CVE-2026-94204
The central cloud storage backend for the entire dashcam platform is misconfigured with public-read permissions, allowing unrestricted acces
CVSS
7.5
High
EPSS
0.3%
p18
KEV
—
Exploit Today
5
0-100
Published: Sep 29, 2026 · Last modified: Sep 29, 2026 · CWE-732
0.3%EPSS · 30 days0.3%
2026-09-302026-10-19
The central cloud storage backend for the entire dashcam platform is misconfigured with public-read permissions, allowing unrestricted access to all stored objects. Because this bucket serves as shared storage for the platform, sensitive user records, live dashcam footage, application packages, and firmware files are exposed to anyone on the internet.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1141056.2 MED—
———Adm-zip before 0.6.1 contains an incorrect permission assignment vulnerability that allows attackers to set setuid, setgid, or sticky bits on extracted files when keepOriginalPermission is enabled. Attackers can craft zip external file attributes that pass unmasked into chmod, letting attacker-controlled executables gain elevated privileges when extracted as root and later run.8hCVE-2026-113720——
———virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the app-data copy seeder uses shutil.copy() to copy cached package files into later environments, causing cached source modes to override the current run's umask. A cache populated under a permissive umask can therefore produce files writable by another local account in a later traversable environment, allowing package code such as pip/__init__.py to be modified and executed by the environment owner. The attacker cannot force the earlier umask, and a private destination parent prevents access. This issue is fixed in version 21.14.9.13hCVE-2026-711697.0 HIG—
——0Dell Application Store, versions prior to 26.05.0.7, contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Disclosure of sensitive information16hCVE-2026-965425.0 MED0.2%
——0Incorrect permission assignment (CWE-732) in the standalone installer for EA Javelin Anticheat (versions 1.0.14329371, 1.0.14547437, 1.0.14789537, and 1.0.14940698) on Windows allows a local non-administrative user to elevate privileges to NT AUTHORITY\SYSTEM by modifying the EAAntiCheatService service configuration and executable path. This vulnerability requires non-standard manual execution of the standalone installer and does not affect standard game installations via the EA App and Steam. This issue is corrected in version 1.0.14940699 and later; service permissions automatically self-heal upon launching an integrated EA game title.2dCVE-2026-964255.5 MED1.0%
——0Incorrect DBus policy for lomiri-download-manager allows arbitrary user to run arbitrary command as root over DBus3dCVE-2026-964247.8 HIG1.0%
——0Incorrect DBus policy for lomiri-upload-manager (part of lomiri-download-manager) allows arbitrary user to read arbitrary file as root over DBus3d