CVE-2026-78404

IBM Db2 is vulnerable to local privilege escalation via the db2pd utility due to Improper Privilege Management (CWE-269). This issue affects the Server edition on Linux and Unix platforms for versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 . Windows platforms are not affected. Impact inc...

CVE-2026-109374

ZITADEL 3.0.0 before 4.19.2 contains a privilege escalation vulnerability in OIDC token exchange that allows end-user impersonators to impersonate administrators including IAMOWNER by bypassing the admin.impersonation check. Attackers holding IAMENDUSERIMPERSONATOR or ORGENDUSERIMPERSONATOR roles...

CVE-2026-109358

Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect permissions vulnerability where the node installer writes the containerd config world-writable 0666. Local unprivileged users on the node can modify the containerd config, for example overwriting the runc location, to escalate...

CVE-2026-109321

Grav Login OAuth plugin grav-plugin-login-oauth before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic . username and an unsalted MD5 hash of the provider identifier as the password, without disabling password login. Unauthenticated remote attackers who learn or guess ...

CVE-2026-109317

Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing positive scalar admin or api parent grants. Attackers with api.users.write can edit account access maps or invitations so the inheriting...

busybox: busybox: tar extraction-root escape via deferred symlink/hardlink creation bypasses CVE-2026-26158 fix

A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and hardlink entries with unsafe-looking targets does not validate that the resolved destination remains inside the extraction directory once the deferred link is created. An attacker can craft a tar archive...

Important: Red Hat Security Advisory: thunderbird security update

An update for thunderbird is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...

firefox: Privilege escalation due to use-after-free in the Graphics: WebRender component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation due to use-after-free in the Graphics: WebRender component...

firefox: thunderbird: Privilege escalation in the DLL Services component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the DLL Services component...

firefox: thunderbird: Privilege escalation in the DOM: Service Workers component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the DOM: Service Workers component...

firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation due to incorrect boundary conditions in the Graphics component...

firefox: thunderbird: Privilege escalation in the Address Bar component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the Address Bar component...

flatpak: Flatpak: Local privilege escalation via symlink traversal in revokefs writer

A flaw was found in Flatpak. A malicious local user in an active local session could exploit a symlink traversal vulnerability in the revokefs writer. This flaw allows an attacker to modify files belonging to a different revokefs session after they have been validated. Consequently, an attacker...

Important: Red Hat Security Advisory: flatpak security update

An update for flatpak is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

CVE-2024-28000

LiteSpeed Cache Privilege Escalation PoC - CVE-2024-28000 🎤 README Translation English فارسی 📸 Screenshot 💎 Introduction This repository contains a Proof of Concept PoC for a critical privilege escalation vulnerability discovered in the LiteSpeed Cache WordPress plugin. The vulnerability,...

CVE-2026-85954

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 can evaluate user-controlled values supplied to certain higher-order XQuery functions in an elevated security context, which could result in privilege escalation beyond the attacker's granted permissions...

EUVD-2026-97672

ZITADEL 3.0.0 before 4.19.2 contains a privilege escalation vulnerability in OIDC token exchange that allows end-user impersonators to impersonate administrators including IAMOWNER by bypassing the admin.impersonation check. Attackers holding IAMENDUSERIMPERSONATOR or ORGENDUSERIMPERSONATOR roles...

CVE-2026-109374 ZITADEL 3.0.0 before 4.19.2 Privilege Escalation via OIDC Token Exchange Impersonation

ZITADEL 3.0.0 before 4.19.2 contains a privilege escalation vulnerability in OIDC token exchange that allows end-user impersonators to impersonate administrators including IAMOWNER by bypassing the admin.impersonation check. Attackers holding IAMENDUSERIMPERSONATOR or ORGENDUSERIMPERSONATOR roles...

CVE-2026-109374

ZITADEL versions 3.0.0 before 4.19.2 are vulnerable to a privilege escalation flaw within the OIDC token exchange process. The root cause is a failure to properly validate the admin.impersonation check, allowing users with IAM_END_USER_IMPERSONATOR or ORG_END_USER_IMPERSONATOR roles to bypass res...

CVE-2026-109374 ZITADEL 3.0.0 before 4.19.2 Privilege Escalation via OIDC Token Exchange Impersonation

ZITADEL 3.0.0 before 4.19.2 contains a privilege escalation vulnerability in OIDC token exchange that allows end-user impersonators to impersonate administrators including IAMOWNER by bypassing the admin.impersonation check. Attackers holding IAMENDUSERIMPERSONATOR or ORGENDUSERIMPERSONATOR roles...