CVE-2026-14478
A maliciously created executable, when executed on the victim's machine, may allow a local low-privileged attacker to inject unauthenticated
CVSS
7.8
Alto
EPSS
—
KEV
—
Exploit Today
—
0-100
Publicado: 12 ago 2026 · Última mod.: 12 ago 2026 · CWE-732
Sin historial EPSS suficiente todavía.
A maliciously created executable, when executed on the victim's machine, may allow a local low-privileged attacker to inject unauthenticated IPC messages into named pipes, modify pipe permissions or ownership, and potentially impact confidentiality, integrity, and availability.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-659406.8 MED—
———In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can write arbitrary files to a web-accessible location on the host server.5hCVE-2026-487905.5 MED—
——0Turso CLI is the command line interface (CLI) to the open-source database Turso. Versions prior to 1.0.26 persist the user's Turso platform JWT to `settings.json` using Viper's default `configPermissions` of `0o644`, leaving the credential file world-readable on standard Linux and macOS systems. Any other local UID on the host can read the file and recover the platform JWT, which grants full Turso platform access scoped to the user's organizations. Version 1.0.26 patches the issue.1dCVE-2025-0046——
——0Incorrect directory permissions could allow a local user to escalate their privileges, potentially resulting in arbitrary code execution.8hCVE-2026-635227.8 ALT—
——0Incorrect permission assignment for critical resource in Azure SQL Database allows an authorized attacker to elevate privileges locally.17hCVE-2025-61970——
——0Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to create arbitrary code, potentially resulting in binary hijacking.8hCVE-2026-691086.0 MED—
——0A vulnerability has been identified in Siemens License Server (SLS) (All versions < V5.1). The affected application is vulnerable to a local privilege escalation due to an insecure sudoers policy. This could allow an attacker to execute arbitrary commands and plant malicious files as root, leading to full system compromise.1d