CVE-2026-19893 | Low | 3.1 | 2026-08-15 | A vulnerability was identified in D-Link DIR-842 2.01.B04. This impacts an unknown function of the file /etc/vsftpd.conf of the component vsftpd. Such manipula… |
CVE-2026-19841 | Low | 3.1 | 2026-08-14 | A flaw has been found in TRENDNET TEW-813DRU 1.01b01. Impacted is an unknown function of the file /etc/vsftpd.conf of the component vsftpd. This manipulation c… |
CVE-2026-63425 | High | 7.8 | 2026-08-13 | During an internal security assessment, a potential improper permissions vulnerability was discovered in Lenovo Dock Manager that could allow a local authentic… |
CVE-2025-52640 | Medium | 4.7 | 2026-08-13 | HCL AION is affected by a vulnerability where the shared storage used by product components is architected without sufficient access separation. Processes shar… |
CVE-2026-65940 | Medium | 6.8 | 2026-08-12 | In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can write arbitrary files to a web-accessible location on the host server. |
CVE-2026-48790 | Medium | 5.5 | 2026-08-11 | Turso CLI is the command line interface (CLI) to the open-source database Turso. Versions prior to 1.0.26 persist the user's Turso platform JWT to `settings.js… |
CVE-2026-59119 | High | 7.3 | 2026-08-11 | Incorrect default permissions in Microsoft PowerShell allows an authorized attacker to elevate privileges locally. |
CVE-2025-61970 | | | 2026-08-11 | Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to create arbitrary code, potentially resu… |
CVE-2025-48505 | | | 2026-08-11 | Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to achieve privileged escalation, potentia… |
CVE-2026-21074 | | | 2026-08-10 | Incorrect default permissions in Bixby prior to version 4.0.86.0 allows local attackers to execute arbitrary commands with Bixby privilege. |
CVE-2026-4793 | High | 7.3 | 2026-08-03 | An incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows local users to read or write arbitrary files and conduct denial-… |
CVE-2026-39875 | High | 7.8 | 2026-07-27 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A malicious… |
CVE-2026-39874 | High | 7.8 | 2026-07-27 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A malicious… |
CVE-2026-17497 | High | 8.3 | 2026-07-26 | NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default deskto… |
CVE-2026-16247 | High | 7.3 | 2026-07-20 | In _connect.BRAIN versions prior to 5.06,
the application LogPathConfig.exe is executed during setup. During this
process, existing permissions on %ProgramData… |
CVE-2026-16246 | High | 7.3 | 2026-07-20 | In BRAIN2 versions prior to 3.09, the
application LogPathConfig.exe is executed during setup. As a result, the
Windows group Everyone is granted full control o… |
CVE-2024-58356 | Medium | 6.3 | 2026-07-18 | SurrealDB before 2.1.4 silently fails to overwrite table definitions when the DEFINE TABLE ... OVERWRITE clause is used on tables defined with TYPE RELATION. B… |
CVE-2023-54366 | High | 8.8 | 2026-07-18 | SurrealDB before 1.0.1 sets default table permissions to FULL instead of NONE, allowing SELECT, CREATE, UPDATE, and DELETE operations on tables without explici… |
CVE-2026-40952 | High | 7.8 | 2026-07-15 | CVE-2026-40952 is a privilege misconfiguration
in the Secure Access installer for the Windows client and server prior to
version 14.55. Attackers with local ac… |
CVE-2026-61828 | | | 2026-07-15 | Nixpkgs is a collection of software packages that can be installed with the Nix package manager. Prior to the 25.11 and 26.05 channel fixes, the NixOS module f… |
CVE-2026-53657 | High | 8.2 | 2026-07-10 | Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to 2.1.3, on an instance of Lima running with the qemu driver, an arbit… |
CVE-2025-27464 | | | 2026-07-09 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The Windows PV drivers expose… |
CVE-2025-27463 | | | 2026-07-09 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The Windows PV drivers expose… |
CVE-2025-27462 | | | 2026-07-09 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]
The Windows PV drivers expos… |
CVE-2026-57895 | High | 7.8 | 2026-07-08 | Incorrect default permissions issue exists in Pupsman versions prior to 3.9.0. An attacker can place a malicious executable in the installation folder, which r… |
CVE-2026-57919 | High | 7.8 | 2026-06-29 | PBackupVSS.exe in Matrix42 Empirum before 25.5 and 26.x before 26.2 creates a named pipe (\\.\pipe\PBackupVSS) with a DACL that grants GENERIC_READ and GENERIC… |
CVE-2026-57924 | Medium | 4.3 | 2026-06-26 | In JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive user profile details |
CVE-2026-48935 | Low | 3.3 | 2026-06-26 | A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. `--allow-fs-read`.
This vulnera… |
CVE-2026-48725 | High | 8.1 | 2026-06-24 | Warp is an agentic development environment. From 0.2021.04.25.23.05.stable_00 until 0.2026.05.06.15.42.stable_01, Warp allows terminal output to request access… |
CVE-2026-56301 | Medium | 5.5 | 2026-06-23 | Nuxt 4.0.0 before 4.4.7 and 3.18.0 before 3.21.7, when running the development server (nuxt dev) on Linux, binds the vite-node IPC server to an abstract-namesp… |
CVE-2026-12602 | | | 2026-06-22 | Incorrect default permissions in ArubaSign, affecting versions prior to v4.6.6. The vulnerability is caused by the assignment of inappropriate permissions duri… |
CVE-2026-12823 | Low | 3.3 | 2026-06-22 | A security flaw has been discovered in Browserbase Skills up to 20260526. This impacts an unknown function of the component Autobrowse Trace Artifact Handler… |
CVE-2026-53870 | Medium | 5.5 | 2026-06-17 | Hermes Agent before 0.16.0 creates response_store.db and webhook_subscriptions.json with world-readable permissions (mode 0o644), exposing conversation history… |
CVE-2025-15642 | | | 2026-06-17 | Netskope is notified about a potential gap in its Netskoped Client for Windows systems where a malicious insider with admin privileges can lead to bypassing th… |
CVE-2026-50255 | Medium | 6.7 | 2026-06-16 | Incorrect default permissions issue exists in Optical Disc Archive Software for Windows 5.5.3 and earlier. If this vulnerability is exploited, arbitrary code m… |
CVE-2026-11931 | Medium | 5.5 | 2026-06-15 | Incorrect default permissions in Kiro IDE on macOS and Linux before version 0.11.133 could expose the authentication token cache file to other local users or p… |
CVE-2026-49157 | High | 8.8 | 2026-06-01 | Incorrect Default Permissions vulnerability in Apache ActiveMQ.
This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.
The default Jolok… |
CVE-2026-48191 | Low | 3.5 | 2026-06-01 | An incorrect handling of permissions in STORM powered by OTRS and in OTRS (2026.x and above) Document Search Article Meta Filters modules allows gaining knowle… |
CVE-2026-48190 | Low | 3.5 | 2026-06-01 | An incorrect handling of permissions in OTRS External Interface and the ConfigItem List module allows an authenticated customer to query the system for CI info… |
CVE-2026-33590 | | | 2026-05-28 | Insecure default settings of Portainer CE grant regular (non-admin) users privileges that allow host filesystem access and host-level code execution. An authen… |
CVE-2026-49237 | High | 7.8 | 2026-05-28 | An issue was discovered in Canonical Multipass for macOS before version 1.16.3 due to an incomplete fix for CVE-2025-5199. While the patch in version 1.16.0 up… |
CVE-2026-44469 | High | 7.8 | 2026-05-26 | The affected product extracts installation files to a temporary directory with incorrect default permissions during administrative installation. A low-privileg… |
CVE-2026-44468 | High | 7.8 | 2026-05-26 | The affected product creates a directory with insecure default permissions during administrative installation. This allows a low-privileged local attacker to m… |
CVE-2018-25359 | High | 8.4 | 2026-05-25 | Splinterware System Scheduler Pro 5.12 contains an insecure file permissions vulnerability that allows low-privilege users to escalate privileges by modifying… |
CVE-2025-32749 | Medium | 5.3 | 2026-05-22 | Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Exposure of Information Through Directory Listing vulnerability. An unauthenticated attacker with rem… |
CVE-2026-8487 | Medium | 6.5 | 2026-05-20 | Incorrect default permissions vulnerability in Progress Software MOVEit Automation allows Retrieve Embedded Sensitive Data.
This issue affects MOVEit Automati… |
CVE-2026-47107 | High | 8.1 | 2026-05-19 | Windmill prior to 1.703.2 contains an incorrect default permissions vulnerability in nsjail sandbox configuration files where /etc is bind-mounted without read… |
CVE-2025-48516 | | | 2026-05-15 | Insecure default configuration state of DDR5 memory module by AGESA Bootloader Firmware could allow an attacker with local user privilege to abuse the unprotec… |
CVE-2026-0432 | | | 2026-05-15 | Incorrect default permissions in the installation directory for the AMD chipset driver could allow an attacker to achieve privilege escalation resulting in arb… |
CVE-2025-48512 | | | 2026-05-15 | Incorrect default permissions in the installation directory for the AMD general-purpose input/output controller (GPIO) could allow an attacker to achieve privi… |
CVE-2026-27680 | Low | 3.1 | 2026-05-14 | Due to improper input handling under certain conditions, SAP NetWeaver Application Server ABAP allows an attacker to inject custom Cascading Style Sheets (CSS)… |
CVE-2026-36742 | Medium | 6.8 | 2026-05-13 | Hiseeu C90 v5.7.15 is vulnerable to Insecure Permissions. The UART bootloader is accessible when battery is disconnected (hidden/debug mode). |
CVE-2026-21015 | Medium | 5.5 | 2026-05-13 | Incorrect default permissions in FactoryCamera prior to SMR May-2026 Release 1 allows local attacker to access unique identifier. |
CVE-2026-20718 | | | 2026-05-12 | Incorrect default permissions for some Intel(R) NPU Driver software installers before version 32.0.100.4511 within Ring 3: User Applications may allow an escal… |
CVE-2026-41712 | High | 7.5 | 2026-05-12 | Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users. |
CVE-2026-45393 | High | 7.8 | 2026-05-12 | A vulnerability chain in Cribl Edge for Windows before 4.17.1 allows a local authenticated user to escalate privileges to NT AUTHORITY\SYSTEM. Incorrect defaul… |
CVE-2026-0539 | | | 2026-04-22 | Incorrect Default Permissions in pcvisit service binary on Windows allows a low-privileged local attacker to escalate their privileges by overwriting the servi… |
CVE-2026-6823 | High | 8.2 | 2026-04-21 | HKUDS OpenHarness prior to PR #147 remediation contains an insecure default configuration vulnerability where remote channels inherit allow_from = ["*"] permit… |
CVE-2026-6819 | High | 8.8 | 2026-04-21 | HKUDS OpenHarness prior to PR #156 remediation exposes plugin lifecycle commands including /plugin install, /plugin enable, /plugin disable, and /reload-plugin… |
CVE-2026-39454 | High | 7.8 | 2026-04-20 | SKYSEA Client View and SKYMEC IT Manager provided by Sky Co.,LTD. configure the installation folder with improper file access permission settings. A non-admini… |
CVE-2026-30811 | Medium | 6.5 | 2026-04-13 | Missing Authorization vulnerability allows Exposure of Sensitive Information via configuration endpoint. This issue affects Pandora FMS: from 777 through 800 |
CVE-2026-21013 | Medium | 5.5 | 2026-04-13 | Incorrect default permission in Galaxy Wearable prior to version 2.2.68.26 allows local attackers to access sensitive information. |
CVE-2026-25203 | High | 7.8 | 2026-04-10 | Samsung MagicINFO 9 Server Incorrect Default Permissions Local Privilege Escalation Vulnerability
This issue affects MagicINFO 9 Server: less than 21.1091.1. |
CVE-2025-58713 | Medium | 6.4 | 2026-04-08 | A container privilege escalation flaw was found in certain Red Hat Process Automation Manager images. This issue stems from the /etc/passwd file being created… |
CVE-2025-57854 | Medium | 6.4 | 2026-04-08 | A container privilege escalation flaw was found in certain OpenShift Update Service (OSUS) images. This issue stems from the /etc/passwd file being created wit… |
CVE-2025-57853 | Medium | 6.4 | 2026-04-08 | A container privilege escalation flaw was found in certain Web Terminal images. This issue stems from the /etc/passwd file being created with group-writable pe… |
CVE-2025-57851 | Medium | 6.4 | 2026-04-08 | A container privilege escalation flaw was found in certain Multicluster Engine for Kubernetes images. This issue stems from the /etc/passwd file being created… |
CVE-2025-57847 | Medium | 6.4 | 2026-04-08 | A container privilege escalation flaw was found in certain Ansible Automation Platform images. This issue arises from the /etc/passwd file being created with g… |
CVE-2025-7024 | High | 7.3 | 2026-04-03 | Incorrect Default Permissions vulnerability in AIRBUS PSS TETRA Connectivity Server on Windows Server OS allows Privilege Abuse.
An attacker may execute arbi… |
CVE-2026-21765 | High | 8.8 | 2026-04-02 | HCL BigFix Platform is affected by insecure permissions on private cryptographic keys. The private cryptographic keys located on a Windows host machine might… |
CVE-2026-34450 | Medium | 4.4 | 2026-03-31 | The Claude SDK for Python provides access to the Claude API from Python applications. From version 0.86.0 to before version 0.87.0, the local filesystem memory… |
CVE-2025-15615 | Medium | 5.8 | 2026-03-27 | Wazuh Manager authd service in wazuh-manager packages through version 4.7.3 contains an improper restriction of client-initiated SSL/TLS renegotiation vulnerab… |
CVE-2026-32983 | Medium | 5.8 | 2026-03-27 | Wazuh Manager authd service in wazuh-manager packages through version 4.7.3 contains an improper restriction of client-initiated SSL/TLS renegotiation vulnerab… |
CVE-2026-0748 | Medium | 4.3 | 2026-03-26 | In the Drupal 7 Internationalization (i18n) module, the i18n_node submodule allows a user with both "Translate content" and "Administer content translations" p… |
CVE-2026-32680 | High | 7.8 | 2026-03-26 | The installer of RATOC RAID Monitoring Manager for Windows allows to customize the installation folder. If the installation folder is customized to some non-de… |
CVE-2026-24063 | High | 8.2 | 2026-03-18 | When a plugin is installed using the Arturia Software Center (MacOS), it also installs an uninstall.sh bash script in a root owned path. This script is written… |
CVE-2016-20029 | Medium | 6.2 | 2026-03-16 | ZKTeco ZKBioSecurity 3.0 contains a file path manipulation vulnerability that allows attackers to access arbitrary files by modifying file paths used to retrie… |
CVE-2025-8766 | Medium | 6.4 | 2026-03-13 | A container privilege escalation flaw was found in certain Multi-Cloud Object Gateway Core images. This issue stems from the /etc/passwd file being created wit… |
CVE-2025-57849 | Medium | 6.4 | 2026-03-13 | A container privilege escalation flaw was found in certain Fuse images. This issue stems from the /etc/passwd file being created with group-writable permission… |
CVE-2026-3315 | High | 7.8 | 2026-03-10 | Incorrect Default Permissions, : Execution with Unnecessary Privileges, : Incorrect Permission Assignment for Critical Resource vulnerability in ASSA ABLOY Vis… |
CVE-2026-26131 | High | 7.8 | 2026-03-10 | Incorrect default permissions in .NET allows an authorized attacker to elevate privileges locally. |
CVE-2026-28267 | Medium | 5.5 | 2026-03-10 | Multiple i-フィルター products are configured with improper file access permission settings. Files may be created or overwritten in the system directory or backup d… |
CVE-2026-28727 | High | 7.8 | 2026-03-06 | Local privilege escalation due to insecure Unix socket permissions. The following products are affected: Acronis Cyber Protect 17 (macOS) before build 41186, A… |
CVE-2026-28717 | Medium | 5.0 | 2026-03-06 | Local privilege escalation due to improper directory permissions. The following products are affected: Acronis Cyber Protect 17 (Windows) before build 41186. |
CVE-2026-26034 | High | 7.8 | 2026-03-05 | UPS Multi-UPS Management Console (MUMC) version 01.06.0001 (A03) contains an Incorrect Default Permissions (CWE-276) vulnerability that allows an attacker to e… |
CVE-2026-21423 | Medium | 6.7 | 2026-03-04 | Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an incorrect default permissions vulnerability. A high privi… |
CVE-2026-2915 | High | 7.1 | 2026-03-03 | HP System Event Utility might allow denial of service with elevated arbitrary file writes. This potential vulnerability was
remediated with HP S… |
CVE-2026-27653 | Medium | 6.7 | 2026-02-27 | The installers for multiple products provided by Soliton Systems K.K. contain an issue with incorrect default permissions, which may allow arbitrary code to be… |
CVE-2026-23703 | High | 7.8 | 2026-02-26 | The installer of FinalCode Client provided by Digital Arts Inc. contains an incorrect default permissions vulnerability. A non-administrative user may execute… |
CVE-2025-1789 | High | 7.8 | 2026-02-24 | Local privilege escalation in Genetec Update Service. An authenticated, low-privileged, Windows user could exploit this vulnerability to gain elevated privileg… |
CVE-2026-2026 | Medium | 6.1 | 2026-02-13 | A vulnerability has been identified where weak file permissions in the Nessus Agent directory on Windows hosts could allow unauthorized access, potentially per… |
CVE-2025-36522 | Medium | 6.7 | 2026-02-10 | Incorrect default permissions for some Intel(R) Chipset Software before version 10.1.20266.8668 or later. within Ring 3: User Applications may allow an escalat… |
CVE-2025-36511 | Medium | 6.7 | 2026-02-10 | Incorrect default permissions for some Intel(R) Memory and Storage Tool before version 2.5.2 within Ring 3: User Applications may allow an escalation of privil… |
CVE-2025-32453 | Medium | 6.7 | 2026-02-10 | Incorrect default permissions for some Intel(R) Graphics Driver software within Ring 2: Privileged Process may allow an escalation of privilege. Unprivileged s… |
CVE-2025-31655 | Medium | 6.7 | 2026-02-10 | Incorrect default permissions for some Intel(R) Battery Life Diagnostic Tool within Ring 3: User Applications may allow an escalation of privilege. Unprivilege… |
CVE-2025-22849 | Medium | 6.7 | 2026-02-10 | Incorrect default permissions for the Intel(R) Optane(TM) PMem management software before versions CR_MGMT_01.00.00.3584, CR_MGMT_02.00.00.4052, CR_MGMT_03.00… |
CVE-2026-25931 | High | 7.8 | 2026-02-09 | vscode-spell-checker is a basic spell checker that works well with code and documents. Prior to v4.5.4, DocumentSettings._determineIsTrusted treats the configu… |
CVE-2020-37160 | Medium | 6.2 | 2026-02-07 | SprintWork 2.3.1 contains multiple local privilege escalation vulnerabilities through insecure file, service, and folder permissions on Windows systems. Local… |
CVE-2025-15343 | Medium | 6.5 | 2026-02-05 | Tanium addressed an incorrect default permissions vulnerability in Enforce. |
CVE-2025-15341 | Medium | 6.5 | 2026-02-05 | Tanium addressed an incorrect default permissions vulnerability in Benchmark. |