CVE-2026-65069

Data::DisjointSet::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without OEXCL or ONOFOLLOW. The segment is created in dsu.h with openpath, ORDWR|OCREAT, 0666. The mode is 0666, so under the default umask 022 the file is created mode 0644 world-readabl...

CVE-2026-65068

CVE-2026-65068 affects Data::SpatialHash::Shared prior to 0.02 for Perl. The code opens a shared mmap backing file with open(path, O_RDWR|O_CREAT, 0666) and creates the file with mode 0666 (often 0644 under default umask) in a world‑readable location (e.g., /tmp or /dev/shm). Because O_NOFOLLOW i...

CVE-2026-65068 Data::SpatialHash::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW

Data::SpatialHash::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without OEXCL or ONOFOLLOW. The segment is created in sphash.h with openpath, ORDWR|OCREAT, 0666. The mode is 0666, so under the default umask 022 the file is created mode 0644...

CVE-2026-65066 Data::RingBuffer::Shared versions before 0.04 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW

Data::RingBuffer::Shared versions before 0.04 for Perl create a world-readable mmap backing file and open it without OEXCL or ONOFOLLOW. The segment is created in ring.h with openpath, ORDWR|OCREAT, 0666. The mode is 0666, so under the default umask 022 the file is created mode 0644 world-readabl...

CVE-2026-65065 Data::RoaringBitmap::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW

Data::RoaringBitmap::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without OEXCL or ONOFOLLOW. The segment is created in roaring.h with openpath, ORDWR|OCREAT, 0666. The mode is 0666, so under the default umask 022 the file is created mode 0644...

CVE-2026-65064

Data::HashMap::Shared before 0.14 for Perl creates a world-readable mmap backing file and opens it with 0666 permissions, without O_EXCL or O_NOFOLLOW. The file is opened with open(path, O_RDWR|O_CREAT|O_CLOEXEC, 0666) in shm_generic.h, yielding a world-readable 0644 file (umask 022). A pre-creat...

CVE-2026-65063

Data::RadixTree::Shared prior to 0.02 for Perl creates a world-readable mmap backing file via open(path, O_RDWR|O_CREAT, 0666) in radix.h. With default umask 022, the resulting mode is 0644, making the file world-readable. O_NOFOLLOW is not used, so a symlink at the path is followed; O_EXCL is no...

CVE-2026-65062

CVE-2026-65062 (Data::SortedSet::Shared) affects Perl versions before 0.03. Affected code creates an mmap-backed segment with world-readable permissions by opening a path with open(path, O_RDWR|O_CREAT, 0666) and a mode of 0666. With the default umask, this yields 0644, making the backing file wo...

CVE-2026-64617

Data::PubSub::Shared before 0.07 (Perl) creates a world-readable mmap backing file via open(path, O_RDWR|O_CREAT, 0666) with mode 0644 after umask. Lack of O_NOFOLLOW and O_EXCL enables a local attacker to follow a symlink or race, potentially reading IPC payloads stored in the shared segment. Th...

CVE-2026-64615

CVE-2026-64615 affects Data::Graph::Shared for Perl, specifically versions before 0.04. The implementation creates a world-readable mmap backing file by opening path with O_RDWR|O_CREAT and mode 0666 (leading to 0644 under default umask), without O_NOFOLLOW or O_EXCL checks. This enables local us...

CVE-2026-64615

Data::Graph::Shared versions before 0.04 for Perl create a world-readable mmap backing file and open it without OEXCL or ONOFOLLOW. The segment is created in graph.h with openpath, ORDWR|OCREAT, 0666. The mode is 0666, so under the default umask 022 the file is created mode 0644 world-readable...

CVE-2026-64615 Data::Graph::Shared versions before 0.04 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW

Data::Graph::Shared versions before 0.04 for Perl create a world-readable mmap backing file and open it without OEXCL or ONOFOLLOW. The segment is created in graph.h with openpath, ORDWR|OCREAT, 0666. The mode is 0666, so under the default umask 022 the file is created mode 0644 world-readable...

CVE-2026-64614

CVE-2026-64614 affects Data::Deque::Shared for Perl versions before 0.06. The issue arises when a shared segment is created with open(path, O_RDWR|O_CREAT, 0666); the mode 0666 (subject to umask 022 -> 0644) makes the backing file world-readable. Because O_NOFOLLOW is absent and O_EXCL is also...

CVE-2026-64613 Data::Buffer::Shared versions before 0.05 for Perl create a world-readable mmap backing file and open it without O_NOFOLLOW

Data::Buffer::Shared versions before 0.05 for Perl create a world-readable mmap backing file and open it without ONOFOLLOW. The segment is created in bufgeneric.h with openpath, ORDWR|OCREAT|OEXCL, 0666. OEXCL blocks a pre-seeded file on create, but the mode is 0666, so under the default umask 02...

PYSEC-2026-2666 motionEye's World-Readable Configuration File Exposes Admin Password Hash

Security Advisory: World-Readable Configuration File Exposes Admin Password Hash in motionEye Summary motionEye v0.43.1 and prior versions create the configuration file /etc/motioneye/motion.conf with 644 permissions -rw-r--r--, making it readable by any local user on the system. This file contai...

Anthropic Claude Code 2.1.59 < 2.1.128 Information Disclosure (CVE-2026-46406)

The version of Anthropic Claude Code installed on the remote host is 2.1.59 prior to 2.1.128. It is, therefore, affected by an information disclosure vulnerability: - The Claude Code /copy command wrote responses to a hardcoded, predictable path /tmp/claude/response.md without UID isolation,...

turso-cli persists Turso platform JWT with world-readable (0o644) file permissions

Summary turso-cli persists the user's Turso platform JWT to settings.json using Viper's default configPermissions of 0o644, leaving the credential file world-readable on standard Linux and macOS systems. Any other local UID on the host can read the file and recover the platform JWT, which grants...

CVE-2017-18424

In cPanel before 66.0.2, the Apache HTTP Server configuration file is changed to world-readable when rebuilt SEC-274...

CVE-2024-32010

A vulnerability has been identified in Spectrum Power 4 All versions V4.70 SP12 Update 2. The affected application is vulnerable to extraction of database credentials via a world-readable credential file. This allows an attacker to connect to the database as privileged application user and to run...

CVE-2024-32010

A vulnerability has been identified in Spectrum Power 4 All versions V4.70 SP12 Update 2. The affected application is vulnerable to extraction of database credentials via a world-readable credential file. This allows an attacker to connect to the database as privileged application user and to run...