PT-2026-125346

A race condition was addressed with additional validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. An app may be able to access sensitive user data...

ROS-20261026-73-0111

The vulnerability in openssh is related to the lack of protection for service data. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to protected information...

ROS-20261026-73-0201

The vulnerability in rabbitmq-server is related to insufficient protection of registration data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

Apple macOS security vulnerabilities

A security vulnerability exists in Apple macOS Golden Gate versions prior to 27.2, macOS Sequoia versions prior to 15.8.2, and macOS Tahoe versions prior to 26.7.2. This vulnerability stems from insufficient permission checks and may allow applications to access sensitive user data...

PT-2026-123408

Arm Keil MDK-Middleware 8.0.0-8.3.0 may allow DHCPv6 Option-Walk Over-Reads and Unintended Data Retransmission...

Apple MacOS: CVE-2026-112558: OS X update for Spotlight

A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to access sensitive user data...

UBUNTU-CVE-2026-79978

The RTIO streaming completion callback adxl345processfifosamplescb in drivers/sensor/adi/adxl345/adxl345stream.c clamps the amount of FIFO data it will report readlen = MINfifobytes, bufavail to the space actually returned by rtiosqerxbuf, but then queues one 6-byte bus read per hardware FIFO ent...

PT-2026-125197

A permissions issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27.2. An app may be able to access sensitive user data...

SiteSettings Component Data Compromise

The vulnerability in the SiteSettings component of Google Chrome and Microsoft Edge web browsers is related to improper authorization. Exploitation of this vulnerability enables a remote attacker to compromise the integrity of protected information by using a specially crafted HTML page...

Google Chrome Microsoft Edge Data Compromise

The vulnerability in the LocalNetworkAccess component of Google Chrome and Microsoft Edge web browsers is related to authorization errors. Exploitation of this vulnerability enables a remote attacker to compromise the integrity of protected information by using a specially crafted HTML page...

Google Chrome Microsoft Edge Data Compromise

The vulnerability in the FileHandling component of Google Chrome and Microsoft Edge is related to improper authorization. Exploitation of this vulnerability enables a remote attacker to compromise the integrity of protected information by using a specially crafted HTML page...

Passwords Component Data Compromise

The vulnerability in the Password component of Google Chrome and Microsoft Edge web browsers is related to the user interface’s false representation of critical information. Exploitation of this vulnerability enables a remote attacker to compromise the integrity of protected data by using a...

Google Chrome Microsoft Edge Data Compromise

The vulnerability in the DeviceBoundSessionCredentials component of Google Chrome and Microsoft Edge is related to improper authorization. Exploitation of this vulnerability may allow a remote attacker to compromise the integrity of protected information...

PT-2026-123398

Bucket Squatting in Google Cloud Run MCP versions prior to 1.11.0 on Google Cloud Platform allows an attacker to intercept and access proprietary source code, execute arbitrary code and exfiltrate data. Users must upgrade to Cloud Run MCP version 1.11.0 or later...

PT-2026-125276

An access issue was addressed with improved access restrictions. This issue is fixed in iOS 27.2 and iPadOS 27.2, visionOS 27.2. An app may be able to access sensitive user data...

Mat Trudel Bandit resource management error vulnerability

Mat Trudel Bandit versions 0.3.3 through 1.14.0 contain a resource management error vulnerability. This vulnerability stems from improper handling of highly compressed data data amplification in the HTTP/2 implementation; only the size limit of compression blocks is enforced while decoding list...

Apple MacOS: CVE-2026-112675: OS X update for Audio

This issue was addressed with additional entitlement checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to access sensitive user data...

A Certified Robustness Framework for Backdoor Poisoning Attacks Using $F$-Divergences

Machine learning systems trained on untrusted data are vulnerable to data and backdoor poisoning attacks, in which an adversary corrupts training and test samples to manipulate predictions at inference time. Randomized smoothing yields provable defenses against such attacks, but existing...

CoSA: The Conflict of Skills Attack in Real-World LLM Agent Ecosystems

Agent Skills allow LLM agents to combine reusable capabilities, but checking each Skill in isolation cannot rule out policy violations when they are composed. We term such failures Conflict of Skills CoS: artifacts or assessment signals produced for one purpose may be reused downstream without...

Then There Is Prompt Injection, a Malicious Email, ...: The Wild Wide West of OpenClaw Agentic System Security

AI-powered personal assistant frameworks such as OpenClaw combine LLM reasoning, persistent memory, tool invocation, local execution, and web-based workflows. These capabilities enable useful automation, but they also create security risks when untrusted inputs, model reasoning, tools, memory, an...