Total
1496 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-15343 | 1 Tanium | 2 Enforce, Service Enforce | 2026-02-10 | 6.5 Medium |
| Tanium addressed an incorrect default permissions vulnerability in Enforce. | ||||
| CVE-2025-15335 | 1 Tanium | 2 Service Threatresponse, Threat Response | 2026-02-10 | 4.3 Medium |
| Tanium addressed an information disclosure vulnerability in Threat Response. | ||||
| CVE-2025-15334 | 1 Tanium | 2 Service Threatresponse, Threat Response | 2026-02-10 | 4.3 Medium |
| Tanium addressed an information disclosure vulnerability in Threat Response. | ||||
| CVE-2025-15333 | 1 Tanium | 2 Service Threatresponse, Threat Response | 2026-02-10 | 4.3 Medium |
| Tanium addressed an information disclosure vulnerability in Threat Response. | ||||
| CVE-2025-15340 | 1 Tanium | 2 Comply, Service Comply | 2026-02-10 | 6.5 Medium |
| Tanium addressed an incorrect default permissions vulnerability in Comply. | ||||
| CVE-2025-15338 | 1 Tanium | 2 Partner Integration, Service Partnerintegration | 2026-02-10 | 6.5 Medium |
| Tanium addressed an incorrect default permissions vulnerability in Partner Integration. | ||||
| CVE-2025-15337 | 1 Tanium | 2 Patch, Service Patch | 2026-02-10 | 6.5 Medium |
| Tanium addressed an incorrect default permissions vulnerability in Patch. | ||||
| CVE-2025-15336 | 1 Tanium | 2 Performance, Service Performance | 2026-02-10 | 6.5 Medium |
| Tanium addressed an incorrect default permissions vulnerability in Performance. | ||||
| CVE-2026-25931 | 1 Streetsidesoftware | 1 Vscode-spell-checker | 2026-02-10 | 7.8 High |
| vscode-spell-checker is a basic spell checker that works well with code and documents. Prior to v4.5.4, DocumentSettings._determineIsTrusted treats the configuration value cSpell.trustedWorkspace as the authoritative trust flag. The value defaults to true (package.json) and is read from workspace configuration each time settings are fetched. The code coerces any truthy value to true and forwards it to ConfigLoader.setIsTrusted , which in turn allows JavaScript/TypeScript configuration files ( .cspell.config.js/.mjs/.ts , etc.) to be located and executed. Because no VS Code workspace-trust state is consulted, an untrusted workspace can keep the flag true and place a malicious .cspell.config.js ; opening the workspace causes the extension host to execute attacker-controlled Node.js code with the user’s privileges. This vulnerability is fixed in v4.5.4. | ||||
| CVE-2025-10314 | 1 Mitsubishi Electric | 1 Freqship-mini | 2026-02-05 | 8.8 High |
| Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation FREQSHIP-mini for Windows versions 8.0.0 to 8.0.2 allows a local attacker to execute arbitrary code with system privileges by replacing service executable files (EXE) or DLLs in the installation directory with specially crafted files. As a result, the attacker may be able to disclose, tamper with, delete, or destroy information stored on the PC where the affected product is installed, or cause a Denial of Service (DoS) condition on the affected system. | ||||
| CVE-2025-55132 | 1 Nodejs | 2 Node.js, Nodejs | 2026-02-03 | 5.3 Medium |
| A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. Unlike `utimes()`, `futimes()` does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25. | ||||
| CVE-2025-20984 | 1 Samsung | 11 Galaxy Watch, Galaxy Watch 4, Galaxy Watch 4 Classic and 8 more | 2026-02-02 | 6.8 Medium |
| Incorrect default permission in Samsung Cloud for Galaxy Watch prior to SMR Jun-2025 Release 1 allows local attackers to access data in Samsung Cloud for Galaxy Watch. | ||||
| CVE-2025-8485 | 1 Lenovo | 1 App Store | 2026-02-02 | 7.3 High |
| An improper permissions vulnerability was reported in Lenovo App Store that could allow a local authenticated user to execute code with elevated privileges during installation of an application. | ||||
| CVE-2024-55930 | 1 Xerox | 1 Workplace Suite | 2026-01-30 | 6.7 Medium |
| Xerox Workplace Suite has weak default folder permissions that allow unauthorized users to access, modify, or delete files | ||||
| CVE-2024-27674 | 2 Macro-expert, Macroexpert | 2 Macro Expert, Macroexpert | 2026-01-30 | 7.8 High |
| Macro Expert through 4.9.4 allows BUILTIN\Users:(OI)(CI)(M) access to the "%PROGRAMFILES(X86)%\GrassSoft\Macro Expert" folder and thus an unprivileged user can escalate to SYSTEM by replacing the MacroService.exe binary. | ||||
| CVE-2025-13905 | 1 Schneider-electric | 2 Ecostruxure Process Expert, Ecostruxure Process Expert For Aveva System Platform | 2026-01-30 | N/A |
| CWE-276: Incorrect Default Permissions vulnerability exists that could cause privilege escalation through the reverse shell when one or more executable service binaries are modified in the installation folder by a local user with normal privilege upon service restart. | ||||
| CVE-2025-27926 | 1 Nintex | 1 Automation | 2026-01-29 | 4.3 Medium |
| In Nintex Automation 5.6 and 5.7 before 5.8, the K2 SmartForms Designer folder has configuration files (web.config) containing passwords that are readable by unauthorized users. | ||||
| CVE-2025-67230 | 1 Todesktop | 1 Builder | 2026-01-29 | 7.1 High |
| Improper permissions in the handler for the Custom URL Scheme in ToDesktop Builder v0.33.0 allows attackers with renderer-context access to invoke external protocol handlers without sufficient validation. | ||||
| CVE-2026-0705 | 1 Acronis | 1 Cloud Manager | 2026-01-29 | N/A |
| Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cloud Manager (Windows) before build 6.4.25342.354. | ||||
| CVE-2025-60262 | 1 H3c | 6 Ba1500l, M102g, Magic Ba1500l and 3 more | 2026-01-29 | 9.8 Critical |
| An issue in H3C M102G HM1A0V200R010 wireless controller and BA1500L SWBA1A0V100R006 wireless access point, there is a misconfiguration vulnerability about vsftpd. Through this vulnerability, all files uploaded anonymously via the FTP protocol is automatically owned by the root user and remote attackers could gain root-level control over the devices. | ||||