Apple Security Advisory 10-26-2026-9

Apple Security Advisory 10-26-2026-9 - visionOS 27.2 addresses out of bounds access, out of bounds read, out of bounds write, use-after-free, memory corruption, buffer overflow, integer overflow, and information disclosure vulnerabilities...

Syncplify Server backlink vulnerability

Versions of Syncplify Server prior to 8.8.0 contain a backlink vulnerability stemming from path traversal. Since only request paths are restricted without validation of the target file on disk, attackers can utilize symbolic links placed in users’ home directories or Windows directory links to re...

Supsystic WordPress Contact Form authorization issue vulnerability

WordPress Contact Form by Supsystic versions 1.10.7 and earlier contain an authorization issue vulnerability. This vulnerability stems from a lack of proper authorization checks, enabling exploitation of improperly configured access control security levels...

Apple iOS security vulnerabilities

A security vulnerability exists in Apple iOS versions prior to 27.2, Apple iPadOS versions prior to 27.2, Apple macOS Golden Gate versions prior to 27, Apple macOS Golden Gate versions prior to 27.2, Apple macOS Sequoia versions prior to 15.8, Apple macOS Tahoe versions prior to 26.7, Apple tvOS...

Apple iOS security vulnerabilities

Security vulnerabilities exist in Apple iOS versions prior to 26.7.2 and 27.2, Apple iPadOS versions prior to 26.7.2 and 27.2, Apple macOS Golden Gate versions prior to 27.2, Apple macOS Sequoia versions prior to 15.8.2, Apple macOS Tahoe versions prior to 26.7.2, Apple tvOS versions prior to 27....

NVDA Remote 2.6.4 / Tele NVDA Remote 2025.3.3 Weak Password Authentication

NVDA Remote version 2.6.4 and Tele NVDA Remote version 2025.3.3 accept weak connection passwords without additional authentication or computer verification, allowing remote system access when an attacker guesses the password...

Apple iOS security vulnerabilities

A security vulnerability exists in Apple iOS versions prior to 27.2 and Apple iPadOS versions prior to 27.2. This vulnerability stems from inadequate validation mechanisms and may allow applications to access sensitive user data...

GiantappMan LiveWallPaper authorization issue vulnerability

Version 2.6.8.0 of GiantappMan LiveWallPaper contains an authorization issue vulnerability. This vulnerability arises because the SignalR Hub component fails to perform proper authentication when processing files at /LiveWallpaper/UploadFile, potentially allowing remote attackers to gain...

UBUNTU-CVE-2026-115371

Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an improper authorization vulnerability that allows restricted TLS clients to read storage bucket keys in the default project. Attackers can query the bucket keys endpoints to obtain S3 access and secret keys, then read...

Apple iOS security vulnerabilities

A security vulnerability exists in Apple iOS versions prior to 27.2, Apple iPadOS versions prior to 27.2, Apple macOS Golden Gate versions prior to 27.2, Apple tvOS versions prior to 27.2, Apple visionOS versions prior to 27.2, and Apple watchOS versions prior to 27.2. This vulnerability stems fr...

PT-2026-123406

Syncplify Server! before 8.8.0 contains an access control bypass vulnerability that allows authenticated SFTP users to evade per-path permission overrides by exploiting case-insensitive filesystem path resolution and 8.3 short names. Attackers can address a protected directory using alternate...

UBUNTU-CVE-2026-116096

A weakness has been identified in ggml-org llama.cpp. Affected by this issue is the function listpocketttsstateslots of the file tools/mtmd/models/pockettts-gen.cpp of the component Pocket-TTS. This manipulation of the argument mmproj causes out-of-bounds write. The attack requires local access...

Apple iOS security vulnerabilities

A security vulnerability exists in Apple iOS versions prior to 27.2, Apple iPadOS versions prior to 27.2, Apple macOS Golden Gate versions prior to 27.2, and Apple visionOS versions prior to 27.2. This vulnerability stems from improper access control and may allow applications to access sensitive...

Apple iOS security vulnerabilities

A security vulnerability exists in Apple iOS versions prior to 26.7.2, Apple iOS versions prior to 27, Apple iPadOS versions prior to 26.7.2, and Apple iPadOS versions prior to 27. This vulnerability stems from issues in state management logic and may allow applications to access sensitive user...

PT-2026-123346

This issue affects Apache SIS from version 0.7 through 1.6 inclusive. When a data file contains links to other files, Apache SIS opened these files regardless their paths. It was possible, for example, to specify a path to a local file. However, these files were always expected to be in some...

Apple MacOS: CVE-2026-86984: OS X update for Siri

A file access issue existed with certain home folder files. This was addressed with improved access restrictions. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to access information about a user's contacts...

PT-2026-125435

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27.2, macOS Tahoe 26.7.2. An attacker with root privileges may be able to access protected user data...

Apple iOS security vulnerabilities

A security vulnerability exists in Apple iOS versions prior to 26.7.2 and 27.2, Apple iPadOS versions prior to 26.7.2 and 27.2, Apple macOS Golden Gate versions prior to 27.2, Apple macOS Sequoia versions prior to 15.8.2, Apple macOS Tahoe versions prior to 26.7.2, and Apple visionOS versions pri...

Prefetch Component Protected Information Access

The Prefetch component vulnerability in Google Chrome and Microsoft Edge web browsers is related to a flaw in the source verification mechanism. Exploitation of this vulnerability may allow a remote attacker to gain access to protected information via a specially crafted HTML page...

Codecs Component Protected Information Access

The vulnerability in the Codecs component of Google Chrome and Microsoft Edge web browsers is related to errors in variable initialization. Exploitation of this vulnerability may allow a remote attacker to gain access to protected information via a specially crafted HTML page...