Privilege-escalation
4 posts tagged with “Privilege-escalation”
Artifactory anonymous token chain hits CISA KEV
How to fix CVE-2026-42018 / CVE-2026-42016: upgrade self-hosted Artifactory past the anonymous-JWT and token-scope floors (prefer 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, or 7.161.20)
BREAKING: CVE-2026-76578 lets an unauthenticated LDAP client become a FreeIPA admin
How to fix CVE-2026-76578: apply the RHEL 9/10 errata where available; otherwise restrict LDAP ports 389/636 and disable anonymous binds until your train is patched
BREAKING: CVE-2026-18432 - Frontend Admin WordPress Unauthenticated Admin Takeover
CVE-2026-18432 is a CVSS 9.8 privilege-escalation flaw in Frontend Admin by DynamiApps that can let unauthenticated attackers reset the default WordPress administrator account. Update to 3.29.10.
BREAKING: CVE-2026-19598 - Pods WordPress Plugin Unauthenticated Admin Takeover
CVE-2026-19598 is a CVSS 9.8 authorization bypass in the Pods WordPress plugin that lets unauthenticated attackers reach admin methods and take over sites. Update to 3.3.9.1.