CVE-2026-86961

A race condition was addressed with additional validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. A malicious app may be able to break out of its sandbox...

EUVD-2026-104734

A race condition was addressed with additional validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. A malicious app may be able to break out of its sandbox...

CVE-2026-86948

This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. An app may be able to break out of its sandbox...

EUVD-2026-104728

This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. An app may be able to break out of its sandbox...

CVE-2026-86948

The Xcode software is affected by a vulnerability that could allow an application to break out of its sandbox . The root cause involves a lack of library validation on certain binaries. This issue is resolved in Xcode 27 by enforcing the necessary library validation. No information regarding spec...

EUVD-2026-104729

This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. A malicious app may be able to break out of its sandbox...

CVE-2026-86949

A security vulnerability in Xcode (specifically the Xcode component on macOS Tahoe 26.6 and later) allows a malicious app to break out of its sandbox . The root cause involves a lack of library validation on affected binaries. This issue has been addressed by enforcing library validation on the a...

CVE-2026-86949

This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. A malicious app may be able to break out of its sandbox...

CVE-2018-20162-digi-lr54-restricted-shell-escape

layout: post title: "CVE-2018-20162: Digi TransPort LR54 Restricted Shell Escape" author: sgo category: security The Digi TransPort LR54 is a high speed LTE router commonly used by industry, infrastructure, retail and public transportation. It supports running python scripts in a restricted...

EUVD-2026-104681

LangAlpha through 2026.09.07 contains an improper isolation vulnerability that places all tenants' sandbox containers on Docker's shared default bridge network with inter-container communication enabled. Authenticated users with code execution in their own sandbox can connect directly to other...

EUVD-2026-104680

LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands or Python by planting instructions in web content retrieved by the agent. Because Bash and ExecuteCode lack an allow-list and human-in-the-loop approval, attacke...

Oracle Linux 10 : bubblewrap (ELSA-2026-85308)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-85308 advisory. - Fix CVE-2026-87766: harden sandbox mount paths Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note...

PT-2026-118758

Memory corruption in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Low...

PT-2026-118786

Improper input validation in PrintPreview in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

PT-2026-118787

Memory corruption in Interstitials in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

PT-2026-118790

Memory corruption in DisplayLocking in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

PT-2026-118792

Out of bounds read in Focus in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

PT-2026-118794

Use after free in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

PT-2026-118923

Memory corruption in Model in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Low...

PT-2026-118950

Use after free in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...