CVE-2025-48505

Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to achieve privileged escalation, potentially resulting in arbitrary code execution...

CVE-2025-61970

Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to create arbitrary code, potentially resulting in binary hijacking...

CVE-2025-61970

Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to create arbitrary code, potentially resulting in binary hijacking...

CVE-2025-61970

CVE-2025-61970 affects the Vitis™ Unified installation path on local Windows machines. The root issue is weak permissions in the installation directory, which could allow a low-privileged user to create arbitrary code and potentially cause binary hijacking. The provided documents do not specify e...

EUVD-2025-210686

Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to create arbitrary code, potentially resulting in binary hijacking...

CVE-2026-18860 Velociraptor incorrect Org deletion permissions check

Velociraptor allows multi-tenant deployments named "Orgs". By default Velociraptor, uses the ROOT org, but users can create child orgs for other tenants within the same deployment. Users can have different permissions in each org. To manage Orgs, Velociraptor usually examines the ORGADMIN...

PowerShell Elevation of Privilege Vulnerability

Incorrect default permissions in Microsoft PowerShell allows an authorized attacker to elevate privileges locally...

EUVD-2026-56131

A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the borrowers = editborrowers permission to cause a time-based denial of service by storing a SQL payload in a patron lang field. The value is concatenated raw into a...

PT-2026-70614

Incorrect permission assignment for critical resource in Azure SQL Database allows an authorized attacker to elevate privileges locally...

PT-2026-70402

Incorrect default permissions in Microsoft PowerShell allows an authorized attacker to elevate privileges locally...

PT-2026-70363

Name of the Vulnerable Software and Affected Versions Vitis Unified affected versions not specified Description Weak permissions in the installation path on local Windows machines could allow a low-privileged user to create arbitrary code, potentially resulting in binary hijacking, which is the...

PT-2026-70361

Name of the Vulnerable Software and Affected Versions Vitis Unified affected versions not specified Description Weak permissions in the installation path on local Windows machines could allow a low-privileged user to achieve privileged escalation, potentially resulting in arbitrary code execution...

PT-2026-70842

NetBox 4.5.8 contains an ORM injection vulnerability that allows authenticated attackers, including those with read-only API tokens, to inject arbitrary Django ORM lookup expressions into nested object references by supplying crafted JSON dictionary keys in POST, PUT, or PATCH requests to any RES...

PT-2026-70789

Incorrect directory permissions could allow a local user to escalate their privileges, potentially resulting in arbitrary code execution...

The vulnerability of the Firewalld firewall configuration program, related to improper execution permissions, allows a intruder to compromise data integrity.

The vulnerability of the Firewalld firewall configuration program is related to improper execution permissions. Exploiting this vulnerability could allow an attacker to compromise data integrity...

CVE-2026-72909

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.23.0, the ReceivablePayableReport prepareconditions path in erpnext/accounts/report/accountsreceivable/accountsreceivable.py does not apply Customer and Supplier user permissions to the Payment Ledger...

CVE-2026-16456

A flaw was found in the odh-model-controller. An authenticated user with permissions to create custom resources can exploit a vulnerability in the loadSecret function. This function improperly reads the Secret namespace from user-controlled input without validation. This allows an attacker to rea...

CVE-2026-72909

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.23.0, the ReceivablePayableReport prepareconditions path in erpnext/accounts/report/accountsreceivable/accountsreceivable.py does not apply Customer and Supplier user permissions to the Payment Ledger...

CVE-2026-18949

A flaw was found in odh-dashboard. This vulnerability allows an attacker, who has compromised the dashboard's Service Account SA token, to exploit overly broad permissions granted to the SA. This enables the attacker to escalate their privileges to cluster-administrator level, gain access to...

CVE-2026-18949 Odh-dashboard: odh-dashboard: clusterrole grants cluster-wide crud on secrets and rbac management resources

A flaw was found in odh-dashboard. This vulnerability allows an attacker, who has compromised the dashboard's Service Account SA token, to exploit overly broad permissions granted to the SA. This enables the attacker to escalate their privileges to cluster-administrator level, gain access to...