4315 matches found
CVE-2024-27674
CVE-2024-27674 Macro Expert icacls "C:\Program Files x86\GrassSoft\Macro Expert" C:\Program Files x86\GrassSoft\Macro Expert BUILTIN\Users:OICIM NT SERVICE\TrustedInstaller:IF NT SERVICE\TrustedInstaller:ICIIOF NT AUTHORITY\SYSTEM:IF NT AUTHORITY\SYSTEM:IOICIIOF BUILTIN\Administrators:IF...
CVE-2026-78150
The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership or status of the post it is asked to duplicate, allowing users with contributor privileges and above to copy any private or password protected post into a draft of their own and read its content and metadata...
PT-2026-86333
🚨 CVE-2026-78150 The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership or status of the post it is asked to duplicate, allowing users with contributor privileges and above to copy any private or password protected post into a draft of their own and read its content and...
EUVD-2026-70902
The Hummingbird Performance WordPress plugin before 3.21.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network...
CVE-2026-85028
CVE-2026-85028 affects the FPGA management tool installation component of AWS FPGA Development Kit (aws-fpga) prior to version 2.3.4 . The root cause is the creation of a temporary file in a world-writable directory with insecure permissions. A local attacker with low privileges can place crafted...
CVE-2026-85213
Kill Bill through version 0.24.21 fails to enforce permission annotations on several AdminResource endpoints, including getQueueEntries , invalidatesCache , and putOutOfRotation . As a result, an authenticated user with only minimal account:read permissions can read internal queues, flush server ...
CVE-2026-12663
A security issue exists within ControlFLASH™, where the installer grants write permissions to the "Everyone" group on a product installation directory. This could allow arbitrary code execution, resulting in an attacker being given the ability to run any commands or code of the attacker's choice ...
EUVD-2026-69148
A security issue exists within the Redundancy Module Configuration Tool. The RMConfigTool.exe binary searches directories in the system path for a required DLL, and one or more of these directories may be writable by standard non-administrator users due to incorrect default permissions. If a loca...
EUVD-2026-68059
The Rank Math SEO WordPress plugin before 1.0.277 does not check that the user requesting an automated SEO fix holds the capability WordPress itself requires for the settings being changed, allowing users with the Editor role to modify site-wide core WordPress settings that are reserved to...
CVE-2026-59292
PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to $java.io.tmpdir/spring-integration/metadata-store.properties with world-readable permissions. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring...
EUVD-2026-67038
opensslencrypt versions before 1.4.9 contain an insecure file permissions vulnerability in the desktop GUI that writes decrypted plaintext with world-readable default permissions. Attackers can read decrypted output files created by the GUI as unprivileged local users on multi-user systems...
CVE-2026-81682
openssl_encrypt versions before 1.4.9 contain an insecure file permissions vulnerability in the desktop GUI. The GUI writes decrypted plaintext with world-readable default permissions , allowing unprivileged local users on multi-user systems to read decrypted output files. The CVSS 3.1 score is 6...
CVE-2026-81682 openssl_encrypt before 1.4.9 Insecure File Permissions
opensslencrypt versions before 1.4.9 contain an insecure file permissions vulnerability in the desktop GUI that writes decrypted plaintext with world-readable default permissions. Attackers can read decrypted output files created by the GUI as unprivileged local users on multi-user systems...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: trousers (UTSA-2026-093151)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093151 advisory. An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the tss user still has read and write access to the...
CVE-2026-79179
Incorrect authorization in DOM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially leak sensitive information via a crafted HTML page. Chromium security severity: Low...
CVE-2026-78553
RansomLook stored its Flask session-signing key in a secret_key file with default file permissions (e.g., 0644 under a common 022 umask) rather than explicitly restricting access. Any local user able to read the RansomLook home directory could obtain this cryptographic secret, which is used to si...
Astra Linux – Vulnerability in libzstd
Starting from v1.4.1 and before v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output files with default permissions and immediately restricted those permissions afterward. As a result, the output files could temporarily be readable or writable by...
CVE-2026-76607
Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik 4.7.2...
