrative access to the system. Version 2.5.0 fixes the issue.

CVE-2025-14975 Alta · 8.1 CWE-269 29/01/2026

Custom Login Page Customizer < 2.5.4 - Unauthenticated Arbitrary Password Reset

The Custom Login Page Customizer WordPress plugin before 2.5.4 does not have a proper password reset process, allowing a few unauthenticated requests to reset the password of any user by knowing their username, such as administrator ones, and therefore gain access to their account

CVE-2025-13918 Média · 6.7 CWE-269 28/01/2026

Elevation of Privileges in Symantec Endpoint Protection Windows Client

Symantec Endpoint Protection, prior to 14.3 RU10 Patch 1, RU9 Patch 2, and RU8 Patch 3, may be susceptible to a Elevation of Privilege vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user.

CVE-2025-13917 Alta · 7.0 CWE-269 28/01/2026

Elevation of Privileges in Web Security Services (WSS) Agent

WSS Agent, prior to 9.8.5, may be susceptible to a Elevation of Privilege vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user.

CVE-2026-22039 Crítica · 9.9 CWE-269 27/01/2026

Bypass de limite de autorização no apiCall de Policy do Kyverno

Kyverno é um motor de políticas projetado para equipes de engenharia de plataformas cloud native. Versões anteriores à 1.16.3 e 1.15.3 apresentam um bypass crítico de limite de autorização no apiCall de Kyverno Policy com escopo de namespace. O urlPath resolvido é executado usando a ServiceAccount do controlador de admissão do Kyverno, sem nenhuma imposição de que a requisição seja limitada ao namespace da política. Como resultado, qualquer usuário autenticado com permissão para criar uma Policy com escopo de namespace pode fazer com que o Kyverno execute requisições à API do Kubernetes usando a identidade do controlador de admissão do Kyverno, direcionadas a qualquer caminho de API permitido pelo RBAC dessa ServiceAccount. Isso quebra o isolamento de namespaces ao possibilitar leituras entre namespaces (por exemplo, ConfigMaps e, onde permitido, Secrets) e permite escritas em escopo de cluster ou entre namespaces (por exemplo, criação de ClusterPolicies) ao controlar o urlPath por meio de substituição de variáveis de contexto. As versões 1.16.3 e 1.15.3 contêm um patch para a vulnerabilidade.

CVE-2025-59094 Alta · 8.4 CWE-269 26/01/2026

Local Privilege Escalation in dormakaba Kaba exos 9300 System management

A local privilege escalation vulnerability has been identified in the Kaba exos 9300 System management application (d9sysdef.exe). Within this application it is possible to specify an arbitrary executable as well as the weekday and start time, when the specified executable should be run with SYSTEM privileges.