42800 matches found
DEBIAN-CVE-2026-115392
Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 allows a filesystem sandbox escape in wasmtime-wasi because its cap-std dependency mishandles symlinks with trailing slashes on macOS and Linux kernels lacking openat2. A guest with write access to any...
CVE-2026-115392 Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 Sandbox Escape via Trailing Slashes
Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 allows a filesystem sandbox escape in wasmtime-wasi because its cap-std dependency mishandles symlinks with trailing slashes on macOS and Linux kernels lacking openat2. A guest with write access to any...
CVE-2026-115392
Versions of Wasmtime prior to 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 are vulnerable to a filesystem sandbox escape in wasmtime-wasi . The root cause is that the cap-std dependency mishandles symlinks containing trailing slashes on macOS and Linux kernels la...
EUVD-2026-108326
Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 allows a filesystem sandbox escape in wasmtime-wasi because its cap-std dependency mishandles symlinks with trailing slashes on macOS and Linux kernels lacking openat2. A guest with write access to any...
python-patrol
Python Patrol Scan for python installations on macOS, and run CVE-2015-20107.py script to report if patching is needed Several of these scripts need Full Disk Access permissions and must be run as root so it can scan the entire macOS filesystem except the areas restricted by macOS Make sure to ru...
CVE-2026-77156
Incomplete validation of extracted archive entry paths in ast-cli's tar extraction logic on Linux and macOS used when installing the Vorpal ASCA real-time engine and the SCA Resolver would allow a malicious tar archive containing absolute or traversal path entries to write files outside the insta...
CVE-2026-77156 ast-cli: Path traversal in tar extraction on Linux/macOS allows writes outside the install directory
Incomplete validation of extracted archive entry paths in ast-cli's tar extraction logic on Linux and macOS used when installing the Vorpal ASCA real-time engine and the SCA Resolver would allow a malicious tar archive containing absolute or traversal path entries to write files outside the insta...
CVE-2026-77156 ast-cli: Path traversal in tar extraction on Linux/macOS allows writes outside the install directory
Incomplete validation of extracted archive entry paths in ast-cli's tar extraction logic on Linux and macOS used when installing the Vorpal ASCA real-time engine and the SCA Resolver would allow a malicious tar archive containing absolute or traversal path entries to write files outside the insta...
CVE-2026-77156
The ast-cli tool is vulnerable to a path traversal flaw during tar extraction on Linux and macOS platforms. The root cause is incomplete validation of extracted archive entry paths, which can be exploited by a malicious archive containing absolute or traversal path entries to write files outside ...
EUVD-2026-108269
Incomplete validation of extracted archive entry paths in ast-cli's tar extraction logic on Linux and macOS used when installing the Vorpal ASCA real-time engine and the SCA Resolver would allow a malicious tar archive containing absolute or traversal path entries to write files outside the insta...
EUVD-2026-107392
Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry...
npm: Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry
npm: Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry vulnerability discovered by ? in WordPress npm electron versions 42.11.6...
CVE-2026-16477
CleanShot X for macOS insecurely deserializes untrusted data embedded in a .cleanshot project file editable screenshot annotations. Exploitation requires an attacker to craft a malicious .cleanshot file, deliver it to the target, and have the target open it; the payload then executes automaticall...
CVE-2026-16477 Insecure Deserialization of .cleanshot Files in CleanShot X
CleanShot X for macOS insecurely deserializes untrusted data embedded in a .cleanshot project file editable screenshot annotations. Exploitation requires an attacker to craft a malicious .cleanshot file, deliver it to the target, and have the target open it; the payload then executes automaticall...
CVE-2026-16477
The software CleanShot X for macOS is vulnerable to an insecure deserialization flaw when processing .cleanshot project files (used for editable screenshot annotations). An attacker can craft a malicious file that, when opened by a target user, triggers automatic execution of a payload during the...
EUVD-2026-108208
CleanShot X for macOS insecurely deserializes untrusted data embedded in a .cleanshot project file editable screenshot annotations. Exploitation requires an attacker to craft a malicious .cleanshot file, deliver it to the target, and have the target open it; the payload then executes automaticall...
CVE-2025-65741
CVE-2025-65741 - Sublime Text 3 vulnerable to Dylib Injection for macOS Download: https://www.sublimetext.com/3 CVE: CVE-2025-65741 | https://nvd.nist.gov/vuln/detail/CVE-2025-65741 Author: Vinicius Batistella Version Affected: Sublime Text 3 Build 3208 or prior for macOS Details The Sublime Text...
CVE-2025-61229
CVE-2025-61229 Description From the developer's blog: User-settable Before/After shell scripts run escalated, with SuperDuper's TCC Full Disk Access permissions. Since those shell scripts are referenced by the settings files for the copy or schedule, a malicious actor could modify those settings ...
CVE-2026-6666-XPC-Service-NSKeyedUnarchiver-Deserialization-Attack-macOS-iOS-simulation-
CVE-2026-6666 – XPC Service NSKeyedUnarchiver Deserialization Attack macOS/iOS simulation Program Code Python simulation !/usr/bin/env python3 vulnerablexpcservice.py - Simulated XPC service using unsafe plist deserialization import plistlib, subprocess, socketserver, struct Mach message...
