CVE-2026-71309 vulnerabilities

Vulnerabilities for packages: telegraf...

MAL-2026-13305 Malicious code in dolyame-boxy-desktop-bnpl-hero-title (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 036c11daa7712014748d57bc2bca8a37672acffa8f3eaca83161b726ba473fdb On require of the package, helpers.js reassembles hostnames from split string arrays e.g. 'oob-worker.cf102-baf.workers.dev',...

Malicious code in bnpl-blocks-atom-bnpl-fade-overflow (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f78c9360e199f852a5b395b6549e12b6334ec3dce096462a4404a3a0e809f545 On require of this package, index.js loads runtime.js which selects a platform-specific payload path, fetches bytes over HTTPS from...

Malicious code in twork-data-services-product-design-data (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a86edfca41ff32a7b044ecb921977944dbdc5cf5d2a3ccae4e5ca001a851816 On require of the package's main module, loader.js downloads a platform-specific binary from a set of obfuscated Cloudflare Workers subdomains...

Malicious code in bigops-voximplant (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e20e151930946a17e9bea02eb51c760264c27138792955452acc4231196ceaae On require of bigops-voximplant, index.js loads ext.js which downloads an OS/arch-specific binary from Cloudflare Workers subdomains whose hostnames...

CVE-2026-64379

A flaw was found in the Linux kernel's Server Message Block SMB client. When processing server-provided file mode information, the system incorrectly applies these modes without proper security masking. This can result in unintended file permissions, potentially allowing unauthorized access to...

CVE-2025-59866

The HCL DFMPro, DFXAnalytics and DFXServer installers are affected by ‘Insecure file permissions Leading to Privilege Escalation’ vulnerability, which enables any logged-in non-administrative user to overwrite or replace the executable file with a malicious binary...

CVE-2025-59866

The CVE concerns HCL DFMPro, DFXAnalytics, and DFXServer installers suffering from Insecure file permissions that allow a logged-in non-administrative user to overwrite or replace the executable with a malicious binary. The underlying cause is unrestricted or insecure permissions on the installer...

bind security update

9.18.33-15.0.1.el102.2 - Hard require needed openssl-libs Orabug: 38742109 - Fix warning when changing device file permissions Orabug: 36518580 32:9.18.33-15.2 - Fix GSS-API resource leak CVE-2026-3039 - Invalid handling of CLASS != IN CVE-2026-5946 32:9.18.33-15.1 - Prevent Denial of Service via...

decompress: @xhmikosr/decompress: Decompress: Arbitrary file read/write via crafted archive extraction

A flaw was found in the decompress package for Node.js. A remote attacker can exploit this vulnerability by crafting a malicious archive. When the archive is extracted, it can create files and links outside the intended directory, leading to unauthorized reading or writing of files. This is due t...

Incorrect Permission Assignment for Critical Resource

Overview garminconnect is a Python 3 API wrapper for Garmin Connect Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource due to insecure file-system permissions being set on the OAuth token store by the dump function. An attacker can gain...

PT-2026-60373

Name of the Vulnerable Software and Affected Versions garminconnect versions prior to 0.3.5 Description The software writes its OAuth token store to disk without restricting file-system permissions. On systems with a default Linux umask of 022, the token file garmin tokens.json is created as...

PT-2026-58899

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a Composer package bin entry containing .. path segments can resolve outside the package install directory and cause Composer's binary installation flow to chmod an existing host file to a world-readable and...

SUSE CVE-2026-59946

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a Composer package bin entry containing .. path segments can resolve outside the package install directory and cause Composer's binary installation flow to chmod an existing host file to a world-readable and...

CVE-2026-58494 Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination

Wasmtime is a runtime for WebAssembly. Prior to 24.0.11, 36.0.12, 45.0.3, and 46.0.1, wasmtime-wasi hard-link creation and renaming check directory permissions but not matching FilePerms on source and destination preopens, allowing a WASI guest with a read-only source file capability to overwrite...

CVE-2026-58494

CVE-2026-58494 affects Wasmtime runtimes prior to the fixed versions 24.0.11, 36.0.12, 45.0.3, and 46.0.1. The issue arises in wasmtime-wasi where hard-link creation and renaming check directory permissions do not correctly match FilePerms on source and destination preopens. This can allow a WASI...

Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers

Summary Project.AddFile, Project.EditFile, Project.RemoveFile, and Project.Edit in cmd/server/api/project/handler.go accept a project or project-file row id from the JSON body and act on it without checking that the project belongs to the caller's namespace. The corresponding...

PYSEC-2026-2047 Wheel Affected by Arbitrary File Permission Modification via Path Traversal in wheel unpack

Summary - Vulnerability Type: Path Traversal CWE-22 leading to Arbitrary File Permission Modification. - Root Cause Component: wheel.cli.unpack.unpack function. - Affected Packages: 1. wheel Upstream source 2. setuptools Downstream, vendors wheel - Severity: High Allows modifying system file...

GO-2026-5811 turso-cli persists Turso platform JWT with world-readable (0o644) file permissions in github.com/tursodatabase/turso-cli

turso-cli persists Turso platform JWT with world-readable 0o644 file permissions in github.com/tursodatabase/turso-cli...

PYSEC-2026-1936 Spotipy's cache file, containing spotify auth token, is created with overly broad permissions

Summary The CacheHandler class creates a cache file to store the auth token here: https://github.com/spotipy-dev/spotipy/blob/master/spotipy/cachehandler.pyL93-L98 The file created has rw-r--r-- 644 permissions by default, when it could be locked down to rw------- 600 permissions. I think 600 is ...