CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.09)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
CoolType.dll in Adobe Reader and Acrobat in versions 10.x before 10.1.13 and 11.x before 11.0.10 on Windows, and 10.x through 10.1.13 and 11.x through 11.0.10 on OS X, allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted PDF document.
Multiple unspecified vulnerabilities in the Bluetooth driver in Apple OS X before 10.10.2 allow attackers to execute arbitrary code in a privileged context.
The Bluetooth driver in Apple OS X before version 10.10.2 allows attackers to execute arbitrary code in a privileged context or cause a denial of service via a crafted app.
The xpc_data_get_bytes function in libxpc in Apple OS X before 10.10.2 does not verify that a dictionary's Attributes key has the xpc_data data type. This allows attackers to execute arbitrary code by providing a crafted dictionary to sysmond, related to an 'XPC type confusion' issue.
SceneKit in Apple OS X before 10.10.2 allows attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via a crafted app.
A vulnerability in Apple OS X before version 10.10 allows attackers to write to the sandbox-profile cache via a sandboxed app that includes a com.apple.sandbox segment in a path.
The kernel in Apple OS X before 10.10.2 does not properly perform identitysvc validation of certain directory-service functionality, allowing local users to gain privileges or spoof directory-service responses.
The kernel in Apple OS X before 10.10.2 does not properly validate IODataQueue object metadata fields, allowing attackers to execute arbitrary code in a privileged context.
IOHIDFamily in Apple OS X before 10.10.2 allows attackers to execute arbitrary code in a kernel context or cause a denial of service (write to kernel memory) via a crafted app that calls an unspecified user-client method.
The Intel Graphics Driver in Apple OS X before 10.10.2 allows local users to gain privileges via unspecified vectors. This is a different vulnerability than CVE-2014-8819 and CVE-2014-8820.
The Intel Graphics Driver in Apple OS X before 10.10.2 allows local users to gain privileges via unspecified vectors. This is a different vulnerability than CVE-2014-8819 and CVE-2014-8821.
The Intel Graphics Driver in Apple OS X before 10.10.2 allows local users to gain privileges via unspecified vectors. This is a different vulnerability than CVE-2014-8820 and CVE-2014-8821.
CoreSymbolication in Apple OS X before 10.10.2 does not verify that expected data types are present in XPC messages, allowing attackers to execute arbitrary code in a privileged context. This issue affects functions related to mmap archives.
An integer signedness error in IOBluetoothFamily in the Bluetooth implementation in Apple OS X before 10.10 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (write to kernel memory) via a crafted app.
The kernel in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not enforce the read-only attribute of a shared memory segment during use of a custom cache mode, allowing attackers to bypass intended access restrictions via a crafted app.
The app-installation functionality in MobileInstallation in Apple iOS before 8.1.3 allows attackers to obtain control of the local app container by leveraging access to an enterprise distribution certificate for signing a crafted app.
libnetcore in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not verify that certain values have the expected data type. This allows attackers to execute arbitrary code in a _networkd context via a crafted XPC message from a sandboxed app.
IOHIDFamily in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not properly initialize event queues, allowing attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app.
IOHIDFamily in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not properly validate resource-queue metadata, allowing attackers to execute arbitrary code in a privileged context via a crafted app.
Buffer overflow in IOHIDFamily in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 allows attackers to execute arbitrary code in a privileged context.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS