Monthly
Incorrect DBus policy in Lomiri Download Manager (lomiri-download-manager on UBports) allows any local user to read arbitrary files as root via the privileged DBus service, resulting in information disclosure. This local privilege escalation vulnerability affects all versions and requires local access to a device running UBports Lomiri/Ubuntu Touch with the service active. No public exploit code or active exploitation has been identified; risk is moderate due to the local-only attack vector.
Incorrect permission assignment (CWE-732) in QNAP Notes Station 3 allows a local attacker who already holds a valid low-privileged account on the NAS to abuse an insecurely permissioned critical resource created by the application, resulting in full compromise of confidentiality, integrity, and availability of the affected system's data. Only QNAP NAS devices with the Notes Station 3 app installed are affected, and exploitation is not possible remotely by an unauthenticated attacker - it requires local access plus a user account (AV:L, PR:L per CVSS:4.0 vector and the assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and EPSS/KEV data were not provided; QNAP has released a fix in Notes Station 3 3.9.11 and later.
Incorrect permission assignment in QNAP Download Station (all builds prior to 5.10.1.312 or 5.11.2.321) lets a local attacker who already holds an administrator account on the NAS escalate that foothold into full compromise of the device's confidentiality, integrity and availability. The issue is access-gated rather than remotely reachable: the CVSS:4.0 vector marks local attack vector (AV:L) and high privileges (PR:H), so a remote or unauthenticated attacker cannot trigger it and no user interaction is required once admin access exists. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (CISA KEV), but vendor-released fixes are available, so the practical risk sits with deployments that share, weakly protect, or already have compromised QNAP admin credentials.
Progress MOVEit Transfer versions before 2025.1.6 and from 2026.0.0 before 2026.0.4 assign incorrect permissions to a critical resource, allowing an authenticated low-privileged user who already has local or session access to read and modify resources beyond their intended privilege boundary, yielding high confidentiality and integrity impact (CVSS 8.8, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). The prerequisite of a valid low-privileged account plus local/session access - rather than anonymous remote reach - keeps this a conditional, post-authentication escalation issue; no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV. There is no EPSS score in the supplied data, so exploitation likelihood is judged from the assessed vector alone; because this is a file-transfer platform typically holding regulated data, the impact of success is high even though the entry bar is elevated.
Local privilege escalation in the Windows Mobile Broadband (WWAN) component on Windows 11 allows an authenticated, low-privileged attacker to gain elevated privileges. The flaw is caused by incorrect permission assignment (CWE-732) on a critical resource, affecting default installations of Windows 11 24H2, 25H2, 26H1, and 26H2 below their respective patched revisions. No public exploit identified at time of analysis; exploitation requires local access and a low-privileged session, making it a post-compromise escalation vector.
Local privilege escalation in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authenticated attacker with existing low-privileged code execution to gain elevated privileges on affected Windows 11 and Windows Server systems. Exploitation requires local interaction with unionfs.sys and cannot be used for remote or initial compromise; the affected unpatched builds include Windows 11 23H2/24H2/25H2/26H2 and Windows Server 2022/2025. Vendor patches are available, no public exploit was identified at time of analysis, and this is a credible but second-tier priority for most environments.
Local privilege escalation in Hammock AssetView allows an authenticated low-privileged user with interactive logon to a Windows host running the Management Console or Client Terminal to gain SYSTEM privileges. The flaw stems from incorrect permission assignment on a critical resource (CWE-732) and is rated CVSS 8.5 (High) in CVSS 4.0, reflecting high confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis, and exploitation requires the attacker to already have local interactive access to the specific component host, not arbitrary managed endpoints.
Code for IBM i (vscode-ibmi) releases before 3.0.1 install and later execute IBM i component programs without verifying their integrity, so an authenticated attacker holding a separate local account on the same IBM i system can modify a component such as GETMBRINFO when it was deployed with permissive *PUBLIC authorities, and the altered program then runs in the context of any user who subsequently connects through the extension. The reported CVSS 4.0 score is 8.9, but the independent assessment rates the issue CVSS 3.1 AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H, reflecting that exploitation requires valid local IBM i credentials, a loosely secured component object, and a victim initiating a connection that triggers the tampered program; no public exploit code or confirmed active exploitation was identified at time of analysis. Version 3.0.1 fixes the flaw, with details in GHSA-rmqv-7c5v-wvjc.
Progress MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7 create certain log files with overly permissive operating-system permissions, allowing a local, already-authenticated low-privilege user on the server host to read or alter log data (CWE-732). Exploitation requires local OS access to the MarkLogic host (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) and is not remotely reachable, so the practical risk is moderate and concentrated on multi-tenant or multi-user hosts where untrusted local accounts exist; no public exploit identified at time of analysis. Notably, the vendor fix only corrects the default permissions for newly created and rotated logs, so previously written log files on an upgraded host remain permissively accessible until an administrator manually remediates them.
Local privilege escalation in Edgeless Systems Contrast 1.8.0 through 1.24.0 allows a low-privileged local user on a node to modify the world-writable containerd configuration and overwrite the runc runtime path, leading to high confidentiality, integrity, and availability impact on that node. This is a credible local privilege-escalation issue rather than a remotely wormable threat; the CVSS vector requires local access with low privileges (PR:L), and no public exploit identified at time of analysis.
Incorrect DBus policy in Lomiri Download Manager (lomiri-download-manager on UBports) allows any local user to read arbitrary files as root via the privileged DBus service, resulting in information disclosure. This local privilege escalation vulnerability affects all versions and requires local access to a device running UBports Lomiri/Ubuntu Touch with the service active. No public exploit code or active exploitation has been identified; risk is moderate due to the local-only attack vector.
Incorrect permission assignment (CWE-732) in QNAP Notes Station 3 allows a local attacker who already holds a valid low-privileged account on the NAS to abuse an insecurely permissioned critical resource created by the application, resulting in full compromise of confidentiality, integrity, and availability of the affected system's data. Only QNAP NAS devices with the Notes Station 3 app installed are affected, and exploitation is not possible remotely by an unauthenticated attacker - it requires local access plus a user account (AV:L, PR:L per CVSS:4.0 vector and the assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and EPSS/KEV data were not provided; QNAP has released a fix in Notes Station 3 3.9.11 and later.
Incorrect permission assignment in QNAP Download Station (all builds prior to 5.10.1.312 or 5.11.2.321) lets a local attacker who already holds an administrator account on the NAS escalate that foothold into full compromise of the device's confidentiality, integrity and availability. The issue is access-gated rather than remotely reachable: the CVSS:4.0 vector marks local attack vector (AV:L) and high privileges (PR:H), so a remote or unauthenticated attacker cannot trigger it and no user interaction is required once admin access exists. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (CISA KEV), but vendor-released fixes are available, so the practical risk sits with deployments that share, weakly protect, or already have compromised QNAP admin credentials.
Progress MOVEit Transfer versions before 2025.1.6 and from 2026.0.0 before 2026.0.4 assign incorrect permissions to a critical resource, allowing an authenticated low-privileged user who already has local or session access to read and modify resources beyond their intended privilege boundary, yielding high confidentiality and integrity impact (CVSS 8.8, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). The prerequisite of a valid low-privileged account plus local/session access - rather than anonymous remote reach - keeps this a conditional, post-authentication escalation issue; no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV. There is no EPSS score in the supplied data, so exploitation likelihood is judged from the assessed vector alone; because this is a file-transfer platform typically holding regulated data, the impact of success is high even though the entry bar is elevated.
Local privilege escalation in the Windows Mobile Broadband (WWAN) component on Windows 11 allows an authenticated, low-privileged attacker to gain elevated privileges. The flaw is caused by incorrect permission assignment (CWE-732) on a critical resource, affecting default installations of Windows 11 24H2, 25H2, 26H1, and 26H2 below their respective patched revisions. No public exploit identified at time of analysis; exploitation requires local access and a low-privileged session, making it a post-compromise escalation vector.
Local privilege escalation in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authenticated attacker with existing low-privileged code execution to gain elevated privileges on affected Windows 11 and Windows Server systems. Exploitation requires local interaction with unionfs.sys and cannot be used for remote or initial compromise; the affected unpatched builds include Windows 11 23H2/24H2/25H2/26H2 and Windows Server 2022/2025. Vendor patches are available, no public exploit was identified at time of analysis, and this is a credible but second-tier priority for most environments.
Local privilege escalation in Hammock AssetView allows an authenticated low-privileged user with interactive logon to a Windows host running the Management Console or Client Terminal to gain SYSTEM privileges. The flaw stems from incorrect permission assignment on a critical resource (CWE-732) and is rated CVSS 8.5 (High) in CVSS 4.0, reflecting high confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis, and exploitation requires the attacker to already have local interactive access to the specific component host, not arbitrary managed endpoints.
Code for IBM i (vscode-ibmi) releases before 3.0.1 install and later execute IBM i component programs without verifying their integrity, so an authenticated attacker holding a separate local account on the same IBM i system can modify a component such as GETMBRINFO when it was deployed with permissive *PUBLIC authorities, and the altered program then runs in the context of any user who subsequently connects through the extension. The reported CVSS 4.0 score is 8.9, but the independent assessment rates the issue CVSS 3.1 AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H, reflecting that exploitation requires valid local IBM i credentials, a loosely secured component object, and a victim initiating a connection that triggers the tampered program; no public exploit code or confirmed active exploitation was identified at time of analysis. Version 3.0.1 fixes the flaw, with details in GHSA-rmqv-7c5v-wvjc.
Progress MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7 create certain log files with overly permissive operating-system permissions, allowing a local, already-authenticated low-privilege user on the server host to read or alter log data (CWE-732). Exploitation requires local OS access to the MarkLogic host (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) and is not remotely reachable, so the practical risk is moderate and concentrated on multi-tenant or multi-user hosts where untrusted local accounts exist; no public exploit identified at time of analysis. Notably, the vendor fix only corrects the default permissions for newly created and rotated logs, so previously written log files on an upgraded host remain permissively accessible until an administrator manually remediates them.
Local privilege escalation in Edgeless Systems Contrast 1.8.0 through 1.24.0 allows a low-privileged local user on a node to modify the world-writable containerd configuration and overwrite the runc runtime path, leading to high confidentiality, integrity, and availability impact on that node. This is a credible local privilege-escalation issue rather than a remotely wormable threat; the CVSS vector requires local access with low privileges (PR:L), and no public exploit identified at time of analysis.