By weakness (CWE)

CWE-732: related vulnerabilities

CVEs classified under CWE-732. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

18 published vulnerabilities

• CVE-2026-10591HIGH 8.8

  Amazon Kiro IDE before version 0.11 contains a flaw in its file write functionality that fails to properly restrict which directories and files can be modified. An attacker can exploit this by sending specially crafted instructions that trick the IDE into writing files to sensitive paths—such as VS Code configuration files that execute automatically when a folder is opened. This could allow remote code execution without requiring the user to authenticate or take risky steps beyond opening a project folder.

• CVE-2026-50570HIGH 8.5

  Fission, a Kubernetes-native serverless framework, has a flaw in how it validates which Linux capabilities tenants are allowed to add to containers. The framework maintains a denylist of dangerous capabilities to prevent privilege escalation, but the list was incomplete—it missed CAP_SYS_TIME and others. This means a tenant could create a Function or Environment and request CAP_SYS_TIME, which would pass validation and allow their code to run with the ability to modify system time. This is a privilege escalation vulnerability that affects multi-tenant Fission clusters where untrusted users can define workloads.

• CVE-2026-26422HIGH 8.4

  A flaw in clash-verge-service-ipc versions prior to 2.3.0 exposes an inter-process communication endpoint that is accessible to any local user on the system. An attacker with local access can exploit this to escalate their privileges to a higher level, potentially gaining full control of the affected system. This is a local-only attack that does not require any special user privileges or interaction to trigger.

• CVE-2021-4480HIGH 8.2

  Dräger Protector Software before version 6.4.2 has a local privilege escalation flaw rooted in overly permissive file system permissions. An attacker with local access to an affected system can replace critical binaries or loaded modules, then trigger execution with NT SYSTEM privileges—the highest level of access on Windows. This gives an adversary complete control over the host.

• CVE-2021-4481HIGH 8.2

  Dräger Protector Software versions prior to 6.4.2 suffer from a local privilege escalation flaw rooted in overly permissive file system permissions. An attacker with local access to an affected system can exploit this weakness to replace system binaries or loaded modules, ultimately executing arbitrary code with the highest privilege level (NT SYSTEM). This is a boots-on-the-ground attack: the attacker must have local file system access, but once they do, they can gain complete system control.

• CVE-2026-49340HIGH 8.1

  Gonic, a free-software music streaming server that implements the Subsonic API, contains a vulnerability in how it handles playlist creation and updates. Any authenticated user—not just administrators—can exploit a flaw in the playlist write function to place files anywhere on the server's filesystem and create directories with overly permissive access controls. This was patched in version 0.21.0.

• CVE-2026-0271HIGH 7.8

  A privilege escalation vulnerability exists in Palo Alto Networks' Prisma Access Agent on Linux systems. An attacker with local access to an affected Linux device can exploit this flaw to gain elevated privileges and run code with higher permissions than their current account level. This capability is limited to Linux deployments; Windows, macOS, iOS, Android, and ChromeOS installations are unaffected.

• CVE-2026-12957HIGH 7.8

  Language Servers for AWS versions before 1.65.0 contain a vulnerability that allows arbitrary code execution when a user opens a malicious workspace. The vulnerability stems from insufficient trust boundary enforcement—if a local user is tricked into trusting a workspace containing malicious commands in project configuration files, those commands will execute automatically. An attacker would need to craft a malicious workspace and convince a user to open and trust it, making this a local attack that relies on social engineering.

• CVE-2026-27788HIGH 7.8

  ServerView Agents for Windows versions up to 11.60.04 contain a privilege escalation vulnerability rooted in improper file or resource permissions. Any local user with valid credentials on the affected server can exploit this flaw to gain SYSTEM-level access, effectively taking complete control of the system. The vulnerability requires no user interaction and affects all Windows deployments running the vulnerable software versions.

• CVE-2026-45353HIGH 7.8

  Electerm, an open-source multi-protocol terminal and remote access client supporting SSH, SFTP, Telnet, serial ports, RDP, VNC, Spice, and FTP, contains a high-severity vulnerability affecting versions 3.0.6 through 3.8.8. The issue stems from improper file permissions and unsafe code execution patterns that allow a local attacker with standard user privileges to gain full control over system resources—reading sensitive data, modifying files, and disrupting availability. The vulnerability is resolved in version 3.9.0.

• CVE-2026-50209HIGH 7.8

  CVE-2026-50209 is a local privilege escalation flaw in Acer Connect M6E 5G devices that allows a low-privileged user or malware running on the device to hijack the Mobile Device Management (MDM) configuration. By exploiting broadcast event handling, an attacker can rewrite the MDM endpoint address to point to an attacker-controlled server, effectively transferring administrative control of the device away from the legitimate organization. This is particularly dangerous in corporate deployments where MDM is the primary remote management and security enforcement mechanism.

• CVE-2026-10840HIGH 7.1

  OpenShift Pipelines operator contains a privilege escalation vulnerability stemming from overly permissive role-based access control (RBAC). The tekton-scheduler-rolebinding automatically grants any authenticated user write access to Kueue and cert-manager custom resources. This means that anyone with cluster login credentials—including low-privilege service accounts or developers without special permissions—can interfere with workload scheduling, tamper with certificate management, and potentially overwrite critical TLS secrets used by ingress controllers. The vulnerability is particularly dangerous in multi-tenant clusters where separation of duties is expected.

• CVE-2026-10997MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how it enforces policies on extensions. An attacker could craft a malicious extension that, if installed by a user, would be able to bypass access controls that should normally restrict what the extension can do. This is a user-assisted attack—the victim must actively install the extension—but once installed, the extension gains unintended capabilities.

• CVE-2026-32315MEDIUM 5.5

  motionEye versions before 0.44.0 store sensitive configuration files with overly permissive file access controls. Any user on the system can read the admin password hash and camera credentials from plain-text configuration files. An attacker with local access could extract these credentials, crack the password hash offline, and use it to impersonate an administrator—potentially combining this with other known flaws in motionEye to take complete control of the system.

• CVE-2026-53856MEDIUM 5.5

  OpenClaw versions before 2026.4.24 have a file permissions problem in their configuration recovery feature. When the system restores its main configuration file (OpenClaw.json), it sets permissions too loosely, allowing other local users on shared systems to read it. Since the configuration file typically contains sensitive data like API keys, credentials, or internal settings, this gives unprivileged attackers a way to extract that information without needing special access.

• CVE-2026-50267MEDIUM 4.7

  Steeltoe, a .NET library for building cloud-native applications, inadvertently exposes database credentials to other processes on the same Linux container. When applications configure MySQL or PostgreSQL connections through Cloud Foundry service bindings, Steeltoe temporarily stores TLS client credentials in world-readable files in the system temp directory. These files are never cleaned up, leaving sensitive key material accessible to any other user or process on the same machine. The vulnerability affects Steeltoe.Configuration.Abstractions versions 4.0.0 through 4.1.0 and is resolved in version 4.2.0.

• CVE-2026-9651MEDIUM 4.4

  CVE-2026-9651 is a file permission vulnerability affecting Schneider Electric industrial control system products. An attacker with administrative or privileged local access to an affected device can read system files that contain password hashes, potentially enabling account compromise. The vulnerability requires high-level local privileges to exploit and does not allow remote access or denial of service, which limits its immediate risk profile but remains concerning for insiders or those who have already gained local foothold on vulnerable systems.

• CVE-2026-54327LOW 2.2

  Pi is a lightweight terminal-based coding tool that manages API authentication through a local configuration file. Between versions 0.74.0 and 0.78.1, a timing vulnerability could temporarily expose stored API keys and OAuth tokens with overly permissive file access before the application locked down security settings. This window is extremely brief but theoretically allows a local user with active session privileges to read credentials meant to be private. The issue has been patched in version 0.78.1.