Severity High in multi-user environments, low otherwise. Problem Emacs Lisp does not provide any functionality to create a file in a publicly writable directory in a safe way. These names are not very hard to guess. Because it is impossible to create the actual temporary file in a safe manner, the usual symlink attacks are likely successful. In the meantime, until Emacs 21 is released and package maintainers adopt the new function, private directories for temporary files should be used.
Most packages provide variables for that.
Passwords are stored in the key history 3.1. Scope All platforms. Problem Functions like read-passwd do not clear the the history of recently typed keys. In fact, there is no way to do that from Emacs Lisp. Impact Passwords might be recovered by someone who has got access to the console on which Emacs is running, subverting password expiring as, for example, provided by Mailcrypt.