Threats Tagged 'cwe-377'

CVE-2026-16791 is a low-severity vulnerability in Lenovo XClarity Essentials OneCLI for Linux versions 5.5.0 and below. It involves insecure temporary file creation that could allow a local low-privileged attacker to overwrite or truncate arbitrary local files when the program is run with elevated privileges. The vulnerability does not impact confidentiality but can affect integrity and availability. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

Flameshot is powerful yet simple to use screenshot software. Prior to 14.0.0, the Open With feature wrote screenshots to a predictable temporary path and followed symlinks, creating a time-of-check to time-of-use race that allowed a local unprivileged attacker on the same machine to pre-plant a symlink and cause Flameshot to write PNG data through it, overwriting any file the victim user could write. This issue is fixed in version 14.0.0.