CVE-2026-58510 | Medium | 4.3 | 2026-08-13 | GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private |
CVE-2025-14779 | Low | 3.8 | 2026-08-06 | The Secret Type Management REST API does not correctly isolate access controls when deleting a secret type. The on-delete cascade logic, when triggered, fails… |
CVE-2026-23556 | | | 2026-07-09 | When oxenstored is tearing a domain down, the node data is cleaned up
but the usage counts are leaked.
When the domain ID is eventually reused, the new domain… |
CVE-2026-58494 | Medium | 6.5 | 2026-07-08 | Wasmtime is a runtime for WebAssembly. Prior to 24.0.11, 36.0.12, 45.0.3, and 46.0.1, wasmtime-wasi hard-link creation and renaming check directory permissions… |
CVE-2026-4360 | Medium | 5.3 | 2026-06-30 | In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrust… |
CVE-2026-44947 | | | 2026-06-30 | A missing clean-up in the legacy Project Role Template Binding (PRTB)
reconciler in Rancher versions 2.13.0 up to 2.13.7 and 2.14.0 up to 2.14.3 allowed users… |
CVE-2026-40767 | High | 7.5 | 2026-06-15 | Unauthenticated Broken Access Control in wpForo Forum < 3.0.2 versions. |
CVE-2024-47270 | Low | 2.7 | 2026-05-27 | Improper preservation of permissions vulnerability in Archiving Push functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows re… |
CVE-2026-44832 | High | 8.8 | 2026-05-26 | Snipe-IT is an IT asset/license management system. Prior to 8.4.1, aAn authenticated user with only users.edit permission can escalate their own privileges to… |
CVE-2026-24194 | High | 7.8 | 2026-05-26 | NVIDIA Display Driver for Linux contains a vulnerability in a kernel mode layer handler, where a user could cause improper permission handling. A successful ex… |
CVE-2026-39832 | Critical | 9.1 | 2026-05-22 | When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrict… |
CVE-2026-39828 | Medium | 6.3 | 2026-05-22 | When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially droppi… |
CVE-2026-34744 | | | 2026-05-19 | Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior permit a user to list and download their own attachments from an Issue… |
CVE-2026-34600 | Medium | 5.7 | 2026-05-19 | Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions 3.5.2 and prior contain a logic error in the… |
CVE-2026-25850 | Medium | 5.5 | 2026-05-19 | in OpenHarmony v6.0 and prior versions allow a local attacker cause information leak |
CVE-2025-8325 | Medium | 6.3 | 2026-05-11 | The software fails to enforce role-based access controls for certain Gateway API invocations. Users with the 'Internal/Everyone' role can invoke these APIs, by… |
CVE-2026-35361 | Low | 3.4 | 2026-04-22 | The mknod utility in uutils coreutils fails to handle security labels atomically by creating device nodes before setting the SELinux context. If labeling fails… |
CVE-2026-35351 | Medium | 4.2 | 2026-04-22 | The mv utility in uutils coreutils fails to preserve file ownership during moves across different filesystem boundaries. The utility falls back to a copy-and-d… |
CVE-2026-35350 | Medium | 6.6 | 2026-04-22 | The cp utility in uutils coreutils fails to properly handle setuid and setgid bits when ownership preservation fails. When copying with the -p (preserve) flag… |
CVE-2026-35385 | High | 7.5 | 2026-04-02 | In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is perform… |
CVE-2026-24834 | Critical | 9.3 | 2026-02-19 | Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. In versions… |
CVE-2025-69875 | High | 7.8 | 2026-02-03 | A vulnerability exists in Quick Heal Total Security 23.0.0 in the quarantine management component where insufficient validation of restore paths and improper p… |
CVE-2025-9615 | Low | 3.3 | 2026-01-26 | A flaw was found in NetworkManager. The NetworkManager package allows access to files that may belong to other users. NetworkManager allows non-root users to c… |
CVE-2025-55130 | Critical | 9.1 | 2026-01-20 | A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By… |
CVE-2024-12125 | High | 7.5 | 2025-11-06 | A flaw was found in the 3scale Developer Portal. When creating or updating an account in the Developer Portal UI it is possible to modify fields explicitly con… |
CVE-2025-37735 | High | 7.0 | 2025-11-06 | Improper preservation of permissions in Elastic Defend on Windows hosts can lead to arbitrary files on the system being deleted by the Defend service running a… |
CVE-2025-34298 | High | 8.8 | 2025-10-30 | Nagios Log Server versions prior to 2024R1.3.2 contain a privilege escalation vulnerability in the account email-change workflow. A user could set their own em… |
CVE-2023-32199 | Medium | 4.3 | 2025-10-29 | A vulnerability has been identified within Rancher
Manager, where after removing a custom GlobalRole that gives
administrative access or the corresponding bi… |
CVE-2025-26420 | Medium | 4.4 | 2025-09-04 | In multiple functions of GrantPermissionsActivity.java , there is a possible way to trick the user into granting the incorrect permission due to permission ove… |
CVE-2025-7346 | | | 2025-07-08 | Any unauthenticated attacker can bypass the localhost
restrictions posed by the application and utilize this to create
arbitrary packages |
CVE-2025-43701 | High | 7.5 | 2025-06-10 | Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows exposure of Custom Settings data.
This impacts OmniStudio: bef… |
CVE-2025-43700 | High | 7.5 | 2025-06-10 | Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows exposure of encrypted data.
This impacts OmniStudio: before Sp… |
CVE-2025-43698 | Critical | 9.1 | 2025-06-10 | Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows bypass of field level security controls for Salesforce objects… |
CVE-2025-43697 | High | 7.5 | 2025-06-10 | Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (DataMapper) allows exposure of encrypted data.
This impacts OmniStudio: before Spr… |
CVE-2025-27563 | Low | 3.3 | 2025-06-08 | in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information leak through get permission. |
CVE-2025-27247 | Medium | 5.5 | 2025-06-08 | in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information leak through get permission. |
CVE-2025-26693 | Low | 3.3 | 2025-06-08 | in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information leak through get permission. |
CVE-2025-26691 | Medium | 5.5 | 2025-06-08 | in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information leak through get permission. |
CVE-2024-46941 | | | 2025-06-06 | SystemUI has an incorrect component protection setting, which allows access to specific information. |
CVE-2025-43026 | High | 7.8 | 2025-06-05 | A potential security vulnerability has been identified in the HP Support Assistant for versions prior to 9.44.18.0. The vulnerability could potentially allow a… |
CVE-2025-27703 | Medium | 6.0 | 2025-05-28 | CVE-2025-27703 is a privilege escalation vulnerability in the management
console of Absolute Secure Access prior to version 13.54. Attackers
with administrat… |
CVE-2024-57698 | High | 7.5 | 2025-04-29 | An issue in modernwms v.1.0 allows an attacker view the MD5 hash of the administrator password and other attributes without authentication, even after initial… |
CVE-2025-32697 | | | 2025-04-10 | Improper Preservation of Permissions vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/editpage/Int… |
CVE-2025-32696 | | | 2025-04-10 | Improper Preservation of Permissions vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/actions/Reve… |
CVE-2025-31184 | High | 7.8 | 2025-03-31 | This issue was addressed with improved permissions checking. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, visionOS 2.4. An… |
CVE-2025-30456 | High | 7.8 | 2025-03-31 | A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia… |
CVE-2025-30449 | High | 7.8 | 2025-03-31 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app ma… |
CVE-2025-25871 | High | 8.0 | 2025-03-14 | An issue in Open Panel v.0.3.4 allows a remote attacker to escalate privileges via the Fix Permissions function |
CVE-2025-25711 | High | 8.8 | 2025-03-12 | An issue in dtp.ae tNexus Airport View v.2.8 allows a remote attacker to escalate privileges via the ProfileID value to the [/tnexus/rest/admin/updateUser] API… |
CVE-2024-56192 | High | 7.8 | 2025-03-10 | In wl_notify_gscan_event of wl_cfgscan.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privile… |
CVE-2024-56191 | High | 8.4 | 2025-03-10 | In dhd_process_full_gscan_result of dhd_pno.c, there is a possible EoP due to an integer overflow. This could lead to local escalation of privilege with no add… |
CVE-2025-0914 | Low | 3.8 | 2025-02-27 | An improper access control issue in the VQL shell feature in Velociraptor Versions < 0.73.4 allowed authenticated users to execute the execve() plugin in deplo… |
CVE-2024-56973 | Critical | 9.8 | 2025-02-14 | Insecure Permissions vulnerability in Alvaria, Inc Unified IP Unified Director before v.7.2SP2 allows a remote attacker to execute arbitrary code via the sourc… |
CVE-2024-53994 | Medium | 4.3 | 2025-02-04 | Discourse is an open source platform for community discussion. In affected versions users who disable chat in preferences could still be reachable in some case… |
CVE-2024-53355 | High | 8.8 | 2025-01-31 | Multiple incorrect access control issues in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote authenticated attackers, with low privileges, to (1)… |
CVE-2025-24791 | Medium | 4.4 | 2025-01-29 | snowflake-connector-nodejs is a NodeJS driver for Snowflake. Snowflake discovered and remediated a vulnerability in the Snowflake NodeJS Driver. File permissio… |
CVE-2024-57439 | Medium | 4.9 | 2025-01-29 | An issue in the reset password interface of ruoyi v4.8.0 allows attackers with Admin privileges to cause a Denial of Service (DoS) by duplicating the login nam… |
CVE-2024-40672 | High | 8.4 | 2025-01-28 | In onCreate of ChooserActivity.java, there is a possible way to bypass factory reset protections due to a missing permission check. This could lead to local es… |
CVE-2024-56178 | Medium | 6.5 | 2025-01-27 | An issue was discovered in Couchbase Server 7.6.x through 7.6.3. A user with the security_admin_local role can create a new user in a group that has the admin… |
CVE-2025-24087 | Medium | 5.5 | 2025-01-27 | The issue was addressed with additional permissions checks. This issue is fixed in macOS Sequoia 15.3. An app may be able to access protected user data. |
CVE-2024-54557 | High | 7.5 | 2025-01-27 | A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An attacker may g… |
CVE-2024-54516 | Low | 3.3 | 2025-01-27 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2. An app may be able to approve a… |
CVE-2025-21544 | Medium | 5.4 | 2025-01-21 | Vulnerability in the Oracle Communications Order and Service Management product of Oracle Communications Applications (component: Security). Supported version… |
CVE-2025-21541 | Medium | 5.4 | 2025-01-21 | Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Admin Screens and Grants UI). Supported versions that are affected are 12… |
CVE-2025-22620 | Medium | 5.0 | 2025-01-20 | gitoxide is an implementation of git written in Rust. Prior to 0.17.0, gix-worktree-state specifies 0777 permissions when checking out executable files, intend… |
CVE-2025-24337 | High | 8.4 | 2025-01-20 | WriteFreely through 0.15.1, when MySQL is used, allows local users to discover credentials by reading config.ini. |
CVE-2023-42231 | High | 8.1 | 2025-01-13 | Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Incorrect Access Control. Low privileged users can delete admin users by sending a request… |
CVE-2023-42228 | High | 8.8 | 2025-01-13 | Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Incorrect Access Control. Low privileged users can edit their own ACL rules by sending a re… |
CVE-2024-46310 | Critical | 9.1 | 2025-01-13 | Incorrect Access Control in Cfx.re FXServer v9601 and earlier allows unauthenticated users to modify and read arbitrary user data via exposed API endpoint |
CVE-2024-52869 | Medium | 6.0 | 2025-01-08 | Certain Teradata account-handling code through 2024-11-04, used with SUSE Enterprise Linux Server, mismanages groups. Specifically, when there is an operating… |
CVE-2024-54818 | High | 8.8 | 2025-01-08 | SourceCodester Computer Laboratory Management System 1.0 is vulnerable to Incorrect Access Control. via /php-lms/admin/?page=user/list. |
CVE-2024-53934 | High | 7.7 | 2025-01-06 | The com.windymob.callscreen.ringtone.callcolor.colorphone (aka Color Phone Call Screen Themes) application through 1.1.2 for Android enables any application (w… |
CVE-2024-54880 | Critical | 9.1 | 2025-01-06 | SeaCMS V13.1 is vulnerable to Incorrect Access Control. A logic flaw can be exploited by an attacker to allow any user to register accounts in bulk. |
CVE-2024-54879 | Critical | 9.1 | 2025-01-06 | SeaCMS V13.1 is vulnerable to Incorrect Access Control. A logic flaw can be exploited by an attacker to allow any user to recharge members indefinitely. |
CVE-2024-46622 | Critical | 9.8 | 2025-01-06 | An Escalation of Privilege security vulnerability was found in SecureAge Security Suite software 7.0.x before 7.0.38, 7.1.x before 7.1.11, 8.0.x before 8.0.18… |
CVE-2024-55507 | Critical | 9.8 | 2025-01-03 | An issue in CodeAstro Complaint Management System v.1.0 allows a remote attacker to escalate privileges via the delete_e.php component. |
CVE-2024-44223 | Medium | 4.6 | 2024-12-20 | This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.1. An attacker with physical access to a Mac may be able to… |
CVE-2024-44211 | Medium | 5.5 | 2024-12-20 | This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.1. An app may be able to access user-sensitive data. |
CVE-2023-42867 | High | 7.8 | 2024-12-20 | This issue was addressed with improved validation of the process entitlement and Team ID. This issue is fixed in GarageBand 10.4.9. An app may be able to gain… |
CVE-2024-56317 | High | 7.5 | 2024-12-18 | In Matter (aka connectedhomeip or Project CHIP) through 1.4.0.0, the WriteAcl function deletes all existing ACL entries first, and then attempts to recreate th… |
CVE-2024-37649 | Medium | 4.6 | 2024-12-18 | Insecure Permissions vulnerability in SecureSTATION v.2.5.5.3116-S50-SMA-B20160811A and before allows a physically proximate attacker to obtain sensitive infor… |
CVE-2024-54515 | High | 7.8 | 2024-12-12 | A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.2. A malicious app may be able to gain root privileges. |
CVE-2024-54513 | Medium | 5.5 | 2024-12-12 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, tvOS 18.2, visionOS 2.2, w… |
CVE-2024-54484 | Medium | 5.5 | 2024-12-12 | The issue was resolved by sanitizing logging. This issue is fixed in macOS Sequoia 15.2. An app may be able to access user-sensitive data. |
CVE-2024-54465 | Critical | 9.8 | 2024-12-12 | A logic issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.2. An app may be able to elevate privileges. |
CVE-2024-50931 | Medium | 4.6 | 2024-12-10 | Silicon Labs Z-Wave Series 500 v6.84.0 was discovered to contain insecure permissions. |
CVE-2024-50930 | High | 8.8 | 2024-12-10 | An issue in Silicon Labs Z-Wave Series 500 v6.84.0 allows attackers to execute arbitrary code. |
CVE-2024-50929 | Medium | 6.2 | 2024-12-10 | Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to arbitrarily change the device type in the controller's memor… |
CVE-2024-50928 | Medium | 6.5 | 2024-12-10 | Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to change the wakeup interval of end devices in controller memo… |
CVE-2024-50924 | Medium | 6.5 | 2024-12-10 | Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to cause disrupt communications between the controller and the… |
CVE-2024-50921 | Medium | 6.5 | 2024-12-10 | Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to cause a Denial of Service (DoS) via repeatedly sending craft… |
CVE-2024-50920 | High | 8.8 | 2024-12-10 | Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to create a fake node via supplying crafted packets. |
CVE-2024-41650 | Critical | 9.8 | 2024-12-06 | Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a cra… |
CVE-2024-41649 | Critical | 9.8 | 2024-12-06 | Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a cra… |
CVE-2024-41648 | Critical | 9.8 | 2024-12-06 | Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a cra… |
CVE-2024-41646 | Critical | 9.8 | 2024-12-06 | Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a cra… |
CVE-2024-41645 | Critical | 9.8 | 2024-12-06 | Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a cra… |
CVE-2024-41644 | Critical | 9.8 | 2024-12-06 | Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via the d… |
CVE-2024-37575 | High | 7.5 | 2024-12-04 | The Mister org.mistergroup.shouldianswer application 1.4.264 for Android enables any installed application (with no permissions) to place phone calls without u… |
CVE-2024-43784 | Medium | 5.7 | 2024-11-26 | lakeFS is an open-source tool that transforms object storage into a Git-like repository. Existing lakeFS users who have issued credentials to users who have be… |