# CWE-277. Every Advisory and CVE whose sources give the weakness CWE-277, newest first. ## Records, newest first - [Podman: arbitrary file write when importing oci archive](https://agentprime.io/advisories/CVE-2025-11395.md) `CVE-2025-11395` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: CWE-277 - [Lenovo Legion Zone: A potential insecure permissions vulnerability was reported in Legion Zone and the Lenovo…](https://agentprime.io/advisories/CVE-2026-9046.md) `CVE-2026-9046` · CVE record: Lenovo Legion Zone and 1 more · CVSS 7.3 High · Not analysed yet · Published 16 Jul 2026 · Tags: CWE-277 - [view_component: Preview Route Can Dispatch Inherited Helper Methods](https://agentprime.io/advisories/GHSA-7f3r-gwc9-2995.md) `GHSA-7f3r-gwc9-2995`, `CVE-2026-44836` · RubyGems `view_component`: affected `>=3.0.0, <4.9.0`, fixed in `4.9.0` · CVSS 6.5 Medium · Not analysed yet · Published 8 May 2026 · Tags: CWE-277, CWE-749 - [OpenClaw's ACP child sessions inherit subagent security envelope constraints](https://agentprime.io/advisories/GHSA-q3jj-46pq-826r.md) `GHSA-q3jj-46pq-826r`, `CVE-2026-44997` · npm `openclaw`: affected `<2026.4.22`, fixed in `2026.4.22` · CVSS 2.3 Low · Not analysed yet · Published 4 May 2026 · Tags: Privilege escalation, CWE-277 - [Insecure Permissions vulnerability in DeepCool DeepCreative v.1.2.12 and before allows a local attacker to execute arbitrary code via a crafted file](https://agentprime.io/advisories/CVE-2026-30266.md) `CVE-2026-30266` · CVE record · CVSS 7.8 High · Not analysed yet · Published 20 Apr 2026 · Tags: CWE-277 - [A permissions issue was addressed with additional restrictions.](https://agentprime.io/advisories/CVE-2026-20630.md) `CVE-2026-20630` · CVE record: Apple macOS · CVSS 5.5 Medium · Not analysed yet · Published 11 Feb 2026 · Tags: CWE-277 - [Intel(R) Graphics Software: Insecure inherited permissions for some Intel(R) Graphics Software before version…](https://agentprime.io/advisories/CVE-2025-32092.md) `CVE-2025-32092` · CVE record: Intel(R) Graphics Software · CVSS 5.4 Medium · Not analysed yet · Published 10 Feb 2026 · Tags: CWE-277 - [Authenticated Arbitrary File Write Vulnerability in AOS 10 and AOS-8 Web-Based Management Interface](https://agentprime.io/advisories/CVE-2025-37174.md) `CVE-2025-37174` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 7.2 High · Not analysed yet · Published 13 Jan 2026 · Tags: CWE-277 - [SpiceDB: LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results](https://agentprime.io/advisories/GHSA-9m7r-g8hg-x3vr.md) `GHSA-9m7r-g8hg-x3vr`, `CVE-2025-65111`, `GO-2025-4151` · Go `github.com/authzed/spicedb`: affected `<1.47.1`, fixed in `1.47.1` · CVSS 2.9 Low · Not analysed yet · Published 21 Nov 2025 · Tags: CWE-277 - [Open OnDemand RPM packages create world writable locations](https://agentprime.io/advisories/CVE-2025-64185.md) `CVE-2025-64185` · CVE record: OSC ondemand · CVSS 6.9 Medium · Not analysed yet · Published 20 Nov 2025 · Tags: Information disclosure, CWE-277 - [Intel(R) Rapid Storage Technology Application: Insecure inherited permissions for some Intel(R) Rapid Storage Technology Application…](https://agentprime.io/advisories/CVE-2025-24327.md) `CVE-2025-24327` · CVE record: Intel(R) Rapid Storage Technology Application · CVSS 5.4 Medium · Not analysed yet · Published 11 Nov 2025 · Tags: CWE-277 - [Portabilis i-Educar User Type AccessLevelController.php insecure inherited permissions](https://agentprime.io/advisories/CVE-2025-11554.md) `CVE-2025-11554` · CVE record: Portabilis i-Educar · CVSS 5.3 Medium · Not analysed yet · Published 9 Oct 2025 · Tags: Privilege escalation, CWE-277 - [An insecure permission vulnerability exists in the Agasta Easytouch+ version 9.3.97 The device allows unauthorized mobile applications to connect via Bluetooth Low Energy (BLE) without authentication.](https://agentprime.io/advisories/CVE-2025-56019.md) `CVE-2025-56019` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 2 Oct 2025 · Tags: CWE-277 - [Coder vulnerable to privilege escalation could lead to a cross workspace compromise in github.com/coder/coder](https://agentprime.io/advisories/GHSA-j6xf-jwrj-v5qp.md) `GHSA-j6xf-jwrj-v5qp`, `CVE-2025-58437`, `GO-2025-3938` · Go `github.com/coder/coder` and 1 more: affected `*`, no fixed version yet · CVSS 8.1 High · Not analysed yet · Published 17 Sept 2025 · Tags: Authentication bypass, CWE-277, CWE-279 - [Information Disclosure in Amazon ECS Container Agent in github.com/aws/amazon-ecs-agent](https://agentprime.io/advisories/GHSA-wm7x-ww72-r77q.md) `GHSA-wm7x-ww72-r77q`, `CVE-2025-9039`, `GO-2025-3891` · Go `github.com/aws/amazon-ecs-agent`: affected `>=0.0.3, <1.97.1`, fixed in `1.97.1` · CVSS 5.3 Medium · Not analysed yet · Published 18 Aug 2025 · Tags: CWE-277 - [IBM Storage Scale information disclosure](https://agentprime.io/advisories/CVE-2025-36104.md) `CVE-2025-36104` · CVE record: IBM Storage Scale · CVSS 6.5 Medium · Not analysed yet · Published 12 Jul 2025 · Tags: CWE-277 - [Conda-build Insecure Build Script Permissions Enabling Arbitrary Code Execution](https://agentprime.io/advisories/CVE-2025-32797.md) `CVE-2025-32797` · CVE record: conda conda-build · CVSS 6.0 Medium · Not analysed yet · Published 16 Jun 2025 · Tags: CWE-277 - [IBM Security Guardium privilege escalation](https://agentprime.io/advisories/CVE-2025-3473.md) `CVE-2025-3473` · CVE record: IBM Security Guardium · CVSS 6.7 Medium · Not analysed yet · Published 11 Jun 2025 · Tags: CWE-277 - [django-helpdesk before 1.0.0 allows Sensitive Data Exposure because of os.umask(0) in models.py.](https://agentprime.io/advisories/GHSA-m4jx-m5hg-qrxx.md) `GHSA-m4jx-m5hg-qrxx`, `CVE-2018-25111`, `PYSEC-2025-44` · PyPI `django-helpdesk`: affected `<1.0.0`, fixed in `1.0.0` · CVSS 5.1 Medium · Not analysed yet · Published 31 May 2025 · Tags: CWE-277 - [Intel(R) Simics(R) Package Manager software: Insecure inherited permissions for some Intel(R) Simics(R) Package Manager software…](https://agentprime.io/advisories/CVE-2025-22448.md) `CVE-2025-22448` · CVE record: Intel(R) Simics(R) Package Manager software · CVSS 6.9 Medium · Not analysed yet · Published 13 May 2025 · Tags: CWE-277 - [Intel(R) Ethernet Network Adapter E810 Series: Insecure inherited permissions in the NVM Update Utility for some Intel(R) Ethernet…](https://agentprime.io/advisories/CVE-2025-20629.md) `CVE-2025-20629` · CVE record: Intel(R) Ethernet Network Adapter E810 Series · CVSS 5.4 Medium · Not analysed yet · Published 13 May 2025 · Tags: CWE-277 - [Intel(R) Simics(R) Package Manager software: Insecure inherited permissions for some Intel(R) Simics(R) Package Manager software…](https://agentprime.io/advisories/CVE-2025-20008.md) `CVE-2025-20008` · CVE record: Intel(R) Simics(R) Package Manager software · CVSS 5.4 Medium · Not analysed yet · Published 13 May 2025 · Tags: CWE-277 - [Insecure File permissions vulnerability in SAP BusinessObjects Business Intelligence Platform](https://agentprime.io/advisories/CVE-2025-31332.md) `CVE-2025-31332` · CVE record: SAP_SE SAP BusinessObjects Business Intelligence Platform · CVSS 6.6 Medium · Not analysed yet · Published 8 Apr 2025 · Tags: CWE-277 - [Dell Wyse Management Suite: Dell Wyse Management Suite, versions prior to WMS 5.1…](https://agentprime.io/advisories/CVE-2025-29982.md) `CVE-2025-29982` · CVE record: Dell Wyse Management Suite · CVSS 6.8 Medium · Not analysed yet · Published 2 Apr 2025 · Tags: CWE-277 - [The issue was addressed with improved checks.](https://agentprime.io/advisories/CVE-2023-28207.md) `CVE-2023-28207` · CVE record: Apple macOS · CVSS 5.5 Medium · Not analysed yet · Published 21 Mar 2025 · Tags: CWE-277 - [IBM Robotic Process Automation privilege escalation](https://agentprime.io/advisories/CVE-2024-51448.md) `CVE-2024-51448` · CVE record: IBM Robotic Process Automation · CVSS 6.7 Medium · Not analysed yet · Published 18 Jan 2025 · Tags: CWE-277 - [Intel(R) DSA software: Insecure inherited permissions for some Intel(R) DSA software before version 24.3.26.8…](https://agentprime.io/advisories/CVE-2024-36294.md) `CVE-2024-36294` · CVE record: Intel(R) DSA software · CVSS 5.4 Medium · Not analysed yet · Published 13 Nov 2024 · Tags: CWE-277 - [Intel(R) CIP software: Insecure inherited permissions for some Intel(R) CIP software before version 2.4.10852…](https://agentprime.io/advisories/CVE-2024-36276.md) `CVE-2024-36276` · CVE record: Intel(R) CIP software · CVSS 5.4 Medium · Not analysed yet · Published 13 Nov 2024 · Tags: CWE-277 - [TCC Bypass in Cursor's macOS Application](https://agentprime.io/advisories/CVE-2024-45599.md) `CVE-2024-45599` · CVE record: getcursor cursor · CVSS 3.8 Low · Not analysed yet · Published 24 Sept 2024 · Tags: CWE-277 - [Improper Preservation of Permissions in xxl-job](https://agentprime.io/advisories/GHSA-cpfp-m5qw-c4r3.md) `GHSA-cpfp-m5qw-c4r3`, `CVE-2024-42681` · Maven `com.xuxueli:xxl-job-core`: affected `<2.4.2`, fixed in `2.4.2` · CVSS 8.8 High · Not analysed yet · Published 15 Aug 2024 · Tags: Broken access control, CWE-277, CWE-281 - [Intel(R) HID Event Filter software installers: Insecure inherited permissions in some Intel(R) HID Event Filter software installers…](https://agentprime.io/advisories/CVE-2024-25561.md) `CVE-2024-25561` · CVE record: Intel(R) HID Event Filter software installers · CVSS 5.4 Medium · Not analysed yet · Published 14 Aug 2024 · Tags: CWE-277 - [Flexlm License Daemons for Intel(R) FPGA software: Insecure inherited permissions in some Flexlm License Daemons for Intel(R) FPGA software…](https://agentprime.io/advisories/CVE-2024-23908.md) `CVE-2024-23908` · CVE record: Flexlm License Daemons for Intel(R) FPGA software · CVSS 5.4 Medium · Not analysed yet · Published 14 Aug 2024 · Tags: CWE-277 - [Pulp incorrectly assigns RBAC permissions in tasks that create objects](https://agentprime.io/advisories/GHSA-9m5j-4xx9-44j9.md) `GHSA-9m5j-4xx9-44j9`, `CVE-2024-7143`, `PYSEC-2026-1808` · PyPI `pulpcore`: affected `<=3.56.0`, no fixed version yet · CVSS 6.7 Medium · Not analysed yet · Published 7 Aug 2024 · Tags: CWE-277 - [Insecure permissions in kuma v2.7.0 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.](https://agentprime.io/advisories/CVE-2024-36542.md) `CVE-2024-36542` · CVE record · CVSS 8.8 High · Not analysed yet · Published 25 Jul 2024 · Tags: CWE-277 - [Insecure permissions in external-secrets v0.9.16 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.](https://agentprime.io/advisories/CVE-2024-36540.md) `CVE-2024-36540` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jul 2024 · Tags: CWE-277 - [Insecure permissions in contour v1.28.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.](https://agentprime.io/advisories/CVE-2024-36539.md) `CVE-2024-36539` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jul 2024 · Tags: CWE-277 - [Insecure permissions in Entrust Datacard XPS Card Printer Driver 8.5 and earlier without the dxp1-patch-E24-004 patch allows unauthenticated attackers to execute arbitrary code as SYSTEM via a crafte…](https://agentprime.io/advisories/CVE-2024-34329.md) `CVE-2024-34329` · CVE record · CVSS 8.4 High · Not analysed yet · Published 22 Jul 2024 · Tags: CWE-277 - [Insecure Permissions vulnerability in lin-CMS v.0.2.0 and before allows a remote attacker to obtain sensitive information via the login method in the UserController.java component.](https://agentprime.io/advisories/CVE-2024-41601.md) `CVE-2024-41601` · CVE record · CVSS 7.5 High · Not analysed yet · Published 19 Jul 2024 · Tags: CWE-277 - [Apache Airflow has DAG Author Code Execution possibility in airflow-scheduler](https://agentprime.io/advisories/GHSA-g5hv-r743-v8pm.md) `GHSA-g5hv-r743-v8pm`, `BIT-airflow-2024-39877`, `CVE-2024-39877`, `PYSEC-2024-190` · PyPI `apache-airflow`: affected `>=2.4.0, <2.9.3`, fixed in `2.9.3` · CVSS 8.8 High · Not analysed yet · Published 17 Jul 2024 · Tags: Code injection, CWE-277 - [Firefox Android missed activation delay to prevent tapjacking](https://agentprime.io/advisories/CVE-2024-6605.md) `CVE-2024-6605` · CVE record: Mozilla Firefox · CVSS 8.8 High · Not analysed yet · Published 9 Jul 2024 · Tags: CWE-277 - [Insecure permissions in the AdminController.AjaxSave() method of PPGo_Jobs v2.8.0 allows authenticated attackers to arbitrarily modify users' account information.](https://agentprime.io/advisories/CVE-2024-36691.md) `CVE-2024-36691` · CVE record · CVSS 6.3 Medium · Not analysed yet · Published 12 Jun 2024 · Tags: CWE-277 - [This issue was addressed with improved permissions checking.](https://agentprime.io/advisories/CVE-2024-27848.md) `CVE-2024-27848` · CVE record: Apple iOS and iPadOS and 1 more · CVSS 7.4 High · Not analysed yet · Published 10 Jun 2024 · Tags: CWE-277 - [Intel(R) Power Gadget software for Windows: Insecure inherited permissions in Intel(R) Power Gadget software for Windows all versions…](https://agentprime.io/advisories/CVE-2023-45736.md) `CVE-2023-45736` · CVE record: Intel(R) Power Gadget software for Windows · CVSS 6.7 Medium · Not analysed yet · Published 16 May 2024 · Tags: CWE-277 - [Intel(R) XTU software: Insecure inherited permissions in some Intel(R) XTU software before version 7.14.0.15 may…](https://agentprime.io/advisories/CVE-2024-21835.md) `CVE-2024-21835` · CVE record: Intel(R) XTU software · CVSS 6.7 Medium · Not analysed yet · Published 16 May 2024 · Tags: CWE-277 - [This issue was addressed with improved checks.](https://agentprime.io/advisories/CVE-2024-27847.md) `CVE-2024-27847` · CVE record: Apple iOS and iPadOS and 1 more · CVSS 7.4 High · Not analysed yet · Published 13 May 2024 · Tags: CWE-277 - [A logic issue was addressed with improved restrictions.](https://agentprime.io/advisories/CVE-2024-27822.md) `CVE-2024-27822` · CVE record: Apple macOS · CVSS 7.4 High · Not analysed yet · Published 13 May 2024 · Tags: CWE-277 - [Apple macOS: A downgrade issue affecting Intel-based Mac computers was addressed with additional…](https://agentprime.io/advisories/CVE-2024-27825.md) `CVE-2024-27825` · CVE record: Apple macOS · CVSS 7.8 High · Not analysed yet · Published 13 May 2024 · Tags: CWE-277 - [Insecure Permissions vulnerability in e-trust Horacius 1.0, 1.1, and 1.2 allows a local attacker to escalate privileges via the password reset function.](https://agentprime.io/advisories/CVE-2024-29417.md) `CVE-2024-29417` · CVE record · CVSS 8.4 High · Not analysed yet · Published 3 May 2024 · Tags: CWE-277 - [This issue was addressed with improved checks.](https://agentprime.io/advisories/CVE-2024-23233.md) `CVE-2024-23233` · CVE record: Apple macOS · CVSS 7.8 High · Not analysed yet · Published 8 Mar 2024 · Tags: CWE-277 - [Intel(R) Ethernet tools and driver install software: Insecure inherited permissions in some Intel(R) Ethernet tools and driver install…](https://agentprime.io/advisories/CVE-2023-33870.md) `CVE-2023-33870` · CVE record: Intel(R) Ethernet tools and driver install software · CVSS 6.7 Medium · Not analysed yet · Published 14 Feb 2024 · Tags: CWE-277 - [Intel HID Event Filter drivers for Windows 10 for some…: Insecure inherited permissions in some Intel HID Event Filter drivers for Windows 10 for…](https://agentprime.io/advisories/CVE-2023-38541.md) `CVE-2023-38541` · CVE record: Intel HID Event Filter drivers for Windows 10 for some Intel NUC laptop software installers · CVSS 6.7 Medium · Not analysed yet · Published 19 Jan 2024 · Tags: CWE-277 - [Overly Permissive Access Policy](https://agentprime.io/advisories/CVE-2023-29065.md) `CVE-2023-29065` · CVE record: Becton, Dickinson and Company (BD) FACSChorus · CVSS 4.1 Medium · Not analysed yet · Published 28 Nov 2023 · Tags: CWE-277 - [Improper privilege management in Intel(R) NUC Pro Software Suite installation software](https://agentprime.io/advisories/CVE-2022-41700.md) `CVE-2022-41700` · CVE record: Intel(R) NUC Pro Software Suite installation software · CVSS 6.7 Medium · Not analysed yet · Published 14 Nov 2023 · Tags: Privilege escalation, CWE-277 - [Intel(R) NUC Watchdog Timer installation software: Insecure inherited permissions in some Intel(R) NUC Watchdog Timer installation software…](https://agentprime.io/advisories/CVE-2022-33898.md) `CVE-2022-33898` · CVE record: Intel(R) NUC Watchdog Timer installation software · CVSS 6.7 Medium · Not analysed yet · Published 14 Nov 2023 · Tags: CWE-277 - [Intel Server Configuration Utility software: Insecure inherited permissions in the installer for some Intel Server Configuration…](https://agentprime.io/advisories/CVE-2023-34997.md) `CVE-2023-34997` · CVE record: Intel Server Configuration Utility software · CVSS 6.7 Medium · Not analysed yet · Published 14 Nov 2023 · Tags: CWE-277 - [Intel(R) Simics Simulator software: Insecure inherited permissions in some Intel(R) Simics Simulator software before version…](https://agentprime.io/advisories/CVE-2023-34314.md) `CVE-2023-34314` · CVE record: Intel(R) Simics Simulator software · CVSS 6.7 Medium · Not analysed yet · Published 14 Nov 2023 · Tags: CWE-277 - [Intel Rapid Storage Technology software: Insecure inherited permissions in some Intel Rapid Storage Technology software before…](https://agentprime.io/advisories/CVE-2023-39230.md) `CVE-2023-39230` · CVE record: Intel Rapid Storage Technology software · CVSS 6.7 Medium · Not analysed yet · Published 14 Nov 2023 · Tags: CWE-277 - [Insecure Inherited Permissions](https://agentprime.io/advisories/CVE-2023-34391.md) `CVE-2023-34391` · CVE record: Schweitzer Engineering Laboratories SEL-5033 AcSELerator RTAC Software · CVSS 7.4 High · Not analysed yet · Published 31 Aug 2023 · Tags: CWE-277 - [Intel(R) oneMKL software: Insecure inherited permissions in some Intel(R) oneMKL software before version 2022.0 may…](https://agentprime.io/advisories/CVE-2023-28658.md) `CVE-2023-28658` · CVE record: Intel(R) oneMKL software · CVSS 6.7 Medium · Not analysed yet · Published 11 Aug 2023 · Tags: CWE-277 - [Denial of Service (DoS) vulnerability in SAP SQL Anywhere](https://agentprime.io/advisories/CVE-2023-33990.md) `CVE-2023-33990` · CVE record: SAP_SE SAP SQL Anywhere · CVSS 7.8 High · Not analysed yet · Published 11 Jul 2023 · Tags: Broken access control, CWE-277 Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .