Do Son Two high-severity Ubiquiti flaws allow privilege escalation via XSS in UCRM and authenticated SQL injection in UISP. Update immediately!
privilege escalation
Qualys uncovered two critical Linux flaws (CVE-2025-6018, CVE-2025-6019) allowing local root privilege escalation via PAM and UDisks. Patching is urgent for major distros.
CISA has added CVE-2023-0386, a critical Linux kernel OverlayFS flaw, to its KEV Catalog, confirming active exploitation allowing local users to gain root privileges.
ASUS warns of a high-severity flaw in Armoury Crate that allows authentication bypass and privilege escalation. Update immediately!
A high-severity flaw (CVE-2025-33108) in IBM BRMS for i allows users with specific capabilities to gain elevated privileges. Update to PTF SJ05907 (7.5) or SJ05906 (7.4).
A spoofing flaw (CVE-2025-26685) in Microsoft Defender for Identity, combined with other vulnerabilities, enables unauthenticated privilege escalation to Active Directory.
A critical Windows SMB client flaw (CVE-2025-33073, CVSS 8.8) allows remote SYSTEM privilege escalation via Kerberos authentication. PoC available.
Ricoh warns of critical flaws in Streamline NX V3, including a CVSS 9.8 path traversal (CVE-2025-46783) allowing remote SYSTEM-level code execution.
A flaw (CVE-2025-5491) in Acer ControlCenter allows remote, unauthenticated attackers to escalate privileges to NT AUTHORITY\SYSTEM
A critical CI/CD flaw in remote caches allows undetectable code injection and privilege escalation via cache poisoning, bypassing all security controls.
A high-severity flaw (CVE-2025-4922) in HashiCorp Nomad allows privilege escalation via ACL policy lookup. Upgrade to Nomad 1.10.2 (or later) immediately.
A flaw (CVE-2025-4232) in GlobalProtect for macOS allows local users to escalate to root. Public PoC code exists. Update now!
Zero-day CVE-2025-33073 allows remote privilege escalation to SYSTEM on Windows via SMB. PoC available. Fixed in June 10, 2025 Patch Tuesday.
A IGEL OS 10 flaw (CVE-2025-47827) allows full Secure Boot bypass, enabling attackers to load untrusted kernels and rootkits. No patch is available.
Apache CloudStack LTS updates patch five security flaws, including two critical vulnerabilities in Kubernetes and admin access, risking full system compromise.
Two Windows Kernel vulnerabilities allow SYSTEM-level privilege escalation. PoC exploit code is publicly available.
A critical CVSS 9.8 flaw (CVE-2025-49653) in Backend.AI allows account takeover via PoC, impacting all versions. Vendor has not issued a patch.
SAP's June 2025 Security Patch Day reveals critical and high-severity vulnerabilities in NetWeaver, GRC, BW, and BI. Immediate patching is crucial to protect your enterprise.
A critical privilege escalation flaw (CVE-2025-4601) in RealHomes WordPress theme allows low-privilege users to become admins. Update now!
Critical flaws in Microsoft's Brokering File System (BFS), including race conditions and UAF bugs, expose Windows to privilege escalation. PoC code available. Patch now!
Cisco issues advisories for high-severity flaws (CVSS 8.8, 8.7) in IMC and NDFC, risking privilege escalation and device impersonation. Patch immediately!
PoC reveals how a Linux vsock driver flaw enables local users to escalate privileges to root via a dangerous Use-After-Free vulnerability.