CVE-2026-100230

Input Leap aka input-leap through 3.0.3, when the non-default --enable-drag-drop option is used on Windows or macOS, mishandles the / versus \ distinction and allows directory traversal, with resultant code execution if a file is written to a startup directory. This occurs via a DDRG message...

PamStealer macOS Malware Adds Live C2 Payload Decryption and Multi-Layer Persistence

Cybersecurity researchers have flagged a new version of PamStealer that ensures that the main payload can only be recovered using a server-side decryption chain. The latest artifacts, per Jamf Threat Labs, continue to rely on the same JavaScript for Automation JXA dropper mechanism, but modify th...

CVE-2026-100230: Incorrect Behavior Order: Validate Before Canonicalize

Input Leap aka input-leap through 3.0.3, when the non-default --enable-drag-drop option is used on Windows or macOS, mishandles the / versus \ distinction and allows directory traversal, with resultant code execution if a file is written to a startup directory. This occurs via a DDRG message...

CVE-2026-100388: Missing Authorization

RustDesk versions before 1.5.0 fail to properly validate file transfer permissions on incoming file clipboard messages in the Cliprdr message handler on Linux and macOS. Authenticated remote peers with disabled file transfer permissions can place files onto the host clipboard and retrieve copied...

PT-2026-98874

Name of the Vulnerable Software and Affected Versions Input Leap versions prior to 3.0.4 Description When the non-default --enable-drag-drop option is active on Windows or macOS, the software mishandles the distinction between forward slashes / and backslashes . This flaw allows directory travers...

Exploit for Out-of-bounds Read in Apple Macos

CVE-2026-84543: a remote kernel vulnerability in macOS SMBFS...

CVE-2026-96872

Improper handling of insufficient permissions or privileges vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension on Linux, MacOS, and Windows allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki - WikiLambda Extension: before 1.47.0...

CVE-2026-96872 WikiLambda public function execution bypasses the unsaved-code permission through nested Z825 compositions

Improper handling of insufficient permissions or privileges vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension on Linux, MacOS, and Windows allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki - WikiLambda Extension: before 1.47.0...

CVE-2026-96872

The WikiLambda Extension for MediaWiki (versions prior to 1.47.0 ) is vulnerable to an improper handling of insufficient permissions. Specifically, public function execution can bypass unsaved-code permissions through nested Z825 compositions , allowing access to functionality that is not properl...

EUVD-2026-85562

Improper handling of insufficient permissions or privileges vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension on Linux, MacOS, and Windows allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki - WikiLambda Extension: before 1.47.0...

CVE-2026-96872 WikiLambda public function execution bypasses the unsaved-code permission through nested Z825 compositions

Improper handling of insufficient permissions or privileges vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension on Linux, MacOS, and Windows allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki - WikiLambda Extension: before 1.47.0...

EUVD-2026-66421

RustDesk versions 1.3.9 through 1.4.9 contain a path traversal vulnerability in the macOS clipboard file-paste code path. The application accepts peer-supplied file descriptor names and joins them to the selected target directory without requiring normalized relative paths. A remote peer in an...

SUSE CVE-2026-95296

Missing authorization in Core in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted HTML page. Chromium security severity: Low...

CVE-2026-91800

A local privilege escalation vulnerability exists in the installer of Foxit PDF Editor for macOS due to insufficient validation of a user-modifiable configuration value during high-privilege upgrades. A local attacker could exploit this issue to execute arbitrary commands with root privileges...

EUVD-2026-85122

A local privilege escalation vulnerability exists in the installer of Foxit PDF Editor for macOS due to insufficient validation of a user-modifiable configuration value during high-privilege upgrades. A local attacker could exploit this issue to execute arbitrary commands with root privileges...

CVE-2026-91800 Foxit PDF Editor installer local privilege escalation

A local privilege escalation vulnerability exists in the installer of Foxit PDF Editor for macOS due to insufficient validation of a user-modifiable configuration value during high-privilege upgrades. A local attacker could exploit this issue to execute arbitrary commands with root privileges...

CVE-2026-91800 Foxit PDF Editor installer local privilege escalation

A local privilege escalation vulnerability exists in the installer of Foxit PDF Editor for macOS due to insufficient validation of a user-modifiable configuration value during high-privilege upgrades. A local attacker could exploit this issue to execute arbitrary commands with root privileges...

CVE-2026-91800

A local privilege escalation vulnerability exists in the installer of Foxit PDF Editor for macOS . The vulnerability is caused by insufficient validation of a user-modifiable configuration value during high-privilege upgrades. A local attacker could exploit this flaw to execute arbitrary commands...

MAL-2026-16443 Malicious code in my-company-device (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbd39b4115bf373ff8f8d036f1db1cdb58e1fb3712d3330eabad7dbc5796ac4f Running npx my-company-device appends a hardcoded ssh-ed25519 public key labelled sunyiting-macmini to the installer's /.ssh/authorizedkeys mode 0o60...

Malicious code in my-company-device (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbd39b4115bf373ff8f8d036f1db1cdb58e1fb3712d3330eabad7dbc5796ac4f Running npx my-company-device appends a hardcoded ssh-ed25519 public key labelled sunyiting-macmini to the installer's /.ssh/authorizedkeys mode 0o60...