CVE Watch8 de nov. de 2026

CVE-2026-123500

Vikunja before 2.7.1 contains an insecure file permissions vulnerability that allows local users to read dump archives created with umask pe

CVSS

6.2

Média

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 8 de nov. de 2026 · Última mod.: 8 de nov. de 2026 · CWE-276

EPSS · 30d

Ainda não há histórico EPSS suficiente.

Descrição técnica

Vikunja before 2.7.1 contains an insecure file permissions vulnerability that allows local users to read dump archives created with umask permissions by the vikunja dump command. Local attackers on a shared host can read the world-readable zip in the rootpath to obtain config, password hashes, TOTP secrets, tokens, and stored files.

Referências oficiais

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-1235055.5 MÉD

—

———Vikunja before 2.7.1 contains an insecure file permissions vulnerability that allows local users to read stored data because localStorage.Write creates blobs world-readable. Local attackers on a shared host can read attachments, project backgrounds and exports, and copy the SQLite database to crack password hashes offline.9h CVE-2026-448757.8 ALT

2.8%

——1In HPE Cray Programming Environment versions 25.03 and 25.09, prior to 26.03, the method that CPE is deployed on HPCM potentially allows elevated access by a local unprivileged user.3d CVE-2026-94460—

8.1%

——2IRISPowerscan contain an insecure default configuration where the built-in installation account is assigned elevated privileges with a predictable password, which could allow an unauthenticated attacker to gain unauthorised access to privileged application functionality.4d CVE-2026-163057.8 ALT

7.8%

——2Local privilege escalation in `SmartUpdate.exe` and `SmartExecute.exe` in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a local low-privileged attacker to execute arbitrary commands with administrator privileges via modification of a world-writable `execlist.txt` command manifest that is processed during application updates.2d CVE-2026-918957.1 ALT

1.6%

——0Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Tampering.5d CVE-2026-1070527.5 ALT

29.4%

——9Insecure permissions in the AIDL interface of ProjectMAXS MAXS Module FileRead versionCode 27 allows unauthorized attackers to arbitrarily reead files outside of the sandbox via providing an absolute path.9d