CVE-2026-123505 Vikunja before 2.7.1 World-Readable Local File Storage and SQLite Database

Vikunja before 2.7.1 contains an insecure file permissions vulnerability that allows local users to read stored data because localStorage.Write creates blobs world-readable. Local attackers on a shared host can read attachments, project backgrounds and exports, and copy the SQLite database to cra...

CVE-2026-123505

Vikunja versions prior to 2.7.1 are vulnerable to an insecure file permissions flaw. The localStorage.Write function creates blobs that are world-readable , allowing local users on shared hosts to access sensitive data. Impacted information includes attachments , project backgrounds , and exports...

socid-extractor

socidextractor Turn any public profile page into a structured account record — usernames, display names, bios, avatars, locations, joined-at dates, follower counts, external links, and the stable internal identifiers that uniquely pin an account across renames, redesigns, and deletions...

qark

Quick Android Review Kit This tool is designed to look for several security related Android application vulnerabilities, either in source code or packaged APKs. The tool is also capable of creating "Proof-of-Concept" deployable APKs and/or ADB commands, capable of exploiting many of the...

krane

Krane Kubernetes RBAC Analysis made Easy Krane is a simple Kubernetes RBAC static analysis tool. It identifies potential security risks in K8s RBAC design and makes suggestions on how to mitigate them. Krane dashboard presents current RBAC security posture and lets you navigate through its...

LDAP-Password-Hunter

LDAP Password Hunter It happens that due to legacy services requirements or just bad security practices password are world-readable in the LDAP database by any user who is able to authenticate. LDAP Password Hunter is a tool which wraps features of getTGT.py Impacket and ldapsearch in order to lo...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Relax-and-Recover vulnerability (USN-8988-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8988-1 advisory. It was discovered that Relax-and-Recover created a world-readable initrd when GRUBRESCUE was enabled. A local attacker could possibly use...

readable-thrift

Readable Thrift Readable Thrift makes binary Thrift protocol messages easy to work with by converting them to and from a human-friendly format. This makes manual analysis of and tampering with binary format Thrift messages just as easy as working with plaintext protocols like HTTP. The library is...

CVE-2020-10977

Python Exploit for gitlab private instance arbitrary file read At the date of 03/23/2020, a vulnerability report with its PoC was released in hackerone by William Bowling With this vulnerability we can read any world readable files with permission 444 or more on the gitlab server like /etc/passwd...

log4shell

log4shell Python Script to scan the server file system for log4j jars that are vulnerable to CVE-2021-44228 and CVE-2021-45046. The script recursively goes through the file system including zip, ear, war to find log4j versions 2. to 2.15 with org/apache/logging/log4j/core/lookup/JndiLookup.class...

EUVD-2026-114215

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.9.2.7 via the process. This makes it possible for unauthenticated attackers to extract sensitive data including the WordPress password hash of any user...

PT-2026-133697

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.9.2.7 via the process. This makes it possible for unauthenticated attackers to extract sensitive data including the WordPress password hash of any user...

CVE-2026-77060

boneIO blackdebianimages stores the Mosquitto MQTT broker password file at /etc/mosquitto/passwd with world-readable permissions. Any local user can read the password hashes for all MQTT accounts and perform offline dictionary attacks. This issue was fixed in version 1.6.0...

CVE-2026-41582

The countly-server component of the Countly product analytics solution is vulnerable to a path traversal vulnerability prior to versions 24.05.50 and 25.03.44 . The root cause is the concatenation of attacker-controlled wildcard paths without containment validation in specific routes located in f...

CVE-2026-41582 countly-server: Unauthenticated Path Traversal via Public Image and Screenshot Routes Leads to Read Internal Files

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, public image and screenshot routes implemented in frontend/express/app.js, plugins/star-rating/frontend/app.js, and plugins/dashboards/frontend/app.js concatenate attacker-controlled...

CVE-2026-41582 countly-server: Unauthenticated Path Traversal via Public Image and Screenshot Routes Leads to Read Internal Files

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, public image and screenshot routes implemented in frontend/express/app.js, plugins/star-rating/frontend/app.js, and plugins/dashboards/frontend/app.js concatenate attacker-controlled...

CVE-2026-102740

The AsyncHttpClient library (versions 2.0.0 to 2.16.1 and 3.0.12) contains a vulnerability in PropertiesBasedResumableProcessor . The component stores resumable download state at the predictable shared path $java.io.tmpdir/ahc/ResumableAsyncHandler.properties with default permissions and follows ...

SUSE CVE-2026-109970

A flaw was found in the clevis PKCS11 pin. The clevis-luks-pkcs11-askpin script writes the PKCS11 token PIN in plaintext to a file without setting restrictive permissions. Under the default process umask, the file is world-readable. Additionally, the PIN file is not reliably cleaned up if the...

CVE-2026-104618

The sdbootutil script creates a debug log at /var/log/sdbootutil.log with world-readable permissions. This misconfiguration allows arbitrary low-privileged users on the system to access and extract sensitive secrets from the log file. No specific remediation or exploit details are provided in the...

CVE-2026-104618 sdbootutil: world-readable debug log

On request the sdbootutil script creates a world-readable debug log in /var/log/sdbootutil.log. The log file is created world-readable, however, which means that arbitrary low-privileged users in the system will be able to extract secrets from it...