CVE-2026-85954: Improper Privilege Management

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 can evaluate user-controlled values supplied to certain higher-order XQuery functions in an elevated security context, which could result in privilege escalation beyond the attacker's granted permissions...

CVE-2026-109572: Missing Authorization

Open WebUI from 0.8.6 before 0.11.4 contains a privilege escalation vulnerability in the terminal proxy that allows authenticated users to reach the Terminals administrator API with the shared key attached. Attackers can send requests through /api/v1/terminals/serverid/path to list or stop other...

PT-2026-110787

Name of the Vulnerable Software and Affected Versions ZITADEL versions 3.0.0 through 4.19.1 Description A privilege escalation issue exists in the OIDC token exchange process. This flaw allows users with IAM END USER IMPERSONATOR or ORG END USER IMPERSONATOR roles to bypass the admin.impersonatio...

PT-2026-110873

Name of the Vulnerable Software and Affected Versions IBM Db2 versions 11.5.0 through 11.5.9 IBM Db2 versions 12.1.0 through 12.1.5 Description Improper privilege management in IBM Db2 for Linux, UNIX, and Windows, including DB2 Connect Server, could allow a local attacker to gain elevated...

PT-2026-110943

Name of the Vulnerable Software and Affected Versions Rapyd Admin versions 9.0.0 through 9.19.9 Description Improper privilege management in the UsersEdit Livewire component allows users with the edit users permission to assign themselves the admin role. An attacker with a role such as the shippe...

PT-2026-111002

Frappe before 14.81.4 and 15.x before 15.41.0 contains an improper privilege management vulnerability involving a certain document action that permits escalation from the Website User role to System Manager. Authenticated attackers with Website User access can combine this document action with...

PT-2026-110489

Name of the Vulnerable Software and Affected Versions OTRS versions 7.0.X OTRS versions 8.0.X OTRS versions 2023.X OTRS versions 2024.X OTRS versions 2025.X OTRS versions prior to 2026.7.X Description Authentication tokens are not immediately invalidated when an agent or customer user account is...

CVE-2026-95837: Improper Privilege Management

containerd is an open-source container runtime. From 2.1.0 until 2.2.7 and 2.3.4, containerd's CRI CreateContainer checkpoint restore is vulnerable because CRIU restores process security state from checkpoint data instead of enforcing the destination ContainerConfig. An attacker who can create a...

CVE-2026-78404: Improper Privilege Management

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a local privilege escalation via the db2pd utility...

PT-2026-110883

Name of the Vulnerable Software and Affected Versions IBM Db2 versions 11.5.0 through 11.5.9 IBM Db2 versions 12.1.0 through 12.1.5 Description A local privilege escalation is possible through the use of the db2pd utility. Recommendations At the moment, there is no information about a newer versi...

CVE-2026-96012: Undefined Security Weakness

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation. An authenticated attacker could craft a malicious request that bypasses additional authorization and input validation checks to execute malicious code. An attacker could exploit this vulnerability to obtain elevated...

ALSA-2026:80498 Important: flatpak security update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fixes: flatpak: Flatpak: Arbitrary code execution via missing symlink protection CVE-2026-90616 flatpak: flatpak: Arbitrary write access as root via extra-data extraction CVE-2026-96275...

CVE-2026-21129: Improper Input Validation

Improper input validation in GuestCreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch an arbitrary activity with Samsung Checkout privileges...

PT-2026-110536

Name of the Vulnerable Software and Affected Versions yangzongzhuan RuoYi versions prior to 4.8.4 Description Improper privilege management occurs due to the manipulation of the roleKey argument within the checkRoleAllowed function located in the /system/role/authDataScope file. This issue allows...

PT-2026-110874

Name of the Vulnerable Software and Affected Versions IBM Db2 versions 11.5.0 through 11.5.9 IBM Db2 versions 12.1.0 through 12.1.5 Description An issue exists that allows for privilege escalation when the db2locssh feature is enabled within the database instance. Recommendations Disable the...

CVE-2026-21123: Improper Privilege Management

Improper privilege management in Locksettings prior to SMR Oct-2026 Release 1 allows local privileged attackers with root privilege to access data of the tied profile in before first unlock...

CVE-2026-108825: Improper Privilege Management

A vulnerability has been found in yangzongzhuan RuoYi up to 4.8.3. This affects the function checkRoleAllowed of the file /system/role/authDataScope. Such manipulation of the argument roleKey leads to improper privilege management. It is possible to launch the attack remotely. The exploit has bee...

CVE-2026-105465: Improper Privilege Management

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation when db2locssh is enabled with the db2 instance...

PT-2026-111092

Name of the Vulnerable Software and Affected Versions IBM Planning Analytics versions 2.0 through 2.1 Description Improper validation of sub-requests allows a remote attacker to bypass authentication and escalate privileges. Recommendations At the moment, there is no information about a newer...

PT-2026-110448

Name of the Vulnerable Software and Affected Versions WSM service versions prior to SMR Oct-2026 Release 1 Description A use after free issue exists in the WSM service. This flaw allows local attackers to potentially execute arbitrary code with system privileges. Use after free is a memory...