EUVD-2026-125026

OpenEMR before 8.5.0 contains an access control flaw in getclaimfile.php: with location=tmp, it serves any file in the shared temporary directory without verifying the file is a claim for the caller. Users with acct/eob or acct/bill write access can request key=ccda.xml to download the most...

python: python: Arbitrary file deletion via race condition during temporary directory cleanup

A flaw was found in Python. A race condition during the cleanup of temporary directories allows a local attacker with write access to replace a directory with a symbolic link a reference pointing to another location. This can lead to unauthorized deletion or alteration of files outside the...

python: python: Arbitrary file deletion via race condition during temporary directory cleanup

A flaw was found in Python. A race condition during the cleanup of temporary directories allows a local attacker with write access to replace a directory with a symbolic link a reference pointing to another location. This can lead to unauthorized deletion or alteration of files outside the...

Microsoft Security Advisory CVE-2026-120778 - Aspire Elevation of Privilege Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in the Aspire CLI. This advisory provides guidance on updating affected applications and components. An insecure temporary directory used by Aspire CLI-generated builds can allow a local...

GHSA-M63F-XHVM-6MV5 Microsoft Security Advisory CVE-2026-120778 - Aspire Elevation of Privilege Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in the Aspire CLI. This advisory provides guidance on updating affected applications and components. An insecure temporary directory used by Aspire CLI-generated builds can allow a local...

CVE-2026-111241

When a non-default stateful session bean passivation strategy is configured, passivated bean state is written to predictably named files in the shared system temporary directory, reusing files that already exist there, and is deserialized on activation. A local attacker who can write to that...

EUVD-2026-121253

When a non-default stateful session bean passivation strategy is configured, passivated bean state is written to predictably named files in the shared system temporary directory, reusing files that already exist there, and is deserialized on activation. A local attacker who can write to that...

CVE-2026-111241

In Apache TomEE , a configuration using a non-default stateful session bean passivation strategy can lead to local code execution . The vulnerability occurs because passivated bean states are written to predictably named files in a shared system temporary directory. These files are reused and sub...

CVE-2026-111241 Apache TomEE: Local code execution via predictable passivation files in the shared temporary directory

When a non-default stateful session bean passivation strategy is configured, passivated bean state is written to predictably named files in the shared system temporary directory, reusing files that already exist there, and is deserialized on activation. A local attacker who can write to that...

PT-2026-141766

When a non-default stateful session bean passivation strategy is configured, passivated bean state is written to predictably named files in the shared system temporary directory, reusing files that already exist there, and is deserialized on activation. A local attacker who can write to that...

CVE-2026-122137

Powerlevel10k before 1.20.19 contains an insecure temporary directory vulnerability in the bundled gitstatus/install script that reuses attacker-creatable directories when mktemp fails. Local attackers can pre-create the predictable gitstatus-install.tmp directory to replace the extracted...

EUVD-2026-117091

Powerlevel10k before 1.20.19 contains an insecure temporary directory vulnerability in the bundled gitstatus/install script that reuses attacker-creatable directories when mktemp fails. Local attackers can pre-create the predictable gitstatus-install.tmp directory to replace the extracted...

CVE-2026-122137 Powerlevel10k before 1.20.19 Insecure Temporary Directory via gitstatus Installer

Powerlevel10k before 1.20.19 contains an insecure temporary directory vulnerability in the bundled gitstatus/install script that reuses attacker-creatable directories when mktemp fails. Local attackers can pre-create the predictable gitstatus-install.tmp directory to replace the extracted...

CVE-2026-122137

The Powerlevel10k framework, in versions prior to 1.20.19 , contains an insecure temporary directory vulnerability within the bundled gitstatus/install script. The issue arises because the script reuses attacker-creatable directories when the mktemp command fails. A local attacker can pre-create ...

PT-2026-137159

Powerlevel10k before 1.20.19 contains an insecure temporary directory vulnerability in the bundled gitstatus/install script that reuses attacker-creatable directories when mktemp fails. Local attackers can pre-create the predictable gitstatus-install.tmp directory to replace the extracted...

CLEANSTART-2026-HP01986 "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp")

CVE-2026-39819 affects multiple packages. The "go bug" command writes to two files with predictable names in the system temporary directory for example, "/tmp". See references for individual vulnerability details...

GHSA-9VW2-F4VP-X7GF PHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handling

Summary When PHPT tests are run with code coverage, PHPUnit 13.4.0 to 13.4.3 writes the code of each PHPT test to a directory with a fixed name below the operating system's path used for temporary files, for instance /tmp/phpunit-phpt on Linux, and executes it from there. PHPUnit uses this...

EUVD-2026-113349

PHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handling...

PHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handling

Summary When PHPT tests are run with code coverage, PHPUnit 13.4.0 to 13.4.3 writes the code of each PHPT test to a directory with a fixed name below the operating system's path used for temporary files, for instance /tmp/phpunit-phpt on Linux, and executes it from there. PHPUnit uses this...

CLEANSTART-2026-HF77036 "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp")

CVE-2026-39819 affects multiple packages. The "go bug" command writes to two files with predictable names in the system temporary directory for example, "/tmp". See references for individual vulnerability details...