CVE-2026-65362

This issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to gain root privileges...

CVE-2026-84622

A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app with root privileges may be able to read...

CVE-2026-84622

CVE-2026-84622 is a memory initialization issue in Apple's operating systems, fixed via improved memory handling. An app with root privileges may be able to read uninitialized kernel memory , representing a local information disclosure risk. The vulnerability affects iOS 26.7 / iPadOS 26.7 , iOS ...

EUVD-2026-78012

This issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to gain root privileges...

CVE-2026-64712

This issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to gain root privileges...

CVE-2026-76461

A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to insufficient validation in the email...

EUVD-2026-77625

A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to insufficient validation in the email...

Astra Linux – Vulnerability in exim4

Exim 4 before 4.94.2 allowed execution with unnecessary privileges. Since Exim operates as root in the spool directory owned by a non-root user, an attacker could write to the /var/spool/exim4/input spool header file. A crafted recipient address in that file could indirectly lead to command...

Astra Linux – Vulnerability in Samba

The Samba vfsfruit module utilizes extended file attributes EA, xattr to enhance compatibility with Apple SMB clients and interoperability with Netatalk 3 AFP file servers. Samba versions prior to 4.13.17, 4.14.12, and 4.15.5, when vfsfruit was configured, allowed out-of-bounds heap read and writ...

Astra Linux – Vulnerability in docker.io-app

Moby is an open-source container framework. In versions prior to 29.5.1, as well as in moby/moby v2 before v2.0.0-beta.14, when a compressed archive was uploaded to a container via PUT /containers/id/archive or piped through docker cp -, the daemon would resolve the decompression binaries such as...

PT-2026-91736

IBM Langflow OSS 1.0.0 through 1.10.0 can allow attackers to execute arbitrary Python code with root privileges UID=0 on the Langflow server by submitting components containing socket or urllib imports. This enables: 1 AWS credential theft via IMDSv1 SSRF with full IAM role permissions, 2 arbitra...

PT-2026-91485

I don’t know much about the behind-the-scenes making of jailbreaks with the coding etc. I know CVE’s are only part of it, but does anyone think this could be used to make a jailbreak for anything for iOS 26 with the exception of 26.7-27 where it was patched considering it could allow root...

PT-2026-91498

A race condition was addressed with improved locking. This issue is fixed in macOS Tahoe 26.6. A malicious app may be able to gain root privileges...

PT-2026-91270

🚨 CVE-2026-76461 — Cisco Secure Email Gateway, root RCE via crafted email What broke: Cisco's Secure Email Gateway AsyncOS software parses every incoming email to scan and route it. That parsing logic didn't properly validate message content before it got used in a database query — a classic SQL...

Linux Distros Unpatched Vulnerability : CVE-2026-85979

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Affected versions of Puppet Enterprise contain a command injection vulnerability in the handling of the javakeystorepasswd parameter. An authenticated user with...

CVE-2026-85979

Affected versions of Puppet Enterprise contain a command injection vulnerability. An authenticated user with Puppet administrative privileges can inject arbitrary shell commands by providing a specially crafted value for this parameter, which is passed to a shell execution context without...

CVE-2026-85979

Affected versions of Puppet Enterprise contain a command injection vulnerability in the handling of the javakeystorepasswd parameter. An authenticated user with Puppet administrative privileges can inject arbitrary shell commands by providing a specially crafted value for this parameter, which is...

CVE-2026-89009

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 are affected by an unauthenticated arbitrary file write vulnerability in the sync_server daemon listening on TCP port 13136 . The daemon runs as root without authentication and accepts a 100-byte filename field in its pro...

EUVD-2026-76124

Affected versions of Puppet Enterprise contain a command injection vulnerability in the handling of the javakeystorepasswd parameter. An authenticated user with Puppet administrative privileges can inject arbitrary shell commands by providing a specially crafted value for this parameter, which is...

CVE-2026-85979

Puppet Enterprise is affected by a command injection vulnerability in the handling of the java_keystore_passwd parameter. An authenticated user with Puppet administrative privileges can inject arbitrary shell commands by supplying a specially crafted value for this parameter, which is passed to a...