CVE-2025-46278

The CVE-2025-46278 entry affects macOS Tahoe; root cause involves improved handling of caches that could allow an app to access protected user data. The vulnerability is fixed in macOS Tahoe 26.2. Primary sources (NVD/Red Hat/CIRCL/NCSC entries) describe the issue as a cache-handling problem with...

CVE-2025-46278

The issue was addressed with improved handling of caches. This issue is fixed in macOS Tahoe 26.2. An app may be able to access protected user data...

Improper Path Handling

formio is vulnerable to improper path handling. The vulnerability is due to improper validation of crafted request paths, which allows an unauthenticated or unauthorized attacker to bypass API access controls and retrieve data from protected endpoints...

CVE-2025-59385

An authentication bypass by spoofing vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to access resources which are not otherwise accessible without proper authentication. We have already fixed the...

CAPIO: Safe Kernel-Bypass of Commodity Devices Using Capabilities

Securing low-latency I/O in commodity systems forces a fundamental trade-off: rely on the kernel's high overhead mediated interface, or bypass it entirely, exposing sensitive hardware resources to userspace and creating new vulnerabilities. This dilemma stems from a hardware granularity mismatch:...

ROS-20251217-7306

A vulnerability in the Omnibox component of the Google Chrome browser is related to the implementation of an incorrect control flow. Exploitation of the vulnerability could allow an attacker acting remotely to disclose protected information...

Mattermost API Data Compromise

The vulnerability of the Mattermost instant messaging application’s API component is related to deficiencies in the authentication process when processing the teamid parameter. Exploiting this vulnerability could allow an attacker to compromise the confidentiality of the protected information...

Apple macOS 安全漏洞

Apple macOS is a suite of specialized operating systems developed for Mac computers by Apple Inc. in the United States. A security vulnerability exists in Apple macOS Tahoe versions prior to 26.2, which stems from improper handling of cache and could cause an application to access protected user...

Mattermost Mobile Apps CSRF

The vulnerability of mobile messaging applications like Mattermost Mobile Apps relates to the manipulation of cross-site requests. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access to protected information...

Mattermost Information Disclosure

The vulnerability of the Mattermost instant messaging application is related to errors in information processing. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information during the processing of the user ID parameter...

Mattermost Account Blocking Disclosure

The vulnerability of the Mattermost instant messaging application is related to an overly restrictive mechanism for blocking user accounts. Exploiting this vulnerability could allow a malicious actor to disclose protected information and block external LDAP accounts...

User-ID Credential Agents Unauthorized Disclosure

The vulnerability of the software for creating and managing User-ID Credential Agents relates to the disclosure of system data that is not accessible to authorized personnel in the controlled area. Exploiting this vulnerability could allow an attacker to disclose protected information...

Adobe DNG Software Development Kit Buffer Overflow

The vulnerability of the Adobe DNG Software Development Kit’s file reading and writing software lies in buffer overflow attacks in dynamic memory. Exploiting this vulnerability can allow an attacker to compromise the confidentiality and accessibility of protected information...

Mattermost WebSocket Unauthorized Access

The vulnerability of the WebSocket component in the Mattermost instant messaging application is related to the lack of authentication for the critical function. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

ROS-20251216-7338

A vulnerability in the Core component of the Oracle VM VirtualBox virtualization software tool is related to an access control flaw. Exploitation of the vulnerability could allow an attacker to gain unauthorized access to protected information...

ROS-20251216-7369

A vulnerability in the WebXR component of Google Chrome and Microsoft Edge browsers is related to reading data outside the buffer boundaries in memory. Exploitation of the vulnerability could allow a remote attacker to gain unauthorized access to protected information...

ROS-20251216-7363

A vulnerability in the Extensions component of Google Chrome and Microsoft Edge browsers is related to access control flaws. Exploitation of the vulnerability could allow a remote attacker to gain unauthorized access to protected information...

ROS-20251216-7360

A vulnerability in the V8 JavaScript script handler of Google Chrome and Microsoft Edge browsers is related to errors in the implementation of security checks for standard elements. Exploitation of the vulnerability may allow a remote attacker to gain unauthorized access to protected information...

ROS-20251216-7336

A vulnerability in the Core component of the Oracle VM VirtualBox virtualization software tool is related to an access control flaw. Exploitation of the vulnerability may allow an attacker to gain unauthorized access to protected information...

ROS-20251216-7337

A vulnerability in the Core component of the Oracle VM VirtualBox virtualization software tool is related to an access control flaw. Exploitation of the vulnerability may allow an attacker to gain unauthorized access to protected information...