cve-2022-46718-leaky-location

CoreParsecLocation tl;dr add an entitlement check toparsecd Overview CoreParsecLocation is a sample application demonstrating how a third-party app can access a user's precise location without a user's consent or permission. parsecd/CoreParsec also provides information such as localized search...

CLEANSTART-2023-BP20266 Type Confusion vulnerability was found in the Spotlight RPC functions in afpd in Netatalk 3

Security vulnerability affects the netatalk package. A Type Confusion vulnerability was found in the Spotlight RPC functions in afpd in Netatalk 3...

Apple MacOS: CVE-2026-112567: OS X update for Spotlight

This issue was addressed with improved checks. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. A malicious application may be able to bypass Privacy preferences...

Apple MacOS: CVE-2026-112441: OS X update for Spotlight

This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to access sensitive user data...

Apple MacOS: CVE-2026-112558: OS X update for Spotlight

A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to access sensitive user data...

Apple MacOS: CVE-2026-112557: OS X update for Spotlight

The issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A malicious application may be able to bypass Privacy preferences...

Astra Linux – vulnerability in Samba

A infinite loop vulnerability was found in Samba’s mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets sent by the client, the core unmarshalling function slunpackloop failed to validate a field within the network packet containing the count of elements in an array-like...

Astra Linux – vulnerability in Samba

A path disclosure vulnerability has been found in Samba. As part of the Spotlight protocol, Samba discloses the server-side absolute path of shares, files, and directories in the results of search queries. This flaw enables a malicious client or an attacker sending a targeted RPC request to view...

Astra Linux – vulnerability in Samba

A Type Confusion vulnerability was found in Samba’s mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets, one encoded data structure is a key-value style dictionary where the keys are character strings, and the values can be any of the supported types in the mdssvc protocol...

AlmaLinux 9.2 [TuxCare] Security Update: ctdb / libnetapi / libnetapi-devel / libsmbclient / etc (ALMALINUX9.2:CLSA-2025:1739822224)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1739822224 advisory. - A path disclosure vulnerability was found in Samba. As part of the Spotlight protocol, Samba discloses the server-side absolute path of...

Malicious Package

Overview epic-ue-spotlight is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Rocky Linux 9.6 [TuxCare] Security Update: wireshark / wireshark-cli / wireshark-devel Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1785518972)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785518972 advisory. - AFP Spotlight protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service CVE-2026-5401 -...

AlmaLinux 9.6 [TuxCare] Security Update: wireshark / wireshark-cli / wireshark-devel Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1785518972)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785518972 advisory. - AFP Spotlight protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service CVE-2026-5401 -...

Astra Linux – Vulnerability in Wireshark

The AFP Spotlight protocol dissector in Wireshark versions 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows for denial of service attacks...

Malicious code in epic-ue-spotlight (npm)

Source: amazon-inspector bd396aa1bdd76e462e346d6e3ab3dd2396963c3c215ff74a6a7c8aaff2ffebe0 The package epic-ue-spotlight was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in @servicetitan/feature-spotlight (npm)

npm/@servicetitan/feature-spotlight is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11867 Malicious code in @servicetitan/feature-spotlight (npm)

npm/@servicetitan/feature-spotlight is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malware in @servicetitan/feature-spotlight

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CLSA-2026-1785518972 wireshark: Fix of 5 CVEs

backport the epan dissection-depth API recursion checks from upstream 3.6 - CVE-2026-5401: limit recursion depth in AFP Spotlight query dissection - CVE-2026-5406: limit FC-SWILS zone-object recursion depth - CVE-2026-5408: limit BitTorrent DHT bencoded list/dict recursion depth - CVE-2026-6538:...

samba security, bug fix, and enhancement update

An update is available for openchange, evolution-mapi. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Samba is an open-source implementation of the Server Messa...