Anchore Enterprise versions from 5.11.0 to 5.27.1 and 6.0.0 contain an improper privilege escalation vulnerability in the user management API. An authenticated attacker who is able to access the Anchore Enterprise API could issue an API call capable of modifying user permissions to gain access to additional resources and operations. It is not possible to grant the system-admin role, but a read onl

An Incorrect Use of Privileged APIs vulnerability in Unity Parsec on Windows hosts leads to a potential Elevation of Privilege. This issue affects Parsec through v2026-05-04.0. The patched version is Parsec for Windows version 150-104a. A user can generate a situation where there is an instance of parsecd.exe running as NT AUTHORITY\SYSTEM with a user-controlled value of the AppData environment va

该漏洞存在于Unity Parsec（Windows版本）中，属于不当使用特权API导致权限提升的问题。攻击者无需用户交互（UI:N）且无需权限（PR:N）即可利用该漏洞，通过控制AppData环境变量，使parsecd.exe以NT AUTHORITY\SYSTEM特权运行，从而实现本地权限提升。受影响的版本包括截至2026-05-04.0的所有Parsec版本，而修复版本为Parsec for Windows 150-104a。由于攻击面为本地（AV:L），但无需提权或用户交互，风险较高。建议用户立即更新至Patched版本。同时，应避免将Parsec暴露于不受信任的网络环境，并限制本地访问权限。目前无证据表明该漏洞已在野被利用，也未列入已知被利用漏洞目录（KEV）。

An unauthorized user can modify configuration through API calls that affects the OpenText Access Manager. This issue affects Access Manager before 5.1.3.

Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS allows attackers to execute arbitrary commands with elevated privileges via local IPC channel

A vulnerability exists in iControl REST where a highly privileged, authenticated attacker with at least the Manager role can create configuration objects that allow running arbitrary commands.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.