CWE-250 vulnerabilities

Execution with unnecessary privileges vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-usb-formatter allows Privilege Abuse. This issue affects pardus-usb-formatter: from 0.7.0 before 0.7.2.

SUSE Rancher Fleet clusters reference a kubeconfig secret that the controller uses to install and manage a Fleet agent on the target cluster. The controller did not sufficiently restrict which kubeconfig secrets a Fleet Cluster object was allowed to reference. As a result, a Fleet cluster defined in a namespace an ordinary user controls could be associated with administrative credentials for the management cluster itself, causing the controller to manage the management cluster on that user's behalf and to run that user's Fleet content there with elevated privileges. This affects SUSE Rancher Fleet 0.16.0 up to 0.16.3, 0.15.0 up to 0.15.8, 0.14.0 up to 0.14.12, 0.13.0 up to 0.13.17 and possible older versions.

NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly. Prior to version 0.25-beta.1, the `Nova` interpreter runs in Ring 0 with unrestricted kernel-memory access. Loading a malicious `.nv` script through the shell permits a local user to execute code with kernel privileges without security checks. The advisory identifies VM initialization in `zig/nova/vm.zig` as the affected component; script execution is not isolated in a restricted Ring 3 privilege domain. This issue is fixed in version 0.25-beta.1.

CVE-2025-30046 is a critical vulnerability in the CGM CLININET application server where HL7 communication processes run with root privileges while handling untrusted data. An attacker on an adjacent network can send malicious data to these processes and achieve remote code execution with root privileges. The vulnerability affects versions up to 2026.MS3 and possibly later versions. The product is a cloud service, and a patch is available.

CVE-2026-87709 is an improper access control vulnerability in the Windows Host Guardian Service on Microsoft Windows 10 Version 1809 and related builds. It allows an authorized local attacker to perform tampering actions with unnecessary privileges. The vulnerability has a medium severity score of 5.5 and has been officially fixed in multiple Windows 10 versions.

NVIDIA AIStore for Linux contains a vulnerability in the legacy ETL Kubernetes PodSpec initialization API where a remote attacker may supply Kubernetes host-namespace and container-security settings. A successful exploit may lead to code execution, privilege escalation, information disclosure, data tampering, and denial of service.

IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to obtain sensitive information due to excessive permissions assigned to a service account.

iControl is affected by a Broken Access Control vulnerability, which could allow an attacker to exploit missing authentication checks or insecure direct object references (IDOR), enabling privilege escalation and the unauthorized modification or deletion of sensitive application data.

CVE-2026-102118 is a local privilege escalation vulnerability in Kiteworks Core that allows an attacker with a low-privileged shell to escalate to root privileges on the appliance. The flaw involves improper link resolution before file access, categorized under CWE-59. It affects Kiteworks Core versions from 0 up to but not including 9.5.0. The vulnerability has a high severity with a CVSS score of 7.8.

Reachy Mini Wireless OS images prior to version 0.2.4 contain a local privilege escalation vulnerability due to an overly broad sudoers entry. The pollen daemon user (uid 1000) has passwordless sudo access to /usr/bin/systemctl without restrictions, allowing any process running as pollen to gain full root privileges. This issue has been patched in version 0.2.4.

CVE-2026-88808 is a high-severity vulnerability in SUSE Rancher Fleet where the Fleet agent improperly uses cluster-admin credentials instead of the intended ServiceAccount credentials when writing resources to downstream clusters. This affects multi-tenant environments sharing downstream clusters, potentially allowing unauthorized overwriting of configuration files. The issue impacts SUSE Rancher Fleet versions 0.14 before 0.14.11, 0.15 before 0.15.7, and 0.16 before 0.16.2.

Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to achieve privilege escalation within the container due to improper privilege management.

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Privilege Escalation vulnerability that allowed an authenticated low-privilege user to gain Administrator privileges through Report Profile import.

CVE-2026-77521 is a critical OS command injection vulnerability in MaxKB, an open-source AI assistant for enterprise. Versions prior to 2.10.5-lts allow untrusted input to execute shell commands without human approval due to improper sandboxing and command execution controls. This can lead to full system compromise by executing arbitrary commands as the application user. The issue is fixed in version 2.10.5-lts.

Browsertrix is a high-fidelity, browser-based crawling service for web archiving that can be self-hosted or used through Webrecorder's hosted instance. From 1.15.0 until 1.22.8, Browsertrix improperly sanitizes Git URLs specified as Custom Behaviors, allowing command injection through /api/orgs/*/crawlconfigs/validate/custom-behavior. A user with crawler or administrator permission on the specific instance can supply a crafted Git URL that executes arbitrary operating-system commands in the backend pod. Open registration or hosted free-trial access can make the required role broadly obtainable. Successful exploitation can expose, modify, or delete application database records, archived items, browser profiles, storage data, proxy credentials, and other configured service data. This issue is fixed in version 1.22.8.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Execution with Unnecessary Privileges vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to unauthorized access.

CVE-2026-69464 is a high-severity vulnerability in Microsoft SharePoint Server Subscription Edition that allows an authorized attacker to execute actions with unnecessary privileges, potentially elevating their privileges over a network. The issue affects versions from 16.0.0 up to but not including 16.0.20326.20090. Microsoft has released an official fix in version 16.0.20326.20090 to address this vulnerability.

CVE-2026-69409 is a vulnerability in Microsoft SharePoint Server Subscription Edition that allows an authorized attacker to disclose information over a network by executing actions with unnecessary privileges. The flaw affects versions 16.0.0 and versions from 16.0.0 up to but not including 16.0.20326.20090. A patch is available in version 16.0.20326.20090. The vulnerability has a CVSS 3.1 base score of 6.5, indicating medium severity.

Dell Secure Connect Gateway (SCG) 5.0 versions prior to 5.36.00.16 (Appliance) and 5.36.00.00 (Application) contain a critical vulnerability allowing execution with unnecessary privileges. An unauthenticated local attacker with SSH access can exploit the exposed Docker socket to gain root-level access without a password. Additionally, compromising a service inside the orchestrator container enables container escape and host-level control. Dell recommends upgrading to fixed versions to mitigate this risk.