Apple macOS security vulnerabilities

A security vulnerability exists in Apple macOS Golden Gate versions prior to 27.2, Apple macOS Sequoia versions prior to 15.8.2, and Apple macOS Tahoe versions prior to 26.7.2. This vulnerability stems from vulnerable code that could allow applications to access sensitive user data...

PT-2026-125274

An authorization issue was addressed with improved access control. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. An app may be able to access sensitive user data...

PT-2026-123312

An SQL Injection vulnerability exists in the dashboard widget data API endpoint /api/data/type. Chart filter parameters supplied by the client are not properly validated before they are used in the database queries that build dashboard chart data. An authenticated user with API access can exploit...

PT-2026-125112

Name of the Vulnerable Software and Affected Versions potatosalad jose versions 1.0.0 through 1.11.12 Description An improper handling of highly compressed data, known as data amplification, allows a remote attacker to exhaust a node's memory using a small crafted JWE token. The jose jwe...

PT-2026-125340

An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. An app may be able to access sensitive user data...

PT-2026-125452

This issue was addressed with improved checks. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2. An app may be able to access sensitive user data...

PT-2026-123206

MISP mispguard is a security filtering proxy that inspects and blocks MISP feed responses based on configured rules. The process feed response method in src/mispguard.py was responsible for evaluating feed responses before they reached the MISP instance. The original logic only explicitly handled...

Tiger Data pgvectorscale buffer error vulnerability

Versions of Tiger Data pgvectorscale prior to 0.9.1 contain a buffer error vulnerability stemming from type confusion. Low-privilege database users possessing CREATE privileges on the vectorscale schema can bypass pgvector’s vector types or operators by pre-creating shadow objects. This allows th...

PT-2026-125492

libyal libmsiecf through 20260525 contains a double free vulnerability in libmsiecf url values read data that allows attackers to corrupt heap memory via crafted partial URL records. Attackers can supply a crafted MSIE cache index.dat file whose recovered partial record has an oversized unknown...

PT-2026-125425

This issue was addressed with additional entitlement checks. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27. An app may be able to access sensitive user data...

PT-2026-125430

An authorization issue was addressed with improved state management. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. An app may be able to access sensitive user data...

Mat Trudel Bandit resource management error vulnerability

Versions of Mat Trudel Bandit from 0.3.1 up to but not including 1.14.0 contain a resource management vulnerability. This vulnerability arises because the HTTP/2 implementation lacks restrictions or throttling on resource allocation. In Bandit.HTTP2.Connection.handleframe/3, the receive window is...

ROS-20261026-73-0151

The vulnerability of the OpenSSH cryptographic protection lies in the use of an unprotected alternative channel. Exploiting this vulnerability could allow a attacker to compromise the integrity of data...

PT-2026-125514

OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to read cross-tenant data by supplying a crafted property parameter to profile.values. Attackers can inject a SELECT expression with their own FROM/WHERE clauses and comment out the project id scope to...

PT-2026-123368

A flaw was found in the Infinispan Operator for Red Hat Data Grid. When cross-site xsite TLS is enabled, the operator launches the Gossip Router container with keystore and truststore passwords passed as plain-text command-line arguments -tls keystore password, -tls truststore password. Container...

Meta FAIRChem load_and_preprocess_data Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of pickl...

CVE-2026-115635

Incorrect Authorization vulnerability in ash-project ashpostgres allows a user to read another tenant's record through a skipped upsert. When Ash.bulkcreate/4 or a single create runs as an upsert with returnskippedupsert?: true and the upsert is skipped for example because its upsertcondition doe...

EUVD-2026-109568

Incorrect Authorization vulnerability in ash-project ashpostgres allows a user to read another tenant's record through a skipped upsert. When Ash.bulkcreate/4 or a single create runs as an upsert with returnskippedupsert?: true and the upsert is skipped for example because its upsertcondition doe...

CVE-2026-115635

Incorrect Authorization vulnerability in ash-project ashpostgres allows a user to read another tenant's record through a skipped upsert. When Ash.bulkcreate/4 or a single create runs as an upsert with returnskippedupsert?: true and the upsert is skipped for example because its upsertcondition doe...

route-sixty-sink

✏️ Contributors Dillon Franke @dillonfranke Michael Maturi @a-marionette 📝 Blog https://www.mandiant.com/resources/route-sixty-sink-launch ⚓ Route Sixty-Sink Route Sixty-Sink is an open source tool that enables defenders and security researchers alike to quickly identify vulnerabilities in any .NE...