CVE-2026-96012: Undefined Security Weakness

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation. An authenticated attacker could craft a malicious request that bypasses additional authorization and input validation checks to execute malicious code. An attacker could exploit this vulnerability to obtain elevated...

CVE-2026-95837: Improper Privilege Management

containerd is an open-source container runtime. From 2.1.0 until 2.2.7 and 2.3.4, containerd's CRI CreateContainer checkpoint restore is vulnerable because CRIU restores process security state from checkpoint data instead of enforcing the destination ContainerConfig. An attacker who can create a...

CVE-2026-85954: Improper Privilege Management

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 can evaluate user-controlled values supplied to certain higher-order XQuery functions in an elevated security context, which could result in privilege escalation beyond the attacker's granted permissions...

CVE-2026-78404: Improper Privilege Management

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a local privilege escalation via the db2pd utility...

CVE-2026-109317: Improper Privilege Management

Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing positive scalar admin or api parent grants. Attackers with api.users.write can edit account access maps or invitations so the inheriting...

CVE-2026-109374: Incorrect Authorization

ZITADEL 3.0.0 before 4.19.2 contains a privilege escalation vulnerability in OIDC token exchange that allows end-user impersonators to impersonate administrators including IAMOWNER by bypassing the admin.impersonation check. Attackers holding IAMENDUSERIMPERSONATOR or ORGENDUSERIMPERSONATOR roles...

ROS-20261012-73-0020

The vulnerability in the kernel-lt is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to increase their privileges...

CVE-2026-109567: Improper Privilege Management

Rapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege management vulnerability in the UsersEdit Livewire component that allows users with the edit users permission to assign themselves the admin role. Attackers holding roles such as the shipped operator role can submit the admin rol...

CVE-2026-108825: Improper Privilege Management

A vulnerability has been found in yangzongzhuan RuoYi up to 4.8.3. This affects the function checkRoleAllowed of the file /system/role/authDataScope. Such manipulation of the argument roleKey leads to improper privilege management. It is possible to launch the attack remotely. The exploit has bee...

PT-2026-110529

Name of the Vulnerable Software and Affected Versions MikroTik RouterOS affected versions not specified Description An incorrect authorization issue exists in the WinBox authentication flow. A remote authenticated attacker with low-privilege credentials can obtain the authorization policy of...

CVE-2026-109631: Improper Neutralization of Special Elements used in an SQL Command

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation, allowing crafted input to alter database queries. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to...

TencentOS Server 4: linux-firmware (TSSA-2026:1080)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1080 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

EulerOS 2.0 SP11 : NetworkManager (EulerOS-SA-2026-4299)

According to the versions of the NetworkManager packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in NetworkManager. This local privilege escalation vulnerability exists in NetworkManager's dhclient backend when...

EulerOS 2.0 SP11 : docker-engine (EulerOS-SA-2026-4223)

According to the versions of the docker-engine package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins privileg...

EulerOS 2.0 SP11 : httpd (EulerOS-SA-2026-4236)

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration. This issue affects Apache HTTP Server:...

Rocky Linux 9.6 [TuxCare] Security Update: libvirt / libvirt-client / libvirt-client-qemu / libvirt-daemon / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1791806541)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791806541 advisory. - A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages...

TencentOS Server 3: microcode_ctl (TSSA-2026:1116)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1116 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

EulerOS 2.0 SP13 : cifs-utils (EulerOS-SA-2026-4034)

According to the versions of the cifs-utils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in the cifs-utils package where the cifs.upcall helper fails to securely drop its root privileges before looking up user...

EulerOS 2.0 SP13 : kbd (EulerOS-SA-2026-4147)

According to the versions of the kbd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : openvt -u is intended to identify the owner of the current VT and then execute login as that user from a privileged context. In the documented...

RHEL 10 : flatpak (RHSA-2026:80498)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:80498 advisory. Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fixes: flatpak: Flatpak:...