CWE-732 · Incorrect Permission Assignment for Critical Resource (page 2)
Page 2 of 18 — CVEs classified under CWE-732, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-42812 | Critical | 9.9 | 2026-05-04 | In Apache Iceberg, the table's metadata files are control files: they tell readers which data files belong to the table and which table version to read. `wr… |
CVE-2026-6499 | | 2026-05-04 | Incorrect Permission Assignment for Critical Resource vulnerability in ILM Informatique OpenConcerto allows Replace Binaries. This issue affects OpenConcerto… | |
CVE-2026-41366 | Medium | 5.5 | 2026-04-28 | OpenClaw before 2026.3.31 contains a local roots self-whitelisting vulnerability in appendLocalMediaParentRoots that allows model-initiated arbitrary host file… |
CVE-2026-35367 | Low | 3.3 | 2026-04-22 | The nohup utility in uutils coreutils creates its default output file, nohup.out, without specifying explicit restricted permissions. This causes the file to i… |
CVE-2026-35341 | High | 7.1 | 2026-04-22 | A vulnerability in uutils coreutils mkfifo allows for the unauthorized modification of permissions on existing files. When mkfifo fails to create a FIFO becaus… |
CVE-2026-6842 | Low | 2.5 | 2026-04-22 | A flaw was found in nano. In environments with permissive umask settings, a local attacker can exploit incorrect directory permissions (0777 instead of 0700) f… |
CVE-2026-6386 | Medium | 6.2 | 2026-04-22 | In order to apply a particular protection key to an address range, the kernel must update the corresponding page table entries. The subroutine which handled t… |
CVE-2026-6369 | Medium | 5.5 | 2026-04-20 | An improper access control vulnerability in the canonical-livepatch snap client prior to version 10.15.0 allows a local unprivileged user to obtain a sensitive… |
CVE-2026-22676 | High | 7.8 | 2026-04-15 | Barracuda RMM versions prior to 2025.2.2 contain a privilege escalation vulnerability that allows local attackers to gain SYSTEM-level privileges by exploiting… |
CVE-2026-21727 | Low | 3.3 | 2026-04-15 | --- title: Cross-Tenant Legacy Correlation Disclosure and Deletion draft: false hero: image: /static/img/heros/hero-legal2.svg content: "# Cross-Tenant Leg… |
CVE-2025-41118 | Critical | 9.1 | 2026-04-15 | Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage (COS). If th… |
CVE-2026-21011 | Medium | 6.8 | 2026-04-13 | Incorrect privilege assignment in Bluetooth in Maintenance mode prior to SMR Apr-2026 Release 1 allows physical attackers to bypass Extend Unlock. |
CVE-2026-4482 | Medium | 5.5 | 2026-04-10 | The installer certificate files in the …/bootstrap/common/ssl folder do not seem to have restricted permissions on Windows systems (users have read and execute… |
CVE-2026-28264 | Low | 3.3 | 2026-04-08 | Dell PowerProtect Agent Service, version(s) prior to 20.1, contain(s) an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged… |
CVE-2026-33271 | Medium | 6.7 | 2026-04-02 | Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis True Image (Windows) before build 42902. |
CVE-2026-21765 | High | 8.8 | 2026-04-02 | HCL BigFix Platform is affected by insecure permissions on private cryptographic keys. The private cryptographic keys located on a Windows host machine might… |
CVE-2026-22768 | High | 7.3 | 2026-04-01 | Dell AppSync, version(s) 4.6.0, contain(s) an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access… |
CVE-2026-34450 | Medium | 4.4 | 2026-03-31 | The Claude SDK for Python provides access to the Claude API from Python applications. From version 0.86.0 to before version 0.87.0, the local filesystem memory… |
CVE-2026-21715 | Low | 3.3 | 2026-03-30 | A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable f… |
CVE-2026-34352 | High | 8.5 | 2026-03-26 | In TigerVNC before 1.16.2, Image.cxx in x0vncserver allows other users to observe or manipulate the screen contents, or cause an application crash, because of… |
CVE-2026-3113 | Medium | 5.0 | 2026-03-26 | Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to set permissions on downloaded bulk export which allows ot… |
CVE-2026-33430 | High | 7.3 | 2026-03-26 | Briefcase is a tool for converting a Python project into a standalone native application. Starting in version 0.3.0 and prior to version 0.3.26, if a developer… |
CVE-2026-4761 | High | 7.5 | 2026-03-25 | When a certificate and its private key are installed in the Windows machine certificate store using Network and Security tool, access rights to the private key… |
CVE-2026-28829 | Medium | 5.5 | 2026-03-25 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may… |
CVE-2026-20693 | Medium | 4.9 | 2026-03-25 | This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An attacker wit… |
CVE-2026-32048 | High | 7.5 | 2026-03-21 | OpenClaw versions prior to 2026.3.1 fail to enforce sandbox inheritance during cross-agent sessions_spawn operations, allowing sandboxed sessions to create chi… |
CVE-2026-32810 | Medium | 5.5 | 2026-03-20 | Halloy is an IRC application written in Rust. In versions on \*nix and macOS prior to commit f180e41061db393acf65bc99f5c5e7397586d9cb, halloy creates its confi… |
CVE-2026-25770 | Critical | 9.1 | 2026-03-17 | Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 3.9.0 and prior to version 4.14.3, a privileg… |
CVE-2026-28563 | Medium | 4.3 | 2026-03-17 | Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns the full DAG dependency graph without filtering by authorized DAG IDs. This allow… |
CVE-2026-26929 | Medium | 6.5 | 2026-03-17 | Apache Airflow versions 3.0.0 through 3.1.7 FastAPI DagVersion listing API does not apply per-DAG authorization filtering when the request is made with dag_id… |
CVE-2026-29516 | Medium | 4.9 | 2026-03-16 | Buffalo TeraStation NAS TS5400R firmware version 4.02-0.06 and prior contain an excessive file permissions vulnerability that allows authenticated attackers to… |
CVE-2026-32704 | Medium | 6.5 | 2026-03-16 | SiYuan is a personal knowledge management system. Prior to 3.6.1, POST /api/template/renderSprig lacks model.CheckAdminRole, allowing any authenticated user to… |
CVE-2025-15037 | | 2026-03-12 | An Incorrect Permission Assignment vulnerability exists in the ASUS Business System Control Interface driver. This vulnerability can be triggered by an unprivi… | |
CVE-2026-3315 | High | 7.8 | 2026-03-10 | Incorrect Default Permissions, : Execution with Unnecessary Privileges, : Incorrect Permission Assignment for Critical Resource vulnerability in ASSA ABLOY Vis… |
CVE-2026-24291 | High | 7.8 | 2026-03-10 | Incorrect permission assignment for critical resource in Windows Accessibility Infrastructure (ATBroker.exe) allows an authorized attacker to elevate privilege… |
CVE-2025-41712 | Medium | 6.5 | 2026-03-10 | An unauthenticated remote attacker who tricks a user to upload a manipulated HTML file can get access to sensitive information on the device. This is a result… |
CVE-2026-28725 | Medium | 5.5 | 2026-03-06 | Sensitive information disclosure due to improper configuration of a headless browser. The following products are affected: Acronis Cyber Protect 17 (Linux, Win… |
CVE-2025-30413 | Medium | 4.4 | 2026-03-06 | Credentials are not deleted from Acronis Agent after plan revocation. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Win… |
CVE-2025-11790 | Medium | 4.4 | 2026-03-06 | Credentials are not deleted from Acronis Agent after plan revocation. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Win… |
CVE-2026-29188 | Critical | 9.1 | 2026-03-05 | File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to ver… |
CVE-2026-29126 | High | 7.8 | 2026-03-05 | Incorrect permission assignment (world-writable file) in /etc/udhcpc/default.script in International Data Casting (IDC) SFX2100 Satellite Receiver allows a loc… |
CVE-2026-29125 | Medium | 4.7 | 2026-03-05 | IDC SFX2100 Satalite Recievers set the `/etc/resolv.conf` file to be world-writable by any local user, allowing DNS resolver tampering that can redirect networ… |
CVE-2025-12801 | Medium | 6.5 | 2026-03-04 | A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate the privileges assi… |
CVE-2025-70342 | Medium | 6.6 | 2026-03-04 | erase-install prior to v40.4 commit 2c31239 writes swiftDialog credential output to a hardcoded path /var/tmp/dialog.json. This allows an unauthenticated attac… |
CVE-2025-70341 | High | 7.8 | 2026-03-04 | Insecure permissions in App-Auto-Patch v3.4.2 create a race condition which allows attackers to write arbitrary files. |
CVE-2026-24732 | | 2026-03-04 | Files or Directories Accessible to External Parties, Incorrect Permission Assignment for Critical Resource vulnerability in Hallo Welt! GmbH BlueSpice (Extensi… | |
CVE-2026-2915 | High | 7.1 | 2026-03-03 | HP System Event Utility might allow denial of service with elevated arbitrary file writes. This potential vulnerability was remediated with HP S… |
CVE-2025-14604 | Medium | 6.6 | 2026-03-03 | IBM Storage Scale IBM S through rage Scale 5.2.3.0 - 5.2.3.5, and IBM S through rage Scale 6.0.0.0 - 6.0.0.1 could allow a local user to unintentionally trigge… |
CVE-2026-2637 | High | 7.8 | 2026-03-03 | iBoysoft NTFS for Mac contains a local privilege escalation vulnerability in its privileged helper daemon ntfshelperd. The daemon exposes an NSConnection servi… |
CVE-2026-21902 | Critical | 9.8 | 2026-02-25 | An Incorrect Permission Assignment for Critical Resource vulnerability in the On-Box Anomaly detection framework of Juniper Networks Junos OS Evolved on PTX Se… |
CVE-2026-26102 | High | 7.8 | 2026-02-20 | Incorrect Permission Assignment for Critical Resource in Owl opds 2.2.0.4 allows File Manipulation via a crafted network request. |
CVE-2026-26101 | High | 7.8 | 2026-02-20 | Incorrect Permission Assignment for Critical Resource in Owl opds 2.2.0.4 allows File Manipulation via a crafted network request. |
CVE-2026-26100 | Medium | 5.5 | 2026-02-20 | Incorrect Permission Assignment for Critical Resource in Owl opds 2.2.0.4 allows File Manipulation via a crafted network request. |
CVE-2026-26096 | Medium | 5.5 | 2026-02-20 | Incorrect Permission Assignment for Critical Resource in Owl opds 2.2.0.4 allows File Manipulation via a crafted network request. |
CVE-2026-26095 | Medium | 5.5 | 2026-02-20 | Incorrect Permission Assignment for Critical Resource in Owl opds 2.2.0.4 allows File Manipulation via a crafted network request. |
CVE-2026-24834 | Critical | 9.3 | 2026-02-19 | Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. In versions… |
CVE-2026-1344 | Medium | 6.5 | 2026-02-18 | Tanium addressed an insecure file permissions vulnerability in Enforce Recovery Key Portal. |
CVE-2025-33088 | High | 7.4 | 2026-02-17 | IBM Concert 1.0.0 through 2.1.0 could allow a local user with specific knowledge about the system's architecture to escalate their privileges due to incorrect… |
CVE-2026-23648 | High | 7.8 | 2026-02-17 | Glory RBG-100 recycler systems using the ISPK-08 software component contain multiple system binaries with overly permissive file permissions. Several binaries… |
CVE-2019-25344 | High | 7.8 | 2026-02-12 | Wondershare MobileGo 8.5.0 contains an insecure file permissions vulnerability that allows local users to modify executable files in the application directory… |
CVE-2019-25343 | High | 7.8 | 2026-02-12 | NextVPN 4.10 contains an insecure file permissions vulnerability that allows local users to modify executable files with full access rights. Attackers can repl… |
CVE-2025-61969 | | 2026-02-11 | Incorrect permission assignment in AMD µProf may allow a local user-privileged attacker to achieve privilege escalation, potentially resulting in arbitrary cod… | |
CVE-2025-35999 | Medium | 6.7 | 2026-02-10 | Incorrect permission assignment for critical resource for some System Firmware Update Utility (SysFwUpdt) for Intel(R) Server Boards and Intel(R) Server System… |
CVE-2025-14740 | Medium | 6.7 | 2026-02-04 | Docker Desktop for Windows contains multiple incorrect permission assignment vulnerabilities in the installer's handling of the C:\ProgramData\DockerDesktop di… |
CVE-2025-52627 | Medium | 5.5 | 2026-02-03 | Root File System Not Mounted as Read-Only configuration vulnerability. This can allow unintended modifications to critical system files, potentially increasing… |
CVE-2025-14988 | | 2026-01-27 | A security issue has been identified in ibaPDA that could allow unauthorized actions on the file system under certain conditions. This may impact the confident… | |
CVE-2020-36938 | High | 8.8 | 2026-01-27 | WinAVR version 20100110 contains an insecure permissions vulnerability that allows authenticated users to modify system files and executables. Attackers can le… |
CVE-2026-24131 | Medium | 5.5 | 2026-01-26 | pnpm is a package manager. Prior to version 10.28.2, when pnpm processes a package's `directories.bin` field, it uses `path.join()` without validating the resu… |
CVE-2026-0775 | High | 7.0 | 2026-01-23 | npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected… |
CVE-2026-22280 | Medium | 5.0 | 2026-01-22 | Dell PowerScale OneFS, versions 9.5.0.0 through 9.5.1.5, versions 9.6.0.0 through 9.7.1.10, versions 9.8.0.0 through 9.10.1.3, versions starting from 9.11.0.0… |
CVE-2026-24049 | High | 7.1 | 2026-01-22 | wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46.1, the unpack function is vulnerable t… |
CVE-2026-20092 | Medium | 6.0 | 2026-01-21 | A vulnerability in the read-only maintenance shell of Cisco Intersight Virtual Appliance could allow an authenticated, local attacker with administrative privi… |
CVE-2025-12985 | High | 8.4 | 2026-01-20 | IBM Licensing Operator incorrectly assigns privileges to security critical files which could allow a local root escalation inside a container running the IBM L… |
CVE-2021-47756 | High | 8.4 | 2026-01-16 | Laravel Valet versions 1.1.4 to 2.0.3 contain a local privilege escalation vulnerability that allows users to modify the valet command with root privileges. At… |
CVE-2025-59961 | Medium | 5.5 | 2026-01-15 | An Incorrect Permission Assignment for Critical Resource vulnerability in the Juniper DHCP daemon (jdhcpd) of Juniper Networks Junos OS and Junos OS Evolved al… |
CVE-2025-67246 | High | 7.3 | 2026-01-15 | A local information disclosure vulnerability exists in the Ludashi driver before 5.1025 due to a lack of access control in the IOCTL handler. This driver expos… |
CVE-2022-50931 | High | 7.8 | 2026-01-13 | TeamSpeak 3.5.6 contains an insecure file permissions vulnerability that allows local attackers to replace executable files with malicious binaries. Attackers… |
CVE-2025-69426 | | 2026-01-09 | The Ruckus vRIoT IoT Controller firmware versions prior to 3.0.0.0 (GA) contain hardcoded credentials for an operating system user account within an initializa… | |
CVE-2025-14979 | High | 7.8 | 2026-01-06 | AirVPN Eddie on MacOS contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root.This issue affects Eddie: 2.2… |
CVE-2020-36916 | High | 8.8 | 2026-01-06 | TDM Digital Signage PC Player 4.1.0.4 contains an elevation of privileges vulnerability that allows authenticated users to modify executable files. Attackers c… |
CVE-2021-47742 | High | 8.8 | 2025-12-31 | Epic Games Psyonix Rocket League <=1.95 contains an insecure permissions vulnerability that allows authenticated users to modify executable files with full acc… |
CVE-2025-64699 | High | 7.8 | 2025-12-31 | An incorrect NULL DACL issue exists in SevenCs ORCA G2 2.0.1.35 (EC2007 Kernel v5.22). The regService process, which runs with SYSTEM privileges, applies a Sec… |
CVE-2025-66723 | High | 7.5 | 2025-12-30 | inMusic Brands Engine DJ before 4.3.4 suffers from Insecure Permissions due to exposed HTTP service in the Remote Library, which allows attackers to access all… |
CVE-2019-25245 | High | 8.8 | 2025-12-24 | Ross Video DashBoard 8.5.1 contains an elevation of privileges vulnerability that allows authenticated users to modify executable files due to improper permiss… |
CVE-2025-13703 | High | 7.8 | 2025-12-23 | VIPRE Advanced Security Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privile… |
CVE-2022-50690 | High | 8.4 | 2025-12-22 | Wondershare MirrorGo 2.0.11.346 contains a local privilege escalation vulnerability due to incorrect file permissions on executable files. Unprivileged local u… |
CVE-2023-53949 | High | 8.4 | 2025-12-19 | AspEmail 5.6.0.2 contains a binary permission vulnerability that allows local users to escalate privileges through the Persits Software EmailAgent service. Att… |
CVE-2025-13941 | High | 8.8 | 2025-12-19 | A local privilege escalation vulnerability exists in the Foxit PDF Reader/Editor Update Service. During plugin installation, incorrect file system permissions… |
CVE-2025-68462 | Low | 3.2 | 2025-12-18 | Freedombox before 25.17.1 does not set proper permissions for the backups-data directory, allowing the reading of dump files of databases. |
CVE-2025-67794 | Medium | 6.1 | 2025-12-17 | An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 before 24.2.8, and 25.1 before 25.1.6. Directories and files created by the agent are created wi… |
CVE-2024-46062 | High | 7.8 | 2025-12-17 | Miniconda3 macOS installers before 23.11.0-1 contain a local privilege escalation vulnerability when installed outside the user's home directory. During instal… |
CVE-2024-46060 | High | 7.8 | 2025-12-17 | Anaconda3 macOS installers before 2024.06-1 contain a local privilege escalation vulnerability when installed outside the user's home directory. During install… |
CVE-2025-34288 | Medium | 6.7 | 2025-12-16 | Nagios XI versions prior to 2026R1.1 are vulnerable to local privilege escalation due to an unsafe interaction between sudo permissions and application file pe… |
CVE-2025-43470 | Medium | 5.5 | 2025-12-12 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.1. A standard user may be able to view files made from a… |
CVE-2025-13733 | High | 7.8 | 2025-12-12 | BuhoNTFS contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root via insecure functions.This issue affects… |
CVE-2025-40818 | Low | 3.3 | 2025-12-09 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP4). Affected applications contain private SSL/TLS keys on the server… |
CVE-2025-8148 | Medium | 4.2 | 2025-12-05 | An Improper Access Control in the SFTP service in Fortra's GoAnywhere MFT prior to version 7.9.0 allows Web Users with an Authentication Alias and a valid SSH… |
CVE-2025-20387 | High | 8.0 | 2025-12-03 | In Splunk Universal Forwarder for Windows versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, a new installation of or an upgrade to an affected version can resul… |
CVE-2025-20386 | High | 8.0 | 2025-12-03 | In Splunk Enterprise for Windows versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, a new installation of or an upgrade to an affected version can result in inco… |
CVE-2025-64642 | High | 8.0 | 2025-12-02 | NMIS/BioDose V22.02 and previous versions' installation directory paths by default have insecure file permissions, which in certain deployment scenarios can en… |