CVE Watch5 jul 2026

CVE-2025-45150

Insecure permissions in LangChain-ChatGLM-Webui commit ef829 allows attackers to arbitrarily view and download sensitive files via supplying

CVSS

9.8

Crítico

EPSS

0.5%

p41

KEV

—

Exploit Today

0-100

Publicado: 1 ago 2025 · Última mod.: 5 jul 2026 · CWE-732

EPSS · 30d

0.5%EPSS · 30 días0.6%

2026-06-302026-07-17

Descripción técnica

Insecure permissions in LangChain-ChatGLM-Webui commit ef829 allows attackers to arbitrarily view and download sensitive files via supplying a crafted request.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2021-341107.8 ALT

63.4%

——19WinWaste.NET version 1.0.6183.16475 has incorrect permissions, allowing a local unprivileged user to replace the executable with a malicious file that will be executed with "LocalSystem" privileges.9d CVE-2017-176778.8 ALT

60.5%

——18BMC Remedy 9.1SP3 is affected by authenticated code execution. Authenticated users that have the right to create reports can use BIRT templates to run code.9d CVE-2022-262817.5 ALT

56.5%

——17BigAnt Server v5.6.06 was discovered to contain an incorrect access control issue.9d CVE-2023-317487.8 ALT

53.4%

——16Insecure permissions in MobileTrans v4.0.11 allows attackers to escalate privileges to local admin via replacing the executable file.9d CVE-2023-390049.8 CRÍ

52.0%

——16Insecure permissions in the configuration directory (/conf/) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allow attackers to access sensitive information (e.g., hashed root password) which could lead to privilege escalation.9d CVE-2021-406496.5 MED

51.6%

——15In Connx Version 6.2.0.1269 (20210623), a cookie can be issued by the application and not have the HttpOnly flag set.9d