https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 10:55:27 +0000 https://cve.radiocsirt.org/vuln/advisory2026-09_vde-2026-055 <p>Two local privilege escalation vulnerabilities were identified in the CODESYS Development System. Specifically, the PackageManager and the IPM create temporary directories with insecure default permissions when executed with administrative privileges. This allows low-privileged local users to modify a temporary bootstrap file to force the deployment of arbitrary components, or to exploit a Time-of-Check to Time-of-Use (TOCTOU) race condition to replace digitally verified installation files with malicious ones prior to installation. Both flaws bypass intended security boundaries during the installation of packages or add-ons.</p> <p>Two local privilege escalation vulnerabilities were identified in the CODESYS Development System. Specifically, the PackageManager and the IPM create temporary directories with insecure default permissions when executed with administrative privileges. This allows low-privileged local users to modify a temporary bootstrap file to force the deployment of arbitrary components, or to exploit a Time-of-Check to Time-of-Use (TOCTOU) race condition to replace digitally verified installation files with malicious ones prior to installation. Both flaws bypass intended security boundaries during the installation of packages or add-ons.</p> https://cve.radiocsirt.org/vuln/advisory2026-09_vde-2026-055 https://cve.radiocsirt.org/vuln/euvd-2026-321196 EUVD-2026-321196 https://cve.radiocsirt.org/vuln/euvd-2026-321196 https://cve.radiocsirt.org/vuln/fkie_cve-2026-44468 <p>The affected product creates a directory with insecure default permissions during administrative installation. This allows a low-privileged local attacker to modify a temporary file defining the components to be installed, enabling local privilege escalation by forcing the deployment of arbitrary components.</p> <p>The affected product creates a directory with insecure default permissions during administrative installation. This allows a low-privileged local attacker to modify a temporary file defining the components to be installed, enabling local privilege escalation by forcing the deployment of arbitrary components.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-44468 https://cve.radiocsirt.org/vuln/ghsa-x347-p9xc-q762 <p>The affected product creates a directory with insecure default permissions during administrative installation. This allows a low-privileged local attacker to modify a temporary file defining the components to be installed, enabling local privilege escalation by forcing the deployment of arbitrary components.</p> <p>The affected product creates a directory with insecure default permissions during administrative installation. This allows a low-privileged local attacker to modify a temporary file defining the components to be installed, enabling local privilege escalation by forcing the deployment of arbitrary components.</p> https://cve.radiocsirt.org/vuln/ghsa-x347-p9xc-q762 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1675 <p>Ein Angreifer kann mehrere Schwachstellen in CODESYS ausnutzen, um seine Privilegien zu erhöhen, um Daten zu manipulieren, und um einen Denial of Service Angriff durchzuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in CODESYS ausnutzen, um seine Privilegien zu erhöhen, um Daten zu manipulieren, und um einen Denial of Service Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1675