CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An out-of-bounds write issue in 3D model processing, addressed with improved bounds checking. The flaw affects iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. Processing a maliciously crafted 3D model may lead to memory corruption.
An integer overflow in NFS connection handling, addressed with improved input validation. The flaw affects macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. Connecting to a malicious NFS server may cause unexpected system termination or corrupt kernel memory.
An out-of-bounds access issue in SMB connection handling, addressed with improved bounds checking. The flaw affects macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. Connecting to a malicious SMB server may cause unexpected system termination or corrupt kernel memory.
An authorization issue, addressed with improved state management. The flaw affects macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. An app may be able to break out of its sandbox.
An out-of-bounds read vulnerability in macOS systems, fixed by improved bounds checking. Processing a maliciously crafted file may result in unexpected app termination or disclosure of process memory.
An out-of-bounds write vulnerability in macOS systems, fixed by improved bounds checking. Connecting to a malicious SMB server may lead to kernel memory corruption.
A buffer overflow was addressed with improved bounds checking. Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory.
An out-of-bounds write issue was addressed with improved bounds checking. Processing a maliciously crafted asset catalog may lead to unexpected process termination.
A race condition was addressed with improved state handling. An app may be able to cause unexpected system termination or corrupt kernel memory.
A use after free issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause unexpected system termination or corrupt kernel memory.
An out-of-bounds write issue was addressed with improved bounds checking. Fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to gain root privileges.
A buffer overflow was addressed with improved size validation. Opening a maliciously crafted file may lead to unexpected process termination.
Concrete CMS 9 through 9.5.2 did not validate a CSRF token in the orphaned block removal panel action (removeOrphanedBlocks). A remote attacker could craft a request that, when loaded by an authenticated user holding edit permission on the target page, deleted every block on that page's current version; blocks not aliased to another page or scrapbook entry were also removed from the global Blocks table and their block-type data table, permanently destroying the content. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.1 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting.
In Concrete CMS 9.2.0 through 9.5.2, the REST API page update endpoint (PUT /ccm/api/1.0/pages/{cID}) did not enforce page-property, page-template, or page-type authorization. A user granted only content-editing rights on a page could therefore alter its properties, template, and type through the API, and could set the header_extra_content attribute, which is rendered unescaped into the head element of every page, to persist JavaScript that executed in the browser of every visitor, including higher-privileged reviewers who approve the page version. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.2 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting.
Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables.
A race condition vulnerability in Apple systems, fixed with additional validation. A local user may cause unexpected system termination or read kernel memory.
A vulnerability in Apple systems, fixed with improved checks. An app may cause unexpected system termination.
An out-of-bounds access issue was addressed with improved bounds checking. The vulnerability affects iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. An app may be able to cause unexpected system termination or corrupt kernel memory.
An out-of-bounds write vulnerability in Safari and Apple systems. Processing maliciously crafted web content may lead to memory corruption.
An integer overflow vulnerability in Safari and Apple systems. Processing maliciously crafted web content may lead to memory corruption.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS