107,130 results · Clear filters · Feed
-
Medium 5.5CVE-2026-86962 Public exploit
A double free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS…
-
Medium 4.3
An input validation issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7…
-
Medium 6.5
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS…
-
Medium 5.5
An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27. An ap…
-
Medium 4.6
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, …
-
Medium 5.5
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26…
-
Medium 5.5
This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Golden Gate 27. An app may be ab…
-
Medium 5.5
This issue was addressed by removing additional entitlements. This issue is fixed in macOS Golden Gate 27. An app may b…
-
Medium 5.5
An authorization issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. An ap…
-
Medium 5.5
A path handling issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27. An app may b…
-
Medium 4.3
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, …
-
Medium 6.2
A permissions issue was addressed with improved validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and…
-
Medium 4.7
A race condition was addressed with improved locking. This issue is fixed in macOS Golden Gate 27. An app may be able t…
-
Medium 5.4
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, …
-
Medium 5.5
An information disclosure issue was addressed with improved state management. This issue is fixed in macOS Golden Gate …
-
Medium 4.4
An authorization issue was addressed with improved entitlement checks. This issue is fixed in macOS Sequoia 15.8, macOS…
-
Medium 5.4
A logic issue was addressed with improved state management. This issue is fixed in Safari 27, visionOS 27, watchOS 27. …
-
Medium 4.3
An input validation issue was addressed with improved input validation. This issue is fixed in Xcode 27. Parsing a mali…
-
Medium 5.9
An integer underflow was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS S…
-
Medium 6.5
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26…
-
Medium 5.5
A privacy issue was addressed with improved access restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Gol…
-
Medium 5.5
This issue was addressed with improved validation of the caller's access. This issue is fixed in iOS 27 and iPadOS 27, …
-
Medium 5.5
A buffer overflow was addressed with improved size validation. This issue is fixed in macOS Golden Gate 27, macOS Sequo…
-
Medium 5.5
The issue was addressed with improved handling of secure input state. This issue is fixed in macOS Golden Gate 27, macO…
-
Medium 4.7
A race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 1…
-
Medium 5.5
An access issue was addressed with improved access controls. This issue is fixed in macOS Golden Gate 27, macOS Sequoia…
-
Medium 5.5
An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.8, visionO…
-
Medium 6.3
Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypass
Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority pseudo-header. Request filters, cache keys, and logs that read the request URI (session.req_header().uri) saw the :authority value, but the upstream …
-
Medium 6.5
Letta through 0.16.8 Credential Exposure via Tool Sandbox Environment Inheritance
Letta through 0.16.8 contains an information disclosure vulnerability that allows users running tools to read server secrets because LocalSandbox subprocesses inherit the full server environment. Attackers can run code via POST /v1/tools/run or custom tools t…
-
Medium 5.8
LangAlpha through 2026.09.07 Cross-Tenant Sandbox Exposure via Shared Docker Bridge
LangAlpha through 2026.09.07 contains an improper isolation vulnerability that places all tenants' sandbox containers on Docker's shared default bridge network with inter-container communication enabled. Authenticated users with code execution in their own sa…
-
Medium 5.5
A Floating-Point Exception (FPE) in the reframer_send_packet function (/filters/reframer.c) of GPAC Project/MP4Box befo…
-
Medium 5.5
A buffer overflow in the gf_ac4_parser_bs function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 2.5 allows…
-
Medium 5.5
A segmentation violation in the gf_props_equal_internal function (/filter_core/filter_props.c) of GPAC Project/MP4Box b…
-
Medium 5.4
IBM ContextForge MCP Gateway is affected by server-side request forgery
IBM ContextForge MCP Gateway 0.1.0 through 1.0.5 is vulnerable to a server-side request Forgery (SSRF) that allows authenticated users with gateway creation privileges to perform arbitrary HTTP POST requests to internal network resources and cloud metadata en…
-
Medium 6.5
H3C Magic NX15 usrlist sub_416874 stack-based overflow
A security vulnerability has been detected in H3C Magic NX15 NX15V100R017. This impacts the function sub_416874 of the file /usr/bin/usrlist. Such manipulation leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has…
-
Medium 6.5
TS4500 Tape Library Denial of Service
IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 IBM Diamondback Tape Library and IBM Storage TS4500 Library could allow an authenticated user to cause a denial of service using specially crafted SMTP requests that would consume excessive amounts of system…
-
Medium 5.5
TS4500 Tape Library Insufficient Session Expiration
IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 does not invalidate session after a logout which could allow an authenticated user to impersonate another user on the system.
-
Medium 6.3
TS4500 Tape Library Insufficient Session Expiration
IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 IBM TS4500 Tape Library/Diamondback Tape Library does not invalidate session which could allow an authenticated user to impersonate another user on the system.
-
Medium 6.8
TS4500 Tape Library Race Condition
IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 could allow a remote authenticated attacker to gain unauthorized administrative privileges due to a race condition.
-
Medium 5.7
Bluetooth Classic HFP Hands-Free: TX buffer leak on RFCOMM disconnect leads to permanent Bluetooth denial of service
The Bluetooth Classic Hands-Free Profile HF role in subsys/bluetooth/host/classic/hfp_hf.c does not release the AT command buffers that are still queued on hf->tx_pending when the RFCOMM DLC goes down. hfp_hf_disconnected() only cancelled the work items and c…