rootpwn

critical · CVSS v3 8.8 · CVSS v4 9.3

CVE-2026-103470

In Internet2 Grouper before 7.5.1 (in some configurations), a user who is allowed to create or edit rules in the User In…

Description

In Internet2 Grouper before 7.5.1 (in some configurations), a user who is allowed to create or edit rules in the User Interface can escalate privileges.

Scores

Severity
critical
CVSS v2
7.5
CVSS v3
8.8
CVSS v4
9.3
EPSS
—

← All CVEs

Related CVEs

critical

CVE-2026-103395

LightLLM through 1.2.0 visual_only deployments expose an unauthenticated RPyC service with allow_pickle enabled that deserializes attacker-supplied arguments in the remote_infer_images method. Attackers can reach the visual RPyC port and pass objects with __reduce__ methods to execute arbitrary code with service account privileges.

View analysis

critical

CVE-2026-18782

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Command Line Execution through SQL Injection. This issue affects Trex MES: through 2026-09-29.

View analysis

critical

CVE-2026-76570

Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1 - The front-end CRUD API controller performs no Joomla token validation and no authentication check on any task. Table names, column names, and values are taken directly from request parameters and concatenated into SQL queries, allowing SQLi for reading and writing queries.

View analysis

critical

CVE-2026-100253

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code execution was possible via the versioned settings Kotlin DSL

View analysis