Find published vulnerabilities, affected versions, and available fixes.
Bring the source evidence into your coding agent to investigate what affects your project.
Sponsored by MoxsoBuild security habits with adaptive training and phishing simulations.Opens in a new tabExplore advisories by severity, ecosystem, and known exploitation. Take the evidence into your next agent session.
Recent security developmentsDell PowerStore contains an insecure-file-permissions vulnerability. A local low-privileged attacker could exploit this vulnerability to disclose administrative credentials.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
A vulnerability was identified in Linksys EA8100 1.0.3.216940. Impacted is an unknown function of the component Web UI. Such manipulation leads to cookie without 'httponly' flag. It is possible to launch the attack remotely. This attack is characterized by high complexity. The exploitability is considered difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
No structured fix or guidance is available here. Check the latest publisher advisory.
Public exploit reference
The Plesk GoAccess statistics integration in Plesk Obsidian for Linux, versions 18.0.77 to 18.0.81.7, 18.0.82 to 18.0.82.2, allows cross-subscription information disclosure.
Review the recorded instructions. Guidance may be a workaround rather than a fixed version.
Exploitation not established
The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket) without authenticating connecting processes. An authenticated local user can send a command to the socket and have it executed as root.
No structured fix or guidance is available here. Check the latest publisher advisory.
Incorrect permission assignment for critical resource in Azure File Sync allows an authorized attacker to elevate privileges locally.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
Improper access control in Windows BitLocker allows an authorized attacker to bypass a security feature with a physical attack.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
Incorrect permission assignment for critical resource in Azure Front Door (AFD) allows an unauthorized attacker to elevate privileges over a network.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
Incorrect permission assignment for critical resource in Windows Brokering File System allows an authorized attacker to elevate privileges locally.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
Incorrect permission assignment for critical resource in Azure Local allows an authorized attacker to elevate privileges locally.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
A vulnerability that could allow a viewer account to gain unauthorized access to network attached storage devices on the server.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
The VAPIX Edge storage API, enabling the escalation of user privileges by circumventing filesystem isolation, granting unauthorized access to protected system resources. This flaw can only be exploited after authenticating with an admin-privileged service account.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
Incorrect Permission Assignment for Critical Resource Vulnerability in HA Monitor.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
Incorrect permission assignment allows local privilege escalation to SYSTEM on affected releases of the Illumio VEN for Windows. Code execution as NT AUTHORITY\LOCAL SERVICE on the Windows host is required to exploit this vulnerability. The flaw exists within the VEN installer, which grants LOCAL SERVICE full access to the VEN data and installation folders, whose configuration and state files are read and trusted by the SYSTEM-privileged illumio-ven-ctl component. An attacker can leverage this vulnerability to modify the VEN configuration so that illumio-ven-ctl executes an injected command in the context of the SYSTEM account.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
Incorrect Permission Assignment for Critical Resource vulnerability in HAVELSAN Inc. Liman Render Engine allows Privilege Escalation.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
Gitleaks through 8.30.1 contains an incorrect permission assignment vulnerability that allows local users to read scan reports because cmd/root.go creates the --report-path file with os.Create and default permissions. Unless --redact is passed, other local users on shared hosts or CI runners can read plaintext secrets and matching lines to obtain discovered credentials.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
OpenHuman is an open-source agent harness available as a desktop application and Rust library. From 0.53.15 before 0.57.5 on macOS, core_process.rs in the Tauri desktop process publishes the per-launch OPENHUMAN_CORE_TOKEN bearer credential in its process environment even though the core now runs as an in-process task. Another process running as the same user can read that environment through the macOS KERN_PROCARGS2 process-inspection interface, recover the token together with the local host and port, and authenticate to the core JSON-RPC service with the authority of the desktop frontend. The attacker can read agent memory and integrated-account data, invoke privileged actions, change configuration, and stop or disrupt services without root access, developer mode, or changes to System Integrity Protection. This issue affects Intel and Apple Silicon macOS systems. This issue is fixed in version 0.57.5.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
VitaFit cloud API before 2026-10-30 contained a misconfigured cloud storage bucket vulnerability that allows unauthenticated attackers to list and download stored files without authentication. Attackers can enumerate the publicly accessible bucket containing 129,947 objects, including 126,881 user-uploaded profile images, to access sensitive personal data without credentials.
No structured fix or guidance is available here. Check the latest publisher advisory.
Public exploit reference
Quest Foglight for Databases Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Quest Foglight for Databases. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
Local privilege escalation in SmartUpdate.exe and SmartExecute.exe in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a local low-privileged attacker to execute arbitrary commands with administrator privileges via modification of a world-writable execlist.txt command manifest that is processed during application updates.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
On Unix-like systems, when logging is enabled, psqlODBC creates its log files in /tmp by default, named from the program name, user name, and process ID, with the default permissions, typically world-readable, and follows symbolic links when opening them. A local user can read query text and data from another user's logs, and can place a symbolic link at the predictable path so that the driver appends log data to a file of the attacker's choosing with the victim's privileges. Versions before psqlODBC 18.00.0006 are affected.
Review the recorded instructions. Guidance may be a workaround rather than a fixed version.
Exploitation not established
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
In Modem, there is a possible escalation of privilege due to a permissions bypass. This could lead to local escalation of privilege (EoP) if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09608864 / ALPS09327759; Issue ID: MSV-2958.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
Insecure permissions in Tailscale versionCode 297862600 allows unauthorized attackers to make arbitrary changes to another user's VPN configurations and preferences.
No structured fix or guidance is available here. Check the latest publisher advisory.
Public exploit reference
Insecure permissions in the io.file.importer.ImportActivity component of OpenTracks versionCode 6751 allows unauthorized attackers to inject crafted tracking data into the victim's location database via a crafted SEND message.
No structured fix or guidance is available here. Check the latest publisher advisory.
Public exploit reference
Insecure permissions in the autosave component of AppML neutriNote CE versionCode 1387 allows unauthorized attackers to write arbitrary files.
No structured fix or guidance is available here. Check the latest publisher advisory.
Public exploit reference
Insecure permissions in mendhak GPSLogger versionCode 137 allows unauthorized attackers to arbitrarily manipulate the app's logging mechanism and log data.
No structured fix or guidance is available here. Check the latest publisher advisory.
Public exploit reference
Insecure permissions in the CitrineContentProvider component of Citrine v3.1.0 (versionCode 62) allows unauthorized attackers to arbitrarily read another's Nostr event database.
No structured fix or guidance is available here. Check the latest publisher advisory.
Public exploit reference
Insecure permissions in ProjectMAXS MAXS Main v0.5.19 (versionCode 19) allows unauthorized attackers to arbitrarily manipulate the app's MAXS command/transport mechanism.
No structured fix or guidance is available here. Check the latest publisher advisory.
Public exploit reference
