CVE-2025-12792

The Mac App Store distribution of the Canva for Mac desktop app before 1.117.1 was built without Hardened Runtime. A local threat actor with unprivileged access could execute arbitrary code that inherits the TCC Transparency, Consent, and Control permissions assigned to Canva...

CVE-2025-12792

The Mac App Store distribution of the Canva for Mac desktop app before 1.117.1 was built without Hardened Runtime. A local threat actor with unprivileged access could execute arbitrary code that inherits the TCC Transparency, Consent, and Control permissions assigned to Canva...

CVE-2025-12792

CVE-2025-12792 describes a vulnerability in the Mac App Store distribution of the Canva for Mac desktop app prior to 1.117.1. The issue stems from the app being built without Hardened Runtime, enabling a local threat actor with unprivileged access to execute arbitrary code that inherits the app’s...

EUVD-2018-12932

Malware in sbrugna...

EUVD-2019-19117

Malware in sbrugna...

EUVD-2019-4091

Malware in sbrugna...

EUVD-2018-12933

Malware in sbrugna...

EUVD-2024-54673

Malicious code in bioql PyPI...

EUVD-2024-51409

Malicious code in bioql PyPI...

EUVD-2023-44891

Malicious code in bioql PyPI...

EUVD-2025-16108

Malicious code in bioql PyPI...

EUVD-2025-25783

Malicious code in bioql PyPI...

EUVD-2025-17060

Malicious code in bioql PyPI...

EUVD-2025-23578

Malicious code in bioql PyPI...

EUVD-2024-2213

Malicious code in bioql PyPI...

EUVD-2025-28697

Malicious code in bioql PyPI...

CVE-2025-57443

FrostWire 6.14.0-build-326 for macOS contains permissive entitlements allow-dyld-environment-variables, disable-library-validation that allow unprivileged local attackers to inject code into the FrostWire process via the DYLDINSERTLIBRARIES environment variable. This allows escalated privileges t...

CVE-2025-57443

FrostWire 6.14.0-build-326 on macOS is affected by a local privilege escalation arising from permissive entitlements (allow-dyld-environment-variables, disable-library-validation). The issue enables unprivileged local attackers to inject code into the FrostWire process via the DYLD_INSERT_LIBRARI...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the Downloader.xpc service. A local unprivileged attacker can access and copy files protected by TCC permissions by registering the service globally and exploiting the lack of client validation. Workaround Th...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the Downloader.xpc service. A local unprivileged attacker can access and copy files protected by TCC permissions by registering the service globally and exploiting the lack of client validation. Workaround Th...