CWE-266 vulnerabilities

In Progress® Telerik® Report Server prior to version 12.2.26.1007, incorrect privilege assignment in the service-agent SignalR hub allows an authenticated user, including a low-privilege or guest account with a valid bearer token, to register as a trusted service agent. On the next server settings-synchronization event, the rogue agent receives storage settings and encryption private keys. This privilege escalation enables disclosure of protected secrets, including stored data-source credentials and connection strings, and allows agent impersonation and interference with task dispatch.

Unauthenticated Privilege Escalation in Salon booking system <= 10.31.7 versions.

Subscriber Privilege Escalation in WP User Profiles <= 2.7.3 versions.

Editor Privilege Escalation in Import and export users and customers <= 2.5.5 versions.

Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions.

CVE-2026-95594 is an Incorrect Privilege Assignment vulnerability in Cozy Vision Technologies Pvt. Ltd.'s SMS Alert Order Notifications plugin. It allows privilege escalation affecting versions from 0 up to but not including 4.0.1. The vulnerability has a high severity with a CVSS score of 8.1.

Subscriber Privilege Escalation in JobZilla - Job Board WordPress Theme <= 2.2 versions.

Unauthenticated Privilege Escalation in Tourfic Pro <= 1.17.3 versions.

Unauthenticated Privilege Escalation in Doctreat Core <= 1.7.0 versions.

Shop Manager Privilege Escalation in Challan <= 3.7.88 versions.

Unauthenticated Privilege Escalation in Meta Box AIO <= 3.7.1 versions.

Unauthenticated Privilege Escalation in Taskbot <= 6.6 versions.

Subscriber Privilege Escalation in ByteCoreStack &#8211; MCP Connector for AI Tools <= 1.2.2 versions.

Unauthenticated Privilege Escalation in Authorizer <= 3.15.3 versions.

CVE-2026-103494 is a privilege escalation vulnerability in JetBrains YouTrack versions before 2026.2.19422. The issue arises from improper control over user group membership changes, allowing users with certain privileges to escalate their access rights. The vulnerability has a CVSS score of 6.6, indicating a medium severity level.

CVE-2026-102129 is a privilege escalation vulnerability in Kiteworks Core where the user-provisioning interface fails to verify if an administrator is authorized to assign certain roles. This flaw allows an administrator with limited delegated permissions for role changes to escalate an account to full system-administrator privileges. The vulnerability affects Kiteworks Core versions from 0 up to but not including 9.5.1. It has a high severity with a CVSS score of 7.2. No known exploits are reported in the wild, and no patch information is provided.

CVE-2026-103470 is a critical privilege escalation vulnerability in Internet2 Grouper before version 7.5.1. It affects configurations where users are allowed to create or edit rules via the User Interface, enabling them to escalate their privileges improperly.

Subscriber Privilege Escalation in FluentBoards <= 2.0.12 versions.

Custom role Privilege Escalation in Vitepos <= 3.5.0 versions.

Subscriber Privilege Escalation in Import and export users and customers <= 2.5.2 versions.