Local-Exploitation

Araxis Merge for Windows stores server credentials using DPAPI with NULL entropy, allowing an attacker with local user access to decrypt and extract stored credentials from the registry.

Netdata’s ndsudo helper utility is vulnerable to local privilege escalation due to insecure PATH-based command resolution, allowing low-privileged users to execute arbitrary code as root.

Progressive Robot hMailServer 6.0.0 through 6.3.6 contains a vulnerability allowing unauthenticated remote attackers to forge DKIM-signed emails for hosted domains via improper verification of sender identity during the signing process.

A local privilege escalation vulnerability in the macOS diskutil utility allows unprivileged users to gain root access via manipulated filesystem mounting.

A local improper authorization vulnerability in Lenovo Baiying PC Client allows an authenticated user to achieve privilege escalation through arbitrary code execution.

The lz4-java library is vulnerable to a race condition during native library extraction that allows a local user to perform arbitrary code execution or a denial of service.

The Nx build system contains OS command injection vulnerabilities in `nx affected` and `nx import` commands, allowing attackers to execute arbitrary code via malicious git revision strings or remote branch names.

Multiple unpatched vulnerabilities in the RPM package manager allow an unauthenticated attacker to achieve arbitrary code execution on systems processing malicious packages.

The GNU binutils package contains multiple vulnerabilities that allow a local attacker to cause a Denial of Service condition or disclose sensitive information by processing malformed object files.

Acunetix 25.11.251107123 for Windows is vulnerable to local privilege escalation via DLL hijacking in the Web Vulnerability Scanning Engine (wvsc.exe) due to insecure directory path handling.

GNU Emacs versions prior to 31.0.91 are susceptible to an integer overflow vulnerability in the PBM/PPM/PGM image loader, potentially leading to heap memory disclosure.

An Uncontrolled Search Path Element vulnerability, CVE-2026-8164, in ArkSigner Desktop Client versions from v2.2.16.10 through 17062026 allows a local attacker to perform Search Order Hijacking, potentially leading to arbitrary code execution or privilege escalation with the application's privileges.

Multiple vulnerabilities in Rockwell Automation Studio 5000 Logix Designer allow a local attacker to execute arbitrary program code, which could lead to a compromise of the affected system or unauthorized control over the design environment.

A stack-based buffer overflow vulnerability (CVE-2026-14605) exists in the `recvmsg` function of the `ls1c CAN Handler` component within RT-Thread up to version 5.0.2, requiring local access for exploitation and having a publicly available exploit, potentially leading to high impact on confidentiality, integrity, and availability.

Multiple vulnerabilities have been discovered in the expat XML parser library that can be exploited by a local attacker, potentially leading to a Denial of Service condition or allowing for arbitrary code execution on the affected system.

CVE-2026-25865 describes an unquoted search path element vulnerability in Yandex Punto Switcher through version 4.5.0.583, allowing local attackers to execute arbitrary code by placing a malicious `RunDll32.exe` earlier in the system's PATH to hijack the application's insecure `WinExec` call, leading to arbitrary code execution with affected user privileges.