WordPress MemberGlut < 1.1.5 - Unauthenticated Privilege Escalation

MemberGlut WordPress plugin 1.1.5 contains a broken access control vulnerability caused by lack of validation of roles during front-end registration, letting unauthenticated users register with arbitrary roles including administrator, exploit requires no authentication. id: CVE-2026-12394 info:...

CVE-2022-0441

A vulnerability classified as critical was found in MasterStudy LMS Plugin up to 2.7.5 on WordPress WordPress Plugin. This vulnerability affects an unknown part of the component New Account Handler. The manipulation with an unknown input leads to a privileges management vulnerability. The CWE...

CVE-2022-37706

CVE-2022-37706 Resumen CVE-2022-37706 es una vulnerabilidad de Escalada Local de Privilegios LPE encontrada en el componente enlightenmentsys del entorno de escritorio Enlightenment para Linux. Esta vulnerabilidad permite que un usuario local con bajos privilegios eleve sus privilegios a root en...

CVE-2022-0441

Se encontró una vulnerabilidad clasificada como crítica en el complemento MasterStudy LMS hasta la versión 2.7.5 en WordPress WordPress Plugin. Esta vulnerabilidad afecta a una parte desconocida del componente New Account Handler. La manipulación con una entrada desconocida conduce a una...

Exploit for CVE-2026-18366

CVE-2026-18366 — Events Manager 7.4.1: Unauthenticated Pr...

GO-2026-6197 vulnerabilities

Vulnerabilities for packages: telegraf...

EUVD-2026-61975

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce component: Endeca Application Controller. The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the...

EUVD-2026-61408

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: Authentication Engine. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority

Summary Repo under test: https://github.com/Netflix/lemur When ADMINONLYAUTHORITYCREATION=False an explicitly supported and documented configuration, POST /api/1/authorities with type=subca never verifies that the caller holds AuthorityPermission on the supplied parent authority. The parent field...

PT-2026-77881

Name of the Vulnerable Software and Affected Versions Oracle Hyperion Data Relationship Management version 11.2.25.0.000 Description An issue exists in the Access and security component that allows a high privileged attacker with network access via HTTP to compromise the system. Successful...

GHSA-QV9R-C865-CP47 vulnerabilities

Vulnerabilities for packages: neo4j, akhq, keycloak-config-cli, spark, zipkin, wavefront-proxy, druid, celeborn, apache-tika, kafka, sonarqube, apache-activemq-artemis, opensearch, spdx-tools-java, flink, infinispan, strimzi-kafka-operator, kserve-modelmesh, thingsboard, wildfly, apache-pulsar, s...

GHSA-H4MF-4V27-HGGJ vulnerabilities

Vulnerabilities for packages: telegraf...

GO-2026-4896 vulnerabilities

Vulnerabilities for packages: minio...

GO-2022-1071 vulnerabilities

Vulnerabilities for packages: kubevela...

GO-2026-5046 vulnerabilities

Vulnerabilities for packages: bento, dapr, opentelemetry-collector-contrib, splunk-otel-collector...

GO-2025-3595 vulnerabilities

Vulnerabilities for packages: harbor-registry, temporal-server, pulumi-kubernetes-operator, prometheus-adapter, step-ca, newrelic-infrastructure-agent, slsa-verifier, kube-fluentd-operator, clickhouse-operator, crossplane-provider-azure-authorization, pvc-autoresizer, sftpgo-plugin-eventsearch,...

CVE-2026-72631

Improper Privilege Management CWE-269 in Kibana Fleet can lead to privilege escalation via Privilege Escalation CAPEC-233. An integration policy may optionally declare extra data streams that the integration writes to, which Fleet adds to the Elasticsearch API key issued to Elastic Agents enrolle...

CVE-2026-72631

Improper Privilege Management CWE-269 in Kibana Fleet can lead to privilege escalation via Privilege Escalation CAPEC-233. An integration policy may optionally declare extra data streams that the integration writes to, which Fleet adds to the Elasticsearch API key issued to Elastic Agents enrolle...

CVE-2026-72631 Improper Privilege Management in Kibana Fleet Leading to Over-Scoped Elastic Agent API Keys

Improper Privilege Management CWE-269 in Kibana Fleet can lead to privilege escalation via Privilege Escalation CAPEC-233. An integration policy may optionally declare extra data streams that the integration writes to, which Fleet adds to the Elasticsearch API key issued to Elastic Agents enrolle...

CVE-2026-72631

Kibana Fleet vulnerability CVE-2026-72631: Improper Privilege Management can allow an Elastic Agent API key issued to agents in a policy to gain additional write rights (insert new documents and extend index mappings) for certain indices by including extra data streams in the integration policy. ...