The Mennekes Amtron series (firmware versions ≤ 5.22.3) is vulnerable to privilege escalation. An authenticated low-privileged user can change the passwords of the admin (operator) and manufacturer accounts via crafted POST requests.
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthenticated privilege escalation in versions up to and including 3.29.2. This is due to insecure form submission handling that accepts arbitrary form definitions from user input instead of securely loading them from the backend. When $_POST['_acf_form'] is an array (rather than a form ID), the validate_form() function bypasses database lookup and directly processes the attacker-controlled structure. The create_record() function preserves attacker-supplied record data if present, and the user action's run() function falls back to attacker-controlled field definitions from $form['fields'] when legitimate fields cannot be found. The role field's pre_update_value() validation reads $field['role_options'] from this attacker-controlled definition, allowing an attacker to specify ['administrator'] as an allowed role and bypass the security check. This makes it possible for unauthenticated attackers to create administrator accounts by injecting a custom form configuration with a spoofed role field.
A Local Privilege Escalation (LPE) vulnerability affects Acer NitroSense software versions prior to 3.01.3052. The vulnerability stems from the the PSAdminAgent service, which creates a Named Pipe with a weak Access Control List (ACL). This allows any authenticated local user to connect and send commands. Because the service does not check the caller's privileges before running file deletion commands, a low-privileged local user can exploit this to delete arbitrary files with system authority.
Jenkins AppSpider Plugin 1.0.17 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to connect to an attacker-specified URL.
The Firebase Support & Chat Management plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.1.1. This is due to the `firebase_auth()` function authenticating the request as the WordPress user whose email is supplied in the `user_email` POST parameter without verifying ownership of that email (no Firebase ID token signature/issuer/audience verification). This makes it possible for authenticated attackers, with Subscriber-level access and above, to log in as an arbitrary existing user — including an Administrator — by submitting that user's email address to the `acb_firebase_auth` AJAX action, resulting in full account takeover.
CVE-2026-9490 is a medium severity vulnerability in Acer Care Center version 4.0 where the ACCSvc service creates a Named Pipe with a weak security descriptor. This flaw allows an authenticated local user to send a crafted message to the pipe, causing the service to crash with exit code 1067 (ERROR_PROCESS_ABORTED). The vulnerability results in local denial of service by disrupting the service operation. Acer advises updating to the latest version to mitigate this issue, but no specific patch or official fix details are currently confirmed.
Acer NitroSense V3 versions before 3.01.3052 contain a local privilege escalation vulnerability due to improper configuration of a Windows Named Pipe. This flaw allows any authenticated local user to execute arbitrary code and delete files with SYSTEM privileges by exploiting a custom protocol exposed by the Named Pipe. The vulnerability is classified as a path traversal and improper access control issue, leading to high-severity impact on affected systems.
A privilege escalation vulnerability exists in authentik versions prior to 2025.12.5 and between 2026.2.0-rc1 and 2026.2.2. The PATCH /api/v3/core/users/{pk}/ API allows users with change_user permission on a target user to assign arbitrary groups, including those with superuser privileges, without requiring the enable_group_superuser flag. This bypasses stricter permission controls in group management and enables escalation to administrator-equivalent privileges. The issue is fixed in versions 2025.
The Easy Elements for Elementor – Addons & Website Templates plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.5 via the `easyel_handle_register()` function. This is due to the `wp_ajax_nopriv_eel_register` AJAX handler iterating the attacker-controlled `custom_meta` POST array and writing every supplied key-value pair to the newly created user's meta via `update_user_meta()` without any key whitelist or blocklist, allowing the `wp_capabilities` user meta key to be overwritten after `wp_insert_user()` has already assigned a safe role. This makes it possible for unauthenticated attackers to register a new account with full administrator-level privileges by supplying `custom_meta[wp_capabilities][administrator]=1`. Exploitation requires that user registration is enabled on the site and that at least one page exposes the Login/Register widget, which publishes the required `easy_elements_nonce` into the page DOM where it can be retrieved by any unauthenticated visitor via a simple GET request.
The Divi Form Builder plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.2. This is due to the plugin accepting a user-controlled 'role' parameter from POST data during user registration without validating it against the form's configured default_user_role setting. This makes it possible for unauthenticated attackers to create administrator accounts by tampering with the role parameter during registration.
The Read More & Accordion plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.5.7. This is due to the 'RadMoreAjax::importData' function not restricting which database tables can be written to during import and not properly validating the imported data. This makes it possible for authenticated attackers, with permission granted by the site owner through the plugin's role settings, to insert arbitrary rows into the 'wp_users' and 'wp_usermeta' tables, including the 'wp_capabilities' field, allowing them to create a new administrator account and gain administrator access to the site.
The Easy Elements for Elementor – Addons & Website Templates plugin for WordPress is vulnerable to privilege escalation via user registration in all versions up to, and including, 1.4.4. This is due to the 'easyel_handle_register' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site.
CVE-2026-8957 is a privilege escalation vulnerability in the Enterprise Policies component of Mozilla Firefox. It was fixed in Firefox 151 and Firefox ESR 140.11. The vulnerability has a high severity with a CVSS score of 8.8. Mozilla has officially addressed this issue in their security advisories dated May 19, 2026. No known exploits in the wild have been reported. Users should update to the fixed versions to mitigate this vulnerability.
CVE-2026-8955 is a privilege escalation vulnerability in the DOM: Workers component of Mozilla Firefox. This vulnerability was addressed and fixed in Firefox 151 and Firefox ESR 140.11. It has a high severity rating with a CVSS score of 8.8, indicating it could allow an attacker to gain elevated privileges. The vendor advisories confirm the issue and the availability of fixes in the specified Firefox versions.
CVE-2026-8952 is a privilege escalation vulnerability in the Application Update component of Mozilla Firefox and Thunderbird. This vulnerability has been fixed in Firefox 151 and Thunderbird 151. The issue was reported by Tomoya Nakanishi and is classified with moderate impact by Mozilla. The vulnerability allows an attacker to escalate privileges within the affected application. Mozilla has released security advisories confirming the fix in the specified versions. No known exploits in the wild have been reported. The CVSS score for this vulnerability is 8.8, indicating a high severity level overall, but Mozilla rates the impact of this specific issue as moderate.
Mullvad VPN is a VPN client app for desktop and mobile. When using macOS with versions 2026.1 and below, Mullvad VPN may allow local privilege escalation during installation or upgrade. The installer package executes binaries from /Applications/Mullvad VPN.app without verifying if the bundle is attacker-controlled or that the path is the legitimate Mullvad application. A user in the admin group can pre-place a crafted application bundle at that location and may be able to achieve code execution as root. Since the issue only affected the installer, there is no immediate need for users to update if they are already running an older version. This issue has been fixed in version 2026.2-beta1.
CVE-2026-8719 is a high-severity privilege escalation vulnerability in version 3.4.9 of the AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin. The issue arises from missing capability enforcement in the MCP OAuth bearer-token authorization path, allowing any valid OAuth token to grant MCP access without verifying administrator privileges. As a result, authenticated users with Subscriber or higher roles can escalate their privileges to Administrator by invoking admin-level MCP tools.
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 3.28.36. This is due to insufficient authorization checks in the role field update mechanism combined with overly permissive capabilities for the admin_form post type. The admin_form custom post type uses 'capability_type' => 'page', which grants editors the ability to create and edit forms. When an editor creates an edit_user form, they can manipulate the form configuration to include 'administrator' in the role_options array by directly submitting POST data to wp-admin/post.php, bypassing the UI restrictions in feadmin_get_user_roles(). When the form is subsequently submitted, the pre_update_value() function in class-role.php only validates that the submitted role exists in the form's role_options array (lines 107-110), but fails to verify that the current user has permission to assign that specific role. This makes it possible for unauthenticated attackers to first register as editors (via a public new_user form), then create an edit_user form with administrator in the allowed roles, and finally use that form to escalate their own privileges to administrator.
CVE-2025-62625 is a medium severity privilege escalation vulnerability in AMD Ryzen 4000 Series Mobile Processors with Radeon Graphics. It involves improper privilege management in the KVM key download component, allowing an attacker to swap tokens and download sensitive keys. This could lead to unauthorized access to privileged resources and loss of confidentiality. There is no confirmed patch or official remediation available at this time. No known exploits are reported in the wild.