https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 02:59:50 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-97025 <p>Flatpak writes the OCI repository authentication token with world-readable permissions (0644) in the system-helper&#39;s cache directory, allowing other local users on a multi-user system to read the token and impersonate the authenticated user against the OCI repository. Only OCI-based sources (e.g. as used by Fedora) are affected; libostree-based sources such as Flathub are not.</p> <p>Flatpak writes the OCI repository authentication token with world-readable permissions (0644) in the system-helper&#39;s cache directory, allowing other local users on a multi-user system to read the token and impersonate the authenticated user against the OCI repository. Only OCI-based sources (e.g. as used by Fedora) are affected; libostree-based sources such as Flathub are not.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-97025