CVE-2026-123505

Vikunja versions prior to 2.7.1 are vulnerable to an insecure file permissions flaw. The localStorage.Write function creates blobs that are world-readable , allowing local users on shared hosts to access sensitive data. Impacted information includes attachments , project backgrounds , and exports...

CVE-2026-123505 Vikunja before 2.7.1 World-Readable Local File Storage and SQLite Database

Vikunja before 2.7.1 contains an insecure file permissions vulnerability that allows local users to read stored data because localStorage.Write creates blobs world-readable. Local attackers on a shared host can read attachments, project backgrounds and exports, and copy the SQLite database to cra...

CVE-2026-124039

Gitleaks versions through 8.30.1 are affected by an incorrect permission assignment vulnerability (CWE-732). The root cause is located in cmd/root.go, where the --report-path file is created using os.Create with default permissions. This allows other local users on shared hosts or CI runners to r...

EUVD-2026-118440

Gitleaks through 8.30.1 contains an incorrect permission assignment vulnerability that allows local users to read scan reports because cmd/root.go creates the --report-path file with os.Create and default permissions. Unless --redact is passed, other local users on shared hosts or CI runners can...

CVE-2026-124039 Gitleaks through 8.30.1 World-Readable Report Files via --report-path

Gitleaks through 8.30.1 contains an incorrect permission assignment vulnerability that allows local users to read scan reports because cmd/root.go creates the --report-path file with os.Create and default permissions. Unless --redact is passed, other local users on shared hosts or CI runners can...

EUVD-2026-118042

In JetBrains CLion before 2026.3, 2026.2.4.1 missing authentication allowed local users to obtain the debug session environment on Linux...

CVE-2026-121003

A flaw was found in Epiphany. An information disclosure vulnerability allows local users to discover websites visited during private browsing sessions. When a user selects the "Always Allow" option for external URL schemes while in incognito mode, Epiphany stores the visited domain into the user'...

CLEANSTART-2024-BB62367 flaw was found in the way Samba maps domain users to local users

Security vulnerability affects the samba package. A flaw was found in the way Samba maps domain users to local users...

CVE-2021-42205

CVE-2021-42205 ELAN Miniport touchpad Windows driver before 24.21.51.2, as used in PC hardware from multiple manufacturers, allows local users to cause a system crash by sending a certain IOCTL request, because that request is handled twice. authentication| complexity| vector ---|---|--- not...

Medium: awscli

Issue Overview: Overly permissive file permissions in AWS CLI before 1.44.78 v1 and 2.34.29 v2 on Unix-like systems where the umask has not been configured to restrict file permissions the default on most systems may allow other local users on the same host to read credentials written by certain...

Medium: awscli

Issue Overview: Overly permissive file permissions in AWS CLI before 1.44.78 v1 and 2.34.29 v2 on Unix-like systems where the umask has not been configured to restrict file permissions the default on most systems may allow other local users on the same host to read credentials written by certain...

Amazon Linux 2 : awscli (ALAS-2026-4052)

The version of awscli installed on the remote host is prior to 1.18.147-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-4052 advisory. Overly permissive file permissions in AWS CLI before 1.44.78 v1 and 2.34.29 v2 on Unix-like systems where the umask has not been...

Amazon Linux 2 : awscli (ALASAWSCLI1-2026-002)

The version of awscli installed on the remote host is prior to 1.27.51-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2AWSCLI1-2026-002 advisory. Overly permissive file permissions in AWS CLI before 1.44.78 v1 and 2.34.29 v2 on Unix-like systems where the umask has not...

CVE-2026-115402

OpenVPN ovpn-dco-win 0.6.5 through 2.8.13 allows unprivileged local users to cause a denial of service system crash via a race condition in the TCP connect path...

Vulnerability related to permission and access control issues in Juniper Networks Session Smart Conductor

Versions prior to Juniper Networks Session Smart Conductor 7.0.5, versions 7.1.0 through 7.1.7, and versions 7.2.0 through 7.2.3 contain a privilege escalation and access control vulnerability. This vulnerability stems from improper permission allocation for critical resources within...

CVE-2026-115413

Missing token audience validation in the OAuth authentication mode of AWS API MCP Server before version 1.6.0 might allow local users to run AWS operations with the server's configured AWS credentials via an access token issued to another application by the same identity provider. To remediate th...

EUVD-2026-111349

Missing token audience validation in the OAuth authentication mode of AWS API MCP Server before version 1.6.0 might allow local users to run AWS operations with the server's configured AWS credentials via an access token issued to another application by the same identity provider. To remediate th...

CVE-2026-115413 AWS API MCP Server OAuth Token Audience Validation Bypass

Missing token audience validation in the OAuth authentication mode of AWS API MCP Server before version 1.6.0 might allow local users to run AWS operations with the server's configured AWS credentials via an access token issued to another application by the same identity provider. To remediate th...

CVE-2026-115413

Missing token audience validation in the OAuth authentication mode of AWS API MCP Server before version 1.6.0 might allow local users to run AWS operations with the server's configured AWS credentials via an access token issued to another application by the same identity provider. To remediate th...

CVE-2026-115413: Origin Validation Error

Missing token audience validation in the OAuth authentication mode of AWS API MCP Server before version 1.6.0 might allow local users to run AWS operations with the server's configured AWS credentials via an access token issued to another application by the same identity provider. To remediate th...