Multiple BinSoft products are vulnerable to Privilege Escalation due to excessive database privileges assigned to the user used by the application. An attacker with access to any running application instance connected to the backend server can extract database credentials from the application’s memory by inspecting the running process. While ability to retrieve credentials from memory is the expected behavior, the exposed credentials grant administrative access to the database, exceeding the privileges required for normal application functionality. This allows an attacker to perform actions beyond those permitted through the application interface.
The described issue affects all published versions. The vendor stated that this issue is a direct result of the architecture model in which the software is distributed, and that it will be mitigated with a corrected installation manual.
Dell Alienware Command Center (AWCC) versions prior to 6.13.8.0 have a vulnerability allowing execution with unnecessary privileges. A local attacker with low privileges could exploit this to elevate their privileges. The vulnerability is identified as CWE-250 and has a CVSS score of 6.7, indicating medium severity. No official patch or remediation guidance is currently confirmed. There are no known exploits in the wild at this time.
An Execution with Unnecessary Privileges vulnerability in the User Interface (UI) of Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged attacker to gain root privileges, thus compromising the system.
When a configuration that allows unsigned Python op scripts is present on the device, a non-root user is able to execute malicious op scripts as a root-equivalent user, leading to privilege escalation.
This issue affects Junos OS:
* All versions before 22.4R3-S7,
* from 23.2 before 23.2R2-S4,
* from 23.4 before 23.4R2-S6,
* from 24.2 before 24.2R1-S2, 24.2R2,
* from 24.4 before 24.4R1-S2, 24.4R2;
Junos OS Evolved:
* All versions before 22.4R3-S7-EVO,
* from 23.2 before 23.2R2-S4-EVO,
* from 23.4 before 23.4R2-S6-EVO,
* from 24.2 before 24.2R2-EVO,
* from 24.4 before 24.4R1-S1-EVO, 24.4R2-EVO.
CVE-2026-4498 is a high-severity vulnerability in Elastic Kibana version 8.0.0 affecting the Fleet plugin. It involves execution with unnecessary privileges (CWE-250) in debug route handlers, allowing an authenticated Kibana user with Fleet sub-feature privileges to read Elasticsearch index data beyond their assigned RBAC scope. The vulnerability does not require user interaction but does require authentication with specific privileges. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.
CVE-2026-1346 is a critical vulnerability in IBM Verify Identity Access Container and IBM Security Verify Access Container versions 10.0 through 11.0.2. It allows a locally authenticated user to escalate privileges to root by exploiting execution with unnecessary privileges. The vulnerability is due to the software running processes with higher privileges than required, enabling privilege escalation. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.
CVE-2026-4606 is a critical local privilege escalation vulnerability in GeoVision's GV-Edge Recording Manager (ERM) version 2.3.1. The application improperly runs components with SYSTEM-level privileges, including Windows file dialogs invoked by functions like 'Import Data'. This allows any local user to execute actions with full SYSTEM privileges, enabling modification or deletion of protected system files. The vulnerability arises because ERM creates a Windows service running as LocalSystem and spawns processes under this context rather than the logged-in user's security context. Exploitation requires local access but no authentication or user interaction. This flaw can lead to full system compromise, making it a severe threat to organizations using this software. No known exploits are currently reported in the wild. Immediate patching or mitigation is critical to prevent potential attacks.
Execution with unnecessary privileges in Forcepoint NGFW Engine allows local privilege escalation.This issue affects NGFW Engine through 6.10.19, through 7.3.0, through 7.2.4, through 7.1.10.
CVE-2026-3315 is a medium severity vulnerability in ASSA ABLOY Visionline versions from 1.0 up to but not including 1.33 on Windows. It involves incorrect default permissions that allow execution with unnecessary privileges and incorrect permission assignments on critical resources. This misconfiguration enables attackers with limited privileges to manipulate configuration or environment settings, potentially escalating their privileges or impacting system integrity. Exploitation requires local access with low privileges and does not need user interaction. No known exploits are currently reported in the wild. The vulnerability affects Visionline installations primarily in physical security environments where this software is deployed. Organizations using affected versions should prioritize patching or applying mitigations to prevent unauthorized configuration changes that could compromise system security.
Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an execution with unnecessary privileges vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.
Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an execution with unnecessary privileges vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges.
Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an execution with unnecessary privileges vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to denial of service, elevation of privileges, and information disclosure.
theshit is a command-line utility that automatically detects and fixes common mistakes in shell commands. Prior to version 0.2.0, improper privilege dropping allows local privilege escalation via command re-execution. This issue has been patched in version 0.2.0.
bleon-ethical/api-gateway-deploy provides API gateway deployment. Version 1.0.0 is vulnerable to an attack chain involving OS Command Injection and Privilege Escalation. This allows an attacker to execute arbitrary commands with root privileges within the container, potentially leading to a container escape and unauthorized infrastructure modifications. This is fixed in version 1.0.1 by implementing strict input sanitization and secure delimiters in entrypoint.sh, enforcing a non-root user (appuser) in the Dockerfile, and establishing mandatory security quality gates.
Local privilege escalation in Genetec Sipelia Plugin. An authenticated low-privileged Windows user could exploit this vulnerability to gain elevated privileges on the affected system.
CVE-2026-25740 is a medium-severity vulnerability in NixOS nixpkgs versions 25.05 and earlier, involving the captive-browser feature. This feature runs a dedicated Chrome instance to handle captive portal logins without altering DNS settings. When enabled, any local user can execute arbitrary commands with the CAP_NET_RAW capability, allowing actions such as binding to privileged ports and spoofing localhost traffic from privileged services. The vulnerability arises from execution with unnecessary privileges (CWE-250). It requires local access and partial privileges but no user interaction. The issue is fixed in versions 25.11 and 26.05. Although no known exploits are reported in the wild, the potential for privilege escalation and network spoofing poses risks, especially in multi-user environments.
CVE-2026-0870 is a high-severity local privilege escalation vulnerability in GIGABYTE's MacroHub application. The flaw arises because MacroHub launches external applications with excessive privileges, allowing an authenticated local attacker to execute arbitrary code with SYSTEM-level privileges. This vulnerability requires local access and no user interaction, but only low complexity to exploit. Although no known exploits are currently reported in the wild, the impact on confidentiality, integrity, and availability is high due to SYSTEM-level code execution. European organizations using GIGABYTE hardware with MacroHub installed could be at risk, especially in sectors with high reliance on GIGABYTE products. Mitigation involves applying patches once available, restricting local user permissions, and monitoring for suspicious local activity. Countries with significant GIGABYTE market penetration and critical infrastructure sectors, such as Germany, France, and the UK, are most likely affected. Defenders should prioritize vulnerability scanning and restrict local access to trusted users to reduce risk.
Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Prior to 0.16.4, a critical Remote Command Execution (RCE) vulnerability has been identified in the Frigate integration with go2rtc. The application does not sanitize user input in the video stream configuration (config.yaml), allowing direct injection of system commands via the exec: directive. The go2rtc service executes these commands without restrictions. This vulnerability is only exploitable by an administrator or users who have exposed their Frigate install to the open internet with no authentication which allows anyone full administrative control. This vulnerability is fixed in 0.16.4.
IBM Common Cryptographic Architecture (CCA) 7.5.52 and 8.4.82 could allow an unauthenticated user to execute arbitrary commands with elevated privileges on the system.
