CVE-2026-119250: Ubiquiti Inc WiFiman Desktop for macOS: A malicious actor with local access and low privileges could exploit an External Control of File Name or Path…

A malicious actor with local access and low privileges could exploit an External Control of File Name or Path vulnerability found in WiFiman Desktop for macOS to execute arbitrary commands with root privileges on the host device...

About the security content of Xcode 27.2

Download JSON About the security content of Xcode 27.2 This document describes the security content of Xcode 27.2. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases ar...

Google Chrome < 156.0.8078.79 Multiple Vulnerabilities

The version of Google Chrome installed on the remote macOS host is prior to 156.0.8078.79. It is, therefore, affected by multiple vulnerabilities as referenced in the 202610stable-channel-update-for-desktop02107719452 advisory. - Use after free in Input. CVE-2026-76031 - Use after free in Frames...

Charles-Proxy-Mobile-Guide

Charles Proxy Mobile Guide The mobile hackers' guide to Charles Proxy 👍 Intro Charles is an HTTP proxy / HTTP monitor / Reverse Proxy that enables a developer to view all of the HTTP and SSL / HTTPS traffic between their machine and the Internet. This includes requests, responses and the HTTP...

CVE-2026-118688

wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 re-appends a trailing slash to rename source paths, causing renameat on macOS and FreeBSD hosts to follow directory symlinks. A guest with sandbox write access can rename a relative symlink such as "up/" to...

DEBIAN-CVE-2026-118688

wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 re-appends a trailing slash to rename source paths, causing renameat on macOS and FreeBSD hosts to follow directory symlinks. A guest with sandbox write access can rename a relative symlink such as "up/" to...

CVE-2026-118688 Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Sandbox Escape via Symlink Rename

wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 re-appends a trailing slash to rename source paths, causing renameat on macOS and FreeBSD hosts to follow directory symlinks. A guest with sandbox write access can rename a relative symlink such as "up/" to...

CVE-2026-118688

The wasmtime-wasi component in Wasmtime versions before 36.0.18 , 37.0.0 before 48.0.6 , and 49.0.0 before 49.0.3 contains a vulnerability where it re-appends a trailing slash to rename source paths. This behavior causes the renameat system call on macOS and FreeBSD hosts to follow directory syml...

CVE-2026-118688 Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Sandbox Escape via Symlink Rename

wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 re-appends a trailing slash to rename source paths, causing renameat on macOS and FreeBSD hosts to follow directory symlinks. A guest with sandbox write access can rename a relative symlink such as "up/" to...

CVE-2026-118688

wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 re-appends a trailing slash to rename source paths, causing renameat on macOS and FreeBSD hosts to follow directory symlinks. A guest with sandbox write access can rename a relative symlink such as "up/" to...

EUVD-2026-112393

wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 re-appends a trailing slash to rename source paths, causing renameat on macOS and FreeBSD hosts to follow directory symlinks. A guest with sandbox write access can rename a relative symlink such as "up/" to...

Vulnerabilities fixed in Apple MacOS

Apple has addressed multiple vulnerabilities in macOS, particularly in versions Golden Gate 27.2, Sequoia 15.8.2, Tahoe 26.7.2, and Monterey 12.4. These vulnerabilities affect various aspects of macOS security, including insufficient validation of symbolic links, improper permission checks,...

Tailscale Patches SSH Flaws That Could Let Hacked Devices Gain Root Access on Other Servers

Tailscale has released version 1.104.4 to fix flaws in its built-in SSH server that could let an attacker reach services and files on other servers that only the root user should be able to touch. The flaws are in how Tailscale SSH forwards network connections, a job the Tailscale background...

PT-2026-129161

wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 re-appends a trailing slash to rename source paths, causing renameat on macOS and FreeBSD hosts to follow directory symlinks. A guest with sandbox write access can rename a relative symlink such as "up/" to...

Apple macOS CoreText GDEF LigCaretList Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Apple macOS. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of...

CVE-2026-118688: bytecodealliance wasmtime: wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 re-appends a trailing slash to…

wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 re-appends a trailing slash to rename source paths, causing renameat on macOS and FreeBSD hosts to follow directory symlinks. A guest with sandbox write access can rename a relative symlink such as "up/" to...

Bytecode Alliance wasmtime post-link vulnerability

Bytecode Alliance: Versions prior to 36.0.18, 37.0.0 through 48.0.6, and 49.0.0 through 49.0.3 contain a post-link vulnerability. This vulnerability arises because wasmtime-wasi reattaches trailing slashes to renamed source paths, causing renameat directories on macOS and FreeBSD hosts to follow...

CVE-2026-118335

Out of bounds write in Metrics in Google Chrome on on Mac prior to 156.0.8078.73 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted file. Chromium security severity: High...

CVE-2026-118329

Improper input validation in ANGLE in Google Chrome on on Mac prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-112655

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing maliciously crafted web content may lead to arbitrary code...