446 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-97025
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Flatpak writes the OCI repository authentication token with world-readable permissions 0644 in the system-helper's cache directory, allowing other local users o...
CVE-2026-97025
Flatpak writes the OCI repository authentication token with world-readable permissions 0644 in the system-helper's cache directory, allowing other local users on a multi-user system to read the token and impersonate the authenticated user against the OCI repository. Only OCI-based sources e.g. as...
CVE-2026-97025
Flatpak writes the OCI repository authentication token with world-readable permissions 0644 in the system-helper's cache directory, allowing other local users on a multi-user system to read the token and impersonate the authenticated user against the OCI repository. Only OCI-based sources e.g. as...
CVE-2026-97025
Flatpak writes the OCI repository authentication token with world-readable permissions 0644 in the system-helper's cache directory, allowing other local users on a multi-user system to read the token and impersonate the authenticated user against the OCI repository. Only OCI-based sources e.g. as...
CVE-2026-97025: Creation of Temporary File With Insecure Permissions
Flatpak writes the OCI repository authentication token with world-readable permissions 0644 in the system-helper's cache directory, allowing other local users on a multi-user system to read the token and impersonate the authenticated user against the OCI repository. Only OCI-based sources e.g. as...
GHSA-G5XV-MHGM-V5F6 MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissions
Summary When OAuth tokens are saved, MCP Atlassian always writes a plaintext fallback copy under /.mcp-atlassian/oauth-.json. The fallback file is created with the process default umask rather than restrictive permissions. In this environment the file was created as mode 0664, exposing access and...
CVE-2026-95667
The MISP installer scripts for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4 create a log file at /var/log/mispinstall.log and a named pipe FIFO at /var/log/mispinstall.log.pipe to capture all installer output. The log captures highly sensitive data including the generated admin password,...
CVE-2026-95667 MISP Installer Log and FIFO Created World-Readable, Exposing Sensitive Credentials
The MISP installer scripts for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4 create a log file at /var/log/mispinstall.log and a named pipe FIFO at /var/log/mispinstall.log.pipe to capture all installer output. The log captures highly sensitive data including the generated admin password,...
PT-2026-96725
The MISP installer scripts for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4 create a log file at /var/log/misp install.log and a named pipe FIFO at /var/log/misp install.log.pipe to capture all installer output. The log captures highly sensitive data including the generated admin password,...
CVE-2026-90457
CVE-2026-90457 involves an inconsistency in administrative password hashing across authentication paths in an ICS product (per CISA advisory ICSA-26-254-01). One path uses a weak, fast hashing algorithm , and the resulting hash file is written with permissions readable by any local user . A separ...
EUVD-2026-67180
PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to $java.io.tmpdir/spring-integration/metadata-store.properties with world-readable permissions. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring...
CVE-2026-81682: Incorrect Default Permissions
opensslencrypt versions before 1.4.9 contain an insecure file permissions vulnerability in the desktop GUI that writes decrypted plaintext with world-readable default permissions. Attackers can read decrypted output files created by the GUI as unprivileged local users on multi-user systems...
CVE-2026-59292: Incorrect Permission Assignment for Critical Resource
PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to $java.io.tmpdir/spring-integration/metadata-store.properties with world-readable permissions. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring...
Hermes Agent creates response_store.db and webhook_subscriptions.json with world-readable permissions (mode 0o644)
Hermes Agent before 0.16.0 creates responsestore.db and webhooksubscriptions.json with world-readable permissions mode 0o644, exposing conversation history and HMAC secrets to local users. Attackers with local filesystem access can read these files directly to obtain sensitive data including...
EUVD-2026-39088
motionEye mEye is an online interface for motion software, a video surveillance program with motion detection. Versions prior to 0.44.0 create the configuration file /etc/motioneye/motion.conf with 644 permissions -rw-r--r--, making it readable by any local user on the system. This file contains...
@steipete/summarize allows local attackers to read bearer tokens and API credentials stored in ~/.summarize/daemon.json
Summarize versions through 0.14.1, fixed in commit 0cfb0fb, creates the daemon configuration directory and file with default filesystem permissions that may be world-readable on Unix-like systems, allowing local attackers to read bearer tokens and API credentials stored in /.summarize/daemon.json...
EUVD-2005-2962
Malware in sbrugna...
EUVD-2012-5987
Malware in sbrugna...