Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,642

Export CSV
CVE-2012-5605

Grinder: red hat cloudforms: grinder in red hat cloudforms: local users can modify cache files via world-writable permissions

A flaw was found in Grinder, a component of Red Hat CloudForms. This vulnerability allows a local user to modify Grinder's cache files due to incorrect world-writable permissions set on the `/var/lib/pulp/cache/grinder/` directory. This could lead to unauthorized data tampering within the application's cache.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Cloudforms Systemengine Cloudforms Tools Redhat
Products
1 1 Cloudforms
CVE-2025-57848

Container-native-virtualization: privilege escalation via excessive /etc/passwd permissions

A container privilege escalation flaw was found in certain Container-native Virtualization images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Container Native Virtualization
CVE-2013-0266

Puppetlabs-cinder: packstack: openstack: puppetlabs-cinder: information disclosure of openstack administrative passwords due to world-readable configuration files.

A flaw was found in the `puppetlabs-cinder` module, as used in PackStack. This vulnerability is due to incorrect file permissions, specifically world-readable permissions, on the `cinder.conf` and `api-paste.ini` configuration files. A local user can exploit this by reading these files, which leads to the disclosure of OpenStack administrative passwords. This information disclosure could allow unauthorized access to sensitive OpenStack resources.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Openstack Redhat
Products
Essex Folsom Openstack
CVE-2012-3427

Jboss-eap: aws-ec2: jboss eap and aws ec2: information disclosure via incorrect directory permissions

A flaw was found in JBoss Enterprise Application Platform (EAP) and EC2 Amazon Machine Image (AMI). Incorrect permissions (755) for the /var/cache/jboss-ec2-eap/ directory allow a local user to read sensitive files. This vulnerability can lead to information disclosure, specifically exposing Amazon Web Services (AWS) credentials.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Jboss Enterprise Application Platform Jbosseapxp
CVE-2026-107052

Insecure AIDL Permissions Enable Arbitrary File Reads in ProjectMAXS MAXS Module FileRead

Insecure permissions in the AIDL interface of ProjectMAXS MAXS Module FileRead versionCode 27 allows unauthorized attackers to arbitrarily reead files outside of the sandbox via providing an absolute path.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-113345

Improper File Permissions Allow Arbitrary Code Execution in Electronic Delivery Item Inspection Support System

Electronic delivery item Inspection Support System provided by Japan's Ministry of Land, Infrastructure, Transport and Tourism contains an improper file access permission vulnerability. Files in the installation folder of the application may be tampered with, resulting in arbitrary code execution.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Ministry Of Land, Infrastructure, Transport And Tourism, Japan
Products
Electronic Delivery Item Inspection Support System
CVE-2026-110359

Local Privilege Escalation via Weak Service Permissions in Hyland Desktop Host

Hyland Desktop Host for Windows before 25.1.1 is vulnerable to local privilege escalation. This is caused by a privileged service running from the %PROGRAMDATA%\Hyland\DesktopHost\bin folder with weak permissions. A local user can exploit this to escalate privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Hyland
Products
Desktop Host
CVE-2026-115253

WatchGuard Agent Incorrect Permission Assignment in Log Directory Allows Local Log Tampering

An incorrect permission assignment vulnerability in the WatchGuard Agent's log directory allows a local, authenticated non-administrative user to create, modify, append to, or delete the agent's log files and write other files into the directory. This allows an attacker to tamper with or destroy the agent's security logs and stage further local attacks by placing executable content in a directory owned by a privileged service.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Watchguard
Products
Watchguard Agent
CVE-2026-107571

Incorrect Default Permissions in hMailServer

Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.6 allow a local authenticated user to run code as the mail server's high-privileged accounts when the product is installed in a folder whose permissions are inherited from a writable parent, such as the root of a drive. The installer places the server's programs in the Bin folder of the program folder and gives neither the program folder nor Bin any permissions of their own, so they inherit the parent's. Under the default location, Program Files, ordinary users receive only read and execute and the configuration is not affected; but the installer accepts any path without warning, and a program folder at the root of an NTFS volume inherits write access for a broad group - Authenticated Users (Modify) on a Windows client, Users (create files and folders) on Windows Server. A local user without administrator rights can then alter or replace the service program, which runs as LocalSystem or as the service's virtual account, or the programs an administrator runs elevated from Bin during setup and maintenance, or place a library in Bin that those programs load in place of the system copy, gaining code execution with those privileges. The default Program Files installation is not affected.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Progressive Robot
Products
Hmailserver
CVE-2026-85300

Apache Camel: Camel-PQC Private Key Disclosure via Key Material Written with Default File Permissions

Incorrect Default Permissions vulnerability in Apache Camel PQC component. This issue affects Apache Camel: from 4.12.0 before 4.18.5, from 4.19.0 before 4.22.1. When the component wrote generated key material to disk it did so with the permissions the process default umask produced, rather than restricting the file to its owner. On a host whose umask allows group or world read, the private key was therefore readable by other local accounts. The exposure is to a local party rather than to the remote sender that the Camel threat model treats as the primary adversary, which is why the severity is assessed low, but the consequence where it applies is complete: possession of the private key defeats every signature and key exchange the deployment performs with it. Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Key material is now written with owner-only permissions. For deployments that cannot upgrade immediately, place the key directory on a path only the service account can traverse, and tighten the process umask. Key material already written with permissive permissions should be treated as exposed and rotated.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Apache Camel Camel
CVE-2026-21131

Unauthorized Activity Launch via Incorrect Default Permission in Samsung Flow

Incorrect default permission in Samsung Flow prior to version 4.9.22.4 allows local attackers to launch an arbitrary activity with Samsung Flow privileges on the connected device.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Samsung Mobile
Products
Samsung Flow
CVE-2026-77364

obsidian-tc fail-open default ACL exposes Obsidian control-directory secrets

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, undefined readPaths and writePaths settings allow all paths, strictReadDefault does not protect direct requests, and the .obsidian, .git, and .trash control directories are excluded only during enumeration. An authenticated caller can directly read sensitive files such as .obsidian/plugins/*/data.json, potentially exposing plugin API keys, Obsidian Sync passwords, and other in-vault data. Version 1.3.1 fixes the vulnerability by denying the control directories by default and enforcing strictReadDefault on direct request paths.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
The-40-thieves
Products
Obsidian-tc
CVE-2022-32207

curl: Unpreserved file permissions

When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally *widen* the permissions for the target file, leaving the updated file accessible to more users than intended.

CVSS 3.1 · 9.8 Critical EPSS 12.3% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 4 more
Products
Macos Debian Linux Fedora and 18 more
CVE-2026-108072

Insecure Permissions on Shared Startup Scripts Allow Cross-User Code Execution and Potential Privilege Escalation

Vulnerability due to incorrect permissions in TSplus Remote Access shared login scripts. The autostart1.tscr files, located in the shared themes directory, allow users without sufficient privileges to write to them. A local attacker with a valid session on the terminal or remote desktop server could modify these files to execute arbitrary commands within another user’s security context when that user logs in using the same theme or operating mode. Depending on the affected user’s privileges, exploitation could allow lateral movement between users or privilege escalation.

CVSS 4.0 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Tsplus
Products
Tsplus Remote Access
CVE-2026-109244

FreeRDP 2.0.0 before 3.32.0 Insecure Private Key Permissions in winpr-makecert

FreeRDP from 2.0.0 before 3.32.0 contains an insecure permission vulnerability in winpr-makecert that creates unencrypted private keys without owner-only file modes. Local users on multi-user Unix hosts can read world-readable key files or open PFX files protected by the hard-coded default password to steal private keys.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Freerdp
Products
Freerdp
CVE-2025-57847

Ansible-automation-platform: privilege escalation via excessive group writable /etc/passwd permissions

A container privilege escalation flaw was found in certain Ansible Automation Platform images. This issue arises from the /etc/passwd file being created with group-writable permissions during the build process. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This vulnerability allows an attacker to add a new user with any arbitrary UID, including UID 0, gaining full root privileges within the container.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Ansible Automation Platform Ansible Core
CVE-2026-108503

Unauthorized information acquisition vulnerability in ZTE Z80 Ultra product

ZTE Z80 Ultra has an interface permission validation vulnerability. The callable functions provided by the system lack sufficient access control. An attacker can leverage these functions to read relevant information.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Zte
Products
Z80 Ultra
CVE-2026-107332

Insecure Default File Permissions on Cached Credentials in AWS Toolkit for Visual Studio Code

Insecure file permissions in the CodeCatalyst connection handler in AWS Toolkit for VS Code before 4.10.0 allowed local users to obtain CodeCatalyst bearer tokens via reading world-readable token cache files. To mitigate this issue, users should upgrade to version 4.10.0 or later.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Aws
Products
Aws-toolkit-vscode