CVE Database

CVE-2026-25701 High · 7.0 CWE-377 Feb 25, 2026

An Insecure Temporary File vulnerability in openSUSE sdbootutil allows local users to…

An Insecure Temporary File vulnerability in openSUSE sdbootutil allows local users to pre-create a directory to achieve various effects like: * gain access to possible private information found in /var/lib/pcrlock.d * manipulate the data backed up in /tmp/pcrlock.d.bak, therefore violating the integrity of the data should it be restored. * overwrite protected system files with data from /var/lib/pcrlock.d by placing symlinks to existing files in the directory tree in /tmp/pcrlock.d.bak. This issue affects sdbootutil: from ? before 5880246d3a02642dc68f5c8cb474bf63cdb56bca.

CVE-2026-20649 High · 7.5 CWE-377 Feb 11, 2026

A logging issue was addressed with improved data redaction. This issue is fixed in iOS…

A logging issue was addressed with improved data redaction. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, watchOS 26.3. A user may be able to view sensitive user information.

CVE-2026-20618 Medium · 5.5 CWE-377 Feb 11, 2026

An issue was addressed with improved handling of temporary files. This issue is fixed in…

An issue was addressed with improved handling of temporary files. This issue is fixed in macOS Tahoe 26.3. An app may be able to access user-sensitive data.

CVE-2025-14614 Medium · 6.7 CWE-377 Jan 7, 2026

Quartus® Prime Standard and Quartus® Prime Lite Security Advisory

Insecure Temporary File vulnerability in Altera Quartus Prime Standard Installer (SFX) on Windows, Altera Quartus Prime Lite Installer (SFX) on Windows allows Explore for Predictable Temporary File Names.This issue affects Quartus Prime Standard: from 23.1 through 24.1; Quartus Prime Lite: from 23.1 through 24.1.

CVE-2025-14612 Medium · 6.7 CWE-377 Jan 6, 2026

Quartus Prime Pro Edition Advisory

Insecure Temporary File vulnerability in Altera Quartus Prime Pro Installer (SFX) on Windows allows : Use of Predictable File Names.This issue affects Quartus Prime Pro: from 24.1 through 25.1.1.

CVE-2025-14307 High · 8.1 CWE-377 Dec 9, 2025

Insecure Temporary File Creation in Robocode's AutoExtract Component

An insecure temporary file creation vulnerability exists in the AutoExtract component of Robocode version 1.9.3.6. The createTempFile method fails to securely create temporary files, allowing attackers to exploit race conditions and potentially execute arbitrary code or overwrite critical files. This vulnerability can be exploited by manipulating the temporary file creation process, leading to potential unauthorized actions.

CVE-2025-46369 High · 7.8 CWE-377 Nov 13, 2025

Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contains an Insecure...

Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contains an Insecure Temporary File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Privilege Escalation.

CVE-2025-46368 Medium · 5.5 CWE-377 Nov 13, 2025

Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contains an Insecure...

Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contains an Insecure Temporary File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering.

CVE-2025-7707 High · 7.8 CWE-377 Oct 13, 2025

World-Writable NLTK Cache Directory Vulnerability in run-llama/llama_index

The llama_index library version 0.12.33 sets the NLTK data directory to a subdirectory of the codebase by default, which is world-writable in multi-user environments. This configuration allows local users to overwrite, delete, or corrupt NLTK data files, leading to potential denial of service, data tampering, or privilege escalation. The vulnerability arises from the use of a shared cache directory instead of a user-specific one, making it susceptible to local data tampering and denial of service.

CVE-2025-61659 Medium · 6.8 CWE-377 Sep 29, 2025

bash-git-prompt 2.6.1 through 2.7.1 insecurely uses the /tmp/git-index-private$$ file…

bash-git-prompt 2.6.1 through 2.7.1 insecurely uses the /tmp/git-index-private$$ file, which has a predictable name.

CVE-2021-29429 Medium · 5.5 CWE-377 Apr 12, 2021

Information disclosure through temporary directory permissions

In Gradle before version 7.0, files created with open permissions in the system temporary directory can allow an attacker to access information downloaded by Gradle. Some builds could be vulnerable to a local information disclosure. Remote files accessed through TextResourceFactory are downloaded into the system temporary directory first. Sensitive information contained in these files can be exposed to other local users on the same system. If you do not use the `TextResourceFactory` API, you are not vulnerable. As of Gradle 7.0, uses of the system temporary directory have been moved to the Gradle User Home directory. By default, this directory is restricted to the user running the build. As a workaround, set a more restrictive umask that removes read access to other users. When files are created in the system temporary directory, they will not be accessible to other users. If you are unable to change your system's umask, you can move the Java temporary directory by setting the System Property `java.io.tmpdir`. The new path needs to limit permissions to the build user only.