CVE-2026-128346

ExcelJS through 4.4.0 contains a resource leak vulnerability in the streaming WorkbookReader.parse that leaves temporary files and open descriptors when sheet parsing fails or iteration stops early. Attackers can repeatedly upload malformed multi-sheet workbooks with worksheets placed before...

EUVD-2026-125153

ExcelJS through 4.4.0 contains a resource leak vulnerability in the streaming WorkbookReader.parse that leaves temporary files and open descriptors when sheet parsing fails or iteration stops early. Attackers can repeatedly upload malformed multi-sheet workbooks with worksheets placed before...

CVE-2026-128346

Versions of ExcelJS up to and including 4.4.0 are vulnerable to a resource leak in the streaming WorkbookReader.parse function. The root cause is the failure to properly clean up temporary files and open descriptors when parsing a sheet fails or iteration stops prematurely. An attacker can exploi...

CVE-2026-128346 ExcelJS through 4.4.0 Resource Exhaustion via Streaming WorkbookReader Temporary Files

ExcelJS through 4.4.0 contains a resource leak vulnerability in the streaming WorkbookReader.parse that leaves temporary files and open descriptors when sheet parsing fails or iteration stops early. Attackers can repeatedly upload malformed multi-sheet workbooks with worksheets placed before...

PT-2026-146560

ExcelJS through 4.4.0 contains a resource leak vulnerability in the streaming WorkbookReader.parse that leaves temporary files and open descriptors when sheet parsing fails or iteration stops early. Attackers can repeatedly upload malformed multi-sheet workbooks with worksheets placed before...

CVE-2026-126627

Apache XML Graphics FOP versions through 2.11 are vulnerable to a Creation of Temporary File With Insecure Permissions (CWE-378) vulnerability. On Unix-like systems, the software creates temporary files that are readable by other local users . To remediate this issue, users are recommended to upg...

CVE-2026-126627 Apache XML Graphics FOP: Temporary files on Unix-like systems are readable by other local users

Creation of Temporary File With Insecure Permissions vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graphics FOP: through 2.11. Users are recommended to upgrade to version 2.12, which fixes the issue...

GHSA-Q6JF-24JF-M3CG Microsoft Security Advisory CVE-2026-120792 - Aspire Information Disclosure Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in the Aspire CLI. This advisory provides guidance on updating affected applications and components. Insecure temporary files used by Aspire CLI can allow a local attacker to obtain...

Microsoft Security Advisory CVE-2026-120792 - Aspire Information Disclosure Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in the Aspire CLI. This advisory provides guidance on updating affected applications and components. Insecure temporary files used by Aspire CLI can allow a local attacker to obtain...

Microsoft Security Advisory CVE-2026-120792 - Aspire Information Disclosure Vulnerability

Microsoft is releasing this security advisory to provide information about a vulnerability in the Aspire CLI. This advisory provides guidance on updating affected applications and components. Insecure temporary files used by Aspire CLI can allow a local attacker to obtain sensitive configuration...

CVE-2026-120792

Insecure temporary files used by Aspire CLI can allow a local attacker to obtain sensitive configuration information...

FileGator: Missing authorization in POST /upload allows cross-user read and deletion of temporary files

Summary POST /upload uses the request-supplied resumableFilename directly as a key into the shared temporary directory, without the character filter it applies to resumableIdentifier and without namespacing it per user. A valid user holding the upload permission can read any file in that director...

GHSA-44R8-3P76-84MW FileGator: Missing authorization in POST /upload allows cross-user read and deletion of temporary files

Summary POST /upload uses the request-supplied resumableFilename directly as a key into the shared temporary directory, without the character filter it applies to resumableIdentifier and without namespacing it per user. A valid user holding the upload permission can read any file in that director...

CVE-2026-94619 FileGator: Missing authorization in POST /upload allows cross-user read and deletion of temporary files

FileGator is a multi-user file manager. Prior to 7.15.0, POST /upload in backend/Controllers/UploadController.php uses the request-supplied resumableFilename as an unnamespaced key in shared temporary storage. In a multi-user deployment configured with distinct per-user home directories, a...

CLEANSTART-2026-WV75757 Apache CXF stores large stream based messages as temporary files on the local filesystem

Security vulnerability affects the wso2is package. Apache CXF stores large stream based messages as temporary files on the local filesystem...

PT-2026-132489

virtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.10, the app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and configuration-file forms of symlink app...

CVE-2026-116132

HTTP::Body versions before 1.2301 for Perl leave the temporary file of an incomplete multipart upload on disk. The multipart parser creates a temporary file as soon as a file part starts, but adds it to the upload list only when the part completes. Uploads are only ever deleted from that list, by...

Linux Distros Unpatched Vulnerability : CVE-2026-113713

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.10, the app-data seeder can leave an environment linked to...

CVE-2026-76497

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered...

CVE-2026-76497

The Cisco Expressway Series software is affected by vulnerabilities involving insecure temporary files , categorized under CWE-377 . These issues were identified during an internal security review and are addressed in the October 2026 hardening release . The impact includes potential high integri...