CVE-2026-46388 | Medium | 4.4 | 2026-07-10 | osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. Prior to 5.23.1, an unprivileged attacker can read the contents… |
CVE-2026-4137 | High | 7.8 | 2026-05-18 | In mlflow/mlflow versions prior to 3.11.0, the `get_or_create_nfs_tmp_dir()` function in `mlflow/utils/file_utils.py` creates temporary directories with world-… |
CVE-2026-33572 | High | 8.4 | 2026-03-29 | OpenClaw before 2026.2.17 creates session transcript JSONL files with overly broad default permissions, allowing local users to read transcript contents. Attac… |
CVE-2026-4822 | High | 7.0 | 2026-03-25 | A vulnerability was detected in Enter Software Iperius Backup up to 8.7.3. Affected is an unknown function of the file C:\ProgramData\IperiusBackup\Jobs\ of th… |
CVE-2026-2817 | Medium | 4.4 | 2026-02-19 | Use of insecure directory in Spring Data Geode snapshot import extracts archives into predictable, permissive directories under the system temp location. On sh… |
CVE-2025-46685 | High | 7.5 | 2026-01-13 | Dell SupportAssist OS Recovery, versions prior to 5.5.15.1, contain a Creation of Temporary File With Insecure Permissions vulnerability. A low privileged atta… |
CVE-2025-46684 | Medium | 6.6 | 2026-01-13 | Dell SupportAssist OS Recovery, versions prior to 5.5.15.1, contain a Creation of Temporary File With Insecure Permissions vulnerability. A low privileged atta… |
CVE-2025-34352 | | | 2025-12-02 | JumpCloud Remote Assist for Windows versions prior to 0.317.0 include an uninstaller that is invoked by the JumpCloud Windows Agent as NT AUTHORITY\SYSTEM duri… |
CVE-2025-7647 | High | 7.3 | 2025-09-27 | The llama-index-core package, up to version 0.12.44, contains a vulnerability in the `get_cache_dir()` function where a predictable, hardcoded directory path `… |
CVE-2025-4953 | High | 7.4 | 2025-09-16 | A flaw was found in Podman. In a Containerfile or Podman, data written to RUN --mount=type=bind mounts during the podman build is not discarded. This issue can… |
CVE-2025-9474 | Medium | 4.5 | 2025-08-26 | A vulnerability was detected in Mihomo Party up to 1.8.1 on macOS. Affected is the function enableSysProxy of the file src/main/sys/sysproxy.ts of the componen… |
CVE-2025-55629 | Medium | 6.5 | 2025-08-22 | Insecure permissions in Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283 allow attackers to arbitrarily change other… |
CVE-2025-38747 | High | 7.8 | 2025-08-06 | Dell SupportAssist OS Recovery, versions prior to 5.5.14.0, contain a Creation of Temporary File With Insecure Permissions vulnerability. A local authenticated… |
CVE-2025-32979 | Medium | 6.5 | 2025-04-25 | NETSCOUT nGeniusONE before 6.4.0 b2350 allows Arbitrary File Creation by authenticated users. |
CVE-2025-32438 | High | 8.8 | 2025-04-15 | make-initrd-ng is a tool for copying binaries and their dependencies. Local privilege escalation affecting all NixOS users. With systemd.shutdownRamfs.enable e… |
CVE-2025-27148 | High | 8.8 | 2025-02-25 | Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. On Unix-like systems, the system temporary directory ca… |
CVE-2024-52543 | Medium | 6.5 | 2024-12-25 | Dell NativeEdge, version(s) 2.1.0.0, contain(s) a Creation of Temporary File With Insecure Permissions vulnerability. A high privileged attacker with local acc… |
CVE-2024-47884 | | | 2024-10-11 | foxmarks is a CLI read-only interface for Firefox's bookmarks and history. A temporary file was created under the /tmp directory with read permissions for all… |
CVE-2024-23454 | Medium | 6.2 | 2024-09-25 | Apache Hadoop’s RunJar.run() does not set permissions for temporary directory by default. If sensitive data will be present in this file, all the other local u… |
CVE-2024-7358 | High | 7.8 | 2024-08-01 | A vulnerability was found in Point B Ltd Getscreen Agent 2.19.6 on Windows. It has been declared as critical. Affected by this vulnerability is an unknown func… |
CVE-2024-42052 | High | 7.8 | 2024-07-28 | The MSI installer for Splashtop Streamer for Windows before 3.5.8.0 uses a temporary folder with weak permissions during installation. A local user can exploit… |
CVE-2024-39872 | Critical | 9.6 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application does not properly assign rights to temp… |
CVE-2023-26603 | Medium | 5.9 | 2024-04-26 | JumpCloud Agent before 1.178.0 Creates a Temporary File in a Directory with Insecure Permissions. This allows privilege escalation to SYSTEM via a repair actio… |
CVE-2023-28600 | Medium | 5.2 | 2023-06-13 | Zoom for MacOSclients prior to 5.14.0 contain an improper access control vulnerability. A malicious user may be able to delete/replace Zoom Client files poten… |
CVE-2023-27408 | Low | 3.3 | 2023-05-09 | A vulnerability has been identified in SCALANCE LPE9403 (All versions < V2.1). The `i2c` mutex file is created with the permissions bits of `-rw-rw-rw-`. This… |
CVE-2023-0481 | Low | 3.3 | 2023-02-24 | In RestEasy Reactive implementation of Quarkus the insecure File.createTempFile() is used in the FileBodyHandler class which creates temp files with insecure p… |
CVE-2023-0482 | Medium | 5.5 | 2023-02-17 | In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with insec… |
CVE-2022-24823 | Medium | 5.5 | 2022-05-06 | Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4.1.77.Final contain… |
CVE-2022-24411 | High | 7.8 | 2022-04-12 | Dell PowerScale OneFS 8.2.2 and above contain an elevation of privilege vulnerability. A local attacker with ISI_PRIV_LOGIN_SSH and/or ISI_PRIV_LOGIN_CONSOLE c… |
CVE-2021-25654 | Medium | 6.2 | 2021-06-25 | An arbitrary code execution vulnerability was discovered in Avaya Aura Device Services that may potentially allow a local user to execute specially crafted scr… |
CVE-2021-1496 | High | 7.0 | 2021-05-06 | Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated… |
CVE-2021-1430 | High | 7.0 | 2021-05-06 | Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated… |
CVE-2021-1429 | High | 7.0 | 2021-05-06 | Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated… |
CVE-2021-1428 | High | 7.0 | 2021-05-06 | Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated… |
CVE-2021-1427 | High | 7.0 | 2021-05-06 | Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated… |
CVE-2021-1426 | High | 7.0 | 2021-05-06 | Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated… |
CVE-2021-28168 | Medium | 6.2 | 2021-04-22 | Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability. This is due to the use of the File.createT… |
CVE-2021-25314 | High | 7.8 | 2021-04-14 | A Creation of Temporary File With Insecure Permissions vulnerability in hawk2 of SUSE Linux Enterprise High Availability 12-SP3, SUSE Linux Enterprise High Ava… |
CVE-2021-29428 | High | 8.8 | 2021-04-13 | In Gradle before version 7.0, on Unix-like systems, the system temporary directory can be created with open permissions that allow multiple users to create and… |
CVE-2021-21364 | Medium | 5.3 | 2021-03-11 | swagger-codegen is an open-source project which contains a template-driven engine to generate documentation, API clients and server stubs in different language… |
CVE-2021-21363 | Medium | 5.3 | 2021-03-11 | swagger-codegen is an open-source project which contains a template-driven engine to generate documentation, API clients and server stubs in different language… |
CVE-2021-21331 | Low | 3.0 | 2021-03-03 | The Java client for the Datadog API before version 1.0.0-beta.9 has a local information disclosure of sensitive information downloaded via the API using the AP… |
CVE-2021-21290 | Medium | 6.2 | 2021-02-08 | Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clie… |
CVE-2020-8908 | Low | 3.3 | 2020-12-10 | A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a tempor… |
CVE-2020-27216 | High | 7.0 | 2020-10-23 | In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's… |
CVE-2016-9485 | High | 7.8 | 2018-07-13 | On Windows endpoints, the SecureConnector agent must run under the local SYSTEM account or another administrator account in order to enable full functionality… |