WordPress MemberGlut < 1.1.5 - Unauthenticated Privilege Escalation

MemberGlut WordPress plugin 1.1.5 contains a broken access control vulnerability caused by lack of validation of roles during front-end registration, letting unauthenticated users register with arbitrary roles including administrator, exploit requires no authentication. id: CVE-2026-12394 info:...

CVE-2022-0441

在 WordPress 上的 MasterStudy LMS 插件 2.7.5 及之前版本中发现了一个被归类为严重的漏洞（WordPress 插件）。该漏洞影响组件 New Account Handler 的未知部分。通过对未知输入的操作，导致了权限管理漏洞。该漏洞的 CWE 定义为 CWE-269。软件未能正确地为参与者分配、修改、跟踪或检查权限，从而为该参与者创建了非预期的控制范围。已知其影响涉及机密性、完整性和可用性。 该弱点于 2022 年 3 月 7 日以编号 2667195 披露。公告可在 wpscan.com 获取。自 2022 年 2 月 1 日起，该漏洞被命名为...

CVE-2022-37706

CVE-2022-37706 概述 CVE-2022-37706 是一个本地权限提升 LPE 漏洞，存在于 Linux 的 Enlightenment 桌面环境的 enlightenmentsys 组件中。该漏洞允许具有低权限的本地用户在易受攻击的系统上将权限提升为 root。 CVE ID: CVE-2022-37706 严重性: High CVSS v3.1: 7.8 攻击向量: Local 受影响组件: enlightenmentsys CWE: CWE-269 Improper Privilege Management 描述 该漏洞的产生原因是二进制文件...

CVE-2022-0441

在 WordPress 上的 MasterStudy LMS Plugin（WordPress 插件）2.7.5 及之前版本中发现了一个被归类为严重的漏洞。该漏洞影响 New Account Handler 组件的某个未知部分。对未知输入进行操纵会导致权限管理漏洞。该漏洞的 CWE 定义为 CWE-269。该软件未能正确地为参与者分配、修改、跟踪或检查权限，从而为该参与者创建了非预期的控制范围。已知其影响会危害机密性、完整性和可用性。 该弱点于 03/07/2022 以编号 2667195 披露。公告可在 wpscan.com 获取。该漏洞自 02/01/2022 起被命名为...

CVE-2026-20287

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release...

CVE-2026-20287 Cisco Identity Services Engine Hardening Release - Improper Privlege Management Vulnerabilities

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release...

Exploit for CVE-2026-18366

CVE-2026-18366 — Events Manager 7.4.1: Unauthenticated Pr...

GO-2026-6197 vulnerabilities

Vulnerabilities for packages: telegraf...

BIT-KIBANA-2026-72631 Improper Privilege Management in Kibana Fleet Leading to Over-Scoped Elastic Agent API Keys

Improper Privilege Management CWE-269 in Kibana Fleet can lead to privilege escalation via Privilege Escalation CAPEC-233. An integration policy may optionally declare extra data streams that the integration writes to, which Fleet adds to the Elasticsearch API key issued to Elastic Agents enrolle...

BIT-ELK-2026-72631 Improper Privilege Management in Kibana Fleet Leading to Over-Scoped Elastic Agent API Keys

Improper Privilege Management CWE-269 in Kibana Fleet can lead to privilege escalation via Privilege Escalation CAPEC-233. An integration policy may optionally declare extra data streams that the integration writes to, which Fleet adds to the Elasticsearch API key issued to Elastic Agents enrolle...

EUVD-2026-61975

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce component: Endeca Application Controller. The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the...

EUVD-2026-61408

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: Authentication Engine. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority

Summary Repo under test: https://github.com/Netflix/lemur When ADMINONLYAUTHORITYCREATION=False an explicitly supported and documented configuration, POST /api/1/authorities with type=subca never verifies that the caller holds AuthorityPermission on the supplied parent authority. The parent field...

PT-2026-77881

Name of the Vulnerable Software and Affected Versions Oracle Hyperion Data Relationship Management version 11.2.25.0.000 Description An issue exists in the Access and security component that allows a high privileged attacker with network access via HTTP to compromise the system. Successful...

GHSA-QV9R-C865-CP47 vulnerabilities

Vulnerabilities for packages: apache-tika, solr, spdx-tools-java, thingsboard, neo4j, infinispan, zipkin, druid, apache-activemq-artemis, opensearch, trino, flink, keycloak-config-cli, akhq, kserve-modelmesh, apache-pulsar, wildfly, strimzi-kafka-operator, spark, celeborn, kafka, wavefront-proxy,...

GHSA-H4MF-4V27-HGGJ vulnerabilities

Vulnerabilities for packages: telegraf...

GO-2026-4896 vulnerabilities

Vulnerabilities for packages: minio...

GO-2022-1071 vulnerabilities

Vulnerabilities for packages: kubevela...

GO-2026-5046 vulnerabilities

Vulnerabilities for packages: splunk-otel-collector, opentelemetry-collector-contrib, bento, dapr...

GO-2025-3595 vulnerabilities

Vulnerabilities for packages: kargo, crossplane-provider-aws-cloudwatchlogs, jaeger-operator, kubernetes-dns-node-cache, dex, witness, kubernetes-csi-driver-hostpath, sftpgo-plugin-kms, cert-manager-webhook-pdns, rancher-system-agent, distribution, trivy, ko, crossplane-provider-aws-cloudfront,...