CVE-2026-20577
In Modem, there is a possible permission bypass due to a permissions bypass. This could lead to local denial of service if a malicious actor
CVSS
—
No CVSS
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Nov 2, 2026 · Last modified: Nov 2, 2026 · CWE-280
Not enough EPSS history yet.
In Modem, there is a possible permission bypass due to a permissions bypass. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: MOLY01880753; Issue ID: MSV-9866.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-20599——
———In Modem, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: MOLY01790985; Issue ID: MSV-8148.6hCVE-2026-3322—7.9%
——2Due to improper permission checks in Lobster_pro, attackers are able to interact with endpoints that should require administrative privileges. This issue affects Lobster_pro version 4.12.12-LTS and potentially other versions prior to 25.1.3.6dCVE-2026-637925.3 MED37.8%
——11Gitea's collaborative-owner authorization path for reading cross-repository reusable workflows does not exclude fork pull request runs. An approved fork workflow targeting a private repository can read workflow files from another private repository that trusts the base repository's owner through collaborative-owner configuration. The issue exposes private reusable workflow contents at caller-selected Git refs; it does not itself grant write access or code execution in the other repository.19dCVE-2026-21121—1.4%
——0Improper handling of insufficient permission in CmcCore prior to SMR Oct-2026 Release 1 allows local attackers to use the privileged APIs.17dCVE-2026-56729—31.7%
——10Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, when multiple KB categories have different editor roles assigned, a user with knowledge_base.editor in one category can see answer titles and updated_at timestamps from categories they do not have editor access to , via the global quick search. Category names are not leaked, and opening the answer returns "Page not found," but the title alone may disclose sensitive information. This vulnerability is fixed in 7.0.2.35dCVE-2026-96872—28.2%
——8Improper handling of insufficient permissions or privileges vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension on Linux, MacOS, and Windows allows Accessing Functionality Not Properly Constrained by ACLs.
This issue affects Mediawiki - WikiLambda Extension: before 1.47.0.39d