CVE Vulnerability Catalog

An out-of-bounds read was addressed with improved bounds checking in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. An app may be able to cause unexpected process termination or disclose process memory.

A denial-of-service issue in iOS and iPadOS was addressed with improved validation. The issue is fixed in iOS 18.7.10 and iPadOS 18.7.10. A remote attacker may be able to cause a denial-of-service.

A privacy issue was addressed by moving sensitive data. The issue affects iOS 26.6 and iPadOS 26.6. An app may be able to fingerprint the user.

The issue was addressed with improved memory handling. The issue affects iOS 26.6.1 and iPadOS 26.6.1, macOS Sequoia 15.8, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, and watchOS 27. An app may be able to cause unexpected system termination or corrupt kernel memory.

An authentication issue in Apple systems allows an app to use the Sign In With Apple flow to access the user's Apple Account. It was addressed with improved state management in iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, and visionOS 27.

IBM Sterling File Gateway versions 6.2.0.0 through 6.2.0.6_1, 6.2.1.0 through 6.2.1.2, and 6.2.2.0 through 6.2.2.1 could allow a remote attacker to obtain sensitive information due to improper access control.

IBM MQ versions LTS and CD up to 10.0.0.0 allow a remote authenticated attacker to execute arbitrary code on the system due to deserialization of untrusted data.

IBM MQ versions LTS and CD up to 10.0.0.0 are vulnerable to XML External Entity (XXE) attacks when processing XML data, potentially exposing sensitive information or consuming memory resources.

IBM MQ is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

IBM MQ Managed File Transfer versions LTS and CD up to 10.0.0.0 allow an authenticated attacker to read arbitrary files or perform server-side request forgery due to XML external entity injection in reply message processing.

IBM Verify Identity Access allows a remote attacker to cause a denial of service due to insufficient validation of incoming request resources. The flaw affects how the product processes requests.

IBM Business Automation Workflow (containers and traditional) may use programming model artifacts that are vulnerable to XML Entity Injection attacks by default.

Magistrala before 1.0.0 contains a SQL injection vulnerability in the timescale-reader and postgres-reader HTTP API services, allowing authenticated attackers to inject arbitrary SQL via the format parameter.

MCP Atlassian before 0.22.0 allows a client with write-tool access to pass file paths without confinement to the server, leading to disclosure of server files, Atlassian credentials, or another tenant's data.

Skipper before 0.27.35 has a vulnerability in the opaAuthorizeRequestWithBody filter that allows bypassing deny-on-presence Rego policies for requests with oversized declared Content-Length when the body exceeds the size limit.

SIPSorcery before 10.0.9 has a vulnerability in RTP packet and STUN attribute handling, where insufficient length checks can allow a remote attacker to close the channel, terminating the active RTP or WebRTC media session.

Anyquery before 0.4.5 exposes file-backed SQLite virtual table modules (csv_reader, log_reader) through its MySQL-compatible server port without authentication, allowing a remote attacker to read arbitrary files from the system.

Anyquery prior to 0.4.5 exposes URL-capable SQLite virtual table modules (json_reader, log_reader) through its unauthenticated MySQL-compatible server port without restricting outbound destinations. A remote attacker can supply a loopback, private-network, or link-local URL (e.g. cloud metadata), causing go-getter to fetch the resource and expose the response as queryable table data.

In garminconnect prior to 0.3.5, Client.dump in client.py creates the OAuth token directory and garmin_tokens.json without explicit owner-only modes, so with umask 022 the directory is 0755 and the file is 0644. garmin_tokens.json contains di_refresh_token, which another unprivileged user on a shared Linux/macOS host can read to gain persistent access to the victim's Garmin Connect account.

In Anyquery prior to 0.4.5, the clear_plugin_cache(plugin) SQL scalar function in namespace/other_functions.go passes the caller-controlled plugin parameter through path.Join to os.RemoveAll without rejecting traversal segments. A low-privileged bearer-token holder can invoke it via the /v1/query HTTP endpoint, causing recursive deletion of any directory writable by the Anyquery server process.