CVE-2026-106608 WordPress WooCommerce plugin 9.8.0-11.1.2 - Shop Manager+ Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in Automattic WooCommerce woocommerce allows Privilege Escalation.This issue affects WooCommerce: from 9.8.0 through 11.1.2...

EUVD-2026-96377

Incorrect Privilege Assignment vulnerability in Automattic WooCommerce woocommerce allows Privilege Escalation.This issue affects WooCommerce: from 9.8.0 through 11.1.2...

Exploit for Improper Privilege Management in Microsoft

CVE-2026-69414 — Microsoft Malware Protection Engine EoP Explo...

oppo-ghostlock

oppofindN2-ghostlock GhostLock CVE-2026-43499 — OPPO Find N2 Linux-Kernel-Privilegieneskalation-Forschung Projektübersicht GhostLock CVE-2026-43499 ist eine Kernel-Stack-UAF-Schwachstelle, die Linux 2.6.39 bis 7.1-rc1 betrifft und durch eine Race Condition in FUTEXCMPREQUEUEPI ausgelöst wird...

CVE-2026-98376

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. When replacing an inner per-CPU array map within a map-in-map structure, the kernel fails to verify that the replacement map matches the size of the original template map. A local attacker can exploit this flaw by...

lxd_root

Privilege Escalation di Linux tramite LXD Panoramica I membri del gruppo locale lxd sui sistemi Linux hanno numerose strade per elevare i propri privilegi a root. Questo repository contiene esempi di exploit locali completamente automatizzati. Una spiegazione dettagliata della vulnerabilità e...

traitor

Traitor Sfrutta automaticamente i frutti a portata di mano per ottenere una shell di root. Elevazione dei privilegi Linux resa semplice! Traitor racchiude una serie di metodi per sfruttare configurazioni errate e vulnerabilità locali al fine di ottenere una shell di root: Quasi tutti i GTFOBins...

CVE-2026-98341

A flaw was found in the Linux kernel's cfg80211 wireless subsystem. When a wireless network interface is shut down while an active scan is running, the kernel prematurely frees memory associated with the scan request while the driver is still accessing it. A local user could exploit this race...

vulns

Segnalazioni di vulnerabilità Avvisi di HN Security. https://hnsecurity.it/ Solaris HNS-2022-01-dtprintinfo. Diverse vulnerabilità in Solaris dtprintinfo e libXm/libXpm CVE-2022-46285, CVE-2023-24039, CVE-2023-24040. Zyxel HNS-2022-02-zyxel-zysh. Diverse vulnerabilità in Zyxel zysh CVE-2022-26531...

CVE-2026-92975

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.3 via the createsupportuser function. This is due to the function identifying the support account solely by matching against publicly...

CVE-2026-77183

The FooSales – Point of Sale POS for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.43.0. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes...

CVE-2026-104766

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.7.3. This is due to the OsSettingsController::update handler iterating over attacker-supplied settings parameters...

CVE-2026-104725

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9 This is due to a missing ownership and capability check on the user parameter within the processedit function, which allows any...

CVE-2026-94257

The SMS Alert WordPress plugin (versions 3.9.6 - 4.0.0 ) is vulnerable to unauthenticated privilege escalation due to a missing bond between the account being modified and the verified phone number during the OTP password reset process. This flaw allows an unauthenticated attacker to set a new pa...

CVE-2026-94257 SMS Alert 3.9.6 - 4.0.0 - Unauthenticated Privilege Escalation via Arbitrary Password Reset

The SMS Alert WordPress plugin before 4.0.1 does not bind the account whose password is being changed to the phone number that was actually verified during its OTP password reset, allowing unauthenticated attackers to set a new password on an arbitrary account, including an administrator, by...

impersonate

Impersonate Beschreibung Dieses Repository enthält die Werkzeuge, die beim Schreiben des folgenden Blogbeitrags https://sensepost.com/blog/2022/abusing-windows-tokens-to-compromise-active-directory-without-touching-lsass/ entwickelt wurden. Der Blogbeitrag enthält alle notwendigen Informationen, ...

CVE-2026-92975 Groundhogg <= 4.8.3 - Unauthenticated Privilege Escalation to Support User Identity Confusion

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.3 via the createsupportuser function. This is due to the function identifying the support account solely by matching against publicly...

CVE-2026-92975

The Groundhogg CRM, Newsletters, and Marketing Automation plugin for WordPress (versions ≤ 4.8.3 ) contains a Privilege Escalation vulnerability in the create_support_user() function. The flaw exists because the function identifies support accounts using publicly hardcoded constants—specifically ...

EUVD-2026-96105

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.3 via the createsupportuser function. This is due to the function identifying the support account solely by matching against publicly...

CVE-2026-92975 Groundhogg <= 4.8.3 - Unauthenticated Privilege Escalation to Support User Identity Confusion

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.3 via the createsupportuser function. This is due to the function identifying the support account solely by matching against publicly...