BIT-ELK-2026-72668 Unintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Privilege Escalation

Unintended Proxy or Intermediary 'Confused Deputy' CWE-441 in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged operations to be carried out under the identity of a higher-privileged user who subsequently interacts...

BIT-AUTHENTIK-2026-94609 authentik: Privilege Escalation to Superuser via Group Hierarchy

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an account with delegated permission to manage a group, group membership, or a user can grant superuser status to an account or assign an existing role to a group without holding the permissions that gate...

gvfs: gvfs-admin socket ownership race permits local root

A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check...

CVE-2026-47516

A flaw was found in the NVIDIA GPU Display Driver. An unprivileged local user can trigger a use-after-free condition, which occurs when the driver accesses memory that has already been released. Successful exploitation could allow the attacker to execute arbitrary code, escalate privileges, tampe...

CVE-2026-95687

The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0 This is due to the plugin not properly validating the target user's role prior to issuing a new authentication session, allowing a...

CVE-2026-103494

In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes...

CVE-2026-103494

In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes...

CVE-2026-103494

JetBrains YouTrack versions prior to 2026.2.19422 are vulnerable to a privilege escalation flaw. This vulnerability is triggered through user group membership changes . No specific exploit details or in-the-wild exploitation information are provided in the documents. Remediation is available in v...

EUVD-2026-90585

In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes...

CVE-2026-103490

In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links...

CVE-2026-103490

In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links...

EUVD-2026-90581

In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links...

CVE-2026-103490

JetBrains YouTrack versions prior to 2026.2.19422 are susceptible to a privilege escalation vulnerability. The flaw is triggered through the use of user group links . This vulnerability has a HIGH base severity score of 7.2, with impacts on confidentiality, integrity, and availability.

CVE-2026-95687

The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to and including 2.0.0 . The root cause is the plugin's failure to properly validate a target user's role before issuing a new authentication session. An a...

EUVD-2026-90568

The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0 This is due to the plugin not properly validating the target user's role prior to issuing a new authentication session, allowing a...

CVE-2026-95687 WPC Shop as a Customer for WooCommerce <= 2.0.0 - Authenticated (Subscriber+) Privilege Escalation via Missing Role Check on Target User to wpcsa_login AJAX Endpoint

The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0 This is due to the plugin not properly validating the target user's role prior to issuing a new authentication session, allowing a...

CVE-2026-95687 WPC Shop as a Customer for WooCommerce <= 2.0.0 - Authenticated (Subscriber+) Privilege Escalation via Missing Role Check on Target User to wpcsa_login AJAX Endpoint

The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0 This is due to the plugin not properly validating the target user's role prior to issuing a new authentication session, allowing a...

CVE-2026-15989

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's beforeemailsuccessmsg function whitelisting the client-submitted 'role' key and copying it into the...

CVE-2026-19807

The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.3 This is due to the wpupdateusermeta MCP tool in executetool gating writes solely with currentusercan'edituser', $uid — a check that WordPress core'...

CVE-2026-19807 ByteCoreStack <= 1.2.3 - Authenticated (Subscriber+) Privilege Escalation via wp_update_user_meta MCP Tool

The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.3 This is due to the wpupdateusermeta MCP tool in executetool gating writes solely with currentusercan'edituser', $uid — a check that WordPress core'...