CVE-2026-12963
A vulnerability that could allow a viewer account to gain unauthorized access to network attached storage devices on the server.
CVSS
7.4
High
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Nov 10, 2026 · Last modified: Nov 10, 2026 · CWE-732
Not enough EPSS history yet.
A vulnerability that could allow a viewer account to gain unauthorized access to network attached storage devices on the server.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-145433.9 LOW—
———The VAPIX Edge storage API, enabling the escalation of user privileges by circumventing filesystem isolation, granting unauthorized access to protected system resources. This flaw can only be exploited after authenticating with an admin-privileged service account.6hCVE-2026-1121257.3 HIG—
———Incorrect Permission Assignment for Critical Resource Vulnerability in HA Monitor.
This issue affects HA Monitor: from 01-00 before 01-83-01.7hCVE-2026-1140317.8 HIG—
———Incorrect permission assignment allows local privilege escalation to SYSTEM on affected releases of the Illumio VEN for Windows. Code execution as NT AUTHORITY\LOCAL SERVICE on the Windows host is required to exploit this vulnerability. The flaw exists within the VEN installer, which grants LOCAL SERVICE full access to the VEN data and installation folders, whose configuration and state files are read and trusted by the SYSTEM-privileged illumio-ven-ctl component. An attacker can leverage this vulnerability to modify the VEN configuration so that illumio-ven-ctl executes an injected command in the context of the SYSTEM account.14hCVE-2026-1194747.8 HIG—
——0Incorrect Permission Assignment for Critical Resource vulnerability in HAVELSAN Inc. Liman Render Engine allows Privilege Escalation.
This issue affects Liman Render Engine: before 1.2-81.21hCVE-2026-1240393.3 LOW0.7%
——0Gitleaks through 8.30.1 contains an incorrect permission assignment vulnerability that allows local users to read scan reports because cmd/root.go creates the --report-path file with os.Create and default permissions. Unless --redact is passed, other local users on shared hosts or CI runners can read plaintext secrets and matching lines to obtain discovered credentials.22hCVE-2026-1129105.3 MED5.3%
——2filelock is a platform-independent file lock for Python. From 3.10.0 until 4.2.1, filelock on Windows ignores the mode argument for WindowsFileLock files and the ReadWriteLock SQLite database. A lock created with mode=0o600 receives the parent directory's inheritable ACL because _open_non_reparse_fd and _nt_open do not create an owner-only security descriptor. Another local account with inherited access can read holder metadata or the lock database, modify those files where the ACL permits writes, or take the byte-range lock after release and delay later acquisitions. UnixFileLock is not affected, and mutual exclusion between cooperating processes continues to hold. This issue is fixed in version 4.2.1.17h