Monthly
Cisco Secure Firewall ASA in multi-context mode contains an access control bypass in SCP operations that allows authenticated local administrators of one context to read, modify, or create files in other contexts, including sensitive admin and system configuration files. The vulnerability stems from improper validation of cross-context file access when the CiscoSSH stack is enabled. No patch is currently available for this high-severity flaw.
File carve operations in osquery prior to 5.23.1 expose sensitive data due to world-readable temporary directory permissions, allowing a local unprivileged attacker to read carve contents during the collection window. If the carve targets a directory the attacker controls, the impact extends to arbitrary local file reads. No public exploit identified at time of analysis; the vendor-confirmed fix ships in osquery 5.23.1.
Firewalld on Red Hat Enterprise Linux 7, 8, 9, and 10, as well as OpenShift Container Platform 4, contains an authentication bypass vulnerability in two D-Bus setters (setZoneSettings2 and setPolicySettings) that allows local unprivileged users to modify runtime firewall configurations without proper authorization. An authenticated local attacker can exploit this to change network security policies, potentially enabling lateral movement or service disruption. No public exploit code has been identified at the time of analysis, though Red Hat has issued security advisories (CVE-2026-4948, Bugzilla #2452086).
A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate the privileges assigned to it in the /etc/exports file at mount time. [CVSS 6.5 MEDIUM]
A flaw was found in Ansible Automation Platform (AAP). Read-only scoped OAuth2 API Tokens in AAP, are enforced at the Gateway level for Gateway-specific operations. [CVSS 8.5 HIGH]
Authenticated users of IBM Aspera Faspex 5 can access backend API features that are disabled in the web interface due to inconsistent permission enforcement (CWE-279), potentially leading to misuse of those features. Affected versions are 5.0.0 through 5.0.14.1. Exploitation requires a valid session and does not involve user interaction; impact is limited to low confidentiality and integrity effects, and no public exploit or active exploitation has been identified. This is assessed as a low-severity, low-priority access-control weakness.
Permission-handling weakness in the Quartus Prime Pro installer for Windows (CVE-2025-13663) lets a local, low-privileged attacker who can pre-create or otherwise control the target installation directory cause the installer to reuse that directory without validating or correcting its ACLs. When an administrator or user then runs the installer against the pre-staged path, installed files may inherit attacker-controlled permissions, allowing tampering with or replacement of program files and potentially privilege escalation in the installer's context. Real-world risk is limited: the attack is local-only, requires the target directory to already exist with attacker-influenced permissions, and needs active user interaction; EPSS is 0.10% (1st percentile), there is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
containerd is an open-source container runtime. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity.
Incorrect permission assignment in Apache StreamPark 2.1.4 and 2.1.5 causes tasks launched by the platform to execute under the wrong privilege context, giving a remote attacker who can reach the affected code path limited but real confidentiality, integrity, and availability impact. NVD rates the issue 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), while our independent assessment scores the same vector with PR:L, treating unauthenticated exploitability as unconfirmed pending vendor detail; the described impact is partial on all three metrics. There is no indication of active exploitation - the CVE is not in CISA KEV and no public exploit code has been identified at time of analysis - and EPSS is low at 0.55% (45th percentile). Authentication requirements are not confirmed from available data. Vendor-released patch: 2.1.6.
In dump of WindowManagerService.java, there is a possible way of running dumpsys without the required permission due to a missing permission check. Rated medium severity (CVSS 4.0), this vulnerability is no authentication required, low attack complexity.
Cisco Secure Firewall ASA in multi-context mode contains an access control bypass in SCP operations that allows authenticated local administrators of one context to read, modify, or create files in other contexts, including sensitive admin and system configuration files. The vulnerability stems from improper validation of cross-context file access when the CiscoSSH stack is enabled. No patch is currently available for this high-severity flaw.
File carve operations in osquery prior to 5.23.1 expose sensitive data due to world-readable temporary directory permissions, allowing a local unprivileged attacker to read carve contents during the collection window. If the carve targets a directory the attacker controls, the impact extends to arbitrary local file reads. No public exploit identified at time of analysis; the vendor-confirmed fix ships in osquery 5.23.1.
Firewalld on Red Hat Enterprise Linux 7, 8, 9, and 10, as well as OpenShift Container Platform 4, contains an authentication bypass vulnerability in two D-Bus setters (setZoneSettings2 and setPolicySettings) that allows local unprivileged users to modify runtime firewall configurations without proper authorization. An authenticated local attacker can exploit this to change network security policies, potentially enabling lateral movement or service disruption. No public exploit code has been identified at the time of analysis, though Red Hat has issued security advisories (CVE-2026-4948, Bugzilla #2452086).
A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate the privileges assigned to it in the /etc/exports file at mount time. [CVSS 6.5 MEDIUM]
A flaw was found in Ansible Automation Platform (AAP). Read-only scoped OAuth2 API Tokens in AAP, are enforced at the Gateway level for Gateway-specific operations. [CVSS 8.5 HIGH]
Authenticated users of IBM Aspera Faspex 5 can access backend API features that are disabled in the web interface due to inconsistent permission enforcement (CWE-279), potentially leading to misuse of those features. Affected versions are 5.0.0 through 5.0.14.1. Exploitation requires a valid session and does not involve user interaction; impact is limited to low confidentiality and integrity effects, and no public exploit or active exploitation has been identified. This is assessed as a low-severity, low-priority access-control weakness.
Permission-handling weakness in the Quartus Prime Pro installer for Windows (CVE-2025-13663) lets a local, low-privileged attacker who can pre-create or otherwise control the target installation directory cause the installer to reuse that directory without validating or correcting its ACLs. When an administrator or user then runs the installer against the pre-staged path, installed files may inherit attacker-controlled permissions, allowing tampering with or replacement of program files and potentially privilege escalation in the installer's context. Real-world risk is limited: the attack is local-only, requires the target directory to already exist with attacker-influenced permissions, and needs active user interaction; EPSS is 0.10% (1st percentile), there is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
containerd is an open-source container runtime. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity.
Incorrect permission assignment in Apache StreamPark 2.1.4 and 2.1.5 causes tasks launched by the platform to execute under the wrong privilege context, giving a remote attacker who can reach the affected code path limited but real confidentiality, integrity, and availability impact. NVD rates the issue 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), while our independent assessment scores the same vector with PR:L, treating unauthenticated exploitability as unconfirmed pending vendor detail; the described impact is partial on all three metrics. There is no indication of active exploitation - the CVE is not in CISA KEV and no public exploit code has been identified at time of analysis - and EPSS is low at 0.55% (45th percentile). Authentication requirements are not confirmed from available data. Vendor-released patch: 2.1.6.
In dump of WindowManagerService.java, there is a possible way of running dumpsys without the required permission due to a missing permission check. Rated medium severity (CVSS 4.0), this vulnerability is no authentication required, low attack complexity.