CVE-2026-8145 is a medium severity vulnerability in the WholesaleX – B2B & Wholesale Plugin for WooCommerce with Wholesale Prices for WordPress. It allows unauthenticated attackers to register as any existing WholesaleX role due to missing validation on the 'wholesalex_registration_role' parameter in the 'process_registration' function. This improper privilege management affects all versions up to and including 3.0.8. A partial patch was introduced in version 2.3.8, but versions up to 3.0.8 remain vulnerable.
The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role that was created as a copy of the administrator role, allowing unauthenticated attackers to register an administrator-equivalent account and take over the site.
KEDA versions 2.20.2 and earlier contain a critical improper privilege management vulnerability. A namespace administrator can exploit this by creating TriggerAuthentication and ScaledObject resources that cause KEDA to send the operator pod's ServiceAccount token to a malicious Vault endpoint. This allows the attacker to gain the operator's cluster-wide permissions, including broad secret access and workload control. The issue is fixed in version 2.21.0.
CVE-2026-73802 is a privilege management vulnerability in Gitea Runner versions before 3.0.0. It allows workflow authors to bypass container isolation by exploiting improper handling of Docker container options, enabling access to host namespaces and root command execution on the runner host.
The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications WordPress plugin up to version 3.10.0 contains a critical privilege escalation vulnerability. An unauthenticated attacker can exploit a missing capability check in an AJAX action and a flawed exclusion list in user meta saving to create a new Administrator-level account. The required nonce is publicly exposed on all front-end pages, making exploitation trivial. This vulnerability allows full control over the WordPress site without authentication.
The Membership & User Roles for WooCommerce (Automatic Role Changer) WordPress plugin contains a privilege escalation vulnerability in versions up to and including 20260828. This flaw allows authenticated users with subscriber-level access or higher to regain previously revoked Administrator roles by exploiting the plugin's role cache mechanism. Exploitation requires the Replace Roles mode to be enabled and that the attacker’s account had legitimately held the Administrator role before revocation. The vulnerability stems from the plugin unconditionally re-assigning cached roles without verifying their current validity from the external provider.
The Bit integrations plugin for WordPress (versions up to and including 2.10.6) contains a privilege escalation vulnerability. This flaw allows unauthenticated attackers to overwrite the administrator's password and take over the admin account. The issue arises because attacker-controlled data is stored without validation and later replayed in an administrator session, enabling password changes without proper authorization. Exploitation requires specific plugin configuration and an administrator to re-execute a logged failure.
CVE-2026-96044 is a high-severity vulnerability in Microsoft SharePoint Server Subscription Edition that allows an authorized attacker to elevate privileges over a network. The issue stems from improper validation of the specified type of input, classified under CWE-1287 and CWE-269. A fix for this vulnerability is available in version 16.0.20326.20190.
CVE-2024-58390 is an improper privilege management vulnerability in Frappe versions before 14.81.4 and 15.x before 15.41.0. It allows authenticated users with the Website User role to escalate their privileges to System Manager by exploiting a specific document action combined with additional steps. This flaw enables unauthorized administrative access within the Frappe application.
IBM Maximo Application Suite - Location Service for Esri Component versions 9.0, 9.1, and 9.2 contain an improper access control vulnerability due to a schema-less Custom Resource Definition. This flaw allows improper privilege management, potentially leading to unauthorized access. The vulnerability has a high severity with a CVSS score of 7.2.
CVE-2026-105464 is a high-severity vulnerability in IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 on Linux, UNIX, and Windows. It involves improper privilege management that could allow a local attacker to gain elevated privileges without user interaction. The vulnerability affects Db2 and Db2 Connect Server components.
IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 contain a high-severity privilege escalation vulnerability (CWE-269) when the db2locssh feature is enabled with the Db2 instance. This vulnerability allows an attacker with limited privileges to escalate their privileges, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.
CVE-2026-78404 is a local privilege escalation vulnerability in IBM Db2 affecting versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5. The issue arises from improper privilege management in the db2pd utility, allowing a local attacker with limited privileges to escalate to higher privileges. The vulnerability has a CVSS 3.1 score of 6.5, indicating a medium severity level. There are no known exploits in the wild and no vendor-provided patch information is currently available.
CVE-2026-85956 is a critical vulnerability in Progress Software Corporation's MarkLogic Server affecting versions 11.x before 11.3.7 and 12.x before 12.1.0. It allows a remote attacker with delegated database-administrator privileges to perform backup or restore operations on forests outside their authorized database scope. This improper privilege management could lead to unauthorized access or modification of security-critical data.
CVE-2026-85955 is a critical vulnerability in Progress Software Corporation's MarkLogic Server affecting versions 11.x before 11.3.7 and 12.x before 12.1.0. It allows a remote attacker with query-execution access to invoke an XQuery evaluation function without requiring the additional evaluation privilege. This improper privilege management could lead to server-side code execution with elevated permissions, posing a severe risk to confidentiality, integrity, and availability.
CVE-2026-85954 is a high-severity vulnerability in Progress Software Corporation's MarkLogic Server. Versions 11.0.0 up to but not including 11.3.7 and 12.0.0 up to but not including 12.1.0 allow user-controlled values to be evaluated in an elevated security context via certain higher-order XQuery functions. This improper privilege management can lead to privilege escalation beyond the attacker's granted permissions.
CVE-2026-85953 is a high-severity vulnerability in Progress Software Corporation's MarkLogic Server affecting versions 11.0.0 up to but not including 11.3.7, and 12.0.0 up to but not including 12.1.0. It involves improper limitation of a pathname to a restricted directory in privileged legacy InfoStudio modules, which insufficiently validate user-controlled file paths and user-context values. This flaw could allow unauthorized access to server files or execution under an unintended identity.
Progress MarkLogic Server versions 11.0.0 up to but not including 11.3.7, and 12.0.0 up to but not including 12.1.0, contain an authorization flaw. This flaw allows a remote attacker with administrative privileges to access authentication materials of users with higher privileges. Exploitation could lead to unauthorized administrative access. The vulnerability is identified as CWE-269 (Improper Privilege Management) and has a high severity with a CVSS score of 8.4.
Progress MarkLogic Server versions 11.0.0 up to but not including 11.3.7, and 12.0.0 up to but not including 12.1.0, contain an XQuery injection vulnerability in a deprecated Management API package path. This flaw allows a remote attacker with manage-user-level privileges to gain persistent unauthorized administrative control. The vulnerability is classified as improper privilege management (CWE-269) and has a critical severity with a CVSS score of 9.9.