New ClickLock Stealer locks your Mac until you hand over your password

ClickLock Stealer is a new, modular macOS infostealer delivered via ClickFix-style phishing pages that can lock a victim’s Mac, steal their macOS password, browser and password manager data, cryptocurrency wallets, and then leave behind a persistent backdoor. The malware was discovered by Group-I...

EUVD-2026-46125

Use after free in CameraCapture in Google Chrome on Mac prior to 150.0.7871.128 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Critical...

EUVD-2024-55690

The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub424CE0 function of the file /goform/setMacFilterCfg...

PT-2026-61981

When verifying a mac with a ChunkedMacVerification object, Tink compares the resulting tag with non constant time comparison. This potentially allows an attacker to use timinig information as a side channel in order to get information how many bytes of a given tag match the correct tag. This in...

CVE-2026-15899

Use after free in CameraCapture in Google Chrome on Mac prior to 150.0.7871.128 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-15899

Use after free in CameraCapture in Google Chrome on Mac prior to 150.0.7871.128 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-15899

Use after free in CameraCapture in Google Chrome on Mac prior to 150.0.7871.128 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-47133

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to version 5.0.10, each table in the on-disk SQLite policy store /Library/Application Support/clearancekit/store.db is verified using an ECDSA signature stored in the datasignatures table. T...

SUSE-SU-2026:22763-1 Security update for the Linux Kernel (Live Patch 11 for SUSE Linux Enterprise 16)

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.32.1 fixes various security issues The following security issues were fixed: - CVE-2026-31505: iavf: fix out-of-bounds writes in iavfgetethtoolstats bsc1263094. - CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of...

CVE-2024-51314

The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub424CE0 function of the file /goform/setMacFilterCfg...

The vulnerability of Microsoft Defender for Endpoint for Mac, related to synchronization errors when using a shared resource (“Race Situation”), allows a malicious actor to escalate their privileges.

The vulnerability of Microsoft Defender for Endpoint for Mac is related to synchronization errors when using a shared resource “Race Situation”. Exploiting this vulnerability can allow an attacker to increase their privileges...

CVE-2024-51314

The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub424CE0 function of the file /goform/setMacFilterCfg...

CVE-2024-51314

The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub424CE0 function of the file /goform/setMacFilterCfg...

CVE-2026-63923

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: validate body pcifunc in rvumboxhandlerrepeventnotify rvumboxhandlerrepeventnotify in drivers/net/ethernet/marvell/ octeontx2/af/rvurep.c queues a sender-controlled REPEVENTNOTIFY request body verbatim, and...

CVE-2026-63866 wifi: mt76: mt7996: Clear wcid pointer in mt7996_mac_sta_deinit_link()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Clear wcid pointer in mt7996macstadeinitlink Clear WCID pointer removing the sta link in mt7996macstadeinitlink routine...

CVE-2026-63866 wifi: mt76: mt7996: Clear wcid pointer in mt7996_mac_sta_deinit_link()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Clear wcid pointer in mt7996macstadeinitlink Clear WCID pointer removing the sta link in mt7996macstadeinitlink routine...

CVE-2026-63832

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: add wcid publish check in mt76staadd Since mt7925macstaadd publishes wcid, add publish check in mt76staadd to avoid reinitializing the wcid-polllist. Found dev-stapolllist corruption when using mt7925 and 7.1-rc4...

CVE-2026-63831 mac802154: llsec: add skb_cow_data() before in-place crypto

In the Linux kernel, the following vulnerability has been resolved: mac802154: llsec: add skbcowdata before in-place crypto llsecdoencryptunauth, llsecdoencryptauth, llsecdodecryptunauth, and llsecdodecryptauth all perform in-place cryptographic transformations on skb data. They build a scatterli...

PT-2026-61147

Name of the Vulnerable Software and Affected Versions Linux Kernel affected versions not specified Description In the Linux kernel, the mac802154 module performs in-place cryptographic transformations on socket buffer skb data using the functions llsec do encrypt unauth, llsec do encrypt auth,...

CVE-2026-49852 joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.6.8, joserfc.jwt.decode accepts attacker-forged HMAC-signed tokens when the caller-supplied verification key is the empty string or None, because HMACAlgorithm.sign...