The vulnerability of the dyld component in operating systems such as iOS, iPadOS, tvOS, watchOS, and macOS allows attackers to execute arbitrary code.

The vulnerability of the dyld component in iOS, iPadOS, tvOS, watchOS, and macOS relates to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

The vulnerability of the Archive Utility component in macOS operating systems allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Archive Utility component in macOS operating systems is related to an incorrect definition of symbolic links before accessing the file. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

The vulnerability of iPadOS and iOS operating systems, related to the operation beyond the memory buffer, allows attackers to trigger a service failure.

The vulnerability of iPadOS and iOS operating systems lies in the fact that operations occur outside of the memory buffer. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the Music component in macOS operating systems allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Music component in macOS operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker, working remotely, to gain unauthorized access to protected information...

The vulnerability of operating systems iPadOS and iOS, as well as macOS, is related to the disclosure of information through registration files, allowing attackers to gain unauthorized access to protected information.

The vulnerabilities of iPadOS and iOS operating systems, as well as macOS, involve the exploitation of registration files for information disclosure. Exploiting these vulnerabilities can allow attackers to gain unauthorized access to protected information...

The vulnerability of the AppleKeyStore component in operating systems such as visionOS, iOS, iPadOS, macOS, watchOS, and tvOS allows a perpetrator to trigger a service failure.

The vulnerability of the AppleKeyStore component in operating systems such as visionOS, iOS, iPadOS, macOS, watchOS, and tvOS relates to the ability to utilize memory after it is freed. Exploiting this vulnerability could allow a malicious individual to cause a service failure...

The vulnerability of the AppleEvents component in macOS operating systems allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the AppleEvents component in macOS operating systems is related to state management errors. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

CVE-2026-5532 ScrapeGraphAI scrapegraph-ai GenerateCodeNode generate_code_node.py create_sandbox_and_execute os command injection

A vulnerability was found in ScrapeGraphAI scrapegraph-ai up to 1.74.0. The affected element is the function createsandboxandexecute of the file scrapegraphai/nodes/generatecodenode.py of the component GenerateCodeNode Component. The manipulation results in os command injection. The attack may be...

Magento 2 Development MCP Server 操作系统命令注入漏洞

Magento 2 Development MCP Server is an open-source AI assistant integrated tool developed by elgentos commerce & configurators for Magento 2. Versions of Magento 2 Development MCP Server prior to 1.0.2 contained a vulnerability related to operating system command injection. This vulnerability...

Invisible Adversaries: A Systematic Study of Session Manipulation Attacks on VPNs

Virtual Private Networks VPNs are widely used for censorship evasion and traffic protection. VPN users expect to be provided with adequate security protection, and at the same time not be affected by other users connected to the same VPN server, which can be illustrated as the non-interference...

PT-2026-30403

A vulnerability was found in ScrapeGraphAI scrapegraph-ai up to 1.74.0. The affected element is the function create sandbox and execute of the file scrapegraphai/nodes/generate code node.py of the component GenerateCodeNode Component. The manipulation results in os command injection. The attack m...

ScrapeGraphAI 操作系统命令注入漏洞

ScrapeGraphAI is an open-source intelligent web scraping library based on large language models. Versions of ScrapeGraphAI 1.74.0 and earlier contain a vulnerability related to operating system command injection, which stems from the createsandboxandexecute function’s ability to execute OS comman...

CVE-2026-34779

CVE-2026-34779 affects Electron on macOS prior to patches 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8. The vulnerability arises in the AppleScript fallback path used by app.moveToApplicationsFolder(), which failed to properly handle certain characters in the application bundle path. Under specific ...

Critical Photon OS Security Update - PHSA-2026-5.0-0802

Updates of 'rubygem-activesupport', 'etcd', 'glibc', 'nghttp2', 'strongswan', 'python3-Pygments', 'sqlite', 'python3-requests', 'python3-pyOpenSSL', 'libpng', 'python3' packages of Photon OS have been released...

Photon OS 4.0: Python3 PHSA-2026-4.0-0991

An update of the python3 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-4.0-0991. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2026-34938

PraisonAI is a multi-agent teams system. Prior to version 1.5.90, executecode in praisonai-agents runs attacker-controlled Python inside a three-layer sandbox that can be fully bypassed by passing a str subclass with an overridden startswith method to the safegetattr wrapper, achieving arbitrary ...

CVE-2025-43210

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing a maliciously crafted media file may lead to...

CVE-2026-34938 PraisonAI: Python Sandbox Escape via str Subclass startswith() Override in execute_code

PraisonAI is a multi-agent teams system. Prior to version 1.5.90, executecode in praisonai-agents runs attacker-controlled Python inside a three-layer sandbox that can be fully bypassed by passing a str subclass with an overridden startswith method to the safegetattr wrapper, achieving arbitrary ...

EUVD-2026-18919

PraisonAI is a multi-agent teams system. Prior to version 1.5.90, executecode in praisonai-agents runs attacker-controlled Python inside a three-layer sandbox that can be fully bypassed by passing a str subclass with an overridden startswith method to the safegetattr wrapper, achieving arbitrary ...

CVE-2026-34938 PraisonAI: Python Sandbox Escape via str Subclass startswith() Override in execute_code

PraisonAI is a multi-agent teams system. Prior to version 1.5.90, executecode in praisonai-agents runs attacker-controlled Python inside a three-layer sandbox that can be fully bypassed by passing a str subclass with an overridden startswith method to the safegetattr wrapper, achieving arbitrary ...