GHSA-5CWG-9F6J-9JVX Claude Code: Insecure System-Wide Configuration Loading Enables Local Privilege Escalation on Windows

On Windows, Claude Code loaded system-wide default configuration from C:\ProgramData\ClaudeCode\managed-settings.json without validating directory ownership or access permissions. Because the ProgramData directory is writable by non-administrative users by default and the ClaudeCode subdirectory...

CVE-2025-15561

CVE-2025-15561 describes a local privilege escalation in NesterSoft WorkTime. An attacker can exploit the update behavior of the WorkTime monitoring daemon to elevate privileges to NT AUTHORITY\SYSTEM. The attack requires a malicious executable named WTWatch.exe to be dropped in the writable dire...