CVE-2026-48722: Incorrect Default Permissions

Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to $NXFHOME:-/.nextflow/seqera-auth.config through AuthCommandImpl.writeConfig in...

CVE-2026-65415

A race condition was addressed with additional validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. A local user may be able to cause unexpected system termination or read kernel memory...

CVE-2026-43690

A race condition was addressed with improved locking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A local user may be able to read kernel memory...

CVE-2026-43690

A race condition was addressed with improved locking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A local user may be able to read kernel memory...

CVE-2026-43690

A race condition exists in macOS that can allow a local user to read kernel memory . This vulnerability was addressed by implementing improved locking and is fixed in macOS Golden Gate 27 , macOS Sequoia 15.8 , and macOS Tahoe 26.7 . Exploitation details and specific in-the-wild evidence are not ...

CVE-2026-65415

A race condition was addressed with additional validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. A local user may be able to cause unexpected system termination or read kernel memory...

CVE-2026-65415

A race condition was addressed with additional validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. A local user may be able to cause unexpected system termination or read kernel memory...

CVE-2026-65415

A race condition exists in several Apple operating systems due to concurrent execution using a shared resource with improper synchronization . This issue is fixed in iOS 27 , iPadOS 27 , macOS Golden Gate 27 , tvOS 27 , visionOS 27 , and watchOS 27 through additional validation. A local user coul...

CVE-2026-65359

An out-of-bounds read vulnerability exists in several Apple products, including iOS , iPadOS , macOS , tvOS , visionOS , and watchOS . The root cause was addressed through improved bounds checking. A local user may be able to exploit this issue to cause unexpected system termination or read kerne...

EUVD-2026-78019

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. A local user may be able to cause unexpected system termination o...

CVE-2026-65359

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. A local user may be able to cause unexpected system termination o...

CVE-2026-19816

A flaw was found in PackageKit. PackageKit skips the polkit authorization check for transactions carrying the SIMULATE dry-run flag. In the dnf5 backend, the RepoRemove handler ignores that contract and always executes the real transaction because its guard is written as role == REPOREMOVE ||...

CVE-2026-19816 PackageKit: dnf5 backend ignores SIMULATE on RepoRemove

A flaw was found in PackageKit. PackageKit skips the polkit authorization check for transactions carrying the SIMULATE dry-run flag. In the dnf5 backend, the RepoRemove handler ignores that contract and always executes the real transaction because its guard is written as role == REPOREMOVE ||...

CVE-2026-19816 PackageKit: dnf5 backend ignores SIMULATE on RepoRemove

A flaw was found in PackageKit. PackageKit skips the polkit authorization check for transactions carrying the SIMULATE dry-run flag. In the dnf5 backend, the RepoRemove handler ignores that contract and always executes the real transaction because its guard is written as role == REPOREMOVE ||...

CVE-2026-19816

A flaw was found in PackageKit. PackageKit skips the polkit authorization check for transactions carrying the SIMULATE dry-run flag. In the dnf5 backend, the RepoRemove handler ignores that contract and always executes the real transaction because its guard is written as role == REPOREMOVE ||...

CVE-2026-54447 garminconnect: Insecure Permission Assignment for Garmin OAuth Token Store

garminconnect is a Python 3 API wrapper for Garmin Connect that retrieves statistics and manages activities. Prior to 0.3.5, garminconnect/client.py Client.dump creates the OAuth token directory and garmintokens.json without explicit owner-only modes, so a permissive umask such as 022 can leave t...

CVE-2026-19624 NetworkManager-l2tp: local privilege escalation via ipsec.conf injection

A flaw was found in NetworkManager-l2tp. The plugin writes attacker-controlled VPN connection properties vpn.data and vpn.secrets values unescaped into a generated ipsec.conf file that pluto loads as root. A local unprivileged user can create and activate their own L2TP VPN profile containing a...

CVE-2026-19624 NetworkManager-l2tp: local privilege escalation via ipsec.conf injection

A flaw was found in NetworkManager-l2tp. The plugin writes attacker-controlled VPN connection properties vpn.data and vpn.secrets values unescaped into a generated ipsec.conf file that pluto loads as root. A local unprivileged user can create and activate their own L2TP VPN profile containing a...

[SECURITY] [DSA 6498-1] network-manager-l2tp security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6498-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 14, 2026 https://www.debian.org/security/faq -...

OESA-2026-3744 systemd security update

systemd is a system and service manager that runs as PID 1 and starts the rest of the system. Security Fixes: systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user, due to missing home-record signature verification on...