CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.03)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A file quarantine bypass in macOS was addressed with additional checks. An app may bypass Gatekeeper checks. This affects Golden Gate, Sequoia and Tahoe versions.
A permissions issue in macOS was addressed with additional restrictions. An attacker with root privileges may be able to access protected user data. This affects Golden Gate and Tahoe versions.
A logic issue in macOS was addressed with improved state management. An app may bypass Gatekeeper checks. This affects Golden Gate, Sequoia and Tahoe versions.
A privacy issue in macOS was addressed with improved memory management. An app may be able to access sensitive user data. This affects Golden Gate, Sequoia and Tahoe versions.
An authorization issue in Apple systems was addressed with improved state management. The flaw affects iOS 27.2, iPadOS 27.2, macOS Golden Gate 27.2 and visionOS 27.2. An app may be able to access sensitive user data.
An authorization issue in Apple systems was addressed with improved state management. The flaw affects iOS/iPadOS 26.7.2, iOS/iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2 and visionOS 27. An app may be able to access sensitive user data.
An issue in Apple systems was addressed with additional entitlement checks. The flaw affects iOS/iPadOS 26.7.2 and iOS/iPadOS 27. An app may be able to access sensitive user data.
A race condition in Apple systems was addressed with additional validation. The flaw affects iOS/iPadOS 27, macOS Golden Gate 27 and visionOS 27. An app may be able to cause unexpected system termination or write kernel memory.
A logic issue in Apple systems was addressed with improved checks. The flaw affects iOS/iPadOS 26.7.2 and iOS/iPadOS 27. An attacker with physical access may be able to access contacts from the lock screen.
An out-of-bounds write issue in Apple systems allows an app to cause unexpected system termination. The issue was addressed with improved bounds checking and is fixed in iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, and visionOS 27.
A logic issue in iOS and iPadOS allows an app to access sensitive user data. The issue was addressed with improved state management and is fixed in iOS 26.7.2, iPadOS 26.7.2, iOS 27, and iPadOS 27.
An out-of-bounds write issue was addressed with improved bounds checking in macOS Golden Gate and macOS Tahoe. Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory.
An authentication issue in Apple systems was addressed with improved state management. A malicious app may be able to access Bluetooth without user consent.
An authorization issue in Apple systems was addressed with improved state management. An app may be able to access sensitive user data.
A permissions issue in macOS was addressed with additional restrictions. An app with root privileges may be able to access private information.
A logic issue in macOS was addressed with improved validation. The issue affects macOS Golden Gate 27, macOS Sequoia 15.8.2, and macOS Tahoe 26.7.2. A maliciously crafted disk image may bypass Gatekeeper checks.
An out-of-bounds write issue was addressed with improved bounds checking. The issue affects iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8.2, and macOS Tahoe 26.7.2. Processing a maliciously crafted image may result in memory corruption.
An authorization issue in macOS was addressed with improved state management. The issue affects macOS Golden Gate 27 and macOS Tahoe 26.7.2. An app may be able to access sensitive user data.
In Seroval from 1.6.0 until 1.6.11, JavaScript-output APIs derive a typed array's constructor name from a property that can be replaced by an own constructor property. When application code copies untrusted properties onto a typed array and serializes it, the attacker-controlled name is written as executable JavaScript.
In Seroval prior to 1.0.0 and from 1.5.5 until 1.6.10, JavaScript-output APIs serialize a RegExp source containing a less-than character without the escaping needed for an HTML script element. When an application builds a RegExp from untrusted input and embeds the result in a script element, the crafted source can terminate the element and execute script.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS