Incorrect Permission Assignment for Critical Resource (CWE-732) — 15 disclosed vulnerabilities

Records the NVD classes as Incorrect Permission Assignment for Critical Resource (CWE-732), highest CVSS first.

CRITICAL 10CVE-2026-92941public PoC2026-09-17
vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call tls.setDefaultCACertificates() and replace process-wide certificate authorities. Attackers with access to allowed tls and url builtins can use …
AI risk analysis on Exploit-DB.ai →
CRITICAL 9.1CVE-2026-39353public PoC2026-09-25
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-rc-1, InvoicePlane builds its permitted template list by scanning a PHP template directory that can be written through an administrator-controlle…
AI risk analysis on Exploit-DB.ai →
CRITICAL 9.1CVE-2026-892822026-09-22
The Apache Lounge Windows distribution of Apache HTTP Server build contains an insecure installation directory permissions vulnerability through its default install directory on C:\, which inherits write access for Authenticated Users.
AI risk analysis on Exploit-DB.ai →
HIGH 8.8CVE-2026-918002026-09-23
A local privilege escalation vulnerability exists in the installer of Foxit PDF Editor for macOS due to insufficient validation of a user-modifiable configuration value during high-privilege upgrades. A local attacker could exploit this issue to execute arbitr…
AI risk analysis on Exploit-DB.ai →
HIGH 8.8CVE-2026-917982026-09-23
A local privilege escalation vulnerability exists in the update daemon of Foxit PDF Editor/Reader due to an insecure permission configuration that allows the configuration file to be modified by regular users, which may lead to arbitrary script execution with …
AI risk analysis on Exploit-DB.ai →
HIGH 8.4CVE-2026-892812026-09-22
The Apache Lounge Windows distribution of Apache HTTP Server build contains a hardcoded configuration path vulnerability within openssl.cnf path that can allow local code execution.
AI risk analysis on Exploit-DB.ai →
HIGH 8.4CVE-2026-498112026-09-21
Dell Command | Monitor (DCM), versions prior to 10.13.2, contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privilege…
AI risk analysis on Exploit-DB.ai →
HIGH 7.7CVE-2026-95627public PoC2026-09-23
When a Tauri application uses the dialog plugin's file or folder picker, an attacker with JavaScript execution (XSS) can force the scope expansion to be recursive, granting read/write access to an entire directory tree after a single user click on a normal-loo…
AI risk analysis on Exploit-DB.ai →
HIGH 7.1CVE-2026-821642026-09-24
Dell Trusted Device Client, versions prior to 8.1.359.0, contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering.
AI risk analysis on Exploit-DB.ai →
MEDIUM 6.5CVE-2026-77256public PoC2026-09-22
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the plaintext OAuth fallback file containing refresh and access tokens is written with permissions inherited from the process umask. Under com…
mcp atlassian
AI risk analysis on Exploit-DB.ai →
MEDIUM 6.4CVE-2026-159522026-09-28
Incorrect Permission Assignment for Critical Resource vulnerability in ABB Protection and control IED manager (PCM600). This issue affects Protection and control IED manager (PCM600): through 2.14.
AI risk analysis on Exploit-DB.ai →
MEDIUM 5.5CVE-2026-77268public PoC2026-09-22
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the OAuth fallback token directory and JSON file are created without explicit owner-only modes. Local users or processes with access through t…
AI risk analysis on Exploit-DB.ai →
MEDIUM 5.5CVE-2026-761042026-09-16
Dell ObjectScale, versions prior to 4.4.0.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability in the OS. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.
objectscale
AI risk analysis on Exploit-DB.ai →
UNSCOREDCVE-2026-684902026-09-23
Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts.
AI risk analysis on Exploit-DB.ai →
UNSCOREDCVE-2026-95667public PoC2026-09-22
The MISP installer scripts (for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4) create a log file at /var/log/misp_install.log and a named pipe (FIFO) at /var/log/misp_install.log.pipe to capture all installer output. The log captures highly sensitive data i…
AI risk analysis on Exploit-DB.ai →