CVE-2026-73218

Cursor is a code editor built for programming with AI. Prior to 3.0.0, Cursor IDE for macOS allows an agent running in Auto-Run Sandbox mode, when Docker Desktop and the Dev Containers CLI are installed, to launch a privileged container and mount Docker's virtiofs0, granting read and write access...

CVE-2026-73218 Cursor: Sandbox escape via launching privileged containers

Cursor is a code editor built for programming with AI. Prior to 3.0.0, Cursor IDE for macOS allows an agent running in Auto-Run Sandbox mode, when Docker Desktop and the Dev Containers CLI are installed, to launch a privileged container and mount Docker's virtiofs0, granting read and write access...

CVE-2026-73218 Cursor: Sandbox escape via launching privileged containers

Cursor is a code editor built for programming with AI. Prior to 3.0.0, Cursor IDE for macOS allows an agent running in Auto-Run Sandbox mode, when Docker Desktop and the Dev Containers CLI are installed, to launch a privileged container and mount Docker's virtiofs0, granting read and write access...

CVE-2026-73218

Cursor for macOS prior to 3.0.0 is vulnerable to a sandbox escape: an agent in Auto-Run Sandbox mode, with Docker Desktop and the Dev Containers CLI installed, can launch a privileged container and mount Docker’s virtiofs0. This grants read/write access to the user’s home directory and enables ho...

CVE-2026-73217

The CVE describes a sandbox-escape flaw in Cursor IDE for macOS prior to 3.1.2. An agent in Auto-Run Sandbox mode can replace a virtual environment’s Python executable with a malicious wrapper that the Microsoft Python extension invokes outside the sandbox, enabling arbitrary host commands with t...

EUVD-2026-56838

Cursor is a code editor built for programming with AI. Prior to 3.1.2, Cursor IDE for macOS allows an agent running in Auto-Run Sandbox mode to replace a virtual environment's Python executable with a malicious wrapper that the Microsoft Python extension invokes outside the sandbox, allowing...

CVE-2026-73217 Cursor: Sandbox escape via tampered Python virtual environments

Cursor is a code editor built for programming with AI. Prior to 3.1.2, Cursor IDE for macOS allows an agent running in Auto-Run Sandbox mode to replace a virtual environment's Python executable with a malicious wrapper that the Microsoft Python extension invokes outside the sandbox, allowing...

CVE-2026-65680

CVE-2026-65680 : Microsoft OneDrive for MacOS is affected by an Elevation of Privilege vulnerability. The issue arises from improper link resolution before file access (“link following”), allowing an authorized local attacker to escalate privileges. Affected component is OneDrive for MacOS; root ...

CVE-2026-65680 Microsoft OneDrive for MacOS Elevation of Privilege Vulnerability

...

CVE-2026-65680 Microsoft OneDrive for MacOS Elevation of Privilege Vulnerability

...

EUVD-2026-56787

Turso CLI is the command line interface CLI to the open-source database Turso. Versions prior to 1.0.26 persist the user's Turso platform JWT to settings.json using Viper's default configPermissions of 0o644, leaving the credential file world-readable on standard Linux and macOS systems. Any othe...

CVE-2026-48790 turso-cli persists Turso platform JWT with world-readable (0o644) file permissions

Turso CLI is the command line interface CLI to the open-source database Turso. Versions prior to 1.0.26 persist the user's Turso platform JWT to settings.json using Viper's default configPermissions of 0o644, leaving the credential file world-readable on standard Linux and macOS systems. Any othe...

Microsoft OneDrive for MacOS Elevation of Privilege Vulnerability

Improper link resolution before file access 'link following' in Microsoft OneDrive allows an authorized attacker to elevate privileges locally...

PT-2026-70833

Cursor is a code editor built for programming with AI. Prior to 3.0.0, Cursor IDE for macOS allows an agent running in Auto-Run Sandbox mode, when Docker Desktop and the Dev Containers CLI are installed, to launch a privileged container and mount Docker's virtiofs0, granting read and write access...

PT-2026-70832

Cursor is a code editor built for programming with AI. Prior to 3.1.2, Cursor IDE for macOS allows an agent running in Auto-Run Sandbox mode to replace a virtual environment's Python executable with a malicious wrapper that the Microsoft Python extension invokes outside the sandbox, allowing...

ClickFix Attacks Deliver macOS Stealer That Can Drain Crypto Wallets

ClickFix-style attacks are being used to deliver a Go-based malware capable of stealing cryptocurrency assets, as well as browser-stored passwords, Apple iCloud Keychain data, and cached credentials. The macOS-focused infection chain is designed to deliver a shell script that profiles the host an...

EUVD-2026-54216

An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials...

Apple Security Advisory 07-27-2026-4

Apple Security Advisory 07-27-2026-4 - macOS Sonoma 14.8.8 addresses buffer overflow, bypass, code execution, denial of service, double free, heap corruption, information leakage, integer overflow, out of bounds read, out of bounds write, traversal, and use-after-free vulnerabilities...

VulnCheck KEV: CVE-2026-65400

An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials...

Apple Security Advisory 07-27-2026-2

Apple Security Advisory 07-27-2026-2 - macOS Tahoe 26.6 addresses buffer overflow, bypass, code execution, denial of service, heap corruption, information leakage, integer overflow, out of bounds access, out of bounds read, out of bounds write, spoofing, traversal, and use-after-free...