CVE-2026-11318

CVE-2026-11318: Локальное повышение привилегий в клиенте DeskIn для macOS Производитель: DeskIn Продукт: Клиент DeskIn для macOS Уязвимые версии: = v3.3.4.3 Обзор В клиенте DeskIn для macOS обнаружена уязвимость локального повышения привилегий LPE. Эта уязвимость позволяет непривилегированному...

CVE-2024-11467

CVE-2024-11467 Операционная система macOS использует службы XPC для базовой межпроцессной связи между различными процессами, например, между демоном XPC Service и привилегированными вспомогательными инструментами сторонних приложений. Клиент VMware Horizon Client при установке регистрирует...

gsscred-move-uaf

GSSCred-move-uaf Le service XPC com.apple.GSSCred, qui s'exécute en tant que root sur macOS et iOS, n'implémente pas correctement la commande "move", conduisant à une condition d'utilisation après libération use-after-free dans la fonction doMove. Le service GSSCred est accessible depuis le sandb...

CVE-2026-11318

Deskin through 3.3.4.3 contains a privilege escalation vulnerability in the com.deskin.service.installer XPC service that allows local unprivileged attackers to execute arbitrary installer packages as root by connecting to the root-owned service without authentication. Attackers can invoke the...

CVE-2026-11318 Deskin 3.3.4.3 XPC Service Privilege Escalation via Unauthenticated Installer

Deskin through 3.3.4.3 contains a privilege escalation vulnerability in the com.deskin.service.installer XPC service that allows local unprivileged attackers to execute arbitrary installer packages as root by connecting to the root-owned service without authentication. Attackers can invoke the...

CVE-2026-11318

DeskIn macOS Client versions up to 3.3.4.3 are vulnerable to a Local Privilege Escalation vulnerability. The root-owned daemon DeskIn_Service exposes a Mach XPC service, com.deskin.service.installer, which lacks proper client validation and fails to verify code signatures or entitlements. This al...

EUVD-2026-95287

Deskin through 3.3.4.3 contains a privilege escalation vulnerability in the com.deskin.service.installer XPC service that allows local unprivileged attackers to execute arbitrary installer packages as root by connecting to the root-owned service without authentication. Attackers can invoke the...

CVE-2026-6666-XPC-Service-NSKeyedUnarchiver-Deserialization-Attack-macOS-iOS-simulation-

CVE-2026-6666 – Attaque de désérialisation NSKeyedUnarchiver du service XPC simulation macOS/iOS Code du programme simulation Python !/usr/bin/env python3 vulnerablexpcservice.py - Simulated XPC service using unsafe plist deserialization import plistlib, subprocess, socketserver, struct Mach...

ios-nehelper-enum-apps-0day

nehelper — 0-day d'énumération des applications installées iOS 15.0 J'ai mis à jour ce code pour éviter d'utiliser directement une API privée. Pour en savoir plus, consultez mon article de blog. Cela signifie toutefois que ce code est désormais spécifique à la version d'iOS et éventuellement au...

Exploit for NULL Pointer Dereference in Pgbouncer

--- CVE-2026-6666 – XPC Service NSKeyedUnarchiver Deserializ...

CVE-2026-12374

Improper certificate validation and a time-of-check time-of-use TOCTOU race condition in the PrivilegedHelperTool XPC service in Cato Client before v.5.13.1 on macOS allows a local authenticated attacker to escalate privileges to root via a self-signed certificate that bypasses the XPC caller...

CVE-2026-12374

CVE-2026-12374 affects the macOS PrivilegedHelperTool in Cato Client prior to v5.13.1. The issue combines improper XPC caller certificate validation with a TOCTOU race, allowing a local authenticated attacker to escalate to root by using a self-signed certificate that bypasses XPC caller verifica...

EUVD-2026-41001

Improper certificate validation and a time-of-check time-of-use TOCTOU race condition in the PrivilegedHelperTool XPC service in Cato Client before v.5.13.1 on macOS allows a local authenticated attacker to escalate privileges to root via a self-signed certificate that bypasses the XPC caller...

CVE-2026-12374 Improper XPC caller certificate validation and TOCTOU race condition in macOS PrivilegedHelperTool

Improper certificate validation and a time-of-check time-of-use TOCTOU race condition in the PrivilegedHelperTool XPC service in Cato Client before v.5.13.1 on macOS allows a local authenticated attacker to escalate privileges to root via a self-signed certificate that bypasses the XPC caller...

CVE-2026-12374: Improper Certificate Validation

Improper certificate validation and a time-of-check time-of-use TOCTOU race condition in the PrivilegedHelperTool XPC service in Cato Client before v.5.13.1 on macOS allows a local authenticated attacker to escalate privileges to root via a self-signed certificate that bypasses the XPC caller...

CVE-2026-24067 Slate Digital Connect macOS XPC PID validation privilege escalation

Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.helper.tool, which exposes the XPC service com.slatedigital.connect.privileged.helper.tool2. The helper validates connecting XPC clients by obtaining the client's process identifier and...

CVE-2026-24067

Slate Digital Connect version 1.37.0 for macOS is vulnerable to local privilege escalation due to a time-of-check time-of-use (TOCTOU) race condition. The issue exists within the privileged helper tool com.slatedigital.connect.privileged.helper.tool, which exposes the XPC service com.slatedigital...

CVE-2026-24066

Slate Digital Connect version 1.37.0 for macOS contains a local privilege escalation vulnerability. The software installs a privileged helper tool, com.slatedigital.connect.privileged.helper.tool, which exposes the XPC service com.slatedigital.connect.privileged.helper.tool2. The vulnerability ex...

EUVD-2026-36002

Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.helper.tool, which exposes the XPC service com.slatedigital.connect.privileged.helper.tool2. The helper validates connecting XPC clients by checking only the subject.OU value of the...

PT-2026-48401

Name of the Vulnerable Software and Affected Versions Slate Digital Connect version 1.37.0 Description The software installs a privileged helper tool, 'com.slatedigital.connect.privileged.helper.tool', which exposes the XPC service 'com.slatedigital.connect.privileged.helper.tool2'. The helper...