CVE-2026-118990

CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup. getConfigBlob has the sqlite3 shell write the dump to /tmp/cbdump and never removes it. The file takes the process umask, and a symlink planted at that...

ChromeSHELFLoader

Chrome SHELF Loader An exploit for CVE-2020-6418 implementing a SHELF Loader. Published as part of Tmp.0ut volume 2...

cve-2022-21658

CVE-2022-21658 poc Make sure the use the Rust 1.58.0 version. First run: while :; do mkdir /tmp/legit; rm -r /tmp/legit; ln -s /tmp/sensitive /tmp/legit; done Then: cargo run...

google-osconfig-privesc

Summary The googleosconfigagent process is a component GoogleCloudPlatform https://github.com/GoogleCloudPlatform/osconfig tooling, running on each VM by default. The agent is running as root and responsible for some user-controllable services, including OS config...

CVE-2026-41900-POC

OpenLearnX-RCE OpenLearnX Unauthenticated RCE via Container Volume Mount Diff-based discovery → Silent patch → Sandbox escape → Full /tmp disclosure Property| Value ---|--- Name| OpenLearnX-RCE CVE| CVE-2026-41900 GHSA| GHSA-8h25-q488-4hxw Type| Unauthenticated Info Disclosure / RCE Affected|...

CVE-2026-48907

CVE-2026-48907 Educational PoC ⚠️ This repository is for educational and defensive security purposes only. Test only on systems you own or are explicitly authorized to assess. Do not use this project against third-party systems. This PoC demonstrates CVE-2026-48907, an unauthenticated RCE...

CVE-2026-21002-Serverless-Cold-Start-Credential-Leakage-via-Reused-tmp

CVE-2026-21002 – Serverless Cold Start Credential Leakage via Reused /tmp Program Code Python AWS Lambda sim lambdafuncsim.py - Simulated serverless function import os, tempfile, time SECRETFILE = '/tmp/credentials' reused across warm starts def handlerevent: On first invocation, write a secret i...

CVE-2026-103404 Session Smart Conductor: Insecure file permissions cause unauthorized access to sensitive routing credentials

An Incorrect Permission Assignment for Critical Resource vulnerability in RoutingManager in Juniper Networks Session Smart Conductor allows a local user to access sensitive routing credentials via triggering processes that write to the /tmp directory...

EUVD-2026-112217

An Incorrect Permission Assignment for Critical Resource vulnerability in RoutingManager in Juniper Networks Session Smart Conductor allows a local user to access sensitive routing credentials via triggering processes that write to the /tmp directory...

CVE-2026-103404

A vulnerability exists in the RoutingManager component of Juniper Networks Session Smart Conductor due to an Incorrect Permission Assignment for Critical Resource (CWE-732). A local user can gain access to sensitive routing credentials by triggering processes that write to the /tmp directory with...

CVE-2026-57203

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, astloggrabber executes a Python script from the world-writable /tmp directory. An attacker already authorized to open a she...

PT-2026-127856

The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'tmp file' parameter parameter. This makes it possible for authenticated attackers, with editor-level access and above, to read the contents of arbitrary files on the server,...

DEBIAN-CVE-2026-57203

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, astloggrabber executes a Python script from the world-writable /tmp directory. An attacker already authorized to open a she...

CVE-2026-57203

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, astloggrabber executes a Python script from the world-writable /tmp directory. An attacker already authorized to open a she...

EUVD-2026-111402

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, astloggrabber executes a Python script from the world-writable /tmp directory. An attacker already authorized to open a she...

CVE-2026-57203 Asterisk: Local privilege escalation through ast_loggrabber's world-writable helper location

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, astloggrabber executes a Python script from the world-writable /tmp directory. An attacker already authorized to open a she...

CVE-2026-57203 Asterisk: Local privilege escalation through ast_loggrabber's world-writable helper location

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, astloggrabber executes a Python script from the world-writable /tmp directory. An attacker already authorized to open a she...

Strands Agents: Default FileSessionManager storage is world-readable on shared systems

There is a local confidentiality issue in the default FileSessionManager storage behavior. By default it writes session data under /tmp/strands/sessions and relies on the process umask for directory and file permissions. On systems using the common umask 022, the session directories are 0755 and...

PT-2026-127242

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, ast loggrabber executes a Python script from the world-writable /tmp directory. An attacker already authorized to open a...

Joomla DJ-Classifieds CVE-2026-61424 detect

Detects comdjclassifieds imageupload task CVE-2026-61424: unauthenticated file write to tmp/djupload/ in DJ-Classifieds 3.9.5. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Joomla DJ-Classifieds CVE-2026-61424 imageupload exposure.""" from kittysploit import from lib.protocols.http.httpclie...