EUVD-2026-74192

Waves Central for macOS contains a local privilege escalation in the privileged helper service. The helper authorizes connecting XPC clients by comparing the caller's code-signing certificate chain for equality with its own, rather than validating the caller against a pinned code requirement...

Waves Central local privilege escalation via Improper XPC Client Authentication in macOS

RISK EVALUATION Waves Central for macOS contains a local privilege escalation in the privileged helper service. The helper authorizes connecting XPC clients by comparing the caller's code-signing certificate chain for equality with its own, rather than validating the caller against a pinned code...

PT-2026-88458

Name of the Vulnerable Software and Affected Versions Waves Central for macOS versions prior to 17.0 Description A local privilege escalation exists in the privileged helper service. The helper authorizes connecting XPC clients by comparing the caller's code-signing certificate chain for equality...

CVE-2026-86819: Missing Authorization

Waves Central for macOS contains a local privilege escalation in the privileged helper service. The helper authorizes connecting XPC clients by comparing the caller's code-signing certificate chain for equality with its own, rather than validating the caller against a pinned code requirement...

openjdk: Enhance Jar handling (Oracle CPU 2026-07)

A flaw was found in OpenJDK. There exists a potential existential forgery vulnerability in CMS and protocols which use CMS. In Java, CMS is used to sign JAR files...

openjdk: Enhance Jar handling (Oracle CPU 2026-07)

A flaw was found in OpenJDK. There exists a potential existential forgery vulnerability in CMS and protocols which use CMS. In Java, CMS is used to sign JAR files...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition via the parent process code-sign verification on macOS. An attacker can...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview org.webjars.npm:electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition via the parent process code-sign verification on macOS. An...

CVE-2026-70597

Electron on macOS had a bug where the code-sign check that verifies a launched app’s parent process could be bypassed by a local attacker. This affects Electron versions prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3. By exploiting this, a local attacker could bypass the fuse-based hardening ...

CVE-2026-70597 Electron: Parent process code-sign check is spoofable

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the check Electron uses on macOS to confirm it was launched by a same-signed parent process could be bypassed by a local process. Apps that...

CVE-2026-70597 Electron: Parent process code-sign check is spoofable

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the check Electron uses on macOS to confirm it was launched by a same-signed parent process could be bypassed by a local process. Apps that...

CVE-2026-43813

A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. A maliciously crafted app may be able to bypass code signing enforcement...

CVE-2026-43813

A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. A maliciously crafted app may be able to bypass code signing enforcement...

EUVD-2026-49457

A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. A maliciously crafted app may be able to bypass code signing enforcement...

CVE-2026-43813

A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. A maliciously crafted app may be able to bypass code signing enforcement...

CVE-2026-43813

A validation issue in the CloudAttestation security mechanism (specifically in CloudAttestation.dylib) allows a maliciously crafted app to bypass code signing enforcement . The root cause is that the PCC.ComputeNodeValidator.policy.getter reads the com.apple.CloudAttestation.environment byte from...

CVE-2026-43813: Improper Input Validation

A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. A maliciously crafted app may be able to bypass code signing enforcement...

PT-2026-65204

Name of the Vulnerable Software and Affected Versions iOS versions prior to 26.6 iPadOS versions prior to 26.6 macOS Tahoe versions prior to 26.6 tvOS versions prior to 26.6 visionOS versions prior to 26.6 watchOS versions prior to 26.6 Description A validation issue exists due to insufficient...

Remote Code Execution

PraisonAI is vulnerable to Remote Code Execution RCE. The vulnerability is due to loading and executing plugin files without code signing, integrity verification, or sandboxing, allowing attackers to place malicious Python plugins in trusted plugin directories and execute arbitrary code when the...

CVE-2026-47122

Sparkle is a software update framework for macOS. In versions up to and including 2.9.1, Autoupdate/AppInstaller.m's shouldAcceptNewConnection: only enforces SUCodeSigningVerifier validateConnection: before stage 1 completes. After performedStage1Installation = YES, new connections to the...