In HPE Cray Programming Environment versions 25.03 and 25.09, prior to 26.03, the method that CPE is deployed on HPCM potentially allows elevated access by a local unprivileged user.
IRISPowerscan contains an insecure default configuration where the built-in installation account has elevated privileges and a predictable password. This vulnerability allows an unauthenticated attacker to gain unauthorized access to privileged application functionality. The issue affects versions from 0 up to and including 12.3. The CVSS 4.0 base score is 7.2, indicating a high severity vulnerability.
Local privilege escalation in `SmartUpdate.exe` and `SmartExecute.exe` in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a local low-privileged attacker to execute arbitrary commands with administrator privileges via modification of a world-writable `execlist.txt` command manifest that is processed during application updates.
Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Tampering.
CVE-2026-114148 is a vulnerability in Microsoft .NET 10.0 installed on Linux where incorrect default permissions in ASP.NET Core allow an authorized local attacker to elevate privileges. The flaw affects multiple versions of .NET 8.0, 9.0, 10.0, and 11.0-preview releases prior to their respective fixed versions. The vulnerability has a high severity rating with a CVSS score of 7.8. Microsoft has released official fixes for all affected versions.
CVE-2026-115253 is a vulnerability in WatchGuard Agent where incorrect default permissions on the agent's log directory allow local, authenticated non-administrative users to manipulate log files and place executable content. This can lead to tampering with security logs and enable further local attacks. The issue affects versions prior to 1.25.14.0000 and has been fixed in version 1.25.14.0000.
CVE-2026-107571 is a vulnerability in Progressive Robot Ltd's hMailServer versions up to 6.3.6 where incorrect default permissions in the Windows installer allow local authenticated users to execute code with high privileges. This occurs if the product is installed in a folder inheriting writable permissions from its parent, such as the root of a drive. The default installation path (Program Files) is not affected. The issue enables privilege escalation by modifying or replacing service programs or libraries loaded by elevated processes.
Incorrect Default Permissions vulnerability in Apache Camel PQC component.
This issue affects Apache Camel: from 4.12.0 before 4.18.5, from 4.19.0 before 4.22.1.
When the component wrote generated key material to disk it did so with the permissions the process default umask produced, rather than restricting the file to its owner. On a host whose umask allows group or world read, the private key was therefore readable by other local accounts. The exposure is to a local party rather than to the remote sender that the Camel threat model treats as the primary adversary, which is why the severity is assessed low, but the consequence where it applies is complete: possession of the private key defeats every signature and key exchange the deployment performs with it.
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Key material is now written with owner-only permissions. For deployments that cannot upgrade immediately, place the key directory on a path only the service account can traverse, and tighten the process umask. Key material already written with permissive permissions should be treated as exposed and rotated.
CVE-2026-108072 is a vulnerability in TSplus Remote Access version 19.20.3.10 caused by incorrect default permissions on shared login scripts (autostart1.tscr) in the shared themes directory. This misconfiguration allows users with valid sessions but insufficient privileges to modify these scripts. An attacker could exploit this to execute arbitrary commands under another user's security context upon login, potentially enabling lateral movement or privilege escalation depending on the targeted user's privileges.
Hyland Desktop Host for Windows versions before 25.1.1 contains a local privilege escalation vulnerability due to incorrect default permissions on a privileged service executable located in the %PROGRAMDATA%\Hyland\DesktopHost\bin folder. This weakness allows a local user to escalate their privileges on the affected system.
CVE-2026-105009 is a vulnerability in Microsoft Windows Server 2012 involving incorrect default permissions in the Windows Server Update Service. This flaw allows an authorized local attacker to elevate privileges. The vulnerability affects multiple Windows Server 2012 and related versions prior to specific fixed builds. A patch is available from Microsoft to address this issue.
### Impact
With a default configuration, an undefined `readPaths`/`writePaths` meant allow-all, the `strictReadDefault` flag was inert, and the `.obsidian`/`.git`/`.trash` control directories were denied only during enumeration — not on the direct request path. A caller could read `.obsidian/plugins/*/data.json`, exfiltrating **plugin API keys and Obsidian Sync passwords** (live-reproduced), as well as any other in-vault file by path.
### Patches
Fixed in **1.3.1**. Upgrade to `>= 1.3.1`. The default now denies `.obsidian`/`.git`/`.trash` on read/write/delete and honors `strictReadDefault` on the request path.
### Workarounds
Set an explicit `readPaths`/`writePaths` whitelist that excludes the control directories.
CVE-2026-21131 is a low-severity vulnerability in Samsung Flow prior to version 4.9.22.4. It involves incorrect default permissions that allow local attackers to launch arbitrary activities with Samsung Flow privileges on a connected device.
ZTE Z80 Ultra contains an interface permission validation vulnerability (CWE-276) where system callable functions lack sufficient access control. This flaw allows an attacker to read certain information by leveraging these improperly protected functions. The vulnerability has a low severity rating with a CVSS score of 3.3. No specific affected versions or patches are currently identified.
Insecure file permissions in the CodeCatalyst connection handler in AWS Toolkit for VS Code before 4.10.0 allowed local users to obtain CodeCatalyst bearer tokens via reading world-readable token cache files.
To mitigate this issue, users should upgrade to version 4.10.0 or later.
Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a local authenticated user to read the mail server's data. The installer created the data, log, temp, database and event folders and the hMailServer.INI configuration file with the permissions inherited from the installation folder, by default under Program Files, which give the local Users group read access. Any user who can sign in to the computer could read every stored message, the logs, the built-in database with the accounts' password hashes whenever the service is stopped, and the configuration file, including the database password, which is sealed only with the machine's DPAPI key and can be unsealed by any local account; with an external database that password gives full control of it. The Linux AppImage of 6.3.0 through 6.3.5 likewise created its per-user data folders readable by other local users.
CVE-2026-78413 is a medium severity vulnerability in Rapid7 Velociraptor versions before 0.77.3. It involves incorrect default permissions in the Windows.Sysinternals.SysmonLogForward artifact, which allows users with COLLECT_CLIENT permissions (typically the Investigator role) to specify an arbitrary binary path and execute a different binary than intended. This could lead to limited confidentiality, integrity, and availability impacts. Exploitation requires existing artifact collection permissions on the endpoint.
Dell Command | Integration Suite for System Center, versions prior to 6.7.2, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure.
Dell Command | Intel vPro Out of Band, versions prior to 4.7.2, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure.