CWE-732 Incorrect Permission Assignment for Critical Resource

Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions

Nx daemon and plugin worker sockets are accessible to other local users

Grafana legacy correlations allow cross-tenant disclosure and deletion

Composer: GHSA-gjfg-22fp-rrxx fix bypass via symlinked package bin path

vm2 NodeVM can replace the host process TLS trust store

Duplicate Advisory: vm2 NodeVM can replace the host process TLS trust store

adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation

Language Servers for AWS Vulnerable to Arbitrary Code Execution

MCP Atlassian: Insecure File Permissions on OAuth Token Storage

@Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft

SurrealDB has Silent Failure to Overwrite Table Definition of Relation Type

vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f)

rclone local `--metadata` applies attacker-controlled mode/uid - setuid binary planted from an untrusted remote

Fission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAP_SYS_TIME and cross-tenant node wall-clock corruption

Kata Container to Guest micro VM privilege escalation

AWS CLI: Overly permissive File Permissions

Gitea: Permanent Fork PR Workflow Approval Gate Bypass

Gitea: draft release attachment disclosure via missing web authorization

Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files

Pi Agent: Race condition in Pi auth.json writes could expose stored credentials

garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store

mknod: Device nodes created mislabeled on SELinux, with broken cleanup (remove_dir on a node)

mkfifo: permissions of an existing file are changed after FIFO creation fails

Duplicate Advisory: uutils coreutils allows unauthorized modification of permissions on existing files

Decompress: Archive extraction can create files and links outside of the target directory