CVE-2026-64758

The issue was addressed with improved bounds checks. This issue is fixed in iOS 26.6 and iPadOS 26.6, iOS 26.7 and iPadOS 26.7, macOS Sequoia 15.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted file may lead to unexpected app termination...

CVE-2026-64742

This vulnerability affects multiple Apple platforms, including iOS , iPadOS , tvOS , visionOS , and watchOS . The issue stems from improper network communication, where information was being sent over the network without HTTPS , potentially allowing an application to access sensitive user data . ...

CVE-2026-64754

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted file may lead to a denial-of-service...

EUVD-2026-49465

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted file may lead to a denial-of-service...

CVE-2026-64754

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted file may lead to a denial-of-service...

EUVD-2026-49621

A path handling issue was addressed with improved validation. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to gain root privileges...

CVE-2026-43810

The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. A remote user may be able to cause unexpected system...

CVE-2026-64775

A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination...

CVE-2026-64554

In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: fix stale prevhdr pointer in brip6fragment brip6fragment gets prevhdr, a pointer into the skb head, from ip6find1stfragopt, then calls skbchecksumhelp. For a cloned skb skbchecksumhelp reallocates the head via...

Malicious code in identityauthorizationserv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca4808d7fab80b2202538cad6c5a1be4d62eb973ac35eb3a431fdf33f68b67ee [email protected] wires scripts.preinstall to node index.js, so on npm install the package auto-executes code that collects host...

Malicious code in crm-reportinsightserv-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed758e4154bc29bda7b5ee78165766980d88068090a9853a2243509d97c11152 [email protected] executes a preinstall script index.js that collects installer host identifiers — os.hostname, os.platform, os.arc...

Important: Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage

A Subscription Management tool for finding and reporting Red Hat product usage Red Hat Discovery, also known as Discovery, is an inspection and reporting tool that finds, identifies, and reports environment data, or facts, such as the number of physical and virtual systems on a network, their...

MAL-2026-11095 Malicious code in @array-util/subsearch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 793344e3c658f3649a113e29dd1124d979af9a7978f3159c55f8da6f6b3bc918 The package's index.js is heavily obfuscated string-array shift/rotate pattern with hex-encoded indices and a while!! decoder loop. Obfuscation in a...

CVE-2026-66053

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue. This replaces CVE-2026-41603...

Malicious code in amanexzyra-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95c2dc37b7d123a5de5b204c909ddc35474421dc3e0e7a4f256691a54d825c20 Package name amanexzyra-baileys resembles the popular WhatsApp Web API library @whiskeysockets/baileys family, which has been a frequent target of...

Malicious code in @sqlite-tag/schema-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6c0c9a31c77b90dcf433595d03bef3c4752075f134be6b4568dccf2751bc63d1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Linux Distros Unpatched Vulnerability : CVE-2026-60747

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Replication. Supported versions that are affected are MySQL Server:...

Linux Distros Unpatched Vulnerability : CVE-2026-13058

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction command with an incomple...

CVE-2021-32084

An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. If a customer restricts access to the web console by IP address or subnets, the API endpoints are not restricted. If credentials/API keys are known to an attacker, the appliance can still be accessed via the API,...

CVE-2021-32084

An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. If a customer restricts access to the web console by IP address or subnets, the API endpoints are not restricted. If credentials/API keys are known to an attacker, the appliance can still be accessed via the API,...