CVE-2026-94178
Subscriber Privilege Escalation in Import and export users and customers <= 2.5.2 versions.
CVSS
7.5
High
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Sep 30, 2026 · Last modified: Sep 30, 2026 · CWE-266
Not enough EPSS history yet.
Subscriber Privilege Escalation in Import and export users and customers <= 2.5.2 versions.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-972457.2 HIG—
———Shop Worker Privilege Escalation in SureCart <= 4.7.2 versions.4hCVE-2026-968216.3 MED—
———Subscriber Privilege Escalation in FluentBoards <= 2.0.12 versions.4hCVE-2026-968157.2 HIG—
———Custom role Privilege Escalation in Vitepos <= 3.5.0 versions.4hCVE-2026-963509.8 CRI—
———Subscriber Privilege Escalation in Estatik <= 4.3.5 versions.4hCVE-2026-1028464.7 MED—
———A vulnerability was detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Impacted is the function sistem.php::simpan of the file application/modules/admin/controllers/sistem.php of the component Configuration Handler. The manipulation of the argument tipe/title/content_setting results in improper authorization. The attack may be launched remotely. The exploit is now public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.4hCVE-2026-1026748.2 HIG—
——0Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, windows opened from a sandboxed top-level document did not inherit that document's active HTML sandbox restrictions. Untrusted content in a sandboxed top-level document that was permitted to open popups could therefore create a window with the Electron application's full origin instead of the restricted origin intended by the sandbox. Applications that deny such popups with setWindowOpenHandler are not affected. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5.23h