Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, contain an Improper Check for Dropped Privileges vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to elevation of privileges.
CVE-2026-110746 is a local privilege escalation vulnerability in TotalAV by TotalSecurity. It involves improper limitation of a pathname to a restricted directory (path traversal), allowing an unprivileged local user to forge the gRPC IPC authentication token by loading IPC.dll. This abuse of the SYSTEM service within TotalAV enables execution of arbitrary code with NT AUTHORITY\SYSTEM privileges. The vulnerability affects versions from 0 up to and including 7.1.17. It has a high severity with a CVSS score of 7.8.
CVE-2026-101304 is a vulnerability in FreeBSD where mounting fdescfs(4) in a jail with the "nodup" option causes file descriptors opened via /dev/fd/N to not inherit certain security restrictions. This allows a process in a jail to potentially escape the jail's filesystem root restriction by using a directory file descriptor received from another jail.
A vulnerability in Hugging Face Transformers (versions 4.57.0 to 5.16.1) allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.load_custom_generate(). The function fetches and caches a remote module file before performing the required trust_remote_code consent check, inverting the security model enforced by other code-loading paths (such as AutoConfig, AutoModel, and AutoTokenizer). As a result, attacker‑controlled Python code from custom_generate/generate.py is copied into the user’s ~/.cache/huggingface/modules directory even if the user declines the trust prompt. Although execution is correctly gated, the file write is not reversible and can persist across sessions. This can lead to persistent, unauthorized files on disk and stale cache collisions where cached attacker code may later be executed during trusted model loads. The issue stems from an unconditional file write in dynamic_module_utils.py prior to any trust verification.
CVE-2026-61897 is a local privilege escalation vulnerability in Ubuntu's accountsservice prior to version 23.13.9-8ubuntu7. The flaw arises because an Ubuntu-specific patch only partially drops privileges before launching language helper scripts, leaving the real user ID as root. This allows a shell spawned by the helper script to inherit root privileges and potentially regain full root access. The vulnerability has a high severity with a CVSS score of 7.8.
CVE-2026-58086 is a vulnerability in FreeBSD where the PRIV_KTRACE privilege is always denied to a jailed root user due to an unintended side effect of a code change. This causes tracing configured by a jailed root user to not be recognized as privileged. Consequently, an unprivileged user within the same jail who has permission to debug a target process can alter or disable the jailed root user's tracing flags, preventing reliable tracing of unprivileged processes by the jailed root user.
sh provides Python process launching. Prior to 2.2.4, the _uid option in sh.py performs an incomplete privilege drop on Linux and Unix-like systems. When sh runs from an elevated process and launches a command with _uid set to an unprivileged user, the child changes its UID but can retain the parent process's supplementary groups because the privilege-drop sequence does not fully establish the target user's UID, primary GID, and supplementary groups. The child can therefore retain access to files or resources granted to privileged groups such as root, docker, disk, shadow, or sudo, violating the expected _uid privilege boundary. This issue is fixed in version 2.2.4.
PraisonAI before 4.6.78 contains an unenforced security policy vulnerability in the default Subprocess Sandbox backend where blocked_commands, blocked_paths, blocked_imports, allow_subprocess, and allow_file_write restrictions are completely ignored. Attackers can execute arbitrary subprocess commands, read sensitive files, and perform destructive operations despite explicit security policy configuration.
xrdp is an open source RDP server. In versions through 0.10.5, the session execution component did not properly handle an error during the privilege drop process. This improper privilege management could allow an authenticated local attacker to escalate privileges to root and execute arbitrary code on the system. An additional exploit would be needed to facilitate this. This issue has been fixed in version 0.10.6.
theshit is a command-line utility that automatically detects and fixes common mistakes in shell commands. Prior to version 0.2.0, improper privilege dropping allows local privilege escalation via command re-execution. This issue has been patched in version 0.2.0.
The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet.