Exploit Intelligence Platform

CVE-2026-28725 5.5 MEDIUM EPSS 0.00

Acronis Cyber Protect 17 <41186 - Info Disclosure

Sensitive information disclosure due to improper configuration of a headless browser. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.

CWE-732 Mar 06, 2026

CVE-2025-30413 4.4 MEDIUM EPSS 0.00

Acronis Cyber Protect <40497/41186 - Info Disclosure

Credentials are not deleted from Acronis Agent after plan revocation. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 40497, Acronis Cyber Protect 17 (Linux, macOS, Windows) before build 41186.

CWE-732 Mar 06, 2026

CVE-2025-11790 4.4 MEDIUM EPSS 0.00

Acronis Cyber Protect Cloud Agent <41124 - Info Disclosure

Credentials are not deleted from Acronis Agent after plan revocation. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 41124.

CWE-732 Mar 06, 2026

CVE-2026-29188 9.1 CRITICAL 1 Writeup EPSS 0.00

File Browser <2.61.1 - Privilege Escalation

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.61.1, a broken access control vulnerability in the TUS protocol DELETE endpoint allows authenticated users with only Create permission to delete arbitrary files and directories within their scope, bypassing the intended Delete permission restriction. Any multi-user deployment where administrators explicitly restrict file deletion for certain users is affected. This issue has been patched in version 2.61.1.

CWE-284 Mar 05, 2026

CVE-2026-29126 EPSS 0.00

IDC SFX2100 - Privilege Escalation

Incorrect permission assignment (world-writable file) in /etc/udhcpc/default.script in International Data Casting (IDC) SFX2100 Satellite Receiver allows a local unprivileged attacker to potentially execute arbitrary commands with root privileges (local privilege escalation and persistence) via modification of a root-owned, world-writable BusyBox udhcpc DHCP event script, which is executed when a DHCP lease is obtained, renewed, or lost.

CWE-732 Mar 05, 2026

CVE-2026-29125 EPSS 0.00

IDC SFX2100 - Privilege Escalation

IDC SFX2100 Satalite Recievers set the `/etc/resolv.conf` file to be world-writable by any local user, allowing DNS resolver tampering that can redirect network communications, facilitate man-in-the-middle attacks, and cause denial of service.

CWE-732 Mar 05, 2026

CVE-2025-12801 6.5 MEDIUM EPSS 0.00

nfs-utils - Privilege Escalation

A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate the privileges assigned to it in the /etc/exports file at mount time. In particular, it allows the client to access any subdirectory or subtree of an exported directory, regardless of the set file permissions, and regardless of any 'root_squash' or 'all_squash' attributes that would normally be expected to apply to that client.

CWE-732 Mar 04, 2026

CVE-2025-70342 6.6 MEDIUM 2 Writeups EPSS 0.00

erase-install <v40.4 - Info Disclosure

erase-install prior to v40.4 commit 2c31239 writes swiftDialog credential output to a hardcoded path /var/tmp/dialog.json. This allows an unauthenticated attacker to intercept admin credentials entered during reinstall/erase operations via creating a named pipe.

CWE-732 Mar 04, 2026

CVE-2025-70341 7.8 HIGH 2 Writeups EPSS 0.00

App-Auto-Patch 3.4.2 - Privilege Escalation

Insecure permissions in App-Auto-Patch v3.4.2 create a race condition which allows attackers to write arbitrary files.

CWE-94 Mar 04, 2026

CVE-2026-24732 EPSS 0.00

BlueSpice 5.1-5.1.3/5.2-5.2.0 - Auth Bypass

Files or Directories Accessible to External Parties, Incorrect Permission Assignment for Critical Resource vulnerability in Hallo Welt! GmbH BlueSpice (Extension:NSFileRepo modules) allows Accessing Functionality Not Properly Constrained by ACLs, Bypassing Electronic Locks and Access Controls.This issue affects BlueSpice: from 5.1 through 5.1.3, from 5.2 through 5.2.0. HINT: Versions provided apply to BlueSpice MediaWiki releases. For Extension:NSFileRepo the affected versions are 3.0 < 3.0.5

CWE-552 Mar 04, 2026

CVE-2026-2915 7.1 HIGH EPSS 0.00

HP System Event Utility <3.2.16 - DoS

HP System Event Utility might allow denial of service with elevated arbitrary file writes. This potential vulnerability was remediated with HP System Event Utility version 3.2.16.

CWE-732 Mar 03, 2026

CVE-2025-14604 6.6 MEDIUM EPSS 0.00

IBM Storage Scale 5.2.3.0-5.2.3.5/6.0.0.0-6.0.0.1 - Privilege Escal...

IBM Storage Scale IBM S through rage Scale 5.2.3.0 - 5.2.3.5, and IBM S through rage Scale 6.0.0.0 - 6.0.0.1 could allow a local user to unintentionally trigger additional permissions for resources in a way that allows that resource to be executed by unintended actors.

CWE-732 Mar 03, 2026

CVE-2026-2637 EPSS 0.00

iBoysoft NTFS for Mac 8.0.0.0 - Privilege Escalation

iBoysoft NTFS for Mac contains a local privilege escalation vulnerability in its privileged helper daemon ntfshelperd. The daemon exposes an NSConnection service that runs as root without implementing any authentication or authorization checks. This issue affects iBoysoft NTFS: 8.0.0.

CWE-732 Mar 03, 2026

CVE-2026-21902 9.8 CRITICAL 2 PoCs 1 Writeup Analysis EPSS 0.00

Juniper Junos OS Evolved - RCE

An Incorrect Permission Assignment for Critical Resource vulnerability in the On-Box Anomaly detection framework of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated, network-based attacker to execute code as root. The On-Box Anomaly detection framework should only be reachable by other internal processes over the internal routing instance, but not over an externally exposed port. With the ability to access and manipulate the service to execute code as root a remote attacker can take complete control of the device. Please note that this service is enabled by default as no specific configuration is required. This issue affects Junos OS Evolved on PTX Series: * 25.4 versions before 25.4R1-S1-EVO, 25.4R2-EVO. This issue does not affect Junos OS Evolved versions before 25.4R1-EVO. This issue does not affect Junos OS.

CWE-732 Feb 25, 2026

CVE-2026-26102 7.8 HIGH EPSS 0.00