Total
1756 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-54618 | 1 Huawei | 1 Harmonyos | 2026-06-17 | N/A | 5.7 MEDIUM |
| Permission control vulnerability in the distributed clipboard module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. | |||||
| CVE-2025-54546 | 2026-06-17 | N/A | 7.5 HIGH | ||
| On affected platforms, restricted users could use SSH port forwarding to access host-internal services | |||||
| CVE-2025-54545 | 2026-06-17 | N/A | 7.8 HIGH | ||
| On affected platforms, a restricted user could break out of the CLI sandbox to the system shell and elevate their privileges. | |||||
| CVE-2025-54497 | 2026-06-17 | N/A | 8.1 HIGH | ||
| Cognex In-Sight Explorer and In-Sight Camera Firmware expose a telnet-based service on port 23 to allow management operations such as firmware upgrades and device reboots, which require authentication. A user with protected privileges can successfully invoke the SetSerialPort functionality to modify relevant device properties (such as serial interface settings), contradicting the security model proposed in the user manual. | |||||
| CVE-2025-53396 | 2026-06-17 | N/A | 7.0 HIGH | ||
| Incorrect permission assignment for critical resource issue exists in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier), which may allow users who can log in to a client terminal to obtain root privileges. | |||||
| CVE-2025-52992 | 2026-06-17 | N/A | 3.2 LOW | ||
| The Nix, Lix, and Guix package managers fail to properly set permissions when a derivation build fails. This may allow arbitrary processes to modify the content of a store outside of the build sandbox. This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b. | |||||
| CVE-2025-52923 | 2026-06-17 | N/A | 4.3 MEDIUM | ||
| Sangfor aTrust through 2.4.10 allows users to modify the ExecStartPre command. | |||||
| CVE-2025-52873 | 2026-06-17 | N/A | 8.1 HIGH | ||
| Cognex In-Sight Explorer and In-Sight Camera Firmware expose a telnet-based service on port 23 to allow management operations such as firmware upgrades and device reboots, which require authentication. A user with protected privileges can successfully invoke the SetSystemConfig functionality to modify relevant device properties (such as network settings), contradicting the security model proposed in the user manual. | |||||
| CVE-2025-52627 | 1 Hcltech | 1 Aion | 2026-06-17 | N/A | 5.5 MEDIUM |
| Root File System Not Mounted as Read-Only configuration vulnerability. This can allow unintended modifications to critical system files, potentially increasing the risk of system compromise or unauthorized changes.This issue affects AION: 2.0. | |||||
| CVE-2025-52094 | 1 Pdq | 1 Smart Deploy | 2026-06-17 | N/A | 7.8 HIGH |
| Insecure Permissions vulnerability in PDQ Smart Deploy V.3.0.2040 allows a local attacker to execute arbtirary code via the \HKLM\SYSTEM\Setup\SmartDeploy component | |||||
| CVE-2025-50675 | 2026-06-17 | N/A | 7.8 HIGH | ||
| GPMAW 14, a bioinformatics software, has a critical vulnerability related to insecure file permissions in its installation directory. The directory is accessible with full read, write, and execute permissions for all users, allowing unprivileged users to manipulate files within the directory, including executable files like GPMAW3.exe, Fragment.exe, and the uninstaller GPsetup64_17028.exe. An attacker with user-level access can exploit this misconfiguration by replacing or modifying the uninstaller (GPsetup64_17028.exe) with a malicious version. While the application itself runs in the user's context, the uninstaller is typically executed with administrative privileges when an administrator attempts to uninstall the software. By exploiting this flaw, an attacker could gain administrative privileges and execute arbitrary code in the context of the admin, resulting in privilege escalation. | |||||
| CVE-2025-4952 | 2026-06-17 | N/A | N/A | ||
| Tampering of the registry entries might have led to preventing the ESET security products from starting correctly on the next system startup or to unauthorized changes in the product's configuration. | |||||
| CVE-2025-4609 | 2 Google, Microsoft | 2 Chrome, Windows | 2026-06-17 | N/A | 9.6 CRITICAL |
| Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 136.0.7103.113 allowed a remote attacker to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High) | |||||
| CVE-2025-49131 | 1 Fastgpt | 1 Fastgpt | 2026-06-17 | N/A | 6.3 MEDIUM |
| FastGPT is an open-source project that provides a platform for building, deploying, and operating AI-driven workflows and conversational agents. The Sandbox container (fastgpt-sandbox) is a specialized, isolated environment used by FastGPT to safely execute user-submitted or dynamically generated code in isolation. The sandbox before version 4.9.11 has insufficient isolation and inadequate restrictions on code execution by allowing overly permissive syscalls, which allows attackers to escape the intended sandbox boundaries. Attackers could exploit this to read and overwrite arbitrary files and bypass Python module import restrictions. This is patched in version 4.9.11 by restricting the allowed system calls to a safer subset and additional descriptive error messaging. | |||||
| CVE-2025-48961 | 2026-06-17 | N/A | 7.3 HIGH | ||
| Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect 16 (Windows) before build 39938. | |||||
| CVE-2025-48747 | 1 Netwrix | 1 Directory Manager | 2026-06-17 | N/A | 5.0 MEDIUM |
| Netwrix Directory Manager (formerly Imanami GroupID) before and including v.11.0.0.0 and after v.11.1.25134.03 has Incorrect Permission Assignment for a Critical Resource. | |||||
| CVE-2025-48382 | 1 Codelibs | 1 Fess | 2026-06-17 | N/A | 5.5 MEDIUM |
| Fess is a deployable Enterprise Search Server. Prior to version 14.19.2, the createTempFile() method in org.codelibs.fess.helper.SystemHelper creates temporary files without explicitly setting restrictive permissions. This could lead to potential information disclosure, allowing unauthorized local users to access sensitive data contained in these files. This issue primarily affects environments where Fess is deployed in a shared or multi-user context. Typical single-user or isolated deployments have minimal or negligible practical impact. This issue has been patched in version 14.19.2. A workaround for this issue involves ensuring local access to the environment running Fess is restricted to trusted users only. | |||||
| CVE-2025-46802 | 2026-06-17 | N/A | 6.0 MEDIUM | ||
| For a short time they PTY is set to mode 666, allowing any user on the system to connect to the screen session. | |||||
| CVE-2025-46093 | 1 Liquidfiles | 1 Liquidfiles | 2026-06-17 | N/A | 9.9 CRITICAL |
| LiquidFiles before 4.1.2 supports FTP SITE CHMOD for mode 6777 (setuid and setgid), which allows FTPDrop users to execute arbitrary code as root by leveraging the Actionscript feature and the sudoers configuration. | |||||
| CVE-2025-45472 | 1 Lumigo | 1 Autodeploy-layer | 2026-06-17 | N/A | 8.8 HIGH |
| Insecure permissions in autodeploy-layer v1.2.0 allows attackers to escalate privileges and compromise the customer cloud account. | |||||