CVE-2026-65380

CVE-2026-65380 is a vulnerability in Apple macOS related to improper handling of snapshots , where insufficient permissions logic could allow an app to access protected user data . The issue is fixed in macOS Golden Gate 27 ; the connected NCSC advisory also lists Sequoia 15.8 and Tahoe 26.7 amon...

ROS-20260810-73-0011

The vulnerability of the Networking component of the Oracle Java SE software platform, as well as of the Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines, is related to insufficient protection of operational data. Exploiting this vulnerability can allow an attacker to...

The vulnerabilities of the functions ksmbd_tree_conn_connect(), ksmbd_tree_connect PUT(), and ksmbd_tree_conn_disconnect() in the module fs/smb/server/mgmt/tree_connect.c, as well as the function smb2_tree_disconnect() in the module fs/smb/server/smb2pdu.c, allow attackers to compromise the confidentiality, integrity, and accessibility of protected information within the SMB server framework of the Linux operating system.

The vulnerabilities of the functions ksmbdtreeconnconnect, ksmbdtreeconnect PUT, and ksmbdtreeconndisconnect in the module fs/smb/server/mgmt/treeconnect.c, as well as the function smb2treedisconnect in the module fs/smb/server/smb2pdu.c, are related to the reuse of previously freed memory due to...

The vulnerability of the `efivar_entry_get()` function in the `fs/efivarfs/vars.c` file of the Linux kernel file system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the efivarentryget function in the fs/efivarfs/vars.c file of the Linux kernel file system is related to deficiencies in error handling. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected...

The vulnerability of the switchtec_ntb_init_shared() function in the drivers/ntb/hw/mscc/ntb_hw_switchtec.c driver module of the Linux operating system allows a hacker to access protected information or cause service failures.

The vulnerability of the switchtecntbinitshared function in the drivers/ntb/hw/mscc/ntbhwswitchtec.c driver for Linux’s non-visible kernel bridges is related to unvalidated array indexing. Exploiting this vulnerability could allow an attacker to access protected information or cause service...

py-djangorestframework -- two vulnerabilities

Bruno Alla reports: Potential bypass of Django DATAUPLOADMAXMEMORYSIZE when parsing oversized JSON and urlencoded request bodies via DRF request.data AdminRenderer may disclose GET-protected data when rendering invalid write requests...

The vulnerability of the Repo.clone_from() function in the Python library for interacting with Git repositories in GitPython allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the Repo.clonefrom function in the Python library for interacting with Git repositories in GitPython is related to insufficient protection of operational data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected...

CVE-2026-14541 Authentication Bypass and Audience Confusion in MCP Toolbox OAuth Provider

An authentication bypass and audience confusion vulnerability exists in the Google OAuth provider component of Google mcp-toolbox version 1.4.0. When a Google authService is initialized with mcpEnabled: true but lacks an explicitly defined audience or clientId, the ValidateMCPAuth pipeline for...

CVE-2026-14541

An authentication bypass and audience confusion vulnerability exists in the Google OAuth provider component of Google mcp-toolbox version 1.4.0. When a Google authService is initialized with mcpEnabled: true but lacks an explicitly defined audience or clientId, the ValidateMCPAuth pipeline for...

The vulnerability of Microsoft Office packages, Microsoft 365 Apps for Enterprise, and Microsoft SharePoint relates to reading data beyond the buffer in memory, allowing an attacker to disclose protected information.

The vulnerability of Microsoft Office packages, Microsoft 365 Apps for Enterprise, and Microsoft SharePoint relates to reading data beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to disclose protected information...

The vulnerability of Microsoft Word, the Microsoft SharePoint Server, Microsoft Office, and Microsoft 365 Apps for Enterprise text editors arises from improper validation of certain input types, allowing attackers to disclose protected information.

The vulnerability of Microsoft SharePoint Server and SharePoint Enterprise Server packages is related to improper validation of the specified type of input data. Exploiting this vulnerability can allow an attacker to disclose protected information...

CVE-2026-43714

The issue was addressed with improved input sanitization. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, visionOS 26.6, watchOS 26.6. A malicious app may be able to access protected user data...

CVE-2026-43714

The issue was addressed with improved input sanitization. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, visionOS 26.6, watchOS 26.6. A malicious app may be able to access protected user data...

EUVD-2026-49477

The issue was addressed with improved input sanitization. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, visionOS 26.6, watchOS 26.6. A malicious app may be able to access protected user data...

ROS-20260724-73-0040

The vulnerability in ImageMagick relates to incorrect restrictions on the path to the restricted catalog. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

The vulnerability of the Windows File Explorer on Windows operating systems, allowing a hacker to disclose protected information

The vulnerability of the Windows File Explorer driver in Windows operating systems is related to insufficient protection of sensitive data. Exploiting this vulnerability can allow an attacker to disclose protected information...

The vulnerability of the Microsoft .NET software platform and the Visual Studio Code editor, related to errors in handling symbolic links, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Microsoft .NET software platform and the code editor Visual Studio Code is related to errors in handling symbolic links. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

ROS-20260722-73-0019

The vulnerability of the Media component in Google Chrome and Microsoft Edge is related to improper protection of physical external channels. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information through a specially created...

The vulnerability of Adobe Audition’s audio editor, related to reading data beyond the buffer in memory, allows a hacker to gain unauthorized access to protected information.

The vulnerability of Adobe Audition is related to reading data beyond the buffer in memory. Exploiting this vulnerability can allow an intruder to gain unauthorized access to protected information...

The vulnerability of the validate_push_nsh() function in the net_openvswitch/flow_netlink.c module, which is part of the Open vSwitch router support in Linux operating systems, allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the validatepushnsh function in the netopenvswitch/flownetlink.c module, which is part of the Open vSwitch router support in Linux operating systems, relates to the pointer manipulation. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...