Export limit exceeded: 10053 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (10053 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-75874 | 1 Mozilla | 1 Firefox | 2026-08-18 | 10 Critical |
| Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154 and Thunderbird 154. | ||||
| CVE-2026-73350 | 2 Psm Plugins, Wordpress | 2 Supportcandy, Wordpress | 2026-08-18 | 8.2 High |
| Unauthenticated Broken Authentication in SupportCandy <= 3.5.1 versions. | ||||
| CVE-2026-28191 | 2 Theme-one, Wordpress | 2 The Grid, Wordpress | 2026-08-18 | 8.8 High |
| Subscriber Privilege Escalation in The Grid <= 2.7.9.1 versions. | ||||
| CVE-2026-18432 | 2 Shabti, Wordpress | 2 Frontend Admin By Dynamapps, Wordpress | 2026-08-18 | 9.8 Critical |
| The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because `ActionUser::conditions_logic()` gates the `current_user_can('edit_user', $user_id)` authorization check behind an `is_numeric()` test, causing the check to be skipped entirely when `$user_id` is a non-numeric string — a condition that can be induced by passing a crafted value such as `1one` through the unvalidated `item_id` parameter of the unauthenticated `wp_ajax_nopriv_frontend_admin/forms/change_form` AJAX endpoint. This makes it possible for attackers to escalate privileges to administrator by obtaining a server-signed `_acf_objects` payload carrying the non-numeric user ID, which WordPress subsequently coerces to integer 1 (the default administrator), allowing the attacker to overwrite that account's password or email address. Exploitation by unauthenticated users requires a public-facing frontend user form to be configured; in all other cases a subscriber-level account is sufficient. | ||||
| CVE-2026-15312 | 2 Fassionstorage, Wordpress | 2 All-in-one Client Management System Plugin, Wordpress | 2026-08-18 | 8.8 High |
| The Propovoice: All-in-One Client Management System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8. This is due to the `create()` function's REST endpoint failing to validate the user-supplied `role` parameter against an allowlist of permitted WordPress roles and omitting any `promote_users` capability check before passing the sanitized value directly to `WP_User::set_role()`. This makes it possible for authenticated attackers with `ndpv_manager`-level access and above to create a new WordPress user account with the `administrator` role assigned, achieving full vertical privilege escalation. The `ndpv_manager` capability is a sub-administrator CRM team role granted by Propovoice itself, meaning the attack surface extends beyond site administrators to any user the plugin has elevated to a manager position. | ||||
| CVE-2026-14279 | 2 Cedcommerce, Wordpress | 2 Wholesale Market, Wordpress | 2026-08-18 | 8.8 High |
| The Wholesale Market plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.2.2 via the ced_wholesale_request_send AJAX action. The ced_wholesale_request_send_callback() handler only verifies a nonce (which is exposed to any authenticated user through wp_localize_script on the frontend) and that the caller has a positive user ID, then calls WP_User::add_role() with the client-supplied role_required POST parameter without restricting the value to an allowlist of wholesale roles. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to Administrator when the site administrator has enabled the 'Assigning requested role directly' option. | ||||
| CVE-2026-67846 | 2026-08-18 | N/A | ||
| Berkeley Out-of-Order Machine (BOOM) commit 5223e44cfeb26f41380057a2eb4d651197475f69 contains a potential incorrect privilege assignment issue in the v3 and v4 NBDTLB implementations. The raw mstatus.SUM value participates in the read and write permission logic without an explicit local satp.MODE validity check at the use site | ||||
| CVE-2026-74952 | 1 Mozilla | 1 Firefox | 2026-08-18 | 8.8 High |
| Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 154 and Thunderbird 154. | ||||
| CVE-2026-74960 | 1 Mozilla | 1 Firefox | 2026-08-18 | 6.1 Medium |
| Site isolation issue in the WebExtensions component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. | ||||
| CVE-2026-74941 | 1 Mozilla | 1 Firefox | 2026-08-18 | 8.8 High |
| Privilege escalation in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. | ||||
| CVE-2026-74939 | 1 Mozilla | 1 Firefox | 2026-08-18 | 8.8 High |
| Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. | ||||
| CVE-2026-50770 | 2026-08-18 | 9.8 Critical | ||
| An issue in Squirro Cognitive Search before v.3.14.2 allows a remote attacker to escalate privileges via a crafted request. | ||||
| CVE-2026-75924 | 1 Redhat | 2 Acm, Multicluster Engine | 2026-08-18 | 8.7 High |
| A flaw was found in managed-serviceaccount. A compromised addon-manager pod, due to its ClusterRole granting excessive permissions, can read any secret across all namespaces. Additionally, it can approve arbitrary Certificate Signing Requests (CSRs), which could lead to information disclosure and privilege escalation within the cluster. | ||||
| CVE-2026-75857 | 1 Hmbown | 1 Codewhale | 2026-08-18 | 7 High |
| CodeWhale versions >= 0.8.41 and < 0.8.64 contain a vulnerability in the exec_shell_interact (alias exec_interact) tool, whose approval_requirement returns ApprovalRequirement::Auto. This overrides the default Required approval for code-executing tools, so LLM-controlled stdin is written into an already-approved long-running interactive shell (e.g., a python3 -i REPL, mysql, ssh, or sudo -i session) without any approval prompt. An attacker who can inject instructions via untrusted content the agent ingests (a fetched page, MCP result, or repo file) can cause commands to run at the privilege level of that approved process. Fixed in 0.8.64. | ||||
| CVE-2026-75481 | 1 Skypilot-org | 1 Skypilot | 2026-08-18 | 8.8 High |
| SkyPilot fails to validate that authenticated users are entitled to grant administrator roles when updating service account permissions. Attackers can create a service account, escalate it to administrator role, and authenticate with its bearer token to gain administrative control over all users and workspaces. | ||||
| CVE-2026-45790 | 1 Dokploy | 1 Dokploy | 2026-08-18 | 8 High |
| Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy's organization.inviteMember tRPC procedure in apps/dokploy/server/api/routers/organization.ts allows a user with member:create permission to invite an account with the owner role, while packages/server/src/services/user.ts allows a privileged self-hosted user to create an account with an arbitrary role, enabling permanent organization takeover because owner roles cannot be demoted. This issue is fixed in version 0.29.6. | ||||
| CVE-2026-26053 | 1 Gallagher | 1 Command Centre | 2026-08-18 | 5.3 Medium |
| An Incorrect Privilege Assignment (CWE-266) vulnerability in the Command Centre Server allows an authenticated operator with limited privileges to perform some operations that they would not normally be authorized to perform. Version of Command Centre affected: 9.50 prior to vEL9.50.1587(MR1), 9.40 prior to vEL9.40.3130(MR3), 9.30 prior to vEL9.30.3983(MR5), 9.20 prior to vEL9.20.4349(MR7), all versions of 9.10. | ||||
| CVE-2026-69414 | 1 Microsoft | 1 Malware Protection Engine | 2026-08-18 | 7.8 High |
| Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "ShieldBreak ". We are working to provide a high quality security update that addresses this vulnerability. We will provide information in this CVE when the update is available. | ||||
| CVE-2026-75845 | 1 Arcadedata | 1 Arcadedb | 2026-08-18 | 6.3 Medium |
| ArcadeDB versions 26.4.2 through 26.7.3 contain an authorization bypass vulnerability in the set_server_setting MCP server-level tool. SetServerSettingTool.execute() gates only on the global allowAdmin flag and never checks the caller's role, so in an MCP deployment with allowAdmin=true and a non-root allowedUsers set, any authenticated read-only user can invoke set_server_setting to modify server GlobalConfiguration, enabling configuration tampering or denial of service. The issue is fixed in 26.8.1. | ||||
| CVE-2026-68568 | 2026-08-18 | 6.3 Medium | ||
| Subscriber Privilege Escalation in MasterStudy LMS <= 3.7.41 versions. | ||||