CVE-2026-69110

OpenCode Studio before 2.4.4 contains a missing authentication vulnerability that allows unauthenticated remote attackers to read arbitrary files within the temp and static/music directories by directly accessing the GET /api/tmp/:tmpFile and GET /api/music/:fileName endpoints. Attackers can...

CVE-2026-69110

OpenCode Studio prior to version 2.4.4 is affected by an unauthenticated file-read vulnerability exposed via GET /api/tmp/:tmpFile and GET /api/music/:fileName, permitting reading of arbitrary files from temp and static/music directories and exposing intermediate artifacts (audio/video) and subti...

CVE-2026-69110 OpenCode Studio < 2.4.4 Unauthenticated File Read via /api/tmp and /api/music

OpenCode Studio before 2.4.4 contains a missing authentication vulnerability that allows unauthenticated remote attackers to read arbitrary files within the temp and static/music directories by directly accessing the GET /api/tmp/:tmpFile and GET /api/music/:fileName endpoints. Attackers can...

CVE-2026-69110

OpenCode Studio before 2.4.4 contains a missing authentication vulnerability that allows unauthenticated remote attackers to read arbitrary files within the temp and static/music directories by directly accessing the GET /api/tmp/:tmpFile and GET /api/music/:fileName endpoints. Attackers can...

EUVD-2026-52743

OpenCode Studio before 2.4.4 contains a missing authentication vulnerability that allows unauthenticated remote attackers to read arbitrary files within the temp and static/music directories by directly accessing the GET /api/tmp/:tmpFile and GET /api/music/:fileName endpoints. Attackers can...

CVE-2026-69110 OpenCode Studio < 2.4.4 Unauthenticated File Read via /api/tmp and /api/music

OpenCode Studio before 2.4.4 contains a missing authentication vulnerability that allows unauthenticated remote attackers to read arbitrary files within the temp and static/music directories by directly accessing the GET /api/tmp/:tmpFile and GET /api/music/:fileName endpoints. Attackers can...

CVE-2026-69110 OpenCode Studio < 2.4.4 Unauthenticated File Read via /api/tmp and /api/music

OpenCode Studio before 2.4.4 contains a missing authentication vulnerability that allows unauthenticated remote attackers to read arbitrary files within the temp and static/music directories by directly accessing the GET /api/tmp/:tmpFile and GET /api/music/:fileName endpoints. Attackers can...

CLSA-2026-1785117460 TuxCare security update for tmp (1 CVE)

TuxCare rebuilt tmp to address 1 CVE. Fixed in 0.0.24-tuxcare.3...

CLSA-2026-1785204339 TuxCare security update for tmp (1 CVE)

TuxCare rebuilt tmp to address 1 CVE. Fixed in 0.2.3-tuxcare.2...

CLSA-2026-1785204337 TuxCare security update for tmp (1 CVE)

TuxCare rebuilt tmp to address 1 CVE. Fixed in 0.0.31-tuxcare.2...

CLSA-2026-1785204340 TuxCare security update for tmp (1 CVE)

TuxCare rebuilt tmp to address 1 CVE. Fixed in 0.1.0-tuxcare.3...

CLSA-2026-1784682766 TuxCare security update for tmp (1 CVE)

TuxCare rebuilt tmp to address 1 CVE. Fixed in 0.0.31-tuxcare.1...

CLSA-2026-1782694760 TuxCare security update for tmp (1 CVE)

TuxCare rebuilt tmp to address 1 CVE. Fixed in 0.2.3-tuxcare.1...

CLSA-2026-1776818190 TuxCare security update for tmp (1 CVE)

TuxCare rebuilt tmp to address 1 CVE. Fixed in 0.0.24-tuxcare.1...

CLSA-2026-1775003185 TuxCare security update for tmp (1 CVE)

TuxCare rebuilt tmp to address 1 CVE. Fixed in 0.0.33-tuxcare.1...

CLSA-2026-1775003179 TuxCare security update for tmp (1 CVE)

TuxCare rebuilt tmp to address 1 CVE. Fixed in 0.2.1-tuxcare.1...

CVE-2026-16791: Insecure Temporary File

A temporary file creation vulnerability in the Linux version of Lenovo XClarity Essentials OneCLI 5.5.0 and below could allow a local low-privileged attacker to overwrite or truncate arbitrary local files with program-generated data when OneCLI is executed with elevated privileges...

ROS-20260804-73-0004

The vulnerability of the Linux operating system’s kernel is related to incomplete cleanup of temporary or auxiliary resources. Exploiting this vulnerability allows an attacker to cause service failures...

cmd/go: golang: Go 'go bug' command: Arbitrary file overwrite via symlink attack

A flaw was found in the 'go bug' command within the Go programming language tools. This command writes to temporary files with predictable names. A local attacker with access to the system's temporary directory could exploit this by creating a symbolic link symlink with one of these predictable...

CVE-2026-69094

Admidio before 5.0.11 contains an insecure direct object reference vulnerability in the savetemporary mode of mylistfunction.php that allows authenticated users to hijack list configurations. Attackers can enumerate global list UUIDs and overwrite admin-curated global lists or other users' privat...