CVE-2026-20978 is a medium severity vulnerability affecting Samsung Mobile Devices, specifically in the KnoxGuardManager component prior to the SMR Feb-2026 Release 1. It involves improper authorization that allows local attackers with limited privileges to bypass the persistence configuration of the application. Exploitation does not require user interaction but does require some level of local privilege. The vulnerability impacts the integrity and availability of the KnoxGuardManager's persistence mechanisms, potentially allowing attackers to maintain unauthorized changes or evade security controls. No known exploits are currently reported in the wild. European organizations using Samsung Mobile Devices with KnoxGuardManager should prioritize patching once updates are available. Countries with high Samsung device penetration and critical infrastructure relying on mobile security features are most at risk. Mitigation involves applying vendor patches promptly and restricting local access to trusted users only.
CVE-2025-15030 is a critical vulnerability in the User Profile Builder WordPress plugin versions before 3.15.2. It allows unauthenticated attackers to reset the password of any user, including administrators, by simply knowing their username. This flaw stems from improper privilege management in the password reset process, enabling full account takeover without user interaction or authentication. The vulnerability has a CVSS score of 9.8, reflecting its high impact on confidentiality, integrity, and availability. Although no known exploits are currently reported in the wild, the ease of exploitation and severity make it a significant threat. European organizations using this plugin on WordPress sites are at risk, especially those with high-value administrative accounts. Immediate patching or mitigation is essential to prevent unauthorized access and potential data breaches.
Chef InSpec versions up to 5.23 and before 7.0.107 creates named pipes with overly permissive default Windows access controls. A local attacker may interfere with the pipe connection process and exploit the insufficient access restrictions to assume the InSpec execution context, potentially resulting in elevated privileges or operational disruption.
This issue affects Chef Inspec: through 5.23 and before 7.0.107
immich is a high performance self-hosted photo and video management solution. Prior to version 2.5.0, API keys can escalate their own permissions by calling the update endpoint, allowing a low-privilege API key to grant itself full administrative access to the system. Version 2.5.0 fixes the issue.
CVE-2025-14975 is a high-severity vulnerability in the Custom Login Page Customizer WordPress plugin versions before 2.5.4. It allows unauthenticated attackers to reset the password of any user, including administrators, by sending a few crafted requests with knowledge of the username. This improper privilege management flaw (CWE-269) enables full account takeover without requiring user interaction or prior authentication. The vulnerability impacts confidentiality, integrity, and availability of affected WordPress sites. Although no known exploits are currently in the wild, the ease of exploitation and critical impact make timely patching essential. European organizations using this plugin on WordPress sites are at risk, especially those with high-value targets or public-facing portals. Mitigation involves immediate plugin updates and enhanced monitoring of password reset activities. Countries with large WordPress user bases and significant e-commerce or governmental web presence, such as Germany, France, and the UK, are most likely to be affected.
Symantec Endpoint Protection, prior to 14.3 RU10 Patch 1, RU9 Patch 2, and RU8 Patch 3, may be susceptible to a Elevation of Privilege vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user.
WSS Agent, prior to 9.8.5, may be susceptible to a Elevation of Privilege vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user.
A local privilege escalation vulnerability has been identified in the Kaba exos 9300 System management application (d9sysdef.exe). Within this application it is possible to specify an arbitrary executable as well as the weekday and start time, when the specified executable should be run with SYSTEM privileges.
The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Administrative User Creation in all versions up to, and including, 1.5.6.3. This is due to the 'ajax_register_handle' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'lakit_bkrole' parameter during registration and gain administrator access to the site.
CVE-2026-23990 is a medium-severity privilege escalation vulnerability in the Flux Operator versions 0.36.0 to before 0.40.0. It arises from improper privilege management in the Web UI authentication code when configured with certain OIDC providers issuing tokens missing expected claims or with custom CEL expressions that yield empty username and groups values. This causes Kubernetes client-go to omit impersonation headers, resulting in API requests executing with the operator's service account privileges rather than the limited authenticated user permissions. Exploitation can lead to privilege escalation and data exposure within Kubernetes clusters using the affected Flux Operator versions. The vulnerability is patched in version 0.40.
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.9.2.1. This is due to the 'insert_user' function not restricting the roles with which a user can register. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site. Note: The vulnerability can only be exploited if 'role' is mapped to the custom field.
The RegistrationMagic plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.0.7.1. This is due to the 'add_menu' function is accessible via the 'rm_user_exists' AJAX action and allows arbitrary updates to the 'admin_order' setting. This makes it possible for unauthenticated attackers to injecting an empty slug into the order parameter, and manipulate the plugin's menu generation logic, and when the admin menu is subsequently built, the plugin adds 'manage_options' capability for the target role. Note: The vulnerability can only be exploited unauthenticated, but further privilege escalation requires at least a subscriber user.
A stored cross-site scripting (XSS) vulnerability exists in the Altium Workflow Engine due to missing server-side input sanitization in workflow form submission APIs. A regular authenticated user can inject arbitrary JavaScript into workflow data.
When an administrator views the affected workflow, the injected payload executes in the administrator’s browser context, allowing privilege escalation, including creation of new administrator accounts, session token theft, and execution of administrative actions.
CVE-2026-23477 is a high-severity privilege management vulnerability in Rocket. Chat versions prior to 6.12.0. It allows any authenticated user, regardless of role or permissions, to access the GET /api/v1/oauth-apps.get API endpoint. This endpoint exposes OAuth application details, including sensitive client_id and client_secret fields, if the user knows the OAuth app ID. The vulnerability does not require user interaction and can be exploited remotely with low complexity. While no exploits are currently known in the wild, the exposure of OAuth credentials can lead to unauthorized access to integrated services. The issue is fixed in Rocket.
The vulnerability exists in BLUVOYIX due to improper authentication in the BLUVOYIX admin APIs. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable admin API to create a new user with admin privileges. Successful exploitation of this vulnerability could allow the attacker to gain full access to customers' data and completely compromise the targeted platform by logging in to the newly-created admin user.
A vulnerability has been identified in the installation/uninstallation of the Nessus Agent Tray App on Windows Hosts which could lead to escalation of privileges.
CVE-2026-22804 is a high-severity Stored Cross-Site Scripting (XSS) vulnerability affecting Termix versions 1.7.0 through 1.9.0. The flaw exists in the Termix File Manager component, where SVG file content is not properly sanitized before rendering. An attacker who has compromised a managed SSH server can plant a malicious SVG file that executes arbitrary JavaScript when previewed by a Termix user. This vulnerability can lead to full compromise of user sessions and potentially the application itself. It requires no privileges but does require user interaction to preview the malicious file. The issue is fixed in version 1.
