CVE-2026-10144

Rsbuild before 2.0.9 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by supplying a crafted URL containing shell metacharacters to the server.open configuration on macOS. The openBrowser function in packages/core/src/server/open.ts passes the URL...

CVE-2026-10144 Rsbuild < 2.0.9 Command Injection via openBrowser() URL Handling

Rsbuild before 2.0.9 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by supplying a crafted URL containing shell metacharacters to the server.open configuration on macOS. The openBrowser function in packages/core/src/server/open.ts passes the URL...

CVE-2026-10144 Rsbuild < 2.0.9 Command Injection via openBrowser() URL Handling

Rsbuild before 2.0.9 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by supplying a crafted URL containing shell metacharacters to the server.open configuration on macOS. The openBrowser function in packages/core/src/server/open.ts passes the URL...

CVE-2026-10144 Rsbuild < 2.0.9 Command Injection via openBrowser() URL Handling

Rsbuild before 2.0.9 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by supplying a crafted URL containing shell metacharacters to the server.open configuration on macOS. The openBrowser function in packages/core/src/server/open.ts passes the URL...

CVE-2026-10144

Rsbuild before 2.0.9 contains a command injection vulnerability in the openBrowser() function (packages/core/src/server/open.ts). The function passes a URL through encodeURI() before interpolating it into a shell command executed via child_process.exec(). Because encodeURI() does not encode dolla...

CVE-2026-57441

MCPVault , a lightweight Model Context Protocol server for safe file access in an Obsidian vault , contains a path-filter bypass in PathFilter (src/pathfilter.ts) prior to 0.11.4 . The deny-list for restricted directories (.git, .obsidian, node_modules) is compiled case-sensitively and compared w...

Vulnerabilities exist in Apple macOS and Samba systems, developed by Apple and Samba.

Apple has identified several vulnerabilities in macOS specifically related to Golden Gate 27, Sequoia 15.8, and Tahoe 26.7. These vulnerabilities include heap-based buffer overflows, use-after-free errors, integer overflows, null pointer dereferences, improper access control, privilege escalation...

CVE-2026-77179

On macOS, the virtio-fs host server used by Docker Sandboxes improperly follows symlinks when reopening an unlinked file from a stored path. A malicious guest can replace a parent directory with a symlink, escape the shared workspace, and read or modify arbitrary host files as the VMM user,...

CVE-2026-77179 Docker Sandboxes guest can write arbitrary macOS host files via a symlink in the virtio-fs stored-path fallback

On macOS, the virtio-fs host server used by Docker Sandboxes improperly follows symlinks when reopening an unlinked file from a stored path. A malicious guest can replace a parent directory with a symlink, escape the shared workspace, and read or modify arbitrary host files as the VMM user,...

EUVD-2026-78467

On macOS, the virtio-fs host server used by Docker Sandboxes improperly follows symlinks when reopening an unlinked file from a stored path. A malicious guest can replace a parent directory with a symlink, escape the shared workspace, and read or modify arbitrary host files as the VMM user,...

CVE-2026-77179 Docker Sandboxes guest can write arbitrary macOS host files via a symlink in the virtio-fs stored-path fallback

On macOS, the virtio-fs host server used by Docker Sandboxes improperly follows symlinks when reopening an unlinked file from a stored path. A malicious guest can replace a parent directory with a symlink, escape the shared workspace, and read or modify arbitrary host files as the VMM user,...

CVE-2026-77179

CVE-2026-77179 is a CRITICAL (CVSS 4.0: 9.4) vulnerability in Docker Sandboxes on macOS. The virtio-fs host server improperly follows symlinks when reopening an unlinked file from a stored path, allowing a malicious guest to replace a parent directory with a symlink, escape the shared workspace, ...

CVE-2026-57441: Improper Resolution of Path Equivalence

MCPVault is a lightweight Model Context Protocol server for safe access to files in an Obsidian vault. Prior to 0.11.4, PathFilter in src/pathfilter.ts compiles restricted-directory patterns case-sensitively and compares paths without canonicalizing filesystem-equivalent segment names. On...

CVE-2026-77179: Improper Link Resolution Before File Access

On macOS, the virtio-fs host server used by Docker Sandboxes improperly follows symlinks when reopening an unlinked file from a stored path. A malicious guest can replace a parent directory with a symlink, escape the shared workspace, and read or modify arbitrary host files as the VMM user,...

Mozilla Firefox < 156.0

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 156.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-90 advisory. - Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 156,...

CVE-2026-10144: Improper Neutralization of Special Elements used in an OS Command

Rsbuild before 2.0.9 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by supplying a crafted URL containing shell metacharacters to the server.open configuration on macOS. The openBrowser function in packages/core/src/server/open.ts passes the URL...

PT-2026-92018

Name of the Vulnerable Software and Affected Versions Docker Sandboxes versions 0.28.0 through 0.41.x Docker Desktop affected on macOS when Docker VMM is selected Description On macOS, the virtio-fs host server used by Docker Sandboxes and Docker Desktop improperly follows symbolic links when...

CVE-2026-86909

A logic issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. An app may be able to bypass Gatekeeper checks...

CVE-2026-86917

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to gain root privileges...

CVE-2026-86924

A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7. Connecting a malicious accessory may cause unexpected system termination...