CVE Vulnerability Catalog

A permissions issue in iOS/iPadOS 26.7 and 27, macOS Golden Gate 27 and visionOS 27 allowed a local attacker to overwrite restricted files. It was fixed with improved validation.

An out-of-bounds write issue in Apple systems was addressed with improved bounds checking. Processing a maliciously crafted image may lead to unexpected app termination.

A race condition in macOS was addressed with improved locking. An app may be able to cause unexpected system termination.

An information disclosure issue in macOS was addressed with improved state management. An app may be able to access sensitive network connection information.

A use after free issue in Apple systems was addressed with improved memory management. Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory.

An authorization issue in macOS was addressed with improved entitlement checks. An app with admin privileges may be able to modify the System Keychain.

An input validation issue in Xcode was addressed with improved input validation. Parsing a maliciously crafted binary may lead to unexpected app termination.

A logic issue in Safari, visionOS and watchOS was addressed with improved state management. Processing maliciously crafted web content may lead to unexpected behavior.

An integer underflow in macOS was addressed with improved input validation. An attacker with control of a network file server may be able to cause unexpected system termination.

An out-of-bounds write issue in Apple systems was addressed with improved bounds checking. The issue affects iOS, iPadOS, macOS, tvOS, visionOS and watchOS. An attacker in radio range may be able to cause unexpected system termination.

A privacy issue was addressed with improved access restrictions. The issue affects iOS, iPadOS, macOS, tvOS, visionOS and watchOS. An app may be able to access sensitive user data.

The issue was addressed with improved validation of the caller's access. The issue affects iOS, iPadOS, macOS and visionOS. An app may be able to access protected user data.

Letta through 0.16.8 contains an information disclosure vulnerability because LocalSandbox subprocesses inherit the full server environment. Users running tools can read server secrets such as LETTA_PG_URI, POSTGRES_PASSWORD, and provider API keys, then access cross-tenant database data.

A buffer overflow in macOS was addressed with improved size validation. The issue affects macOS Golden Gate 27, macOS Sequoia 15.8 and macOS Tahoe 26.7. An app may be able to cause unexpected system termination.

The issue was addressed with improved handling of secure input state. The issue affects macOS Golden Gate 27, macOS Sequoia 15.8 and macOS Tahoe 26.7. An app may be able to access sensitive user data.

A race condition in macOS was addressed with additional validation. The issue affects macOS Golden Gate 27, macOS Sequoia 15.8 and macOS Tahoe 26.7. A malicious application may be able to bypass Privacy preferences.

An access issue in macOS was addressed with improved access controls. The issue affects macOS Golden Gate 27, macOS Sequoia 15.8 and macOS Tahoe 26.7. An app may be able to access sensitive user data.

An authorization issue was addressed with improved state management. Fixed in macOS Sequoia 15.8 and visionOS 27. An app may be able to access sensitive user data.

LangAlpha through 2026.09.07 contains an improper isolation vulnerability that places all tenants' sandbox containers on Docker's shared default bridge network with inter-container communication enabled. An authenticated user with code execution in their own sandbox can connect directly to other tenants' containers, bypassing require_workspace_owner checks.

Before version 0.9.0, Pingora accepted HTTP/2 requests where the Host header differed from the :authority pseudo-header. Request filters, cache keys, and logs saw the :authority value, but the upstream received the client-supplied Host value. Pingora also accepted :authority values containing userinfo (e.g., [email protected]), violating RFC 9113 Section 8.3.1.