CVE-2026-38056

A local privilege escalation vulnerability exists in the iDirect iQ200 VSAT terminal running firmware 23.0.1.0 , a rackmount satellite modem used as the primary communications link for offshore rigs, vessels, and remote sites. The device ships with a pre-configured low-privilege local user accoun...

CVE-2026-38056 ST Engineering iDirect iQ-Series Terminals Missing Authorization

A local privilege escalation vulnerability exists in the iDirect iQ200 VSAT terminal running firmware 23.0.1.0. The iQ200 is a rackmount satellite modem deployed across oil and gas, maritime, defense, and remote infrastructure as the primary, and often sole communications link for offshore rigs,...

EUVD-2026-76127

A local privilege escalation vulnerability exists in the iDirect iQ200 VSAT terminal running firmware 23.0.1.0. The iQ200 is a rackmount satellite modem deployed across oil and gas, maritime, defense, and remote infrastructure as the primary, and often sole communications link for offshore rigs,...

CVE-2026-85979 Command Injection in Puppet Enterprise

Affected versions of Puppet Enterprise contain a command injection vulnerability. An authenticated user with Puppet administrative privileges can inject arbitrary shell commands by providing a specially crafted value for this parameter, which is passed to a shell execution context without...

CVE-2026-89298

A flaw was found in the Dynamic Client Registration service of Keycloak, an open-source identity and access management solution. The issue occurs when a user with the view-clients role accesses the client registration endpoint to retrieve client details. Due to a failure to mask sensitive...

CVE-2026-88879

A flaw was found in Traefik, an HTTP reverse proxy and load balancer. Due to a discrepancy in how Traefik and certain backend applications process HTTP header names, a remote attacker can smuggle specially crafted headers. This allows the attacker to bypass identity assertions made by Traefik,...

EUVD-2026-76114

Incorrect privilege assignment vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus-software allows Privilege Escalation. This issue affects Pardus-software: before 1.0.5...

CVE-2026-8303 Privilege Escalation in TUBITAK BILGEM's Pardus-software

Incorrect privilege assignment vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus-software allows Privilege Escalation. This issue affects Pardus-software: before 1.0.5...

CVE-2026-8303

An incorrect privilege assignment vulnerability in TUBITAK BILGEM 's Pardus-software (a Turkish software product developed by the Software Technologies Research Institute) allows local privilege escalation . The issue affects versions before 1.0.5 , and upgrading to 1.0.5 remediates it. The CVSS ...

WordPress Registration Form for WooCommerce plugin 1.1.0-1.1.2 - Contributor+ Privilege Escalation vulnerability

Contributor+ Privilege Escalation vulnerability discovered by Sai Praneeth Koti in WordPress Plugin Registration Form for WooCommerce versions 1.1.0-1.1.2...

WordPress MultiVendorX plugin 5.0.0-5.0.15 - Store Owner+ Privilege Escalation to Administrator vulnerability

Store Owner+ Privilege Escalation to Administrator vulnerability discovered by Philipp Doblhofer in WordPress Plugin MultiVendorX versions 5.0.0-5.0.15...

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization 'race condition' in Microsoft Edge Chromium-based allows an authorized attacker to elevate privileges locally...

razer-lycosa-kernel-lpe-BYOVD-Vulnerability-PoC

Lycosa.sys, Razer: two kernel vulnerabilities reachable by any local user Discovered through https://github.com/416rehman/DeepZero Vendor: Razer Inc. Component: Lycosa.sys, the Razer Lycosa keyboard filter driver, x64 SHA-256: a120a6184ab16864e8a5f1dfd0cd178fca541de463b5cef946e18c34b9b6f716...

CVE-2025-2304-Camaleon-CMS-Mass-Assignment-Privilege-Escalation-PoC

CVE-2025-2304 — Camaleon CMS Escalada de Privilegios por Asignación Masiva PoC Vulnerabilidad de escalada de privilegios en Camaleon CMS /updatedajax con passwordrole=admin inyectado en los parámetros de contraseña. 4. Verifica que el rol se haya actualizado a admin. Requisitos Python 3 Instalar...

Azure

Kit de Seguridad Ofensiva de Azure Una colección de scripts de Bash y PowerShell para evaluaciones de seguridad de Azure, que cubren escalada de privilegios de IAM, seguridad de contenedores, exposición de Key Vault, configuración de Entra ID y más. Diseñada para ejecutarse en Azure Cloud Shell o...

CVE-2026-89298 Keycloak-services: keycloak-services: confidential client secret disclosed to view-clients role via client registration get

A flaw was found in the Dynamic Client Registration service of Keycloak, an open-source identity and access management solution. The issue occurs when a user with the view-clients role accesses the client registration endpoint to retrieve client details. Due to a failure to mask sensitive...

EUVD-2026-76104

A flaw was found in the Dynamic Client Registration service of Keycloak, an open-source identity and access management solution. The issue occurs when a user with the view-clients role accesses the client registration endpoint to retrieve client details. Due to a failure to mask sensitive...

CVE-2026-89298

A flaw in Keycloak 's Dynamic Client Registration service allows a user with the view-clients role to retrieve a client's confidential secret in cleartext via the client registration GET endpoint. The root cause is a failure to mask sensitive information when returning client details. A read-only...

CVE-2026-89298

A flaw was found in the Dynamic Client Registration service of Keycloak, an open-source identity and access management solution. The issue occurs when a user with the view-clients role accesses the client registration endpoint to retrieve client details. Due to a failure to mask sensitive...

CVE-2026-80462

A vulnerability in the Chef Automate API gateway and identity validation path may allow an unauthenticated actor to gain elevated access to protected Chef Automate functionality under specific conditions...