Overview 1,875 matches · 68 in Waratek scope · 3 protected · 15 exploited · 5 CISA KEV · 78 public PoC · 6 EPSS ≥ 0.5
1,875matches
68in Waratek scope3.6%
3protected0.2%
15exploited0.8%
5CISA KEV0.3%
78public PoC4.2%
6EPSS ≥ 0.50.3%
Protected by Waratek
3
0.2%
Rule in development
0
0.0%
Mitigation candidate
2
0.1%
No exploit published
63
3.4%
Outside Waratek scope
12
0.6%
Not applicable
1,794
95.7%
Withdrawn CVE
1
0.1%
blocked by ARMR today
3
0.2%
partly blocked
0
0.0%
not blocked
1,872
99.8%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 323 / year
20011
Not applicable1
High1
not blocked1
Working exploit published1
20020
20030
20041
Not applicable1
High1
not blocked1
Working exploit published1
20051
Not applicable1
High1
not blocked1
Working exploit published1
20060
20072
Not applicable2
High2
not blocked2
No public exploit2
20085
Not applicable5
High2
Medium1
Low2
not blocked5
No public exploit5
200910
Not applicable10
High6
Medium3
Low1
not blocked10
Working exploit published1
No public exploit9
20102
Not applicable2
Medium2
not blocked2
No public exploit2
20111
Not applicable1
Low1
not blocked1
No public exploit1
20120
20132
Not applicable2
High2
not blocked2
No public exploit2
20140
20150
20160
201789
No exploit published5
Outside Waratek scope1
Not applicable83
Critical13
High50
Medium25
Low1
not blocked89
Exploited1
Working exploit published7
No public exploit81
2018226
No exploit published5
Outside Waratek scope1
Not applicable220
Critical26
High135
Medium60
Low5
not blocked226
Exploited1
Working exploit published25
No public exploit200
2019219
Mitigation candidate1
No exploit published2
Outside Waratek scope3
Not applicable213
Critical18
High103
Medium78
Low20
not blocked219
Exploited5
Working exploit published7
No public exploit207
2020177
Protected by Waratek1
No exploit published3
Outside Waratek scope1
Not applicable172
Critical14
High97
Medium63
Low3
blocked by ARMR today1
not blocked176
Working exploit published7
No public exploit170
2021165
Mitigation candidate1
No exploit published6
Outside Waratek scope1
Not applicable156
Withdrawn CVE1
Critical6
High102
Medium55
Low1
Unknown1
not blocked165
Exploited3
Working exploit published3
Proof of concept only1
No public exploit158
2022142
Protected by Waratek1
No exploit published7
Not applicable134
Critical9
High66
Medium65
Low2
blocked by ARMR today1
not blocked141
Exploited1
Working exploit published1
Proof of concept only8
No public exploit132
2023166
No exploit published15
Outside Waratek scope4
Not applicable147
Critical15
High87
Medium61
Low3
not blocked166
Exploited1
Working exploit published5
Proof of concept only24
Forecast only1
No public exploit135
2024149
Protected by Waratek1
No exploit published3
Outside Waratek scope1
Not applicable144
Critical13
High79
Medium52
Low5
blocked by ARMR today1
not blocked148
Exploited1
Proof of concept only11
No public exploit137
2025194
No exploit published9
Not applicable185
Critical24
High89
Medium72
Low9
not blocked194
Working exploit published4
Proof of concept only24
No public exploit166
2026323
No exploit published8
Not applicable315
Critical28
High152
Medium115
Low28
not blocked323
Exploited2
Working exploit published1
Proof of concept only53
No public exploit267
200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-127276 | Low | 2026-11-13 | Not applicable | Proof of concept only | A vulnerability was identified in Linksys EA8100 1.0.3.216940. Impacted is an unknown function of the component Web UI. Such manipulation leads to cookie without 'httponly' flag. It is possible to launch the attack remotely. This attack is characterized by high complexity. The exploitability is considered difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2026-116412 | Medium | 2026-11-13 | Not applicable | No public exploit | Dell PowerStore contains an insecure-file-permissions vulnerability. A local low-privileged attacker could exploit this vulnerability to disclose administrative credentials. |
| CVE-2026-82977 | High | 2026-11-12 | Not applicable | No public exploit | The Plesk GoAccess statistics integration in Plesk Obsidian for Linux, versions 18.0.77 to 18.0.81.7, 18.0.82 to 18.0.82.2, allows cross-subscription information disclosure. |
| CVE-2026-123039 | High | 2026-11-12 | Not applicable | Exploited | The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket) without authenticating connecting processes. An authenticated local user can send a command to the socket and have it executed as root. |
| CVE-2026-85929 | High | 2026-11-10 | Not applicable | No public exploit | Incorrect permission assignment for critical resource in Windows Brokering File System allows an authorized attacker to elevate privileges locally. |
| CVE-2026-14543 | Low | 2026-11-10 | Not applicable | No public exploit | The VAPIX Edge storage API, enabling the escalation of user privileges by circumventing filesystem isolation, granting unauthorized access to protected system resources. This flaw can only be exploited after authenticating with an admin-privileged service account. |
| CVE-2026-12963 | High | 2026-11-10 | No exploit published | No public exploit | A vulnerability that could allow a viewer account to gain unauthorized access to network attached storage devices on the server. |
| CVE-2026-119832 | Medium | 2026-11-10 | Not applicable | No public exploit | Improper access control in Windows BitLocker allows an authorized attacker to bypass a security feature with a physical attack. |
| CVE-2026-118742 | High | 2026-11-10 | Not applicable | No public exploit | Incorrect permission assignment for critical resource in Azure Front Door (AFD) allows an unauthorized attacker to elevate privileges over a network. |
| CVE-2026-118288 | High | 2026-11-10 | Not applicable | No public exploit | Incorrect permission assignment for critical resource in Azure File Sync allows an authorized attacker to elevate privileges locally. |
| CVE-2026-112125 | High | 2026-11-10 | Not applicable | No public exploit | Incorrect Permission Assignment for Critical Resource Vulnerability in HA Monitor. This issue affects HA Monitor: from 01-00 before 01-83-01. |
| CVE-2026-105734 | High | 2026-11-10 | Not applicable | No public exploit | Incorrect permission assignment for critical resource in Azure Local allows an authorized attacker to elevate privileges locally. |
| CVE-2026-119474 | High | 2026-11-09 | Not applicable | No public exploit | Incorrect Permission Assignment for Critical Resource vulnerability in HAVELSAN Inc. Liman Render Engine allows Privilege Escalation. This issue affects Liman Render Engine: before 1.2-81. |
| CVE-2026-114031 | High | 2026-11-09 | Not applicable | No public exploit | Incorrect permission assignment allows local privilege escalation to SYSTEM on affected releases of the Illumio VEN for Windows. Code execution as NT AUTHORITY\LOCAL SERVICE on the Windows host is required to exploit this vulnerability. The flaw exists within the VEN installer, which grants LOCAL SERVICE full access to the VEN data and installation folders, whose configuration and state files are read and trusted by the SYSTEM-privileged illumio-ven-ctl component. An attacker can leverage this vulnerability to modify the VEN configuration so that illumio-ven-ctl executes an injected command in the context of the SYSTEM account. |
| CVE-2026-124039 | Medium | 2026-11-06 | Not applicable | No public exploit | Gitleaks through 8.30.1 contains an incorrect permission assignment vulnerability that allows local users to read scan reports because cmd/root.go creates the --report-path file with os.Create and default permissions. Unless --redact is passed, other local users on shared hosts or CI runners can read plaintext secrets and matching lines to obtain discovered credentials. |
| CVE-2026-54146 | High | 2026-11-05 | Not applicable | No public exploit | OpenHuman is an open-source agent harness available as a desktop application and Rust library. From 0.53.15 before 0.57.5 on macOS, core_process.rs in the Tauri desktop process publishes the per-launch OPENHUMAN_CORE_TOKEN bearer credential in its process environment even though the core now runs as an in-process task. Another process running as the same user can read that environment through the macOS KERN_PROCARGS2 process-inspection interface, recover the token together with the local host and port, and authenticate to the core JSON-RPC service with the authority of the desktop frontend. The attacker can read agent memory and integrated-account data, invoke privileged actions, change configuration, and stop or disrupt services without root access, developer mode, or changes to System Integrity Protection. This issue affects Intel and Apple Silicon macOS systems. This issue is fixed in version 0.57.5. |
| CVE-2026-112910 | Medium | 2026-11-05 | Not applicable | Proof of concept only | filelock is a platform-independent file lock for Python. From 3.10.0 until 4.2.1, filelock on Windows ignores the mode argument for WindowsFileLock files and the ReadWriteLock SQLite database. A lock created with mode=0o600 receives the parent directory's inheritable ACL because _open_non_reparse_fd and _nt_open do not create an owner-only security descriptor. Another local account with inherited access can read holder metadata or the lock database, modify those files where the ACL permits writes, or take the byte-range lock after release and delay later acquisitions. UnixFileLock is not affected, and mutual exclusion between cooperating processes continues to hold. This issue is fixed in version 4.2.1. |
| CVE-2026-112908 | Medium | 2026-11-05 | Not applicable | Proof of concept only | filelock is a platform-independent file lock for Python. From version 3.30.0 until version 4.2.1, StrictSoftFileLock and AsyncStrictSoftFileLock on POSIX systems create coordination and claim directories without applying the caller’s restrictive lock mode. A permissive umask or inherited default ACL can leave these directories writable by another local user, allowing that user to delete an active holder’s claims. Another authorized process can then acquire the lock while the original holder remains in its critical section. An attacker can also plant malformed claims to prevent acquisition. This issue is fixed in version 4.2.1. |
| CVE-2026-92200 | High | 2026-11-04 | Not applicable | No public exploit | Quest Foglight for Databases Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Quest Foglight for Databases. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the product installer. The issue results from incorrect permissions on a folder used by the product. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-31118. |
| CVE-2026-54381 | High | 2026-11-04 | Not applicable | Proof of concept only | VitaFit cloud API before 2026-10-30 contained a misconfigured cloud storage bucket vulnerability that allows unauthenticated attackers to list and download stored files without authentication. Attackers can enumerate the publicly accessible bucket containing 129,947 objects, including 126,881 user-uploaded profile images, to access sensitive personal data without credentials. |
| CVE-2026-91906 | Medium | 2026-11-02 | Not applicable | No public exploit | Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass. |
| CVE-2026-91904 | Medium | 2026-11-02 | Not applicable | No public exploit | Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass. |
| CVE-2026-68591 | Medium | 2026-11-02 | Not applicable | No public exploit | In Modem, there is a possible escalation of privilege due to a permissions bypass. This could lead to local escalation of privilege (EoP) if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09608864 / ALPS09327759; Issue ID: MSV-2958. |
| CVE-2026-59001 | Medium | 2026-11-02 | Not applicable | No public exploit | In checkQueryPermission of TelephonyProvider.java, there is a possible permission bypass due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-16305 | High | 2026-11-02 | Not applicable | No public exploit | Local privilege escalation in `SmartUpdate.exe` and `SmartExecute.exe` in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a local low-privileged attacker to execute arbitrary commands with administrator privileges via modification of a world-writable `execlist.txt` command manifest that is processed during application updates. |
| CVE-2026-120066 | Medium | 2026-11-02 | Not applicable | No public exploit | On Unix-like systems, when logging is enabled, psqlODBC creates its log files in /tmp by default, named from the program name, user name, and process ID, with the default permissions, typically world-readable, and follows symbolic links when opening them. A local user can read query text and data from another user's logs, and can place a symbolic link at the predictable path so that the driver appends log data to a file of the attacker's choosing with the victim's privileges. Versions before psqlODBC 18.00.0006 are affected. |
| CVE-2026-118574 | Medium | 2026-10-30 | Not applicable | No public exploit | Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects S3 File System versions: from 0.0.0 to 3.12.0. |
| CVE-2026-111499 | Medium | 2026-10-30 | Not applicable | No public exploit | Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass. |
| CVE-2026-107060 | Critical | 2026-10-29 | Not applicable | Proof of concept only | Insecure permissions in Tailscale versionCode 297862600 allows unauthorized attackers to make arbitrary changes to another user's VPN configurations and preferences. |
| CVE-2026-107056 | Critical | 2026-10-29 | Not applicable | Proof of concept only | Insecure permissions in the io.file.importer.ImportActivity component of OpenTracks versionCode 6751 allows unauthorized attackers to inject crafted tracking data into the victim's location database via a crafted SEND message. |
| CVE-2026-107055 | High | 2026-10-29 | Not applicable | Proof of concept only | Insecure permissions in the autosave component of AppML neutriNote CE versionCode 1387 allows unauthorized attackers to write arbitrary files. |
| CVE-2026-107047 | High | 2026-10-29 | Not applicable | Proof of concept only | Insecure permissions in mendhak GPSLogger versionCode 137 allows unauthorized attackers to arbitrarily manipulate the app's logging mechanism and log data. |
| CVE-2026-107045 | Critical | 2026-10-29 | Not applicable | Proof of concept only | Insecure permissions in the CitrineContentProvider component of Citrine v3.1.0 (versionCode 62) allows unauthorized attackers to arbitrarily read another's Nostr event database. |
| CVE-2026-107044 | High | 2026-10-29 | Not applicable | Proof of concept only | Insecure permissions in ProjectMAXS MAXS Main v0.5.19 (versionCode 19) allows unauthorized attackers to arbitrarily manipulate the app's MAXS command/transport mechanism. |
| CVE-2026-107042 | High | 2026-10-29 | Not applicable | Proof of concept only | Insecure permissions in USP Ultimate Screenshot Painter versionCode 240213.009 allows unauthorized attackers to move or overwrite files in another user's private storage via supplying a crafted content URI. |
| CVE-2026-107039 | High | 2026-10-29 | Not applicable | Proof of concept only | Insecure permissions in the ActivityMain component of M66B/Marcel Bokhorst NetGuard no-root firewall versionCode 2026080101/versionName 2.337 allows unauthorized attackers to arbitrarily force a device reset or Denial of Service (DoS). |
| CVE-2026-107029 | Critical | 2026-10-29 | Not applicable | Proof of concept only | Insecure permissions in rubenalfon Pile v1.1.3 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting. |
| CVE-2026-107026 | High | 2026-10-29 | Not applicable | Proof of concept only | Insecure permissions in Share to Clipboard v1.14.1 (versionCode 32) allows unauthorized attackers to arbitrarily overwrite another user's clipboard content. |
| CVE-2026-107024 | High | 2026-10-29 | Not applicable | No public exploit | Insecure permissions in Share 2 Archive Today versionCode 61 allows unauthorized attackers to arbitrarily overwrite another user's clipboard content via supplying a crafted URL. |
| CVE-2026-107023 | Medium | 2026-10-29 | Not applicable | Proof of concept only | Insecure permissions in the ContentProvider component of mhss1 MyBrain v3.1.0 allows unauthorized attackers to arbitrarily read another user's private notes/tasks/diary content. |
| CVE-2026-107018 | High | 2026-10-29 | Not applicable | Proof of concept only | Insecure permissions in Ghost Commander File Manager versionCode 479 allows unauthorized attackers to arbitrarily read and write files inside the commander's private storage. |
| CVE-2026-103404 | Medium | 2026-10-28 | Not applicable | No public exploit | An Incorrect Permission Assignment for Critical Resource vulnerability in RoutingManager in Juniper Networks Session Smart Conductor allows a local user to access sensitive routing credentials via triggering processes that write to the /tmp directory. |
| CVE-2026-92377 | High | 2026-10-27 | Not applicable | No public exploit | Improper access control in the Patch Management update mechanism of TeamViewer Full Client and Host for Windows prior to version 15.82 allows a local authenticated attacker with low privileges to supply a signed executable through a forged IPC response and cause it to load a malicious DLL from a user-writable temporary directory. Successful exploitation results in arbitrary code execution with NT AUTHORITY\SYSTEM privileges. |
| CVE-2026-90464 | High | 2026-10-27 | Not applicable | No public exploit | An external control of file path vulnerability in a WatchGuard Fireware OS firewall diagnostic command allows a remote, authenticated attacker with at least read-only (Device Monitor) privileges and access to the management CLI to create, truncate, or overwrite arbitrary files and modify kernel parameters with root privileges by submitting a specially crafted command. Written content is limited to numeric values. |
| CVE-2026-118131 | Critical | 2026-10-27 | Not applicable | No public exploit | GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\ProgramData directory allows members of the BUILTIN\Users group to create arbitrary subdirectories under this path. An attacker with low-privilege access can create the expected GnuPG configuration directory and inject malicious configuration files consumed by GnuPG components. This can result in code execution within the security context of the victim user. |
| CVE-2026-86945 | High | 2026-10-26 | Not applicable | No public exploit | This issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A malicious app may be able to create files in protected directories. |
| CVE-2026-77060 | Medium | 2026-10-26 | Not applicable | No public exploit | boneIO black_debian_images stores the Mosquitto MQTT broker password file at /etc/mosquitto/passwd with world-readable permissions. Any local user can read the password hashes for all MQTT accounts and perform offline dictionary attacks. This issue was fixed in version 1.6.0. |
| CVE-2026-113948 | Medium | 2026-10-26 | Not applicable | No public exploit | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27.2. An app may be able to modify protected parts of the file system. |
| CVE-2026-112539 | High | 2026-10-26 | Not applicable | No public exploit | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A malicious app may be able to read or write to protected files. |
| CVE-2026-93640 | High | 2026-10-23 | Not applicable | No public exploit | A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to access files with root privileges. The passwordless sudo policy permits arbitrary arguments to zmunbound, whose wrapper forwards them to Unbound without restricting the configuration path. An attacker can supply a configuration that retains root privileges and disables the chroot. Include directives expose root-readable file contents through parser errors, while an attacker-selected logfile path creates a root-owned file or appends Unbound log records to an existing file. This can disclose password hashes and private keys and corrupt privileged configuration files, preventing affected services from starting with the modified configuration. The affected configuration is present in ZCS 10.1.16 and 10.1.21 dnscache packages. |
| CVE-2026-50057 | High | 2026-10-23 | Not applicable | No public exploit | A local privilege escalation vulnerability in the Zimbra Collaboration Suite (ZCS) MTA package allows the Unix zimbra account to execute arbitrary commands as root. The installed sudo policy permits passwordless root execution of Postfix administration commands without restricting their arguments. An attacker can select a zimbra-controlled daemon_directory in the Postfix configuration and invoke postfix set-permissions, causing Postfix to execute the attacker's post-install program as root. The Postfix configuration directory is also writable by zimbra, so restricting postconf alone does not remove the execution path. Exploitation requires local command execution as zimbra on an MTA node. ZCS 10.1.16 and 10.1.21 are affected. |
| CVE-2025-30054 | Critical | 2026-10-23 | Not applicable | No public exploit | CGM CLININET is vulnerable to local privilege escalation. The service that processes incoming HL7 messages runs with root privileges, but due to incorrect permissions, its scripts and configuration files can be modified by the uhcapache user. An attacker with uhcapache privileges can modify these files to execute arbitrary code as root. The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable. |
| CVE-2025-30051 | Medium | 2026-10-23 | Not applicable | No public exploit | The CGM CLININET application stores the production database login and password, as well as RabbitMQ broker credentials, in the SysIO.pl configuration file. Insecure file permissions make this file readable by any local account. This issue was fixed in version 2026.MS3 |
| CVE-2026-96293 | Medium | 2026-10-22 | Not applicable | No public exploit | A cleartext storage of sensitive information vulnerability in WatchGuard Endpoint Security's Full Disk Encryption feature for macOS allows a local, unprivileged user or process to obtain a managed computer's FileVault Personal Recovery Key by reading a persistently written diagnostic log file left readable by all local users. |
| CVE-2026-115253 | High | 2026-10-22 | Not applicable | No public exploit | An incorrect permission assignment vulnerability in the WatchGuard Agent's log directory allows a local, authenticated non-administrative user to create, modify, append to, or delete the agent's log files and write other files into the directory. This allows an attacker to tamper with or destroy the agent's security logs and stage further local attacks by placing executable content in a directory owned by a privileged service. |
| CVE-2026-76495 | High | 2026-10-21 | Not applicable | No public exploit | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76495 are related to issues concerning incorrect permission assignments that are grouped under the Common Weakness Enumeration (CWE) Variant CWE-732. |
| CVE-2026-114105 | Medium | 2026-10-21 | Not applicable | No public exploit | Adm-zip before 0.6.1 contains an incorrect permission assignment vulnerability that allows attackers to set setuid, setgid, or sticky bits on extracted files when keepOriginalPermission is enabled. Attackers can craft zip external file attributes that pass unmasked into chmod, letting attacker-controlled executables gain elevated privileges when extracted as root and later run. |
| CVE-2026-111184 | High | 2026-10-21 | Not applicable | No public exploit | NoMachine Named Pipe Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the NoMachine Device Service. The issue results from incorrect permissions on a named pipe. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-31213. |
| CVE-2026-113720 | Medium | 2026-10-20 | Not applicable | No public exploit | virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the app-data copy seeder uses shutil.copy() to copy cached package files into later environments, causing cached source modes to override the current run's umask. A cache populated under a permissive umask can therefore produce files writable by another local account in a later traversable environment, allowing package code such as pip/__init__.py to be modified and executed by the environment owner. The attacker cannot force the earlier umask, and a private destination parent prevents access. This issue is fixed in version 21.14.9. |
| CVE-2026-71169 | High | 2026-10-19 | Not applicable | No public exploit | Dell Application Store, versions prior to 26.05.0.7, contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Disclosure of sensitive information |
| CVE-2026-96542 | Medium | 2026-10-16 | Not applicable | No public exploit | Incorrect permission assignment (CWE-732) in the standalone installer for EA Javelin Anticheat (versions 1.0.14329371, 1.0.14547437, 1.0.14789537, and 1.0.14940698) on Windows allows a local non-administrative user to elevate privileges to NT AUTHORITY\SYSTEM by modifying the EAAntiCheatService service configuration and executable path. This vulnerability requires non-standard manual execution of the standalone installer and does not affect standard game installations via the EA App and Steam. This issue is corrected in version 1.0.14940699 and later; service permissions automatically self-heal upon launching an integrated EA game title. |
| CVE-2026-96425 | Medium | 2026-10-16 | Not applicable | No public exploit | Incorrect DBus policy for lomiri-download-manager allows arbitrary user to run arbitrary command as root over DBus |
| CVE-2026-96424 | High | 2026-10-16 | Not applicable | No public exploit | Incorrect DBus policy for lomiri-upload-manager (part of lomiri-download-manager) allows arbitrary user to read arbitrary file as root over DBus |
| CVE-2026-92228 | Medium | 2026-10-15 | Not applicable | No public exploit | The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`) granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one team could read other teams' audit events through the UI or the event-log API. Users of apache-airflow-providers-keycloak are recommended to upgrade to apache-airflow-providers-keycloak 0.11.1 or later. |
| CVE-2026-34014 | High | 2026-10-15 | Not applicable | No public exploit | An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Download Station 5.10.1.312 and later Download Station 5.11.2.321 and later |
| CVE-2026-34008 | High | 2026-10-15 | Not applicable | No public exploit | An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later |
| CVE-2026-104618 | Medium | 2026-10-15 | Not applicable | No public exploit | On request the `sdbootutil` script creates a world-readable debug log in /var/log/sdbootutil.log. The log file is created world-readable, however, which means that arbitrary low-privileged users in the system will be able to extract secrets from it. |
| CVE-2026-102740 | Medium | 2026-10-15 | Not applicable | No public exploit | The AsyncHttpClient library allows Java applications to execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, PropertiesBasedResumableProcessor stores resumable download state at the predictable shared path $java.io.tmpdir/ahc/ResumableAsyncHandler.properties with default permissions and link-following file operations. A local user who can read the shared store can see download URLs, including embedded user information or query tokens. A local user who can write within or pre-create the affected shared store directory can plant a symbolic link that the client follows when saving state, truncating and overwriting a target file writable by the client process. The filesystem path is used when ResumableAsyncHandler decorates another AsyncHandler, while the no-argument constructors use a no-op processor and are unaffected. This issue is fixed in versions 2.16.1 and 3.0.12. |
| CVE-2026-87093 | High | 2026-10-14 | Not applicable | No public exploit | Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4. |
| CVE-2026-70402 | Medium | 2026-10-14 | Not applicable | No public exploit | Gitea creates server-side Git hook directories and scripts with mode 0777 and relies on the process umask to restrict access. With a permissive umask such as 0000 or 0002, another local user who can reach the repository storage may modify a hook or add an executable to a writable hook directory. A later Git operation can execute that file as the Gitea service account. |
| CVE-2026-97800 | High | 2026-10-13 | Not applicable | No public exploit | Incorrect permission assignment for critical resource in Windows Mobile Broadband allows an authorized attacker to elevate privileges locally. |
| CVE-2026-97792 | High | 2026-10-13 | Not applicable | No public exploit | Improper access control in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally. |
| CVE-2026-78632 | Medium | 2026-10-13 | Not applicable | No public exploit | The Okta RADIUS Agent Windows installer assigns write permissions to the NT SERVICE\ALL SERVICES and CREATOR OWNER security principals on the directories containing the agent configuration, AES encryption key, and logs. These permissions allow any local service account on the host to read the AES encryption key and the encrypted Okta API token. |
| CVE-2026-101020 | High | 2026-10-13 | Not applicable | No public exploit | An incorrect permission assignment for critical resource issue exists in AssetView, AssetView CLOUD, and AssetView Cloud +. If this vulnerability is exploited, a local authenticated attacker who can log in to the Windows system where Management Console or Client Terminal for the product is running may gain SYSTEM privileges. |
| CVE-2026-85971 | High | 2026-10-12 | Not applicable | No public exploit | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 assign overly permissive operating-system permissions to certain log files, which could allow a local user to read or alter log data. The corrected default permissions apply to newly created and rotated logs; existing logs retain their current permissions until remediated. |
| CVE-2026-49483 | High | 2026-10-12 | Not applicable | No public exploit | Code for IBMi is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, IBMi components implementing IBMiComponent were accepted after checking that a procedure existed without reliably verifying component integrity. Components installed with broad public permissions allow another local account to alter a program such as GETMBRINFO. A later connection can execute the altered program under the connecting account because the LONG_COMMENT marker alone does not establish integrity. This issue is fixed in version 3.0.1. |
| CVE-2026-109358 | High | 2026-10-12 | Not applicable | No public exploit | Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect permissions vulnerability where the node installer writes the containerd config world-writable (0666). Local unprivileged users on the node can modify the containerd config, for example overwriting the runc location, to escalate privileges. |
| CVE-2026-109244 | Medium | 2026-10-12 | Not applicable | No public exploit | FreeRDP from 2.0.0 before 3.32.0 contains an insecure permission vulnerability in winpr-makecert that creates unencrypted private keys without owner-only file modes. Local users on multi-user Unix hosts can read world-readable key files or open PFX files protected by the hard-coded default password to steal private keys. |
| CVE-2026-109243 | Medium | 2026-10-12 | Not applicable | Proof of concept only | FreeRDP from 3.0.0 before 3.32.0 contains an incorrect permission assignment vulnerability that allows local users to read private keys written by crypto_write_pem without owner-only permissions. Attackers on multi-user Unix hosts can enumerate the shared temporary directory during soft-smartcard logon to read the world-readable PKINIT private-key copy. |
| CVE-2026-108582 | Medium | 2026-10-10 | Not applicable | No public exploit | GenOffice through 0.11.505 contains an incorrect permissions vulnerability in its HTTP MCP server file store that allows local unprivileged users to read uploaded and generated documents. Attackers can list the world-readable genoffice-mcp-http directory under the system temporary directory to read client uploads and converted outputs, bypassing the HTTP bearer token. |
| CVE-2026-78339 | High | 2026-10-09 | Not applicable | No public exploit | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure, Protection mechanism bypass, and Unauthorized access. |
| CVE-2026-107814 | High | 2026-10-09 | Not applicable | No public exploit | MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an administrator opened a login shell for the mysql account. Debian packages are not affected because they use /nonexistent as the account home. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. |
| CVE-2026-87660 | High | 2026-10-08 | Not applicable | No public exploit | An improper file permission and missing authorization vulnerability exists in the diagnostic kernel module subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An unprivileged local user can invoke privileged hardware tests, force system error conditions, reset hardware blades, or disrupt storage fabric operations. |
| CVE-2026-107612 | High | 2026-10-08 | Not applicable | No public exploit | Incorrect permission assignment in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to read or overwrite the inter-process communication handles used between the TightVNC service and its desktop server process. The named shared memory segment in the Global\ namespace that carries the pipe HANDLE values is created with a NULL DACL, and its name is derived from a time-seeded srand(time(0)) value that is predictable to one-second granularity. A low-privileged local process can open the mapping and tamper with the IPC channel of a service running as SYSTEM, potentially leading to disclosure of session data, privilege escalation, or denial of service. |
| CVE-2026-76280 | Medium | 2026-10-07 | Not applicable | No public exploit | In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, an authenticated user who does not hold the "admin" or "sc_admin" Splunk roles could modify Splunk Secure Gateway alert and mobile-device recipient data in App Key Value Store (KV Store) collections that later alert and subscription workflows use. The vulnerability is possible because the affected collections allow unrestricted write access instead of limiting writes to authorized Splunk Secure Gateway workflows. For more information see About the app key value store (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/administer-the-app-key-value-store/about-the-app-key-value-store), KV store endpoint descriptions (https://help.splunk.com/en/splunk-enterprise/leverage-rest-apis/rest-api-reference/10.4/kv-store-endpoints/kv-store-endpoint-descriptions), and About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access) in the Splunk documentation. |
| CVE-2026-86361 | High | 2026-10-06 | Not applicable | No public exploit | Dell System Update, versions prior to 2.3.0.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges. |
| CVE-2026-106105 | High | 2026-10-06 | Not applicable | No public exploit | Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0, the @quasar/ssl-certificate utility cached a combined private key and certificate PEM without explicitly applying owner-only filesystem permissions. Another local user able to read the cache can copy the key and impersonate a development TLS endpoint in an environment that trusts the certificate. The generated certificate was also CA-capable, carried unnecessarily broad key usages, and encoded the IPv6 loopback address as a DNS subject alternative name. This issue is fixed in @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0. |
| CVE-2026-105267 | High | 2026-10-06 | Not applicable | No public exploit | The Gitea web route for deleting tags (`POST /{owner}/{repo}/tags/delete`) requires only write access to the Code unit, but shares its handler with release deletion and did not check that the target was a plain tag. A collaborator with Code write access and without Releases write access could permanently delete published releases of that repository, including their attachments. Protected tag rules covering the release tag still blocked the deletion. |
| CVE-2026-102282 | High | 2026-10-05 | Not applicable | Proof of concept only | adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via `fs.chmodSync()` when `keepOriginalPermission=true` is passed to `extractAllTo()`/`extractEntryTo()` — and it never filters the setuid/setgid/sticky bits out of those bits. A zip crafted by an attacker can therefore produce an extracted binary with mode `04755`. When extraction runs as root (the default posture in Docker builds, CI runners, and privileged install steps — the exact environments where this flag is used), the resulting root-owned setuid file is executed later by a lesser-privileged user, turning the attacker's code into a root execution. Version 0.6.1 fixes the issue. |
| CVE-2026-105165 | Medium | 2026-10-04 | Not applicable | No public exploit | A vulnerability has been found in devopspolis secrets-replicator up to 0.4.0. Impacted is the function process_single_secret of the file src/handler.py of the component AssumeRole Handler. Such manipulation of the argument external_id leads to incorrect permission assignment. The attack can be executed remotely. Upgrading to version 0.5.0 is recommended to address this issue. The name of the patch is b42239405fbf4fae3c3f0048fc0b4225112edceb. It is suggested to upgrade the affected component. |
| CVE-2026-104854 | High | 2026-10-02 | Not applicable | No public exploit | Nx is a monorepo solution for TypeScript and polyglot codebases. From 14.6.0 until 22.7.9 and 23.1.2, Nx creates Unix domain sockets for its daemon and isolated plugin workers in shared temporary locations without owner-only directory and socket permissions. Another unprivileged local account on a shared build server, developer host, or multi-user container can discover and connect to a running socket because the transport performs no authentication and relies on filesystem containment. The daemon's PROCESS_IN_BACKGROUND request accepts a module path and invokes its default export, allowing a caller that controls a file to execute code as the account running Nx; other handlers can expose workspace file contents, project graphs, and task hashes. Disabling the daemon alone does not remove the vulnerable plugin-worker sockets, while single-user machines without another local account are not exposed. This issue is fixed in versions 22.7.9 and 23.1.2. |
| CVE-2026-47518 | Medium | 2026-09-30 | Not applicable | No public exploit | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in a secure microcontroller component, where incorrect permission assignment for a critical resource allows an attacker with privileged local access to modify protected memory that should be restricted. A successful exploit of this vulnerability might lead to code execution and escalation of privileges. |
| CVE-2026-94204 | High | 2026-09-29 | Not applicable | No public exploit | The central cloud storage backend for the entire dashcam platform is misconfigured with public-read permissions, allowing unrestricted access to all stored objects. Because this bucket serves as shared storage for the platform, sensitive user records, live dashcam footage, application packages, and firmware files are exposed to anyone on the internet. |
| CVE-2026-84414 | High | 2026-09-29 | Not applicable | No public exploit | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to change the ownership of arbitrary files due to improper validation of an attacker-controlled file path. |
| CVE-2026-73598 | High | 2026-09-29 | Not applicable | No public exploit | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges. |
| CVE-2026-15952 | High | 2026-09-28 | Not applicable | No public exploit | Incorrect Permission Assignment for Critical Resource vulnerability in ABB Protection and control IED manager (PCM600). This issue affects Protection and control IED manager (PCM600): through 2.14. |
| CVE-2026-39353 | Critical | 2026-09-25 | Not applicable | Proof of concept only | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-rc-1, InvoicePlane builds its permitted template list by scanning a PHP template directory that can be written through an administrator-controlled file-write capability. A malicious PHP file placed in the directory is automatically trusted by Mdl_templates and can be selected as public_invoice_template. When a public invoice is rendered, the guest View controller includes the trusted file and executes it with web-server privileges. This issue is fixed in version 1.7.2-rc-1. |
| CVE-2026-82164 | High | 2026-09-24 | Not applicable | No public exploit | Dell Trusted Device Client, versions prior to 8.1.359.0, contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering. |
| CVE-2026-95627 | High | 2026-09-23 | Not applicable | No public exploit | When a Tauri application uses the dialog plugin's file or folder picker, an attacker with JavaScript execution (XSS) can force the scope expansion to be recursive, granting read/write access to an entire directory tree after a single user click on a normal-looking OS file dialog. The user has no indication that recursive access was granted, and the expanded scope cannot be revoked for the lifetime of the application. |
| CVE-2026-91800 | High | 2026-09-23 | Not applicable | No public exploit | A local privilege escalation vulnerability exists in the installer of Foxit PDF Editor for macOS due to insufficient validation of a user-modifiable configuration value during high-privilege upgrades. A local attacker could exploit this issue to execute arbitrary commands with root privileges. |