CWE-648 vulnerabilities

An Incorrect Use of Privileged APIs vulnerability in Unity Parsec on Windows hosts leads to a potential Elevation of Privilege. This issue affects Parsec through v2026-05-04.0. The patched version is Parsec for Windows version 150-104a. A user can generate a situation where there is an instance of parsecd.exe running as NT AUTHORITY\SYSTEM with a user-controlled value of the AppData environment variable.

An unauthorized user can modify configuration through API calls that affects the OpenText Access Manager. This issue affects Access Manager before 5.1.3.

CVE-2026-9560 is a critical privilege escalation vulnerability in OpenVPN Connect versions 3.5.1 through 3.8.1 on macOS. It allows an attacker with local access to execute arbitrary commands with elevated privileges via a local inter-process communication (IPC) channel in the background service. The vulnerability is related to improper handling of IPC leading to command injection. No official patch or remediation guidance has been provided yet, and no known exploits are reported in the wild.

CVE-2026-41225 is a high-severity vulnerability in F5 BIG-IP's iControl REST interface. It allows a highly privileged, authenticated attacker with at least Manager role permissions to create configuration objects that enable execution of arbitrary commands. This vulnerability affects specific versions of BIG-IP including 21.0.0, 17.5.0, 17.1.0, and 16.1.

Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access to view task logs without having task log access. Users are recommended to upgrade to Apache Airflow 3.1.7 or later, which resolves this issue.

Incorrect Use of Privileged APIs vulnerability in NomySoft Information Technology Training and Consulting Inc. Nomysem allows Privilege Escalation. This issue affects Nomysem: through May 2025.

A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to a local privilege escalation due to an exposed debug interface on the localhost. This allows any local user to gain code execution as administrative application user.

An authenticated, read-only user can upload a file and perform a directory traversal to have the uploaded file placed in a location of their choosing. This can be used to overwrite existing PERL modules within the application to achieve remote code execution (RCE) by an attacker.

An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to download logs from the appliance configuration, exposing sensitive information.

An authenticated, read-only user can kill any processes running on the Xormon Original virtual appliance as the lpar2rrd user.

An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to import the appliance configuration, allowing an attacker to control the configuration of the appliance, to include granting themselves administrative level permissions.

An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to export the appliance configuration, exposing sensitive information.

Incorrect Use of Privileged APIs vulnerability in Beamsec PhishPro allows Privilege Abuse. This issue affects PhishPro: before 7.5.4.2.

The EAI developed by Digiwin has a Privilege Escalation vulnerability, allowing remote attackers with regular privileges to elevate their privileges to administrator level via a specific API.

Dell PowerProtect Data Manager version 19.15.0 contains a vulnerability involving incorrect use of privileged APIs. This flaw allows a low privileged local attacker to potentially elevate their privileges. The vulnerability is classified as high severity with a CVSS score of 7.8, indicating significant impact on confidentiality, integrity, and availability.

Incorrect Use of Privileged APIs, Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials vulnerability in Sechard Information Technologies SecHard allows Authentication Bypass, Interface Manipulation, Authentication Abuse, Harvesting Information via API Event Monitoring. This issue affects SecHard: before 3.3.0.20220411.