CVE-2026-9055

CVE-2026-9055 — Amelia Booking Plugin Unauthenticated Privilege Escalation Research writeup by Sentinel AI Defense. Defensive analysis only — no working exploit or PoC is published here for this vulnerability. An unauthenticated privilege escalation vulnerability in the Amelia Premium WordPress...

CVE-2026-5118

CVE-2026-5118 — Divi Form Builder ≤ 5.1.2 Unauthenticated Privilege Escalation via Role Injection === Beelze zeroday 1diot9 === 📋 Vulnerability Info Field| Details ---|--- CVE ID| CVE-2026-5118 CVSS Score| 9.8 Critical CVSS Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE| CWE-269 —...

CVE-2026-97361

There exists an improper privilege management vulnerability that could cause privilege escalation at the SpaceCom and Space Battery pack SP with WiFi...

CVE-2026-62183

CVE-2026-62183 — Apache Syncope user self-service privilege escalation Improper Privilege Management CWE-269 in Apache Syncope. An authenticated, low-privilege user can grant themselves arbitrary roles and group memberships, external resources, and a new realm through the user self-service API —...

CVE-2026-13610

CVE-2026-13610 KiviCare – Clinic & Patient Management System CWE-269 Improper Privilege Management | Unauthenticated registration with attacker-chosen staff role → patient PHI disclosure Overview Critical vulnerability in the KiviCare – Clinic & Patient Management System WordPress plugin versions...

Multiple vulnerabilities have been addressed in Citrix Secure Access Client, NetScaler ADC, NetScaler Gateway, and NetScaler Console.

Citrix has addressed multiple vulnerabilities in Citrix Secure Access Client, NetScaler ADC, NetScaler Gateway, and NetScaler Console. These vulnerabilities have been assigned CVSS v4.0 scores ranging from 6.9 to 9.5. They include memory corruption, improper authentication, and improper privilege...

SCKit Malware Turns ScreenConnect Support Sessions Into Potential MSP Attack Paths

The ongoing campaign targeting ConnectWise ScreenConnect deployments involves the exploitation of a now-patched critical security flaw in the remote access software, and not a new vulnerability, it has emerged. Blackpoint Cyber's Adversary Pursuit Group APG, which shared the details with The Hack...

CVE-2026-126249: Fortinet FortiAuthenticator: A improper privilege management vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator…

A improper privilege management vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated attacker to escalate privileges...

Fortinet FortiAnalyzer Improper privilege management (FG-IR-26-231)

The version of FortiAnalyzer installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-26-231 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version...

Fortinet FortiManager Improper privilege management (FG-IR-26-231)

The version of FortiManager installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-26-231 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version...

PT-2026-144886

Name of the Vulnerable Software and Affected Versions FortiAnalyzer versions 8.0.0 through 8.0.1 FortiAnalyzer versions 7.6.0 through 7.6.7 FortiAnalyzer versions 7.4.0 through 7.4.11 FortiAnalyzer versions 7.2.0 through 7.2.12 FortiAnalyzer Cloud versions 8.0.0 through 8.0.1 FortiAnalyzer Cloud...

PT-2026-144888

Name of the Vulnerable Software and Affected Versions FortiAnalyzer versions 8.0.0 through 8.0.1 FortiAnalyzer versions 7.6.0 through 7.6.7 FortiAnalyzer versions 7.4.0 through 7.4.11 FortiAnalyzer versions 7.2.0 through 7.2.12 FortiAnalyzer Cloud versions 8.0.0 through 8.0.1 FortiAnalyzer Cloud...

PT-2026-144885

Name of the Vulnerable Software and Affected Versions FortiAnalyzer versions 8.0.0 through 8.0.1 FortiAnalyzer versions 7.6.0 through 7.6.7 FortiAnalyzer versions 7.4.0 through 7.4.11 FortiAnalyzer versions 7.2.0 through 7.2.12 FortiAnalyzer Cloud versions 8.0.0 through 8.0.1 FortiAnalyzer Cloud...

PT-2026-144883

Name of the Vulnerable Software and Affected Versions FortiAnalyzer versions 8.0.0 through 8.0.1 FortiAnalyzer versions 7.6.1 through 7.6.7 FortiAnalyzer Cloud versions 8.0.0 through 8.0.1 FortiAnalyzer Cloud versions 7.6.1 through 7.6.8 FortiManager versions 8.0.0 through 8.0.1 FortiManager...

PT-2026-144887

A improper privilege management vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through...

PT-2026-144899

Name of the Vulnerable Software and Affected Versions FortiAnalyzer versions 8.0.0 through 8.0.1 FortiAnalyzer versions 7.6.0 through 7.6.7 FortiAnalyzer versions 7.4.0 through 7.4.11 FortiAnalyzer versions 7.2.0 through 7.2.12 FortiAnalyzer Cloud version 8.0.1 FortiAnalyzer Cloud versions 7.6.0...

PT-2026-144870

Name of the Vulnerable Software and Affected Versions FortiMail versions 8.0.0 through 8.0.1 FortiMail versions 7.6.0 through 7.6.6 FortiMail versions 7.4.0 through 7.4.8 FortiMail version 7.2 Description An incorrect authorization issue exists that allows an unauthenticated remote attacker to...

EUVD-2026-119758

A weakness has been identified in Tidelift moto up to 5.2.4. Affected is an unknown function of the file moto/batch/models.py of the component AWS Batch Emulation. This manipulation of the argument privileged/volumes causes improper privilege management. Remote exploitation of the attack is...

CVE-2026-124501

A weakness has been identified in Tidelift moto up to 5.2.4. Affected is an unknown function of the file moto/batch/models.py of the component AWS Batch Emulation. This manipulation of the argument privileged/volumes causes improper privilege management. Remote exploitation of the attack is...

CVE-2026-124501: Tidelift moto: A weakness has been identified in Tidelift moto up to 5.2.4

A weakness has been identified in Tidelift moto up to 5.2.4. Affected is an unknown function of the file moto/batch/models.py of the component AWS Batch Emulation. This manipulation of the argument privileged/volumes causes improper privilege management. Remote exploitation of the attack is...