CVE-2026-84516

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Processing a maliciously crafted file may result in unexpected app termination or disclosure of process memory...

CVE-2026-84516

An out-of-bounds read vulnerability exists in macOS and was addressed with improved bounds checking. The issue affects macOS Golden Gate 27 , macOS Sequoia 15.8 , and macOS Tahoe 26.7 . Processing a maliciously crafted file may result in the disclosure of process memory or unexpected app terminat...

EUVD-2026-77956

An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted file may result in disclosure of...

CVE-2026-84487

An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted file may result in disclosure of...

Buffer Overflow

Overview Affected versions of this package are vulnerable to Buffer Overflow in the elfx8664relocatesection function due to improper handling of the roff argument. An attacker can achieve unauthorized access to memory and potentially execute arbitrary code by supplying a specially crafted input...

AZL-100971 CVE-2026-84445 affecting package azl-otel-collector 0.127.0-1

gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer allow internal/transport/http2server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go...

AZL-101001 CVE-2026-84445 affecting package cloud-provider-kubevirt for versions less than 0.5.1-9

gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer allow internal/transport/http2server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go...

AZL-101070 CVE-2026-84445 affecting package multus 4.0.2-11

gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer allow internal/transport/http2server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go...

AZL-101043 CVE-2026-84445 affecting package kata-containers for versions less than 3.32.0.kata0-6

gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer allow internal/transport/http2server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go...

MGASA-2026-0407 Updated libcupsfilters & cups-filters packages fix security vulnerabilities

cpu exhaustion via infinite loop in cfieee1284normalizemakemodel. CVE-2026-64611 cups image filter process abort via malformed png. CVE-2026-64612...

Updated libcupsfilters & cups-filters packages fix security vulnerabilities

cpu exhaustion via infinite loop in cfieee1284normalizemakemodel. CVE-2026-64611 cups image filter process abort via malformed png. CVE-2026-64612...

CVE-2026-84445

CVE-2026-84445 affects gRPC-Go prior to versions 1.82.2 and 1.83.2 . Servers created via xds.NewGRPCServer() accept RPCs containing neither the :authority nor Host header. The RouteAndProcess function in internal/xds/server/routing.go then assumes an authority value exists and indexes an empty sl...

CVE-2026-55235 langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication

langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, langgraph-api permits a run or cron to specify a relative webhook target that is delivered through an in-process loopback transport, and the authentication middleware treats that transport as internal...

CVE-2026-55235 langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication

langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, langgraph-api permits a run or cron to specify a relative webhook target that is delivered through an in-process loopback transport, and the authentication middleware treats that transport as internal...

CVE-2026-55235

langgraph-api (the LangGraph Server runtime) prior to 0.10.0 allows a run or cron to specify a relative webhook target that is delivered through an in-process loopback transport. The authentication middleware treats this transport as internal, so the webhook reaches the server's own thread and ru...

CVE-2026-57124 PraisonAI UI MCP connect endpoint allows unauthenticated local command execution

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the default UI host applications expose POST /api/mcp/connect without mandatory authentication and accept caller-controlled command and args values that PraisonAIUI passes to StdioMCPClient to start a local process. Because the UI commands...

CVE-2026-57124 PraisonAI UI MCP connect endpoint allows unauthenticated local command execution

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the default UI host applications expose POST /api/mcp/connect without mandatory authentication and accept caller-controlled command and args values that PraisonAIUI passes to StdioMCPClient to start a local process. Because the UI commands...

CVE-2026-57124

PraisonAI (a multi-agent LLM framework) is vulnerable to unauthenticated remote code execution in versions prior to 4.6.59 . The default UI host applications expose POST /api/mcp/connect without mandatory authentication, accepting caller-controlled command and args fields that are passed to Stdio...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization due to improper enforcement of entitlements in the ClientApp update process. An attacker can gain unauthorized access to update operations by possessing only the create entitlement, which is incorrectly checked f...

CVE-2026-7208

Yealink SIP-T33G firmware versions 124.86.x.x prior to 124.87.0.0 contain a race condition vulnerability that allows authenticated attackers to interrupt active diagnostic processes by concurrently deleting output files written to predictable paths under the diagnostic directory. Attackers can...