CVE & Exploit Intelligence Database

CVE-2026-28727 7.8 HIGH EPSS 0.00

Local privilege escalation due to insecure Unix socket permissions. The following products are affected: Acronis Cyber Protect 17 (macOS) before build 41186, Acronis Cyber Protect Cloud Agent (macOS) before build 41124.

CWE-276 Mar 06, 2026

CVE-2026-28717 5.0 MEDIUM EPSS 0.00

Local privilege escalation due to improper directory permissions. The following products are affected: Acronis Cyber Protect 17 (Windows) before build 41186.

CWE-276 Mar 06, 2026

CVE-2026-26034 7.8 HIGH EPSS 0.00

UPS Multi-UPS Management Console (MUMC) version 01.06.0001 (A03) contains an Incorrect Default Permissions (CWE-276) vulnerability that allows an attacker to execute arbitrary code with SYSTEM privileges by causing the application to load a specially crafted DLL.

CWE-428 Mar 05, 2026

CVE-2026-21423 6.7 MEDIUM EPSS 0.00

Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an incorrect default permissions vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to code execution, denial of service, elevation of privileges, and information disclosure.

CWE-276 Mar 04, 2026

CVE-2026-2915 7.1 HIGH EPSS 0.00

HP System Event Utility might allow denial of service with elevated arbitrary file writes. This potential vulnerability was remediated with HP System Event Utility version 3.2.16.

CWE-732 Mar 03, 2026

CVE-2026-27653 6.7 MEDIUM EPSS 0.00

The installers for multiple products provided by Soliton Systems K.K. contain an issue with incorrect default permissions, which may allow arbitrary code to be executed with SYSTEM privileges.

CWE-276 Feb 27, 2026

CVE-2026-23703 7.8 HIGH EPSS 0.00

The installer of FinalCode Client provided by Digital Arts Inc. contains an incorrect default permissions vulnerability. A non-administrative user may execute arbitrary code with SYSTEM privilege.

CWE-276 Feb 26, 2026

CVE-2025-1789 7.8 HIGH EPSS 0.00

Local privilege escalation in Genetec Update Service. An authenticated, low-privileged, Windows user could exploit this vulnerability to gain elevated privileges on the affected system.

CWE-276 Feb 24, 2026

CVE-2026-2026 6.1 MEDIUM EPSS 0.00

A vulnerability has been identified where weak file permissions in the Nessus Agent directory on Windows hosts could allow unauthorized access, potentially permitting Denial of Service (DoS) attacks.

CWE-276 Feb 13, 2026

CVE-2025-36522 6.7 MEDIUM EPSS 0.00

Incorrect default permissions for some Intel(R) Chipset Software before version 10.1.20266.8668 or later. within Ring 3: User Applications may allow an escalation of privilege. System software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

CWE-276 Feb 10, 2026

CVE-2025-36511 6.7 MEDIUM EPSS 0.00

Incorrect default permissions for some Intel(R) Memory and Storage Tool before version 2.5.2 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

CWE-276 Feb 10, 2026

CVE-2025-32453 6.7 MEDIUM EPSS 0.00

Incorrect default permissions for some Intel(R) Graphics Driver software within Ring 2: Privileged Process may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

CWE-276 Feb 10, 2026

CVE-2025-31655 6.7 MEDIUM EPSS 0.00

Incorrect default permissions for some Intel(R) Battery Life Diagnostic Tool within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

CWE-276 Feb 10, 2026

CVE-2025-22849 6.7 MEDIUM EPSS 0.00

Incorrect default permissions for the Intel(R) Optane(TM) PMem management software before versions CR_MGMT_01.00.00.3584, CR_MGMT_02.00.00.4052, CR_MGMT_03.00.00.0538 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

CWE-276 Feb 10, 2026

CVE-2026-25931 7.8 HIGH 1 Writeup EPSS 0.00

vscode-spell-checker is a basic spell checker that works well with code and documents. Prior to v4.5.4, DocumentSettings._determineIsTrusted treats the configuration value cSpell.trustedWorkspace as the authoritative trust flag. The value defaults to true (package.json) and is read from workspace configuration each time settings are fetched. The code coerces any truthy value to true and forwards it to ConfigLoader.setIsTrusted , which in turn allows JavaScript/TypeScript configuration files ( .cspell.config.js/.mjs/.ts , etc.) to be located and executed. Because no VS Code workspace-trust state is consulted, an untrusted workspace can keep the flag true and place a malicious .cspell.config.js ; opening the workspace causes the extension host to execute attacker-controlled Node.js code with the user’s privileges. This vulnerability is fixed in v4.5.4.

CWE-807 Feb 09, 2026

CVE-2020-37160 6.2 MEDIUM 1 PoC Analysis EPSS 0.00

SprintWork 2.3.1 contains multiple local privilege escalation vulnerabilities through insecure file, service, and folder permissions on Windows systems. Local unprivileged users can exploit missing executable files and weak service configurations to create a new administrative user and gain complete system access.

CWE-276 Feb 07, 2026

CVE-2025-15343 6.5 MEDIUM EPSS 0.00

Tanium addressed an incorrect default permissions vulnerability in Enforce.

CWE-276 Feb 05, 2026

CVE-2025-15341 6.5 MEDIUM EPSS 0.00

Tanium addressed an incorrect default permissions vulnerability in Benchmark.

CWE-276 Feb 05, 2026

CVE-2025-15340 6.5 MEDIUM EPSS 0.00

Tanium addressed an incorrect default permissions vulnerability in Comply.

CWE-276 Feb 05, 2026

CVE-2025-15339 6.5 MEDIUM EPSS 0.00

Tanium addressed an incorrect default permissions vulnerability in Discover.

CWE-276 Feb 05, 2026