196 matches found
CVE-2026-64613 Data::Buffer::Shared versions before 0.05 for Perl create a world-readable mmap backing file and open it without O_NOFOLLOW
Data::Buffer::Shared versions before 0.05 for Perl create a world-readable mmap backing file and open it without ONOFOLLOW. The segment is created in bufgeneric.h with openpath, ORDWR|OCREAT|OEXCL, 0666. OEXCL blocks a pre-seeded file on create, but the mode is 0666, so under the default umask 02...
CVE-2026-64613 Data::Buffer::Shared versions before 0.05 for Perl create a world-readable mmap backing file and open it without O_NOFOLLOW
Data::Buffer::Shared versions before 0.05 for Perl create a world-readable mmap backing file and open it without ONOFOLLOW. The segment is created in bufgeneric.h with openpath, ORDWR|OCREAT|OEXCL, 0666. OEXCL blocks a pre-seeded file on create, but the mode is 0666, so under the default umask 02...
PT-2026-62058
Data::NDArray::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O EXCL or O NOFOLLOW. The segment is created in ndarray.h with openpath, O RDWR|O CREAT, 0666. The mode is 0666, so under the default umask 022 the file is created mode 0644...
PT-2026-62059
Data::PubSub::Shared versions before 0.07 for Perl create a world-readable mmap backing file and open it without O EXCL or O NOFOLLOW. The segment is created in pubsub.h with openpath, O RDWR|O CREAT, 0666. The mode is 0666, so under the default umask 022 the file is created mode 0644...
CVE-2026-64158
CVE-2026-64158 has been rejected or withdrawn by its CVE Numbering Authority. However, the underlying fix is present in vendor kernel updates. The fix addresses the netfs subsystem in the Linux kernel , specifically correcting write streaming disablement when a file descriptor is opened with O_RD...
garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store
Insecure Permission Assignment for Garmin OAuth Token Store Summary garminconnect ≤ 0.3.4 wrote its OAuth token store to disk without restricting file-system permissions. Under the default Linux umask 022 the token file garmintokens.json was created world-readable 0o644. The file contains the DI...
PYSEC-2026-2666 motionEye's World-Readable Configuration File Exposes Admin Password Hash
Security Advisory: World-Readable Configuration File Exposes Admin Password Hash in motionEye Summary motionEye v0.43.1 and prior versions create the configuration file /etc/motioneye/motion.conf with 644 permissions -rw-r--r--, making it readable by any local user on the system. This file contai...
motionEye's World-Readable Configuration File Exposes Admin Password Hash
Security Advisory: World-Readable Configuration File Exposes Admin Password Hash in motionEye SummarymotionEye v0.43.1 and prior versions create the configuration file /etc/motioneye/motion.conf with 644 permissions -rw-r--r--, making it readable by any local user on the system. This file contain...
Anthropic Claude Code 2.1.59 < 2.1.128 Information Disclosure (CVE-2026-46406)
The version of Anthropic Claude Code installed on the remote host is 2.1.59 prior to 2.1.128. It is, therefore, affected by an information disclosure vulnerability: - The Claude Code /copy command wrote responses to a hardcoded, predictable path /tmp/claude/response.md without UID isolation,...
turso-cli persists Turso platform JWT with world-readable (0o644) file permissions
Summary turso-cli persists the user's Turso platform JWT to settings.json using Viper's default configPermissions of 0o644, leaving the credential file world-readable on standard Linux and macOS systems. Any other local UID on the host can read the file and recover the platform JWT, which grants...
PT-2026-52646
Name of the Vulnerable Software and Affected Versions Nextflow versions 25.09.2-edge through 26.04.1 Description The nextflow auth login command persists Seqera Platform OIDC tokens to the $NXF HOME:-/.nextflow/seqera-auth.config file. Because the file is created via Java NIO without specifying...
Exploit for Incorrect Resource Transfer Between Spheres in Linux Linux_Kernel
CVE-2026-31431 — Copy Fail Local Privilege Escalation i...
CVE-2017-18424
In cPanel before 66.0.2, the Apache HTTP Server configuration file is changed to world-readable when rebuilt SEC-274...
CVE-2024-32010
A vulnerability has been identified in Spectrum Power 4 All versions V4.70 SP12 Update 2. The affected application is vulnerable to extraction of database credentials via a world-readable credential file. This allows an attacker to connect to the database as privileged application user and to run...
CVE-2024-32010
A vulnerability has been identified in Spectrum Power 4 All versions V4.70 SP12 Update 2. The affected application is vulnerable to extraction of database credentials via a world-readable credential file. This allows an attacker to connect to the database as privileged application user and to run...
CVE-2024-32010
A vulnerability has been identified in Spectrum Power 4 All versions V4.70 SP12 Update 2. The affected application is vulnerable to extraction of database credentials via a world-readable credential file. This allows an attacker to connect to the database as privileged application user and to run...
PT-2025-46535
Name of the Vulnerable Software and Affected Versions Spectrum Power versions prior to 4.70 SP12 Update 2 Description The application is susceptible to the exposure of database credentials through a world-readable credential file. Successful exploitation allows an attacker to connect to the...
EUVD-2005-1095
Malware in sbrugna...