Privilege Dropping / Lowering Errors

Every one of the 11 is a mark on the map. Named now: 1 to 11, most at risk first.

1. PostgreSQL non-owner REFRESH MATERIALIZED VIEW CONCURRENTLY executes arbitrary SQLCVE-2024-0985Postgresql · CVSS 8 · 1.8% likelycovered by CyberSIXT

   Postgresql

2. In Kubernetes v1.12.0-v1.12.4 and v1.13.0, the rest.AnonymousClientConfig() method returns a copy of the provided config, with credentials removed (bearer token, username/password…CVE-2019-11243Kubernetes · CVSS 3.1 · 1.7% likely

   Kubernetes

3. A flaw incorrect umask during file or directory modification in the Linux kernel NFS (network file system) functionality was found in the way user create and delete object using N…CVE-2020-35513kernel · 1.4% likely
4. Due to an issue with incorrect sudo permissions, Zimbra Collaboration Suite (ZCS) suffers from a local privilege escalation issue in versions 9.0.0 and prior, where the 'zimbra' u…CVE-2022-3569Synacor · CVSS 7.8 · 0.8% likely

   Zimbra

5. Unprivileged Stalwart Mail Server user can read files as rootCVE-2024-35179stalwartlabs · CVSS 6.8 · 0.6% likely

   Stalwartlabs

6. A Improper Privilege Management vulnerability in SUSE Rancher causes permission changes in Azure AD not to be reflected to users while they are logged in the Rancher UI. This woul…CVE-2023-22648SUSE · CVSS 8 · 0.5% likely

   SUSE

7. Local root exploit via `logfile_reopen()` in screen 5.0.0 with setuid-root bit setCVE-2025-23395CVSS 7.8 · 0.3% likely
8. Apptainer's ineffective privileges drop when requesting container networkCVE-2023-38496apptainer · CVSS 6.1 · 0.3% likely
9. In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not a fatal error and can lead to…CVE-2026-35535Sudo project · CVSS 7.4 · 0.2% likely

   Sudo project

10. Nix's privilege dropping to build user broke for macOSCVE-2025-53819NixOS · CVSS 7.9 · 0.1% likely

    NixOS

11. Incomplete privilege drop for com.system76.CosmicGreeter.GetUserDataCVE-2026-25704pop-os · CVSS 5.8 · 0.1% likely

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.