Latest Privilege Escalation news

A weekend batch of 198 CVEs includes a BACnet plaintext flaw (CVSS 9.1) exposing building automation to traffic interception. WordPress gets hit with five privilege escalation bugs, cookie-based SQL injection bypassing WAFs, and a strpos() admin takeover.

A timing flaw between snap-confine and systemd-tmpfiles gives unprivileged users root on default Ubuntu Desktop 24.04+ installations. Qualys TRU's second Ubuntu disclosure in one week. Patch snapd now.

Nine confused deputy bugs in Linux AppArmor let any local person gain root on 12.6 million Ubuntu, Debian, and SUSE systems. Hidden since 2017. Qualys TRU named the cluster CrackArmor. Patches landed March 12, no CVEs assigned yet.