CWE-732 · Incorrect Permission Assignment for Critical Resource (page 2)
Page 2 of 18 — CVEs classified under CWE-732, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-9085 | High | 8.8 | 2026-07-05 | Incorrect Permission Assignment for Critical Resource, Improper Access Control vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus-… |
CVE-2026-58424 | High | 8.9 | 2026-07-03 | Permanent Fork PR Workflow Approval Gate Bypass |
CVE-2026-44268 | Medium | 4.4 | 2026-07-03 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30… |
CVE-2026-13079 | High | 7.8 | 2026-07-03 | A local privilege escalation vulnerability in the WatchGuard Mobile VPN with SSL client for Windows allows a local attacker to escalate their privileges to NT… |
CVE-2026-13769 | Medium | 5.5 | 2026-07-01 | Overly permissive file permissions in AWS CLI before 1.44.78 (v1) and 2.34.29 (v2) on Unix-like systems where the umask has not been configured to restrict fil… |
CVE-2026-58174 | Medium | 6.5 | 2026-06-30 | Hermes WebUI before 0.51.521 validates the workspace of an imported session under the active named profile but constructs the Session object without setting it… |
CVE-2026-43721 | Medium | 6.5 | 2026-06-29 | This issue was addressed through improved state management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6… |
CVE-2026-55441 | High | 8.6 | 2026-06-26 | mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.6.4, mise's trust feature gates config files (mise.toml, .tool-versions) through… |
CVE-2026-9651 | Medium | 4.4 | 2026-06-25 | CWE-732 Incorrect Permission Assignment for Critical Resource vulnerability that could cause unauthorized disclosure of password hashes and potential account c… |
CVE-2026-32315 | Medium | 5.5 | 2026-06-24 | motionEye (mEye) is an online interface for motion software, a video surveillance program with motion detection. Versions prior to 0.44.0 create the configurat… |
CVE-2026-54327 | Low | 2.2 | 2026-06-23 | Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi stored API keys and OAuth credentials in auth.json. A race condition in the file write pa… |
CVE-2026-12957 | High | 7.8 | 2026-06-23 | Improper trust boundary enforcement in Language Servers for AWS before version 1.65.0 on all supported platforms may allow a for arbitrary code execution. If a… |
CVE-2026-49340 | High | 8.1 | 2026-06-19 | gonic is a music streaming server / free-software subsonic server API implementation. Prior to version 0.21.0, a logic error in `ServeCreateOrUpdatePlaylist` a… |
CVE-2026-50267 | Medium | 4.7 | 2026-06-17 | Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Configuration.Abstract… |
CVE-2026-53856 | Medium | 5.5 | 2026-06-16 | OpenClaw 2026.4.23 before 2026.4.24 contains an insecure file permissions vulnerability in config recovery that restores OpenClaw.json with overly broad permis… |
CVE-2026-0271 | High | 7.8 | 2026-06-10 | A privilege escalation (PE) vulnerability in the Palo Alto Networks Prisma Access Agent app on Linux devices enables a local user to execute code with elevated… |
CVE-2026-50570 | High | 8.5 | 2026-06-10 | Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version… |
CVE-2026-26422 | High | 8.4 | 2026-06-06 | clash-verge-service-ipc before 2.3.0 has a world-reachable IPC endpoint, leading to local privilege escalation. |
CVE-2026-50590 | Medium | 4.5 | 2026-06-05 | In Mimecast Incydr before 2.6.0, arbitrary file access can occur. |
CVE-2026-10997 | Medium | 6.5 | 2026-06-04 | Insufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2026-10840 | High | 7.1 | 2026-06-04 | A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to… |
CVE-2026-50209 | High | 7.8 | 2026-06-04 | Broadcast events allow malicious software to rewrite the device's default Mobile Device Management (MDM) endpoint address, shifting administrative ownership to… |
CVE-2021-4481 | High | 8.2 | 2026-06-02 | Dräger Protector Software prior to version 6.4.2 contains a local privilege escalation vulnerability due to insecure file system permissions that allows local… |
CVE-2021-4480 | High | 8.2 | 2026-06-02 | Dräger Protector Software prior to version 6.4.2 contains a local privilege escalation vulnerability due to insecure file system permissions that allows local… |
CVE-2026-10591 | High | 8.8 | 2026-06-02 | Insufficient access control restrictions in the file write tool in Amazon Kiro IDE before version 0.11 might allow remote unauthenticated actors to execute arb… |
CVE-2026-27788 | High | 7.8 | 2026-06-01 | Incorrect permission assignment for critical resource issue exists in ServerView Agents for Windows V11.60.04 and earlier. If this vulnerability is exploited… |
CVE-2026-9508 | | 2026-05-29 | Incorrect permission settings on a critical resource in Suprema BioStar 2 (versions 2.9.3 through 2.9.11) that allow backup files to be publicly exposed when t… | |
CVE-2026-8070 | | 2026-05-29 | Incorrect permission assignment for a critical resource in Armoury Crate allows a local user to bypass the driver’s validation mechanism, resulting in unauthor… | |
CVE-2026-7480 | | 2026-05-29 | An Incorrect Permission Assignment for Critical Resource vulnerability in ASUS System Control Interface allows a local user to elevate privileges to SYSTEM and… | |
CVE-2026-45353 | High | 7.8 | 2026-05-28 | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From 3.0.6 to 3.8.8, This vulnerability is fixed in 3.9.0. |
CVE-2026-9789 | | 2026-05-28 | A Local Privilege Escalation (LPE) vulnerability affects Acer NitroSense software versions prior to 3.01.3052. The vulnerability stems from the the PSAdminAgen… | |
CVE-2026-2254 | Medium | 6.3 | 2026-05-27 | Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x and 8.3.x, does not apply ACLs on certain API endpo… |
CVE-2025-43290 | Medium | 5.5 | 2026-05-26 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app may be abl… |
CVE-2026-25112 | High | 7.8 | 2026-05-26 | A high-severity vulnerability in the deployment of Genetec RabbitMQ that allows a privilege escalation attack. |
CVE-2026-42497 | High | 7.5 | 2026-05-26 | Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory. _make_special_file() passes the ta… |
CVE-2026-9489 | | 2026-05-25 | NitroSense 3.x before 3.01.3052 contains Local Privilege Escalation (LPE) vulnerability.The program exposes a Windows Named Pipe that uses a custom protocol to… | |
CVE-2026-45246 | Medium | 5.5 | 2026-05-18 | Summarize prior to 0.15.1 contains an insecure file permission vulnerability in the refresh-free configuration rewrite path that allows local users to read sen… |
CVE-2026-8612 | Medium | 5.3 | 2026-05-15 | WWW::Mechanize::Cached versions before 2.00 for Perl deserialize cached HTTP responses from a world-writable on-disk cache, enabling local response forgery and… |
CVE-2026-42937 | Medium | 6.5 | 2026-05-13 | Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tmsh) arp and ndp commands, and in BIG-IP iControl REST. These vulnerabi… |
CVE-2026-42058 | Medium | 4.3 | 2026-05-13 | An authenticated attacker's undisclosed requests to BIG-IP iControl REST can lead to an information leak of BIG-IP local user account names. Note: Software ve… |
CVE-2026-41959 | Medium | 6.5 | 2026-05-13 | Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tmsh) network diagnostics commands and in BIG-IP iControl REST. These vu… |
CVE-2026-41217 | High | 7.9 | 2026-05-13 | A vulnerability exists in an undisclosed BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with resource administrator or administrator… |
CVE-2026-40462 | Medium | 6.5 | 2026-05-13 | Incorrect permission assignment vulnerabilities exist in iControl REST and TMOS shell (tmsh) undisclosed command which may allow an authenticated attacker to v… |
CVE-2026-8110 | High | 7.8 | 2026-05-12 | Incorrect permissions assignment in the agent of Ivanti Endpoint Manager before version 2024 SU6 allows a local authenticated attacker to escalate their privil… |
CVE-2026-7431 | Medium | 4.4 | 2026-05-12 | An incorrect permission assignment for critical resource of Ivanti Secure Access Client before 22.8R6 allows a local authenticated user to read or modify sen… |
CVE-2026-32684 | Low | 2.9 | 2026-05-12 | The application does not impose strict enough restrictions on directory access permissions, posing a risk that other malicious applications could obtain sensit… |
CVE-2026-1185 | Medium | 5.4 | 2026-05-12 | A configuration file on the local file system had improper input validation which could allow code execution and potentially lead to privilege escalation. This… |
CVE-2026-0541 | Medium | 6.7 | 2026-05-12 | ACAP applications can gain elevated privileges due to improper input validation during the installation process, potentially leading to privilege escalation. T… |
CVE-2026-41489 | High | 8.8 | 2026-05-11 | Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.0 to before Core 6.4.2 and FTL 6.6.1… |
CVE-2026-45222 | Medium | 6.1 | 2026-05-11 | Summarize versions through 0.14.1, fixed in commit 0cfb0fb, creates the daemon configuration directory and file with default filesystem permissions that may be… |
CVE-2026-8069 | High | 7.8 | 2026-05-08 | PredatorSense version 3.00.3136 to 3.00.3196 contain Local Privilege Escalation (LPE) vulnerability.The program exposes a Windows Named Pipe that uses a custom… |
CVE-2026-41288 | High | 7.8 | 2026-05-06 | Incorrect permission assignment for a resource in the patch management component of the WatchGuard Agent on Windows allows an authenticated local user to eleva… |
CVE-2026-41686 | Medium | 4.4 | 2026-05-04 | Claude SDK for TypeScript provides access to the Claude API from server-side TypeScript or JavaScript applications. From version 0.79.0 to before version 0.91… |
CVE-2026-42812 | Critical | 9.9 | 2026-05-04 | In Apache Iceberg, the table's metadata files are control files: they tell readers which data files belong to the table and which table version to read. `wr… |
CVE-2026-6499 | | 2026-05-04 | Incorrect Permission Assignment for Critical Resource vulnerability in ILM Informatique OpenConcerto allows Replace Binaries. This issue affects OpenConcerto… | |
CVE-2026-41366 | Medium | 5.5 | 2026-04-28 | OpenClaw before 2026.3.31 contains a local roots self-whitelisting vulnerability in appendLocalMediaParentRoots that allows model-initiated arbitrary host file… |
CVE-2026-35367 | Low | 3.3 | 2026-04-22 | The nohup utility in uutils coreutils creates its default output file, nohup.out, without specifying explicit restricted permissions. This causes the file to i… |
CVE-2026-35341 | High | 7.1 | 2026-04-22 | A vulnerability in uutils coreutils mkfifo allows for the unauthorized modification of permissions on existing files. When mkfifo fails to create a FIFO becaus… |
CVE-2026-6842 | Low | 2.5 | 2026-04-22 | A flaw was found in nano. In environments with permissive umask settings, a local attacker can exploit incorrect directory permissions (0777 instead of 0700) f… |
CVE-2026-6386 | Medium | 6.2 | 2026-04-22 | In order to apply a particular protection key to an address range, the kernel must update the corresponding page table entries. The subroutine which handled t… |
CVE-2026-6369 | Medium | 5.5 | 2026-04-20 | An improper access control vulnerability in the canonical-livepatch snap client prior to version 10.15.0 allows a local unprivileged user to obtain a sensitive… |
CVE-2026-22676 | High | 7.8 | 2026-04-15 | Barracuda RMM versions prior to 2025.2.2 contain a privilege escalation vulnerability that allows local attackers to gain SYSTEM-level privileges by exploiting… |
CVE-2026-21727 | Low | 3.3 | 2026-04-15 | A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condit… |
CVE-2025-41118 | Critical | 9.1 | 2026-04-15 | Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage (COS). If th… |
CVE-2026-21011 | Medium | 6.8 | 2026-04-13 | Incorrect privilege assignment in Bluetooth in Maintenance mode prior to SMR Apr-2026 Release 1 allows physical attackers to bypass Extend Unlock. |
CVE-2026-4482 | Medium | 5.5 | 2026-04-10 | The installer certificate files in the …/bootstrap/common/ssl folder do not seem to have restricted permissions on Windows systems (users have read and execute… |
CVE-2026-28264 | Low | 3.3 | 2026-04-08 | Dell PowerProtect Agent Service, version(s) prior to 20.1, contain(s) an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged… |
CVE-2026-33271 | Medium | 6.7 | 2026-04-02 | Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis True Image (Windows) before build 42902. |
CVE-2026-21765 | High | 8.8 | 2026-04-02 | HCL BigFix Platform is affected by insecure permissions on private cryptographic keys. The private cryptographic keys located on a Windows host machine might… |
CVE-2026-22768 | High | 7.3 | 2026-04-01 | Dell AppSync, version(s) 4.6.0, contain(s) an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access… |
CVE-2026-34450 | Medium | 4.4 | 2026-03-31 | The Claude SDK for Python provides access to the Claude API from Python applications. From version 0.86.0 to before version 0.87.0, the local filesystem memory… |
CVE-2026-21715 | Low | 3.3 | 2026-03-30 | A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable f… |
CVE-2026-34352 | High | 8.5 | 2026-03-26 | In TigerVNC before 1.16.2, Image.cxx in x0vncserver allows other users to observe or manipulate the screen contents, or cause an application crash, because of… |
CVE-2026-3113 | Medium | 5.0 | 2026-03-26 | Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to set permissions on downloaded bulk export which allows ot… |
CVE-2026-33430 | High | 7.3 | 2026-03-26 | Briefcase is a tool for converting a Python project into a standalone native application. Starting in version 0.3.0 and prior to version 0.3.26, if a developer… |
CVE-2026-4761 | High | 7.5 | 2026-03-25 | When a certificate and its private key are installed in the Windows machine certificate store using Network and Security tool, access rights to the private key… |
CVE-2026-28829 | Medium | 5.5 | 2026-03-25 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may… |
CVE-2026-20693 | Medium | 4.9 | 2026-03-25 | This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An attacker wit… |
CVE-2026-32048 | High | 7.5 | 2026-03-21 | OpenClaw versions prior to 2026.3.1 fail to enforce sandbox inheritance during cross-agent sessions_spawn operations, allowing sandboxed sessions to create chi… |
CVE-2026-32810 | Medium | 5.5 | 2026-03-20 | Halloy is an IRC application written in Rust. In versions on \*nix and macOS prior to commit f180e41061db393acf65bc99f5c5e7397586d9cb, halloy creates its confi… |
CVE-2026-25770 | Critical | 9.1 | 2026-03-17 | Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 3.9.0 and prior to version 4.14.3, a privileg… |
CVE-2026-28563 | Medium | 4.3 | 2026-03-17 | Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns the full DAG dependency graph without filtering by authorized DAG IDs. This allow… |
CVE-2026-26929 | Medium | 6.5 | 2026-03-17 | Apache Airflow versions 3.0.0 through 3.1.7 FastAPI DagVersion listing API does not apply per-DAG authorization filtering when the request is made with dag_id… |
CVE-2026-29516 | Medium | 4.9 | 2026-03-16 | Buffalo TeraStation NAS TS5400R firmware version 4.02-0.06 and prior contain an excessive file permissions vulnerability that allows authenticated attackers to… |
CVE-2026-32704 | Medium | 6.5 | 2026-03-16 | SiYuan is a personal knowledge management system. Prior to 3.6.1, POST /api/template/renderSprig lacks model.CheckAdminRole, allowing any authenticated user to… |
CVE-2025-15037 | | 2026-03-12 | An Incorrect Permission Assignment vulnerability exists in the ASUS Business System Control Interface driver. This vulnerability can be triggered by an unprivi… | |
CVE-2026-3315 | High | 7.8 | 2026-03-10 | Incorrect Default Permissions, : Execution with Unnecessary Privileges, : Incorrect Permission Assignment for Critical Resource vulnerability in ASSA ABLOY Vis… |
CVE-2026-24291 | High | 7.8 | 2026-03-10 | Incorrect permission assignment for critical resource in Windows Accessibility Infrastructure (ATBroker.exe) allows an authorized attacker to elevate privilege… |
CVE-2025-41712 | Medium | 6.5 | 2026-03-10 | An unauthenticated remote attacker who tricks a user to upload a manipulated HTML file can get access to sensitive information on the device. This is a result… |
CVE-2026-28725 | Medium | 5.5 | 2026-03-06 | Sensitive information disclosure due to improper configuration of a headless browser. The following products are affected: Acronis Cyber Protect 17 (Linux, Win… |
CVE-2025-30413 | Medium | 4.4 | 2026-03-06 | Credentials are not deleted from Acronis Agent after plan revocation. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Win… |
CVE-2025-11790 | Medium | 4.4 | 2026-03-06 | Credentials are not deleted from Acronis Agent after plan revocation. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Win… |
CVE-2026-29188 | Critical | 9.1 | 2026-03-05 | File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to ver… |
CVE-2026-29126 | High | 7.8 | 2026-03-05 | Incorrect permission assignment (world-writable file) in /etc/udhcpc/default.script in International Data Casting (IDC) SFX2100 Satellite Receiver allows a loc… |
CVE-2026-29125 | Medium | 4.7 | 2026-03-05 | IDC SFX2100 Satalite Recievers set the `/etc/resolv.conf` file to be world-writable by any local user, allowing DNS resolver tampering that can redirect networ… |
CVE-2025-12801 | Medium | 6.5 | 2026-03-04 | A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate the privileges assi… |
CVE-2025-70342 | Medium | 6.6 | 2026-03-04 | erase-install prior to v40.4 commit 2c31239 writes swiftDialog credential output to a hardcoded path /var/tmp/dialog.json. This allows an unauthenticated attac… |
CVE-2025-70341 | High | 7.8 | 2026-03-04 | Insecure permissions in App-Auto-Patch v3.4.2 create a race condition which allows attackers to write arbitrary files. |
CVE-2026-24732 | | 2026-03-04 | Files or Directories Accessible to External Parties, Incorrect Permission Assignment for Critical Resource vulnerability in Hallo Welt! GmbH BlueSpice (Extensi… | |
CVE-2026-2915 | High | 7.1 | 2026-03-03 | HP System Event Utility might allow denial of service with elevated arbitrary file writes. This potential vulnerability was remediated with HP S… |