CVE-2026-116386
Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 versions.
CVSS
9.8
Crítico
EPSS
—
KEV
—
Exploit Today
—
0-100
Publicado: 30 oct 2026 · Última mod.: 30 oct 2026 · CWE-266
Sin historial EPSS suficiente todavía.
Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 versions.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-548546.3 MED—
———Contributor Privilege Escalation in Profile Builder <= 4.0.5 versions.8hCVE-2026-1180868.8 ALT—
———Subscriber Privilege Escalation in WP BASE Booking <= 6.5.2 versions.4hCVE-2026-1195994.3 MED—
———AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerability that allows project users to assign system-level scopes by creating service_account API keys with unvalidated scopes. Attackers holding write_api_keys can mint keys with read_channels and query /admin/graphql to read every channel's configuration, including base URLs and model lists.8hCVE-2026-1180828.8 ALT—
——0Subscriber Privilege Escalation in Buddyboss Platform <= 3.5.0 versions.8hCVE-2026-1186447.7 ALT10.1%
——3n8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow's full execution context, including the identity of the user who started the run, to the configured error workflow. A project editor can set a colleague's workflow settings.errorWorkflow to an error workflow they own, inherit the colleague's identity when that workflow fails, and resolve the colleague's per-user dynamic credential secrets.2dCVE-2026-1164714.3 MED9.6%
——3A security flaw has been discovered in BKWLD Decoy up to 5.11.1. The impacted element is an unknown function of the file Policy.php of the component Authorization Policy. The manipulation of the argument role results in improper privilege management. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.4d