CWE-732 · Incorrect Permission Assignment for Critical Resource (page 3)
Page 3 of 18 — CVEs classified under CWE-732, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-14604 | Medium | 6.6 | 2026-03-03 | IBM Storage Scale IBM S through rage Scale 5.2.3.0 - 5.2.3.5, and IBM S through rage Scale 6.0.0.0 - 6.0.0.1 could allow a local user to unintentionally trigge… |
CVE-2026-2637 | High | 7.8 | 2026-03-03 | iBoysoft NTFS for Mac contains a local privilege escalation vulnerability in its privileged helper daemon ntfshelperd. The daemon exposes an NSConnection servi… |
CVE-2026-21902 | Critical | 9.8 | 2026-02-25 | An Incorrect Permission Assignment for Critical Resource vulnerability in the On-Box Anomaly detection framework of Juniper Networks Junos OS Evolved on PTX Se… |
CVE-2026-26102 | High | 7.8 | 2026-02-20 | Incorrect Permission Assignment for Critical Resource in Owl opds 2.2.0.4 allows File Manipulation via a crafted network request. |
CVE-2026-26101 | High | 7.8 | 2026-02-20 | Incorrect Permission Assignment for Critical Resource in Owl opds 2.2.0.4 allows File Manipulation via a crafted network request. |
CVE-2026-26100 | Medium | 5.5 | 2026-02-20 | Incorrect Permission Assignment for Critical Resource in Owl opds 2.2.0.4 allows File Manipulation via a crafted network request. |
CVE-2026-26096 | Medium | 5.5 | 2026-02-20 | Incorrect Permission Assignment for Critical Resource in Owl opds 2.2.0.4 allows File Manipulation via a crafted network request. |
CVE-2026-26095 | Medium | 5.5 | 2026-02-20 | Incorrect Permission Assignment for Critical Resource in Owl opds 2.2.0.4 allows File Manipulation via a crafted network request. |
CVE-2026-24834 | Critical | 9.3 | 2026-02-19 | Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. In versions… |
CVE-2026-1344 | Medium | 6.5 | 2026-02-18 | Tanium addressed an insecure file permissions vulnerability in Enforce Recovery Key Portal. |
CVE-2025-33088 | High | 7.4 | 2026-02-17 | IBM Concert 1.0.0 through 2.1.0 could allow a local user with specific knowledge about the system's architecture to escalate their privileges due to incorrect… |
CVE-2026-23648 | High | 7.8 | 2026-02-17 | Glory RBG-100 recycler systems using the ISPK-08 software component contain multiple system binaries with overly permissive file permissions. Several binaries… |
CVE-2019-25344 | High | 7.8 | 2026-02-12 | Wondershare MobileGo 8.5.0 contains an insecure file permissions vulnerability that allows local users to modify executable files in the application directory… |
CVE-2019-25343 | High | 7.8 | 2026-02-12 | NextVPN 4.10 contains an insecure file permissions vulnerability that allows local users to modify executable files with full access rights. Attackers can repl… |
CVE-2025-61969 | | 2026-02-11 | Incorrect permission assignment in AMD µProf may allow a local user-privileged attacker to achieve privilege escalation, potentially resulting in arbitrary cod… | |
CVE-2025-35999 | Medium | 6.7 | 2026-02-10 | Incorrect permission assignment for critical resource for some System Firmware Update Utility (SysFwUpdt) for Intel(R) Server Boards and Intel(R) Server System… |
CVE-2025-14740 | Medium | 6.7 | 2026-02-04 | Docker Desktop for Windows contains multiple incorrect permission assignment vulnerabilities in the installer's handling of the C:\ProgramData\DockerDesktop di… |
CVE-2025-52627 | Medium | 5.5 | 2026-02-03 | Root File System Not Mounted as Read-Only configuration vulnerability. This can allow unintended modifications to critical system files, potentially increasing… |
CVE-2025-14988 | | 2026-01-27 | A security issue has been identified in ibaPDA that could allow unauthorized actions on the file system under certain conditions. This may impact the confident… | |
CVE-2020-36938 | High | 8.8 | 2026-01-27 | WinAVR version 20100110 contains an insecure permissions vulnerability that allows authenticated users to modify system files and executables. Attackers can le… |
CVE-2026-24131 | Medium | 5.5 | 2026-01-26 | pnpm is a package manager. Prior to version 10.28.2, when pnpm processes a package's `directories.bin` field, it uses `path.join()` without validating the resu… |
CVE-2026-0775 | High | 7.0 | 2026-01-23 | npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected… |
CVE-2026-22280 | Medium | 5.0 | 2026-01-22 | Dell PowerScale OneFS, versions 9.5.0.0 through 9.5.1.5, versions 9.6.0.0 through 9.7.1.10, versions 9.8.0.0 through 9.10.1.3, versions starting from 9.11.0.0… |
CVE-2026-24049 | High | 7.1 | 2026-01-22 | wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46.1, the unpack function is vulnerable t… |
CVE-2026-20092 | Medium | 6.0 | 2026-01-21 | A vulnerability in the read-only maintenance shell of Cisco Intersight Virtual Appliance could allow an authenticated, local attacker with administrative privi… |
CVE-2025-12985 | High | 8.4 | 2026-01-20 | IBM Licensing Operator incorrectly assigns privileges to security critical files which could allow a local root escalation inside a container running the IBM L… |
CVE-2021-47756 | High | 8.4 | 2026-01-16 | Laravel Valet versions 1.1.4 to 2.0.3 contain a local privilege escalation vulnerability that allows users to modify the valet command with root privileges. At… |
CVE-2025-59961 | Medium | 5.5 | 2026-01-15 | An Incorrect Permission Assignment for Critical Resource vulnerability in the Juniper DHCP daemon (jdhcpd) of Juniper Networks Junos OS and Junos OS Evolved al… |
CVE-2025-67246 | High | 7.3 | 2026-01-15 | A local information disclosure vulnerability exists in the Ludashi driver before 5.1025 due to a lack of access control in the IOCTL handler. This driver expos… |
CVE-2022-50931 | High | 7.8 | 2026-01-13 | TeamSpeak 3.5.6 contains an insecure file permissions vulnerability that allows local attackers to replace executable files with malicious binaries. Attackers… |
CVE-2025-69426 | | 2026-01-09 | The Ruckus vRIoT IoT Controller firmware versions prior to 3.0.0.0 (GA) contain hardcoded credentials for an operating system user account within an initializa… | |
CVE-2025-14979 | High | 7.8 | 2026-01-06 | AirVPN Eddie on MacOS contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root.This issue affects Eddie: 2.2… |
CVE-2020-36916 | High | 8.8 | 2026-01-06 | TDM Digital Signage PC Player 4.1.0.4 contains an elevation of privileges vulnerability that allows authenticated users to modify executable files. Attackers c… |
CVE-2021-47742 | High | 8.8 | 2025-12-31 | Epic Games Psyonix Rocket League <=1.95 contains an insecure permissions vulnerability that allows authenticated users to modify executable files with full acc… |
CVE-2025-64699 | High | 7.8 | 2025-12-31 | An incorrect NULL DACL issue exists in SevenCs ORCA G2 2.0.1.35 (EC2007 Kernel v5.22). The regService process, which runs with SYSTEM privileges, applies a Sec… |
CVE-2025-66723 | High | 7.5 | 2025-12-30 | inMusic Brands Engine DJ before 4.3.4 suffers from Insecure Permissions due to exposed HTTP service in the Remote Library, which allows attackers to access all… |
CVE-2019-25245 | High | 8.8 | 2025-12-24 | Ross Video DashBoard 8.5.1 contains an elevation of privileges vulnerability that allows authenticated users to modify executable files due to improper permiss… |
CVE-2025-13703 | High | 7.8 | 2025-12-23 | VIPRE Advanced Security Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privile… |
CVE-2022-50690 | High | 8.4 | 2025-12-22 | Wondershare MirrorGo 2.0.11.346 contains a local privilege escalation vulnerability due to incorrect file permissions on executable files. Unprivileged local u… |
CVE-2023-53949 | High | 8.4 | 2025-12-19 | AspEmail 5.6.0.2 contains a binary permission vulnerability that allows local users to escalate privileges through the Persits Software EmailAgent service. Att… |
CVE-2025-13941 | High | 8.8 | 2025-12-19 | A local privilege escalation vulnerability exists in the Foxit PDF Reader/Editor Update Service. During plugin installation, incorrect file system permissions… |
CVE-2025-68462 | Low | 3.2 | 2025-12-18 | Freedombox before 25.17.1 does not set proper permissions for the backups-data directory, allowing the reading of dump files of databases. |
CVE-2025-67794 | Medium | 6.1 | 2025-12-17 | An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 before 24.2.8, and 25.1 before 25.1.6. Directories and files created by the agent are created wi… |
CVE-2024-46062 | High | 7.8 | 2025-12-17 | Miniconda3 macOS installers before 23.11.0-1 contain a local privilege escalation vulnerability when installed outside the user's home directory. During instal… |
CVE-2024-46060 | High | 7.8 | 2025-12-17 | Anaconda3 macOS installers before 2024.06-1 contain a local privilege escalation vulnerability when installed outside the user's home directory. During install… |
CVE-2025-34288 | Medium | 6.7 | 2025-12-16 | Nagios XI versions prior to 2026R1.1 are vulnerable to local privilege escalation due to an unsafe interaction between sudo permissions and application file pe… |
CVE-2025-43470 | Medium | 5.5 | 2025-12-12 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.1. A standard user may be able to view files made from a… |
CVE-2025-13733 | High | 7.8 | 2025-12-12 | BuhoNTFS contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root via insecure functions.This issue affects… |
CVE-2025-40818 | Low | 3.3 | 2025-12-09 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP4). Affected applications contain private SSL/TLS keys on the server… |
CVE-2025-8148 | Medium | 4.2 | 2025-12-05 | An Improper Access Control in the SFTP service in Fortra's GoAnywhere MFT prior to version 7.9.0 allows Web Users with an Authentication Alias and a valid SSH… |
CVE-2025-20387 | High | 8.0 | 2025-12-03 | In Splunk Universal Forwarder for Windows versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, a new installation of or an upgrade to an affected version can resul… |
CVE-2025-20386 | High | 8.0 | 2025-12-03 | In Splunk Enterprise for Windows versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, a new installation of or an upgrade to an affected version can result in inco… |
CVE-2025-64642 | High | 8.0 | 2025-12-02 | NMIS/BioDose V22.02 and previous versions' installation directory paths by default have insecure file permissions, which in certain deployment scenarios can en… |
CVE-2025-64298 | High | 8.4 | 2025-12-02 | NMIS/BioDose V22.02 and previous version installations where the embedded Microsoft SQLServer Express is used are exposed in the Windows share accessed by clie… |
CVE-2025-62575 | High | 8.3 | 2025-12-02 | NMIS/BioDose V22.02 and previous versions rely on a Microsoft SQL Server database. The SQL user account 'nmdbuser' and other created accounts by default have t… |
CVE-2025-59373 | | 2025-11-25 | A local privilege escalation vulnerability exists in the restore mechanism of ASUS System Control Interface. It can be triggered when an unprivileged acto… | |
CVE-2025-11921 | | 2025-11-24 | iStats contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root via command injection.This issue affects iSt… | |
CVE-2025-64324 | High | 7.7 | 2025-11-18 | KubeVirt is a virtual machine management add-on for Kubernetes. The `hostDisk` feature in KubeVirt allows mounting a host file or directory owned by the user w… |
CVE-2025-64996 | Medium | 4.4 | 2025-11-18 | In Checkmk versions prior to 2.4.0p16, 2.3.0p41, and all versions of 2.2.0 and older, the mk_inotify plugin creates world-readable and writable files, allowing… |
CVE-2025-34323 | High | 7.8 | 2025-11-17 | Nagios Log Server versions prior to 2026R1.0.1 are vulnerable to local privilege escalation due to a combination of sudo misconfiguration and group-writable ap… |
CVE-2024-32014 | Medium | 4.7 | 2025-11-11 | A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to alter the local databas… |
CVE-2024-32010 | High | 7.8 | 2025-11-11 | A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to extraction of database… |
CVE-2025-8108 | Medium | 6.7 | 2025-11-11 | An ACAP configuration file has improper permissions and lacks input validation, which could potentially lead to privilege escalation. This vulnerability can on… |
CVE-2025-6779 | Medium | 6.7 | 2025-11-11 | An ACAP configuration file has improper permissions, which could allow command injection and potentially lead to privilege escalation. This vulnerability can o… |
CVE-2025-64322 | Medium | 5.3 | 2025-11-04 | Incorrect Permission Assignment for Critical Resource vulnerability in Salesforce Agentforce Vibes Extension allows Manipulating Writeable Configuration Files… |
CVE-2025-64319 | Medium | 5.3 | 2025-11-04 | Incorrect Permission Assignment for Critical Resource vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Manipulating Writeable Configuration Fi… |
CVE-2025-4952 | | 2025-10-31 | Tampering of the registry entries might have led to preventing the ESET security products from starting correctly on the next system startup or to unauthorized… | |
CVE-2025-34287 | High | 7.8 | 2025-10-30 | Nagios XI versions prior to 2024R2 contain an improperly owned script, process_perfdata.pl, which is executed periodically as the nagios user but owned by www-… |
CVE-2025-34135 | Medium | 4.4 | 2025-10-30 | Nagios XI versions prior to 2024R1.4.2 configure some systemd unit files with permission sets that were too permissive. In particular, the nagios.service unit… |
CVE-2025-11906 | Medium | 6.7 | 2025-10-30 | A vulnerability exists in Progress Flowmon versions prior 12.5.6 where certain system configuration files have incorrect file permissions, allowing a user with… |
CVE-2025-54546 | High | 7.5 | 2025-10-29 | On affected platforms, restricted users could use SSH port forwarding to access host-internal services |
CVE-2025-54545 | High | 7.8 | 2025-10-29 | On affected platforms, a restricted user could break out of the CLI sandbox to the system shell and elevate their privileges. |
CVE-2025-12148 | | 2025-10-29 | In Search Guard versions 3.1.1 and earlier, Field Masking (FM) rules are improperly enforced on fields of type IP (IP Address). While the content of these fie… | |
CVE-2025-12147 | | 2025-10-29 | In Search Guard FLX versions 3.1.1 and earlier, Field-Level Security (FLS) rules are improperly enforced on object-valued fields. When an FLS exclusion rule… | |
CVE-2025-62688 | High | 7.1 | 2025-10-23 | An incorrect permission assignment for a critical resource vulnerability was discovered in Productivity Suite software version 4.4.1.19. The vulnerability allo… |
CVE-2025-12004 | | 2025-10-21 | Incorrect Permission Assignment for Critical Resource vulnerability in The Wikimedia Foundation Mediawiki - Lockdown Extension allows Privilege Abuse. Fixed in… | |
CVE-2025-31702 | Medium | 6.8 | 2025-10-15 | A vulnerability exists in certain Dahua embedded products. Third-party malicious attacker with obtained normal user credentials could exploit the vulnerability… |
CVE-2025-57741 | High | 7.8 | 2025-10-14 | An Incorrect Permission Assignment for Critical Resource vulnerability [CWE-732] in FortiClientMac 7.4.0 through 7.4.3, 7.2.0 through 7.2.11, 7.0 all versions… |
CVE-2025-62251 | Medium | 6.5 | 2025-10-13 | Liferay Portal 7.3.0 through 7.4.3.119, and Liferay DXP 2023.Q3.1 through 2023.Q3.8, 2023.Q4.0 through 2023.Q4.5, 7.4 GA through update 92 and 7.3 GA though up… |
CVE-2025-8886 | Medium | 6.7 | 2025-10-10 | Incorrect Permission Assignment for Critical Resource, Exposure of Sensitive Information to an Unauthorized Actor, Missing Authorization, Incorrect Authorizati… |
CVE-2025-10751 | High | 7.8 | 2025-10-04 | MacForge contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root.This issue affects MacForge: 1.2.0 Beta 1. |
CVE-2025-34212 | Critical | 9.8 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.843 and Application prior to version 20.0.1923 (VA/SaaS deployments) possess … |
CVE-2025-10541 | High | 7.8 | 2025-09-25 | iMonitor EAM 9.6394 installs a system service (eamusbsrv64.exe) that runs with NT AUTHORITY\SYSTEM privileges. This service includes an insecure update mechani… |
CVE-2025-43808 | Medium | 5.3 | 2025-09-19 | The Commerce component in Liferay Portal 7.3.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through upd… |
CVE-2025-34206 | Critical | 9.8 | 2025-09-19 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA and SaaS deployments) mount host configuration and secret material under /var/w… |
CVE-2025-34189 | High | 7.8 | 2025-09-19 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 1.0.735 and Application versions prior to 20.0.1330 (macOS/Linux client deploymen… |
CVE-2025-54497 | High | 8.1 | 2025-09-18 | Cognex In-Sight Explorer and In-Sight Camera Firmware expose a telnet-based service on port 23 to allow management operations such as firmware upgrades and … |
CVE-2025-52873 | High | 8.1 | 2025-09-18 | Cognex In-Sight Explorer and In-Sight Camera Firmware expose a telnet-based service on port 23 to allow management operations such as firmware upgrades and d… |
CVE-2025-10643 | Critical | 9.1 | 2025-09-17 | Wondershare Repairit Incorrect Permission Assignment Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication o… |
CVE-2025-59349 | Low | 3.3 | 2025-09-17 | Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, DragonFly2 uses the os.MkdirAll function to create certa… |
CVE-2025-0164 | Low | 2.3 | 2025-09-14 | IBM QRadar SIEM 7.5 through 7.5 Update Pack 13 Independent Fix 01 could allow a local privileged user to perform unauthorized actions on configuration files du… |
CVE-2025-57392 | High | 7.8 | 2025-09-10 | BenimPOS Masaustu 3.0.x is affected by insecure file permissions. The application installation directory grants Everyone and BUILTIN\Users groups FILE_ALL_ACCE… |
CVE-2025-40804 | Critical | 9.1 | 2025-09-09 | A vulnerability has been identified in SIMATIC Virtualization as a Service (SIVaaS) (All versions). The affected application exposes a network share without an… |
CVE-2025-41664 | High | 7.5 | 2025-09-08 | A low-privileged remote attacker could gain unauthorized access to critical resources, such as firmware and certificates, due to improper permission handling d… |
CVE-2025-58372 | High | 8.1 | 2025-09-05 | Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions 3.25.23 and below contain a vulnerability where certain VS Code worksp… |
CVE-2025-10059 | Medium | 6.5 | 2025-09-05 | An improper setting of the lsid field on any sharded query can cause a crash in MongoDB routers. This issue occurs when a generic argument (lsid) is provided i… |
CVE-2025-23258 | High | 7.3 | 2025-09-04 | NVIDIA DOCA contains a vulnerability in the collectx-dpeserver Debian package for arm64 that could allow an attacker with low privileges to escalate privileges… |
CVE-2025-23257 | High | 7.3 | 2025-09-04 | NVIDIA DOCA contains a vulnerability in the collectx-clxapidev Debian package that could allow an actor with low privileges to escalate privileges. A successfu… |
CVE-2025-36193 | High | 8.4 | 2025-09-03 | IBM Transformation Advisor 2.0.1 through 4.3.1 incorrectly assigns privileges to security critical files which could allow a local root escalation inside a con… |
CVE-2025-43268 | High | 7.8 | 2025-08-29 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6. A malicious app may be able to gain root privileges. |