Set up in your agent.

One prompt to get started. Paste it into your coding agent to connect cve.new through MCP and bring vulnerability context into your workflow.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

Skip to content
cve.newCreate a CVE report

Your agent Now with CVE context

Find published vulnerabilities, affected versions, and available fixes.
Bring the source evidence into your coding agent to investigate what affects your project.

MoxsoSponsored by MoxsoBuild security habits with adaptive training and phishing simulations.Opens in a new tab
ORIGINAL EVIDENCE. READY FOR YOUR WORKFLOW.CVE / OSV / CISA KEV

Find vulnerabilities that affect you.

Explore advisories by severity, ecosystem, and known exploitation. Take the evidence into your next agent session.

Recent security developments
Severity
Clear filters
48 matching advisories · 30 shown
Explore packages Subscribe to these results
Follow substantive record changes →
SEVERITYVULNERABILITY / AFFECTED PACKAGESPUBLISHED
critical9.3
CVE-2026-129255

CoolerMaster MASTERPLUS+ Device Driver WinRing0x64.sys sub_11504 default permission

A vulnerability was identified in CoolerMaster MASTERPLUS+ 1.9.6. This affects the function sub_11504 in the library WinRing0x64.sys of the component Device Driver. The manipulation of the argument PhysicalAddress leads to incorrect default permissions. The attack can only be performed from a local environment. The vendor was contacted early about this disclosure but did not respond in any way.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

CoolerMaster · MASTERPLUS+
unknown
CVE-2026-129137

Incorrect default permissions in the agent configuration folder in Devolutions PowerShell Universal 2026.3.4 and earlier allows a local unprivileged user to…

Incorrect default permissions in the agent configuration folder in Devolutions PowerShell Universal 2026.3.4 and earlier allows a local unprivileged user to execute arbitrary code as SYSTEM via a crafted agent configuration file that points the agent to an attacker-controlled server.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Devolutions · PowerShell Universal
high7.0
CVE-2025-0043

Incorrect directory permissions within AMD Vivado™ Lab Solutions could allow a local user-privileged attacker to escalate their privileges, potentially…

Incorrect directory permissions within AMD Vivado™ Lab Solutions could allow a local user-privileged attacker to escalate their privileges, potentially resulting in arbitrary code execution.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

AMD · Vivado Software
medium6.0
CVE-2025-10698

Improper File Permissions on Private Key Files in Docker Deployments

Incorrect default permissions and Product released in Non-Release configuration vulnerability in OpenText Identity Console on Windows, Linux, and 64 bit allows Retrieve Embedded Sensitive Data.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

OpenText · Identity Console
critical9.3
CVE-2026-126785

rmalright TR-VISION HOME IOCTL WFanManager.sys sub_11504 default permission

A vulnerability has been found in rmalright TR-VISION HOME 2.0.5. Impacted is the function sub_11504 in the library WFanManager.sys of the component IOCTL Handler. Such manipulation leads to incorrect default permissions. The attack must be carried out locally. The vendor was contacted early about this disclosure but did not respond in any way.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

rmalright · TR-VISION HOME
high8.5
CVE-2026-89061

During an internal security assessment, a potential vulnerability was discovered in Lenovo PC Manager, distributed exclusively in the Chinese market, that…

During an internal security assessment, a potential vulnerability was discovered in Lenovo PC Manager, distributed exclusively in the Chinese market, that could allow a local user to escalate privileges.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

Lenovo · PC Manager
high8.5
CVE-2026-123040

An attacker who gains the ability to execute arbitrary code on a system with TrueConf Server (Linux) versions from 4.7.2 up to, but not including, 5.5.6…

An attacker who gains the ability to execute arbitrary code on a system with TrueConf Server (Linux) versions from 4.7.2 up to, but not including, 5.5.6 installed, running as the user trueconf (by exploiting some other vulnerability), can elevate their privileges to root.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

TrueConf · TrueConf Server
medium6.7
CVE-2026-126625

Incorrect Default Permissions in hMailServer

Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.3.7 allow a local authenticated user to run code as the administrator who installs the product, when it is installed into a new program folder in a location whose permissions let every user write, such as the root of a drive. 6.3.7 fixed CVE-2026-107571 by giving the program folder, Bin and ControlPanel permissions that only administrators may change, but its setup lets Inno Setup make a new program folder first, with the permissions the folder above hands down, and replaces them only afterwards, tens of milliseconds later (33 to 139 milliseconds in the project's test runs). In that time any local account may make files and folders in the new folder, which keep that account as their owner, among them the Bin folder that setup then copies the programs into. Setup runs programs from Bin with the administrator's elevated rights, registering the service among them, before its hardening at the end of setup takes such a folder back, and those programs load a library placed in Bin in place of the system's. The default installation under Program Files, whose folders give ordinary users read and execute only, is not affected.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

Progressive Robot Ltd · hMailServer
high7.3
CVE-2026-126622

Incorrect Default Permissions in hMailServer

Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.3.7 allow a local authenticated user to run code as the administrator who runs setup, when the server is installed into a program folder that is already there and that accounts other than the administrators could write, such as a folder made beforehand at the root of a drive, or when such an installation is upgraded or repaired. 6.3.7 fixed CVE-2026-107571 by giving the program folder, Bin and ControlPanel permissions that only administrators may change, but for a folder that is already there it does so only at the end of setup: setup first copies the programs into Bin, which every user may still write, and runs programs from Bin with the administrator's elevated rights, registering the service among them, before that hardening, so that a library another account places in Bin meanwhile is loaded in place of the system's. A handle an account opened on such a folder while it could write it keeps that access after the hardening. The default installation under Program Files, whose folders give ordinary users read and execute only, is not affected.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

Progressive Robot Ltd · hMailServer
medium6.8
CVE-2026-124848

Incorrect default permissions on session transcripts and prompt history in Kiro CLI

Incorrect default file permissions in Kiro CLI (formerly Amazon Q Developer CLI) before version 2.27.0 on macOS and Linux might allow other local users on the same host to read a user's session transcripts and prompt history, including any credentials or source code they contain. The CLI created its local session storage files with permissions that made them readable by all local users.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Amazon · Kiro CLI
medium6.3
CVE-2026-28702

Incorrect default permissions for the Intel(R) VTune(TM) Profiler software within Ring 3: User Applications may allow an escalation of privilege.

Incorrect default permissions for the Intel(R) VTune(TM) Profiler software within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an unauthenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via network access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

n/a · Intel(R) VTune(TM) Profiler software
medium5.4
CVE-2026-20880

Incorrect default permissions for some Intel(R) Graphics Driver software installers within Ring 3: User Applications may allow an escalation of privilege.

Incorrect default permissions for some Intel(R) Graphics Driver software installers within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

n/a · Intel(R) Graphics Driver software installers
medium5.4
CVE-2026-20756

Incorrect default permissions for some Intel(R) Graphics Driver software installers within Ring 3: User Applications may allow an escalation of privilege.

Incorrect default permissions for some Intel(R) Graphics Driver software installers within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

n/a · Intel(R) Graphics Driver software installers
high7.8
CVE-2026-121267

Incorrect Default Permissions Vulnerability in TÜBİTAK BİLGEM's eta-remote

Incorrect default permissions vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-remote allows Accessing Functionality Not Properly Constrained by ACLs.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

TÜBİTAK BİLGEM Software Technologies Research Institute · eta-remote
high8.5
CVE-2026-113362

Improper Access Control in the program installation folder in NEC Corporation WebSAM Winshare Ver 7.5.0 and earlier (excluding Ver 7.3.3), Ver 7.6.0 and Ver…

Improper Access Control in the program installation folder in NEC Corporation WebSAM Winshare Ver 7.5.0 and earlier (excluding Ver 7.3.3), Ver 7.6.0 and Ver 7.7.0 through 7.7.1 on Windows allows a locally authenticated low-privileged attacker to execute arbitrary code with SYSTEM privileges via a crafted DLL file that is loaded by a SYSTEM-level process.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

NEC Corporation · WebSAM WinShare
medium6.8
CVE-2026-123505

Vikunja before 2.7.1 World-Readable Local File Storage and SQLite Database

Vikunja before 2.7.1 contains an insecure file permissions vulnerability that allows local users to read stored data because localStorage.Write creates blobs world-readable. Local attackers on a shared host can read attachments, project backgrounds and exports, and copy the SQLite database to crack password hashes offline.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

go-vikunja · vikunja
medium6.9
CVE-2026-123500

Vikunja before 2.7.1 Insecure Permissions on Dump Archive via vikunja dump

Vikunja before 2.7.1 contains an insecure file permissions vulnerability that allows local users to read dump archives created with umask permissions by the vikunja dump command. Local attackers on a shared host can read the world-readable zip in the rootpath to obtain config, password hashes, TOTP secrets, tokens, and stored files.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

go-vikunja · vikunja
high7.8
CVE-2026-44875

In HPE Cray Programming Environment versions 25.03 and 25.09, prior to 26.03, the method that CPE is deployed on HPCM potentially allows elevated access by…

In HPE Cray Programming Environment versions 25.03 and 25.09, prior to 26.03, the method that CPE is deployed on HPCM potentially allows elevated access by a local unprivileged user.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Hewlett Packard Enterprise (HPE) · HPE Cray Programming Environment
high7.2
CVE-2026-94460

IRISPowerscan Insecure default privilege assignment for installation account

IRISPowerscan contain an insecure default configuration where the built-in installation account is assigned elevated privileges with a predictable password, which could allow an unauthenticated attacker to gain unauthorised access to privileged application functionality.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

I.R.I.S S.A. · IRISPowerscan
high7.8
CVE-2026-16305

Local privilege escalation in SmartUpdate.exe and SmartExecute.exe in INFINITT Healthcare Co., Ltd.

Local privilege escalation in SmartUpdate.exe and SmartExecute.exe in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a local low-privileged attacker to execute arbitrary commands with administrator privileges via modification of a world-writable execlist.txt command manifest that is processed during application updates.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

INFINITT Healthcare · System Manager
high7.1
CVE-2026-91895

Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Incorrect Default Permissions vulnerability.

Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Tampering.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Dell · Alienware Command Center (AWCC)
high7.8
CVE-2026-114148

ASP.NET Core Elevation of Privilege Vulnerability

Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · .NET 10.0 installed on Linux / Microsoft · .NET 10.0 installed on Mac OS
high7.5
CVE-2026-107052

Insecure permissions in the AIDL interface of ProjectMAXS MAXS Module FileRead versionCode 27 allows unauthorized attackers to arbitrarily reead files…

Insecure permissions in the AIDL interface of ProjectMAXS MAXS Module FileRead versionCode 27 allows unauthorized attackers to arbitrarily reead files outside of the sandbox via providing an absolute path.

No structured fix or guidance is available here. Check the latest publisher advisory.

Public exploit reference

n/a · n/a
high8.5
CVE-2026-112357

GFI KerioConnect KOFF < 10.0.9p2 Privilege Escalation

GFI KerioConnect (Kerio Connect) Outlook Connector (Offline Edition), 'KOFF', before 10.0.9 Patch 2 contains a local privilege escalation vulnerability caused by weak installer permissions that leave the product directory writable by the built-in Users group. A local non-administrative attacker can replace the searchd.exe service binary used by the bundled KOFFIndexingService, which runs as LocalSystem, to execute arbitrary code with NT AUTHORITY\SYSTEM privileges upon the next service start or reboot.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

GFI USA, LLC · GFI KerioConnect
high8.5
CVE-2026-113345

Electronic delivery item Inspection Support System provided by Japan's Ministry of Land, Infrastructure, Transport and Tourism contains an improper file…

Electronic delivery item Inspection Support System provided by Japan's Ministry of Land, Infrastructure, Transport and Tourism contains an improper file access permission vulnerability. Files in the installation folder of the application may be tampered with, resulting in arbitrary code execution.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Ministry of Land, Infrastructure, Transport and Tourism, Japan · Electronic delivery item Inspection Support System
high7.8
CVE-2026-113951

If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plugin in /etc/kubernetes/admin.conf.

If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plugin in /etc/kubernetes/admin.conf. kubectl will run that plugin as the macOS host user the next time someone pulls the cluster's kubeconfig onto the host with container k8s write-config or create and then runs kubectl against it — turning filesystem access inside an untrusted Linux container into arbitrary command execution on the host. This vulnerability is addressed in Container version 1.5.0.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Apple · Container
medium5.5
CVE-2026-101472

Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues).

Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues). The supported version that is affected is 3.6.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Product Lifecycle Analytics executes to compromise Oracle Product Lifecycle Analytics. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Product Lifecycle Analytics accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Oracle Corporation · Oracle Product Lifecycle Analytics
high7.5
CVE-2026-105009

Windows Server Update Service Elevation of Privilege Vulnerability

Incorrect default permissions in Windows Server Update Service allows an authorized attacker to elevate privileges locally.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Windows Server 2012 / Microsoft · Windows Server 2012 (Server Core installation)
high7.3
CVE-2026-59119

PowerShell Elevation of Privilege Vulnerability

Incorrect default permissions in Microsoft PowerShell allows an authorized attacker to elevate privileges locally.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · PowerShell 7.4 / Microsoft · PowerShell 7.5