An incorrect handling of permissions in STORM powered by OTRS and in OTRS (2026.x and above) Document Search Article Meta Filters modules allows gaining knowledge about number of affected CIs, SLA and services without gaining access to them.
This issue affects OTRS with STORM modules:
* 7.0.X
* 8.0.X
* 2023.X
* 2024.X
* 2025.X
* 2026.X before 2026.4.X
Insecure default settings of Portainer CE grant regular (non-admin) users privileges that allow host filesystem access and host-level code execution. An authenticated non-administrative user with endpoint access can exploit these settings to read host files or obtain root equivalent
access on the host.
An issue was discovered in Canonical Multipass for macOS before version 1.16.3 due to an incomplete fix for CVE-2025-5199. While the patch in version 1.16.0 updated the ownership of the multipassd daemon binary to root:wheel, five co-located binaries (multipass, qemu-img, qemu-system-aarch64, qemu-system-x86_64, and sshfs_server) in /Library/Application Support/com.canonical.multipass/bin/ retain ownership by the installing user and remain writable. Because the root LaunchDaemon (com.canonical.multipassd.plist) configures a PATH environment variable that prioritizes this user-writable directory and invokes these auxiliary binaries by their bare names, a local attacker can replace an auxiliary binary (such as qemu-img) with a malicious wrapper. When the root daemon subsequently triggers the binary during routine execution (e.g., via multipass launch), the malicious code executes with root privileges, leading to local privilege escalation.
The affected product extracts installation files to a temporary directory with incorrect default permissions during administrative installation. A low-privileged local attacker can exploit a TOCTOU race condition with a practical time window to replace verified files with malicious ones before installation, resulting in local privilege escalation.
The affected product creates a directory with insecure default permissions during administrative installation. This allows a low-privileged local attacker to modify a temporary file defining the components to be installed, enabling local privilege escalation by forcing the deployment of arbitrary components.
Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Exposure of Information Through Directory Listing vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.
Incorrect default permissions vulnerability in Progress Software MOVEit Automation allows Retrieve Embedded Sensitive Data.
This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7.
CVE-2025-48516 is a vulnerability in AMD Ryzen 4000 Series Mobile Processors with Radeon Graphics involving insecure default permissions in the AGESA Bootloader Firmware. The issue stems from an insecure default configuration of the DDR5 memory module, allowing a local attacker with user privileges to abuse the unprotected PMIC interface. This could lead to a permanent denial of service or impact the integrity of the memory module. The vulnerability has a medium severity rating with a CVSS score of 6.9. No official patch or remediation guidance has been provided by AMD as of the publication date. There are no known exploits in the wild at this time.
CVE-2026-0432 is a high-severity vulnerability affecting AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics. It involves incorrect default permissions in the installation directory of the AMD chipset driver, which could allow a local attacker with limited privileges to escalate their privileges and execute arbitrary code. The vulnerability has a CVSS 4.0 base score of 8.5, indicating a significant risk. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
CVE-2025-48512 is a high-severity vulnerability in AMD Ryzen 4000 Series Mobile Processors with Radeon Graphics, caused by incorrect default permissions in the installation directory of the AMD general-purpose input/output controller (GPIO). This misconfiguration could allow an attacker with limited privileges to escalate their privileges and execute arbitrary code. The vulnerability has a CVSS 4.0 score of 7.0, indicating significant risk, but no official patch or remediation guidance has been provided yet. There are no known exploits in the wild at this time.
Due to improper input handling under certain conditions, SAP NetWeaver Application Server ABAP allows an attacker to inject custom Cascading Style Sheets (CSS) data into a web page served by the application. When a user accesses or clicks the affected page, the injected CSS is executed. As a result, the issue has a low impact on confidentiality, while integrity and availability are not impacted.
A vulnerability chain in Cribl Edge for Windows before 4.17.1 allows a local authenticated user to escalate privileges to NT AUTHORITY\SYSTEM. Incorrect default permissions on the Windows installer's authentication directory (CWE-276) expose a cryptographic secret used for JWT signing and password-hash derivation, enabling forgery of administrative API tokens. The forged token can then be used to invoke a pipeline function that reaches an OS command sink (CWE-78) running in the SYSTEM context.
Incorrect Default Permissions in pcvisit service binary on Windows allows a low-privileged local attacker to escalate their privileges by overwriting the service binary with arbitrary contents. This service binary is automatically launched with NT\SYSTEM privileges on boot. This issue affects all versions after 22.6.22.1329 and was fixed in 25.12.3.1745.
HKUDS OpenHarness prior to PR #147 remediation contains an insecure default configuration vulnerability where remote channels inherit allow_from = ["*"] permitting arbitrary remote senders to pass admission checks. Attackers who can reach the configured channel can bypass access controls and reach host-backed agent runtimes, potentially leading to unauthorized file disclosure and read access through default-enabled read-only tools.
HKUDS OpenHarness prior to PR #156 remediation exposes plugin lifecycle commands including /plugin install, /plugin enable, /plugin disable, and /reload-plugins to remote senders by default. Attackers who gain access through the channel layer can remotely manage plugin trust and activation state, enabling unauthorized plugin installation and activation on the system.
CVE-2026-21013 is a medium severity vulnerability in Samsung Mobile's Galaxy Wearable application prior to version 2.2.68.26. It involves incorrect default permissions that allow local attackers to access sensitive information. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a moderate risk. There is no official patch or remediation level provided in the available data. No known exploits in the wild have been reported.
CVE-2026-25203 is a local privilege escalation vulnerability in Samsung MagicINFO 9 Server versions earlier than 21.1091.1. The issue arises from incorrect default permissions, which could allow a local attacker with limited privileges to escalate their access rights. The vulnerability has a high severity rating with a CVSS score of 7.8, indicating significant potential impact on confidentiality, integrity, and availability. There is no vendor-provided patch or official remediation guidance available at this time. No known exploits in the wild have been reported. Users of affected versions should monitor vendor advisories for updates and apply patches once available.
CVE-2025-7024 is an Incorrect Default Permissions vulnerability in AIRBUS PSS TETRA Connectivity Server version 7.0 running on Windows Server OS. It allows privilege abuse whereby an attacker who can trick or direct a user to place a crafted file into a vulnerable directory may execute arbitrary code with SYSTEM privileges. The vulnerability has a medium severity with a CVSS score of 5.6. A fix for this issue is available and has been delivered to impacted customers.
CVE-2026-21765 is a vulnerability in HCL BigFix Platform versions 11.0.0 through 11.0.5 where private cryptographic keys on Windows hosts have overly permissive file system permissions. This incorrect permission assignment could allow unauthorized users with local access to read or modify these critical keys. The vulnerability has a high severity with a CVSS score of 8.8, indicating a significant impact on confidentiality, integrity, and availability. No patch or official remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.