CVE-2026-111683 is a missing authorization vulnerability in Allegro Ralph versions up to 20260902.1. Authenticated staff users can bypass rack model permissions due to RalphPermission skipping checks for views without a queryset. This allows attackers to access and modify rack and server room data, including asset hostnames, serial numbers, and management IPs.
Piranha CMS versions up to 12.2 have a missing authorization vulnerability in the Piranha.Manager LanguageApiController. This flaw allows any authenticated manager user to perform language management actions—listing, creating, editing, and deleting site languages—without requiring the specific granular permissions. Exploitation can lead to removal of languages and reassignment of sites to the default language, impacting localized content across the entire instance.
Misaka Danmu Server versions up to 2.8.9 have a missing authentication vulnerability in several critical API routes under /api/ui. This flaw allows unauthenticated attackers to access sensitive audit, diagnostics, and data management functions, including reading audit logs with login IPs, server logs, environment paths, deleting episode rows, clearing media-server mappings, and wiping audit history. The vulnerability has a medium severity with a CVSS score of 6.9.
sshportal versions up to 1.19.5 have a missing authorization vulnerability in the management shell 'key show' command. This flaw allows authenticated non-admin users to retrieve decrypted backend private SSH keys by requesting predictable key names such as 'default' or 'host'. Exploiting this vulnerability enables attackers to connect directly to backend hosts, bypassing access control lists (ACLs) and session recording mechanisms.
Dockhand is a Docker management application. Prior to 1.0.34, the in-browser container terminal endpoint /api/containers/<id>/exec does not enforce authentication on the WebSocket upgrade request. When an unauthenticated attacker has network reach to Dockhand, knows a target container ID, and targets a container with an interactive shell, the attacker can open a raw WebSocket terminal session and execute commands inside a known target container. This allows unauthenticated command execution inside the container, with possible host compromise when the container has sensitive mounts or privileged execution. This issue is fixed in version 1.0.34.
This analysis discusses the risk management considerations for deploying open-weight AI models in enterprise environments. Open-weight models provide enterprises with access to model weights, enabling inspection, evaluation, modification, and local deployment. However, this flexibility introduces complexities in risk evaluation and safeguard responsibilities. Microsoft and NVIDIA have published a joint paper introducing a risk taxonomy and management approach based on established standards such as ISO and NIST frameworks. The taxonomy categorizes risks into Cybersecurity, Data Protection, Content, Human-AI Interaction, and Bias. The guidance emphasizes that risk depends on the model, use case, deployment context, and safeguards rather than weight openness alone. Enterprises are encouraged to adapt the taxonomy to their specific scenarios and use evaluations as evidence to manage risks effectively. The paper focuses primarily on model-layer risks and highlights the need for ongoing assessment of controls as models and deployments evolve.
Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request.
The WP Compress – Instant Performance & Speed Optimization WordPress plugin contains a privilege escalation vulnerability in all versions up to and including 7.25.00. The flaw allows unauthenticated attackers to gain plugin-administrator-equivalent control by exploiting improper privilege management in the plugin's API key validation and settings update mechanism. Attackers can retrieve the API key without authentication via an exposed AJAX action and then use it to modify plugin settings arbitrarily, granting themselves elevated capabilities.
The Subscribe to Comments WordPress plugin before 2.3.3 does not sign or validate a cookie it trusts to identify a commenter, allowing unauthenticated attackers to disclose a subscriber's management key and silently alter that subscriber's subscriptions.
The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.0.43. The vulnerability exists because the `update_cc_details()` AJAX handler forwards an attacker-supplied `username` parameter to ONTRAPORT via `api_call('update_cc_details', ...)` before performing the local `username_exists()` collision check, and aborts without rolling back the remote rename when a collision is detected — leaving the remote ONTRAPORT contact renamed to an existing WordPress Administrator's login. On a subsequent login attempt, `user_login()` (hooked to `wp_authenticate`) authenticates against ONTRAPORT using the renamed login and the attacker's own password, resolves the local WordPress user row via `get_user_by('login', $username)` — which now selects the real Administrator's row — and calls `wp_set_password()` against that Administrator's user ID; because the `user_level != 10` guard only suppresses PilotPress's own cookie issuance rather than returning a `WP_Error` to core, WordPress proceeds to validate the newly-synchronized password and issues a full Administrator authentication cookie to the attacker. This makes it possible for authenticated attackers with Subscriber-level access and above — specifically any PilotPress member holding a valid ONTRAPORT contact and the Customer Center nonce — to fully take over an Administrator account.
The User Profile Builder plugin for WordPress versions up to 4.0.3 contains a privilege escalation vulnerability via the 'role' parameter in the user registration form. This flaw allows unauthenticated attackers to create a fully activated administrator account by submitting a crafted registration request with 'role=administrator' and confirming via email. Exploitation requires legacy form fields named 'role', email confirmation enabled, and open user registration. The vulnerability arises from insufficient validation of the role parameter in the activation handler.
The Theme My Login plugin for WordPress up to version 7.2.1 contains a critical privilege escalation vulnerability. This flaw allows unauthenticated attackers to change arbitrary users' passwords on multi-site setups due to improper validation of user identity before password updates. The vulnerability enables account takeover without requiring prior authentication.
The My Calendar – Accessible Event Manager WordPress plugin versions up to 3.8.7 contain a critical privilege escalation vulnerability. An unauthenticated attacker can inject a crafted shortcode via the public 'mcs' GET parameter, leading to arbitrary PHP function calls. This flaw allows overwriting the Administrator account credentials (user ID 1), granting full administrative access. The vulnerability is exploitable through the plugin's publicly accessible /my-calendar/ page by default upon activation.
The Nexter Extension plugin for WordPress up to version 4.7.11 contains a privilege escalation vulnerability. Authenticated users with Subscriber-level access or higher can exploit a flaw in the role switching feature to regain Administrator privileges if their account previously held that role and was demoted via a bulk role change. This occurs because the plugin does not verify nonces or capabilities in a specific handler and fails to clear stored administrator role metadata during bulk role changes.
MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. WordPress plugin versions up to 1.2.78.6 contain a critical privilege escalation vulnerability. The flaw allows unauthenticated attackers to manipulate the subscribe_to_email_list endpoint by supplying crafted form_custom_field_mappings, enabling them to overwrite any WordPress user account password, including administrators. Exploitation requires a published WordPress User Registration opt-in form but no authentication or capability checks are needed to reach the vulnerable endpoint. This leads to full site compromise.
A privilege escalation vulnerability exists in the InstaWP Connect – 1-click WP Staging & Migration WordPress plugin in all versions up to and including 0.1.4.1. The flaw allows authenticated users with Subscriber-level access or higher to obtain the plaintext master API key due to improper privilege checks on the plugin's admin page. Using this key, attackers can generate a single-use login URL that grants administrator-level access, fully escalating their privileges. Exploitation requires the site to be connected to InstaWP and the attacker's role to be included in the plugin's Sync Tab Access list alongside the administrator role.
The Customer Email Verification for WooCommerce WordPress plugin (versions up to 3.3.0) contains a privilege escalation vulnerability when the 'Encoding method' is set to 'hashids'. This flaw allows unauthenticated attackers to brute-force a small activation code space to verify any unverified account, including administrators, by exploiting a weak token generation and lack of nonce or rate limiting in the verification handler.
The Cooked – Recipe Management WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability in the [cooked-timer] shortcode content. This vulnerability exists in all versions up to and including 1.16.1 and allows authenticated users with contributor-level access or higher to inject malicious scripts that execute when other users view the affected pages.
ELADMIN (eladmin-mp) versions up to 2.7 have an improper access control vulnerability in the role management module. The vulnerability exists in the PUT /api/roles/menu endpoint, which authorizes requests only by comparing role levels but does not validate the granted menu set or prevent users from modifying their own roles. A logged-in non-admin user with delegated 'roles:edit' permission can exploit this to modify their own role's menu permissions arbitrarily.
A potential out-of-bounds write vulnerability was reported in the Lenovo Energy Management driver that could allow a local authenticated user to cause a blue screen error.