GHSA-5CWG-9F6J-9JVX Claude Code: Insecure System-Wide Configuration Loading Enables Local Privilege Escalation on Windows

On Windows, Claude Code loaded system-wide default configuration from C:\ProgramData\ClaudeCode\managed-settings.json without validating directory ownership or access permissions. Because the ProgramData directory is writable by non-administrative users by default and the ClaudeCode subdirectory...

CVE-2025-15561

NesterSoft WorkTime project tracking software contains a local privilege escalation vulnerability due to a flaw in the WorkTime monitoring daemon update behavior. An attacker can elevate privileges to NT AuthoritySYSTEM by placing a malicious executable named WTWatch.exe in the C: orProgramData ...