Tagged “cve.org”
CVEs tagged cve.org, newest first.
49988 CVEsRSS
CVE-2026-86933Low· 3.3A permissions issue was addressed with additional sandbox restrictions
A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Golden Gate 27. An app may be able to access information about a user's contacts.
CVE-2026-86949High· 8.8This issue was addressed by enforcing library validation on the affected binaries
This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. A malicious app may be able to break out of its sandbox.
CVE-2026-86948High· 7.8This issue was addressed by enforcing library validation on the affected binaries
This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. An app may be able to break out of its sandbox.
CVE-2026-86944Medium· 5.5An out-of-bounds write issue was addressed with improved bounds checking
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause unexpected system termination.
CVE-2026-86959Medium· 4.3An input validation issue was addressed with improved input validation
An input validation issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Processing a maliciously crafted i…
CVE-2026-86957Medium· 6.5An out-of-bounds read was addressed with improved bounds checking
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An at…
CVE-2026-86962Medium· 5.5PoCA double free issue was addressed with improved memory management
A double free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An ap…
CVE-2026-86955Medium· 5.5An authorization issue was addressed with improved state management
An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27. An app may be able to access sensitive user data.
CVE-2026-86953Medium· 4.6An out-of-bounds write issue was addressed with improved bounds checking
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. An attacker in physical proximity may be able to cause a denia…
CVE-2026-86979Medium· 5.5A privacy issue was addressed with improved checks
A privacy issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27. An app may be able to access sensitive user data.
CVE-2026-86977High· 7.5An authorization issue was addressed with improved network restrictions
An authorization issue was addressed with improved network restrictions. This issue is fixed in iOS 27 and iPadOS 27. An app may be able to initiate calls or send messages.
CVE-2026-86981Medium· 5.5An out-of-bounds write issue was addressed with improved bounds checking
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause unexpected system termination.
CVE-2026-86975Medium· 4.3An out-of-bounds read was addressed with improved bounds checking
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted image may lead to unexpected process…
CVE-2026-86963Medium· 5.9A denial-of-service issue was addressed with improved input validation
A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27. An attacker in a privileged network position may be able to cause a denial-of-service.
CVE-2026-86976Medium· 5.5An authorization issue was addressed with improved state management
An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. An app may be able to access sensitive user data.
CVE-2026-86961High· 7.8A race condition was addressed with additional validation
A race condition was addressed with additional validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. A malicious app may be able to break out of its sandbox.
CVE-2026-105299High· 8.7Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deployments
Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deployments
CVE-2026-112895High· 7.5Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)
Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)
CVE-2026-112897High· 7.5PoCPillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips
Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips
CVE-2026-112896High· 7.1PoCPillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read
Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read
CVE-2026-112400High· 7.5PoCPillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS
Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS
CVE-2026-112403Critical· 9.8PoCPillow: Heap buffer overflow in ImagingJpegDecode
Pillow: Heap buffer overflow in ImagingJpegDecode
CVE-2026-112397High· 7.5PoCPillow: Out-of-bounds access in _imagingmorph on a zero-width image
Pillow: Out-of-bounds access in _imagingmorph on a zero-width image
CVE-2026-111759High· 7.5PoCmarkdown-it: Quadratic complexity in smartquotes with unmatched closing quotes
markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes
CVE-2026-111065Medium· 6.9AIOHTTP: Connector pool exhaustion via Max-Age overflow
AIOHTTP: Connector pool exhaustion via Max-Age overflow
CVE-2026-111748Medium· 6.3AIOHTTP: Absolute-form request targets can spoof Request.scheme
AIOHTTP: Absolute-form request targets can spoof Request.scheme
CVE-2026-123817High· 8.7aiohttp: Multiple instances of excessive or unbounded memory/CPU use
aiohttp: Multiple instances of excessive or unbounded memory/CPU use
CVE-2026-121417High· 7.8PoCUse-after-free in KV backends via leaked `affinitypool::spawn_local` future
Use-after-free in KV backends via leaked `affinitypool::spawn_local` future
CVE-2026-8355Medium· 5.4IBM ContextForge MCP Gateway is affected by server-side request forgery
IBM ContextForge MCP Gateway 0.1.0 through 1.0.5 is vulnerable to a server-side request Forgery (SSRF) that allows authenticated users with gateway creation privileges to perform arbitrary HTTP POST requests to internal network resources…
CVE-2026-109126High· 8.8IBM Verify Identity Access and IBM Security Verify Access Hard-coded Credentials
IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 Appliance could allow a physically proximate attacker to gain elevated privileges due to the use of hard-coded credentials.