ROS-20261026-73-0008

The vulnerability in openssh is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to enhance their privileges...

ROS-20261026-73-0014

The vulnerability in openssh is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to enhance their privileges...

ROS-20261026-73-0016

The vulnerability in openssh is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to enhance their privileges...

ROS-20261026-73-0050

The vulnerability in openssh is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to enhance their privileges...

ROS-20261026-73-0173

The vulnerability in openssh is related to errors in processing the relative path to the directory. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

ROS-20261026-73-0203

The vulnerability in rabbitmq-server relates to incorrect restrictions on the path name to the restricted access catalog. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to protected information...

CVE-2026-116638

The Windows Recovery Environment WinRE in Windows 10 and 11 may allow an attacker to bypass firmware security controls, including administrator-configured UEFI/BIOS passwords. An attacker with physical or administrative access to a device may be able to leverage WinRE-related boot mechanisms to...

EUVD-2026-110069

The Windows Recovery Environment WinRE in Windows 10 and 11 may allow an attacker to bypass firmware security controls, including administrator-configured UEFI/BIOS passwords. An attacker with physical or administrative access to a device may be able to leverage WinRE-related boot mechanisms to...

PT-2026-125333

This issue was addressed with additional entitlement checks. This issue is fixed in iOS 27.2 and iPadOS 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to access sensitive user data...

PT-2026-125119

An access-control vulnerability has been identified in the web server configuration. Some resources intended for on-device use only could be accessed remotely by an unauthenticated attacker with network access to the web interface. The accessible resources do not expose credentials or provide...

PT-2026-123361

boneIO black debian images ships with a Mosquitto MQTT broker that uses the same default credentials on all devices. These credentials are publicly documented on github, and there is no indication in the instructions to change them. A remote attacker can use them to gain full read and write acces...

Apple Security Advisory 10-26-2026-5

Apple Security Advisory 10-26-2026-5 - macOS Tahoe 26.7.2 addresses out of bounds access, out of bounds read, out of bounds write, use-after-free, memory corruption, buffer overflow, integer overflow, arbitrary code execution, and information disclosure vulnerabilities...

Apple Security Advisory 10-26-2026-7

Apple Security Advisory 10-26-2026-7 - tvOS 27.2 addresses out of bounds access, out of bounds read, out of bounds write, use-after-free, buffer overflow, integer overflow, and information disclosure vulnerabilities...

Bukwild Decoy permission and access control issue vulnerability

Bukwild Decoy versions 5.11.1 and earlier contain a vulnerability related to permission escalation and access control. This issue stems from improper handling of the ‘role’ parameter in the Policy.php file, resulting in inadequate permission management and potential remote exploitation...

Billabear authorization issue vulnerability

Billabear versions 2025.01.03 and earlier contain an authorization issue vulnerability. This vulnerability stems from the absence of authentication in the processInstall function within the file src/BillaBear/Controller/InstallController.php in the Installation Handler component, potentially...

JIZHICMS permission and access control issues vulnerability

Versions JIZHICMS 2.5.6 and earlier contain a security vulnerability. This vulnerability stems from improper handling of the ‘orderno’ parameter within the Pay function of the file app/home/c/OrderController.php in the Front-end Order Handler component. It may lead to unauthorized access, and...

Apple iOS security vulnerabilities

Security vulnerabilities exist in Apple iOS versions prior to 26.7.2 and prior to 27.2, Apple iPadOS versions prior to 26.7.2 and prior to 27.2, Apple macOS versions prior to 27.2 for Golden Gate, prior to 15.8.2 for Sequoia, prior to 26.7.2 for Tahoe, prior to 27.2 for tvOS, prior to 27.2 for...

CVE-2026-116638

The Windows Recovery Environment WinRE in Windows 10 and 11 may allow an attacker to bypass firmware security controls, including administrator-configured UEFI/BIOS passwords. An attacker with physical or administrative access to a device may be able to leverage WinRE-related boot mechanisms to...

Webasyst Framework cross-site request forgery vulnerability

Webasyst Framework versions 4.4.0 and earlier contain a cross-site request forgery vulnerability. This flaw arises because the Photos application fails to enable CSRF checks within the framework; it is thus susceptible to such attacks. Attackers can trick logged-in Photos users into visiting...

Apple macOS security vulnerabilities

A security vulnerability exists in Apple macOS Golden Gate versions prior to 27.2, Apple macOS Sequoia versions prior to 15.8.2, and Apple macOS Tahoe versions prior to 26.7.2. This vulnerability stems from an access control issue and may allow applications to bypass sandbox restrictions...