CVE-2026-59292

CVE-2026-59292...

CVE-2026-53795

A flaw was found in rsync. A remote attacker can exploit this vulnerability by specifying an absolute path using the --temp-dir or --link-dest options. This bypasses the rename-confinement logic, allowing the attacker to write files to arbitrary locations outside the intended destination tree,...

cmd/go: golang: Go 'go bug' command: Arbitrary file overwrite via symlink attack

A flaw was found in the 'go bug' command within the Go programming language tools. This command writes to temporary files with predictable names. A local attacker with access to the system's temporary directory could exploit this by creating a symbolic link symlink with one of these predictable...

EUVD-2026-62942

In versions below 2.5.3 of the Azure AD Graph app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive password by invoking the reset password action, because the action's temppassword parameter is not masked and is shown in cleartext in the user...

Insecure Temporary File

Overview Affected versions of this package are vulnerable to Insecure Temporary File via the predictable cache directory location. An attacker can substitute a malicious ONNX model file by pre-creating the deterministic cache path on a multi-user host. Remediation Upgrade...

Incorrect Default Permissions

Overview Affected versions of this package are vulnerable to Incorrect Default Permissions via the PropertiesPersistingMetadataStore. An attacker can access sensitive metadata, such as processed message keys, offsets, or idempotency markers, by reading the world-readable metadata file created in ...

CVE-2026-76377 Information Disclosure through Action Parameters in Azure AD Graph app for Splunk SOAR

In versions below 2.5.3 of the Azure AD Graph app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive password by invoking the reset password action, because the action's temppassword parameter is not masked and is shown in cleartext in the user...

EUVD-2026-62741

Etherpad is a real-time collaborative editor. Prior to 3.1.0, src/node/handler/ImportHandler.ts and src/node/handler/ExportHandler.ts derive temporary filenames from Math.random and place them in os.tmpdir. On a host with a shared world-writable temporary directory, a local unprivileged attacker...

CVE-2026-55086 Etherpad: Import/export use Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwrite

Etherpad is a real-time collaborative editor. Prior to 3.1.0, src/node/handler/ImportHandler.ts and src/node/handler/ExportHandler.ts derive temporary filenames from Math.random and place them in os.tmpdir. On a host with a shared world-writable temporary directory, a local unprivileged attacker...

CVE-2026-55086 Etherpad: Import/export use Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwrite

Etherpad is a real-time collaborative editor. Prior to 3.1.0, src/node/handler/ImportHandler.ts and src/node/handler/ExportHandler.ts derive temporary filenames from Math.random and place them in os.tmpdir. On a host with a shared world-writable temporary directory, a local unprivileged attacker...

CVE-2026-55086

Etherpad (ep_etherpad-lite) versions prior to 3.1.0 are vulnerable to a symlink-based file overwrite via predictable temporary filenames. The ImportHandler.ts and ExportHandler.ts components derive temp-file paths from Math.random() (~32 bits of entropy), which is predictable within the same Node...

SUSE CVE-2026-53795

rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute path via --temp-dir or --link-dest options. The rename-confinement logic is bypassed when these options resolve to paths outside t...

Incomplete Cleanup

Overview @fastify/multipart is a Multipart plugin for Fastify Affected versions of this package are vulnerable to Incomplete Cleanup due to incomplete temporary-file handling in saveRequestFiles in index.js. An attacker can exhaust disk space by sending a multipart request that completes one file...

Incomplete Cleanup

Overview @fastify/multipart is a Multipart plugin for Fastify Affected versions of this package are vulnerable to Incomplete Cleanup due to the saveRequestFiles multipart upload handling in index.js. An attacker can hang a request and leave temporary files behind by sending a file part that excee...

CVE-2026-19474

The CVE-2026-19474 entry concerns @fastify/multipart, affecting versions 3.0.0 up to but not including 10.1.1. The root cause is that request.saveRequestFiles() can leave completed temporary files on disk when a client disconnects while the parser is advancing between multipart parts; the iterato...

CVE-2026-18549 @fastify/multipart vulnerable to Denial of Service via aborted upload after fileSize limit

@fastify/multipart is a multipart form-data parser for Fastify. In versions from 5.3.0 up to but not including 10.1.1, when the busboy fileSize limit truncates a file part, the plugin clears its internal current-file reference while the underlying stream is still open. If the client then aborts t...

CVE-2026-18549 @fastify/multipart vulnerable to Denial of Service via aborted upload after fileSize limit

@fastify/multipart is a multipart form-data parser for Fastify. In versions from 5.3.0 up to but not including 10.1.1, when the busboy fileSize limit truncates a file part, the plugin clears its internal current-file reference while the underlying stream is still open. If the client then aborts t...

CVE-2026-18549

@fastify/multipart is a multipart form-data parser for Fastify. In versions from 5.3.0 up to but not including 10.1.1, when the busboy fileSize limit truncates a file part, the plugin clears its internal current-file reference while the underlying stream is still open. If the client then aborts t...

CVE-2026-18549 @fastify/multipart vulnerable to Denial of Service via aborted upload after fileSize limit

@fastify/multipart is a multipart form-data parser for Fastify. In versions from 5.3.0 up to but not including 10.1.1, when the busboy fileSize limit truncates a file part, the plugin clears its internal current-file reference while the underlying stream is still open. If the client then aborts t...

PT-2026-73034

@fastify/multipart is a multipart form-data parser for Fastify. In versions from 3.0.0 up to but not including 10.1.1, request.saveRequestFiles can leave completed temporary files on disk when a client disconnects while the parser is advancing between multipart parts. The iterator rejection that...