CVE-2026-65380

CVE-2026-65380 is a vulnerability in Apple macOS related to improper handling of snapshots , where insufficient permissions logic could allow an app to access protected user data . The issue is fixed in macOS Golden Gate 27 ; the connected NCSC advisory also lists Sequoia 15.8 and Tahoe 26.7 amon...

EUVD-2026-77999

A permissions issue was addressed with improved path validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to modify protected system files...

CVE-2026-84609

A permissions issue was addressed with improved path validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to modify protected system files...

CVE-2026-65348

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to modify protected parts of the file system...

EUVD-2026-77994

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to modify protected parts of the file system...

EUVD-2026-77980

A path handling issue was addressed with improved validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, visionOS 27. An app may be able to modify protected parts of the file system...

Insufficiently Protected Credentials

Overview org.apache.storm:storm-server is a distributed realtime computation system. Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the getNimbusConf process. An attacker can obtain sensitive configuration data, including authentication payloads and...

Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the storm.zookeeper.topology.auth.payload configuration parameter. An attacker can gain unauthorized access to sensitive ZooKeeper credentials by obtaining read-only topology permissions or...

Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the getTopologyPageInfo process. An attacker can access sensitive daemon configuration data, including authentication payloads and passwords, by sending requests to the topology page endpoints...

Insufficiently Protected Credentials

Overview org.apache.storm:storm-server is a distributed realtime computation system. Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the getTopologyPageInfo process. An attacker can access sensitive daemon configuration data, including authentication...

Insufficiently Protected Credentials

Overview org.apache.syncope.core:syncope-core-provisioning-java is an Open Source system for managing digital identities in enterprise environments, implemented in Java EE technology and released under Apache 2.0 license. Affected versions of this package are vulnerable to Insufficiently Protecte...

CVE-2026-75015

Insufficiently Protected Credentials vulnerability in Apache Syncope. Audit events, when sent to the configured store, are not sufficiently masked for the sensitive values they might carry on their payloads, thus allowing administrators to access such sensitive values. This issue affects Apache...

Astra Linux – Vulnerability in Redis

Redis is an in-memory database that persists data on disk. Upon startup, Redis begins listening on Unix sockets before adjusting its permissions according to the user-provided configuration. If a permissive umask value is used, this can create a race condition that allows another process to...

Astra Linux – Vulnerability in imagemagick

ImageMagick versions before 6.9.11-40 and 7.x before 7.0.10-40 mishandle the -authenticate option, which allows setting a password for password-protected PDF files. The user-controlled password was not properly escaped/sanitized, allowing additional shell commands to be injected through...

Astra Linux – Vulnerability in HAPProxy

A issue was discovered in HAProxy 2.0 before 2.0.24, 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. A HTTP method name may contain a space followed by the name of a protected resource. It is possible that a server would interpret this as a request for that protected resource, as in t...

CVE-2026-82786

Insufficiently protected credentials issue exists in Remote I/O Coupler Unit Server Type CPSN-MCB271-. If this vulnerability is exploited, sensitive information may be restored from a backup file...

CVE-2026-82786

Insufficiently protected credentials issue exists in Remote I/O Coupler Unit Server Type CPSN-MCB271-. If this vulnerability is exploited, sensitive information may be restored from a backup file...

CVE-2026-82786

Insufficiently protected credentials issue exists in Remote I/O Coupler Unit Server Type CPSN-MCB271-. If this vulnerability is exploited, sensitive information may be restored from a backup file...

CVE-2026-82786

CVE-2026-82786 affects the Contec Remote I/O Coupler Unit (Server Type) CPSN-MCB271- *. The root cause is an insufficiently protected credentials issue: if exploited, sensitive information may be restored from a backup file . The vulnerability is scored 6.3 (CVSS v3.1, MEDIUM) and 8.2 (CVSS v4.0,...

CVE-2026-43741: Improper Access Control

A logic issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access protected user data...