CVE-2026-100718 | High | 7.1 | 2026-09-26 | Froxlor through 2.3.10 does not enforce the mail.allow_external_domains policy in the EmailSender.add API command. When an administrator has enabled the allowe… |
CVE-2026-6718 | Medium | 6.2 | 2026-09-23 | IBM Concert 1.0.0 through 3.0.0 is vulnerable to improper access control which allows unauthorized modification of application files. |
CVE-2026-82165 | Medium | 5.5 | 2026-09-21 | Dell Command | Integration Suite for System Center, versions prior to 6.7.2, contain an Incorrect Default Permissions vulnerability. A low privileged attacker… |
CVE-2026-82163 | Medium | 5.5 | 2026-09-21 | Dell Command | Intel vPro Out of Band, versions prior to 4.7.2, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local ac… |
CVE-2026-92252 | | | 2026-09-20 | Incorrect default permissions in the installation directory of WatchDog Anti-Virus on Windows allow local, low-privileged users to modify, replace, or delete a… |
CVE-2026-87886 | High | 7.8 | 2026-09-17 | Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1… |
CVE-2026-86359 | High | 8.5 | 2026-09-16 | Dell Repository Manager, versions prior to 3.5.2, contains an Incorrect Default Permissions vulnerability. A low privileged attacker with remote access could p… |
CVE-2026-48722 | Medium | 5.5 | 2026-09-15 | Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer… |
CVE-2026-86836 | | | 2026-09-14 | In Eclipse Ankaios versions 0.1.0 through 1.0.2, the agent creates workload files and Control Interface named pipes (FIFOs) under a predictable path derived fr… |
CVE-2026-11813 | High | 7.8 | 2026-09-10 | A potential improper permissions vulnerability was reported in the Lenovo Filez Client application that could allow a local authenticated user to escalate priv… |
CVE-2026-52766 | Critical | 9.1 | 2026-09-05 | YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the {{erasespamedcomments}} wiki action (actions/EraseSpamedCommentsAction.php) accepts a supp… |
CVE-2026-77393 | High | 8.8 | 2026-09-04 | In Ignition 8.1.53 and earlier, the Gateway "Create Project Role(s)" setting shipped blank, which permitted any authenticated user to create projects (if they… |
CVE-2026-75166 | High | 8.8 | 2026-09-04 | Insecure Permission vulnerability in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows the low-privileged service user to execute /usr/bin/tcpdump as root… |
CVE-2026-81302 | High | 7.8 | 2026-09-04 | PALLET CONTROL products contain an incorrect default permission vulnerability, which may allow a local attacker to execute arbitrary code with SYSTEM privilege… |
CVE-2026-9634 | | | 2026-09-01 | A security issue exists within the Redundancy Module Configuration Tool. The RMConfigTool.exe binary searches directories in the system path for a required DLL… |
CVE-2026-9633 | | | 2026-09-01 | A security issue exists within the Redundancy Module Configuration Tool. The RM3ConfigTool.exe binary searches directories in the system path for a required DL… |
CVE-2026-81682 | Medium | 6.2 | 2026-08-27 | openssl_encrypt versions before 1.4.9 contain an insecure file permissions vulnerability in the desktop GUI that writes decrypted plaintext with world-readable… |
CVE-2026-69665 | High | 7.8 | 2026-08-25 | SKYSEA Client View and SKYMEC IT Manager contain an issue with incorrect default permissions. If this vulnerability is exploited, an attacker who can log in to… |
CVE-2026-78553 | | | 2026-08-24 | RansomLook created its Flask session-signing key without explicitly restricting the file permissions. The secret_key file was created using the process's defau… |
CVE-2025-68825 | High | 7.5 | 2026-08-24 | HCL Hive is affected by incorrect default permissions which could allow an attacker unauthorized lateral movement, container breakout, and interception of sens… |
CVE-2026-18273 | Medium | 6.6 | 2026-08-20 | Kenwood DNR1007XR USB Incorrect Default Permissions Local Privilege Escalation Vulnerability. This vulnerability allows physically present attackers to escalat… |
CVE-2026-58564 | High | 7.8 | 2026-08-19 | Dell Command Update (DCU), versions prior to 5.7.1, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could p… |
CVE-2026-19893 | Low | 3.1 | 2026-08-15 | A vulnerability was identified in D-Link DIR-842 2.01.B04. This impacts an unknown function of the file /etc/vsftpd.conf of the component vsftpd. Such manipula… |
CVE-2026-19841 | Low | 3.1 | 2026-08-14 | A flaw has been found in TRENDNET TEW-813DRU 1.01b01. Impacted is an unknown function of the file /etc/vsftpd.conf of the component vsftpd. This manipulation c… |
CVE-2026-63425 | High | 7.8 | 2026-08-13 | During an internal security assessment, a potential improper permissions vulnerability was discovered in Lenovo Dock Manager that could allow a local authentic… |
CVE-2025-52640 | Medium | 4.7 | 2026-08-13 | HCL AION is affected by a vulnerability where the shared storage used by product components is architected without sufficient access separation. Processes shar… |
CVE-2026-65940 | Medium | 6.8 | 2026-08-12 | In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can write arbitrary files to a web-accessible location on the host server. |
CVE-2026-48790 | Medium | 5.5 | 2026-08-11 | Turso CLI is the command line interface (CLI) to the open-source database Turso. Versions prior to 1.0.26 persist the user's Turso platform JWT to `settings.js… |
CVE-2026-59119 | High | 7.3 | 2026-08-11 | Incorrect default permissions in Microsoft PowerShell allows an authorized attacker to elevate privileges locally. |
CVE-2025-61970 | | | 2026-08-11 | Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to create arbitrary code, potentially resu… |
CVE-2025-48505 | | | 2026-08-11 | Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to achieve privileged escalation, potentia… |
CVE-2026-21074 | | | 2026-08-10 | Incorrect default permissions in Bixby prior to version 4.0.86.0 allows local attackers to execute arbitrary commands with Bixby privilege. |
CVE-2026-4793 | High | 7.3 | 2026-08-03 | An incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows local users to read or write arbitrary files and conduct denial-… |
CVE-2026-39875 | High | 7.8 | 2026-07-27 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A malicious… |
CVE-2026-39874 | High | 7.8 | 2026-07-27 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A malicious… |
CVE-2026-17497 | High | 8.3 | 2026-07-26 | NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default deskto… |
CVE-2026-16247 | High | 7.3 | 2026-07-20 | In _connect.BRAIN versions prior to 5.06,
the application LogPathConfig.exe is executed during setup. During this
process, existing permissions on %ProgramData… |
CVE-2026-16246 | High | 7.3 | 2026-07-20 | In BRAIN2 versions prior to 3.09, the
application LogPathConfig.exe is executed during setup. As a result, the
Windows group Everyone is granted full control o… |
CVE-2024-58356 | Medium | 6.3 | 2026-07-18 | SurrealDB before 2.1.4 silently fails to overwrite table definitions when the DEFINE TABLE ... OVERWRITE clause is used on tables defined with TYPE RELATION. B… |
CVE-2023-54366 | High | 8.8 | 2026-07-18 | SurrealDB before 1.0.1 sets default table permissions to FULL instead of NONE, allowing SELECT, CREATE, UPDATE, and DELETE operations on tables without explici… |
CVE-2026-40952 | High | 7.8 | 2026-07-15 | CVE-2026-40952 is a privilege misconfiguration
in the Secure Access installer for the Windows client and server prior to
version 14.55. Attackers with local ac… |
CVE-2026-61828 | | | 2026-07-15 | Nixpkgs is a collection of software packages that can be installed with the Nix package manager. Prior to the 25.11 and 26.05 channel fixes, the NixOS module f… |
CVE-2026-53657 | High | 8.2 | 2026-07-10 | Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to 2.1.3, on an instance of Lima running with the qemu driver, an arbit… |
CVE-2025-27464 | | | 2026-07-09 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The Windows PV drivers expose… |
CVE-2025-27463 | | | 2026-07-09 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The Windows PV drivers expose… |
CVE-2025-27462 | | | 2026-07-09 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]
The Windows PV drivers expos… |
CVE-2026-57895 | High | 7.8 | 2026-07-08 | Incorrect default permissions issue exists in Pupsman versions prior to 3.9.0. An attacker can place a malicious executable in the installation folder, which r… |
CVE-2026-57919 | High | 7.8 | 2026-06-29 | PBackupVSS.exe in Matrix42 Empirum before 25.5 and 26.x before 26.2 creates a named pipe (\\.\pipe\PBackupVSS) with a DACL that grants GENERIC_READ and GENERIC… |
CVE-2026-57924 | Medium | 4.3 | 2026-06-26 | In JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive user profile details |
CVE-2026-48935 | Low | 3.3 | 2026-06-26 | A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. `--allow-fs-read`.
This vulnera… |
CVE-2026-48725 | High | 8.1 | 2026-06-24 | Warp is an agentic development environment. From 0.2021.04.25.23.05.stable_00 until 0.2026.05.06.15.42.stable_01, Warp allows terminal output to request access… |
CVE-2026-56301 | Medium | 5.5 | 2026-06-23 | Nuxt 4.0.0 before 4.4.7 and 3.18.0 before 3.21.7, when running the development server (nuxt dev) on Linux, binds the vite-node IPC server to an abstract-namesp… |
CVE-2026-12602 | | | 2026-06-22 | Incorrect default permissions in ArubaSign, affecting versions prior to v4.6.6. The vulnerability is caused by the assignment of inappropriate permissions duri… |
CVE-2026-12823 | Low | 3.3 | 2026-06-22 | A security flaw has been discovered in Browserbase Skills up to 20260526. This impacts an unknown function of the component Autobrowse Trace Artifact Handler… |
CVE-2026-53870 | Medium | 5.5 | 2026-06-17 | Hermes Agent before 0.16.0 creates response_store.db and webhook_subscriptions.json with world-readable permissions (mode 0o644), exposing conversation history… |
CVE-2025-15642 | | | 2026-06-17 | Netskope is notified about a potential gap in its Netskoped Client for Windows systems where a malicious insider with admin privileges can lead to bypassing th… |
CVE-2026-50255 | Medium | 6.7 | 2026-06-16 | Incorrect default permissions issue exists in Optical Disc Archive Software for Windows 5.5.3 and earlier. If this vulnerability is exploited, arbitrary code m… |
CVE-2026-11931 | Medium | 5.5 | 2026-06-15 | Incorrect default permissions in Kiro IDE on macOS and Linux before version 0.11.133 could expose the authentication token cache file to other local users or p… |
CVE-2026-49157 | High | 8.8 | 2026-06-01 | Incorrect Default Permissions vulnerability in Apache ActiveMQ.
This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.
The default Jolok… |
CVE-2026-48191 | Low | 3.5 | 2026-06-01 | An incorrect handling of permissions in STORM powered by OTRS and in OTRS (2026.x and above) Document Search Article Meta Filters modules allows gaining knowle… |
CVE-2026-48190 | Low | 3.5 | 2026-06-01 | An incorrect handling of permissions in OTRS External Interface and the ConfigItem List module allows an authenticated customer to query the system for CI info… |
CVE-2026-33590 | | | 2026-05-28 | Insecure default settings of Portainer CE grant regular (non-admin) users privileges that allow host filesystem access and host-level code execution. An authen… |
CVE-2026-49237 | High | 7.8 | 2026-05-28 | An issue was discovered in Canonical Multipass for macOS before version 1.16.3 due to an incomplete fix for CVE-2025-5199. While the patch in version 1.16.0 up… |
CVE-2026-44469 | High | 7.8 | 2026-05-26 | The affected product extracts installation files to a temporary directory with incorrect default permissions during administrative installation. A low-privileg… |
CVE-2026-44468 | High | 7.8 | 2026-05-26 | The affected product creates a directory with insecure default permissions during administrative installation. This allows a low-privileged local attacker to m… |
CVE-2018-25359 | High | 8.4 | 2026-05-25 | Splinterware System Scheduler Pro 5.12 contains an insecure file permissions vulnerability that allows low-privilege users to escalate privileges by modifying… |
CVE-2025-32749 | Medium | 5.3 | 2026-05-22 | Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Exposure of Information Through Directory Listing vulnerability. An unauthenticated attacker with rem… |
CVE-2026-8487 | Medium | 6.5 | 2026-05-20 | Incorrect default permissions vulnerability in Progress Software MOVEit Automation allows Retrieve Embedded Sensitive Data.
This issue affects MOVEit Automati… |
CVE-2026-47107 | High | 8.1 | 2026-05-19 | Windmill prior to 1.703.2 contains an incorrect default permissions vulnerability in nsjail sandbox configuration files where /etc is bind-mounted without read… |
CVE-2025-48516 | | | 2026-05-15 | Insecure default configuration state of DDR5 memory module by AGESA Bootloader Firmware could allow an attacker with local user privilege to abuse the unprotec… |
CVE-2026-0432 | | | 2026-05-15 | Incorrect default permissions in the installation directory for the AMD chipset driver could allow an attacker to achieve privilege escalation resulting in arb… |
CVE-2025-48512 | | | 2026-05-15 | Incorrect default permissions in the installation directory for the AMD general-purpose input/output controller (GPIO) could allow an attacker to achieve privi… |
CVE-2026-27680 | Low | 3.1 | 2026-05-14 | Due to improper input handling under certain conditions, SAP NetWeaver Application Server ABAP allows an attacker to inject custom Cascading Style Sheets (CSS)… |
CVE-2026-36742 | Medium | 6.8 | 2026-05-13 | Hiseeu C90 v5.7.15 is vulnerable to Insecure Permissions. The UART bootloader is accessible when battery is disconnected (hidden/debug mode). |
CVE-2026-21015 | Medium | 5.5 | 2026-05-13 | Incorrect default permissions in FactoryCamera prior to SMR May-2026 Release 1 allows local attacker to access unique identifier. |
CVE-2026-20718 | | | 2026-05-12 | Incorrect default permissions for some Intel(R) NPU Driver software installers before version 32.0.100.4511 within Ring 3: User Applications may allow an escal… |
CVE-2026-41712 | High | 7.5 | 2026-05-12 | Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users. |
CVE-2026-45393 | High | 7.8 | 2026-05-12 | A vulnerability chain in Cribl Edge for Windows before 4.17.1 allows a local authenticated user to escalate privileges to NT AUTHORITY\SYSTEM. Incorrect defaul… |
CVE-2026-0539 | | | 2026-04-22 | Incorrect Default Permissions in pcvisit service binary on Windows allows a low-privileged local attacker to escalate their privileges by overwriting the servi… |
CVE-2026-6823 | High | 8.2 | 2026-04-21 | HKUDS OpenHarness prior to PR #147 remediation contains an insecure default configuration vulnerability where remote channels inherit allow_from = ["*"] permit… |
CVE-2026-6819 | High | 8.8 | 2026-04-21 | HKUDS OpenHarness prior to PR #156 remediation exposes plugin lifecycle commands including /plugin install, /plugin enable, /plugin disable, and /reload-plugin… |
CVE-2026-39454 | High | 7.8 | 2026-04-20 | SKYSEA Client View and SKYMEC IT Manager provided by Sky Co.,LTD. configure the installation folder with improper file access permission settings. A non-admini… |
CVE-2026-30811 | Medium | 6.5 | 2026-04-13 | Missing Authorization vulnerability allows Exposure of Sensitive Information via configuration endpoint. This issue affects Pandora FMS: from 777 through 800 |
CVE-2026-21013 | Medium | 5.5 | 2026-04-13 | Incorrect default permission in Galaxy Wearable prior to version 2.2.68.26 allows local attackers to access sensitive information. |
CVE-2026-25203 | High | 7.8 | 2026-04-10 | Samsung MagicINFO 9 Server Incorrect Default Permissions Local Privilege Escalation Vulnerability
This issue affects MagicINFO 9 Server: less than 21.1091.1. |
CVE-2025-58713 | Medium | 6.4 | 2026-04-08 | A container privilege escalation flaw was found in certain Red Hat Process Automation Manager images. This issue stems from the /etc/passwd file being created… |
CVE-2025-57854 | Medium | 6.4 | 2026-04-08 | A container privilege escalation flaw was found in certain OpenShift Update Service (OSUS) images. This issue stems from the /etc/passwd file being created wit… |
CVE-2025-57853 | Medium | 6.4 | 2026-04-08 | A container privilege escalation flaw was found in certain Web Terminal images. This issue stems from the /etc/passwd file being created with group-writable pe… |
CVE-2025-57851 | Medium | 6.4 | 2026-04-08 | A container privilege escalation flaw was found in certain Multicluster Engine for Kubernetes images. This issue stems from the /etc/passwd file being created… |
CVE-2025-57847 | Medium | 6.4 | 2026-04-08 | A container privilege escalation flaw was found in certain Ansible Automation Platform images. This issue arises from the /etc/passwd file being created with g… |
CVE-2025-7024 | High | 7.3 | 2026-04-03 | Incorrect Default Permissions vulnerability in AIRBUS PSS TETRA Connectivity Server on Windows Server OS allows Privilege Abuse.
An attacker may execute arbi… |
CVE-2026-21765 | High | 8.8 | 2026-04-02 | HCL BigFix Platform is affected by insecure permissions on private cryptographic keys. The private cryptographic keys located on a Windows host machine might… |
CVE-2026-34450 | Medium | 4.4 | 2026-03-31 | The Claude SDK for Python provides access to the Claude API from Python applications. From version 0.86.0 to before version 0.87.0, the local filesystem memory… |
CVE-2025-15615 | Medium | 5.8 | 2026-03-27 | Wazuh Manager authd service in wazuh-manager packages through version 4.7.3 contains an improper restriction of client-initiated SSL/TLS renegotiation vulnerab… |
CVE-2026-32983 | Medium | 5.8 | 2026-03-27 | Wazuh Manager authd service in wazuh-manager packages through version 4.7.3 contains an improper restriction of client-initiated SSL/TLS renegotiation vulnerab… |
CVE-2026-0748 | Medium | 4.3 | 2026-03-26 | In the Drupal 7 Internationalization (i18n) module, the i18n_node submodule allows a user with both "Translate content" and "Administer content translations" p… |
CVE-2026-32680 | High | 7.8 | 2026-03-26 | The installer of RATOC RAID Monitoring Manager for Windows allows to customize the installation folder. If the installation folder is customized to some non-de… |
CVE-2026-24063 | High | 8.2 | 2026-03-18 | When a plugin is installed using the Arturia Software Center (MacOS), it also installs an uninstall.sh bash script in a root owned path. This script is written… |
CVE-2016-20029 | Medium | 6.2 | 2026-03-16 | ZKTeco ZKBioSecurity 3.0 contains a file path manipulation vulnerability that allows attackers to access arbitrary files by modifying file paths used to retrie… |
CVE-2025-8766 | Medium | 6.4 | 2026-03-13 | A container privilege escalation flaw was found in certain Multi-Cloud Object Gateway Core images. This issue stems from the /etc/passwd file being created wit… |