CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A use after free issue was addressed with improved memory management. The vulnerability affects Apple systems and may allow an app to cause unexpected system termination or corrupt kernel memory.
An out-of-bounds read was fixed with improved bounds checking. Fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6. Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory.
An integer overflow was addressed with improved input validation. The vulnerability affects Apple systems and may allow an app to cause unexpected system termination.
An integer overflow was addressed with improved input validation. An app may cause unexpected system termination.
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to cause unexpected system termination.
A buffer overflow in macOS allows an app to execute arbitrary code out of its sandbox or with elevated privileges. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6.
An out-of-bounds write issue in macOS may cause unexpected system termination by an app. This is fixed in macOS Sequoia 15.7.8 and macOS Tahoe 26.6.
Permissions issue in Apple systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) allowing an app to fingerprint the user. Fixed with additional restrictions.
Vulnerability in macOS (Sequoia, Sonoma, Tahoe) allowing an attacker to cause unexpected system termination or corrupt kernel memory. Fixed with improved memory handling.
Vulnerability in macOS (Sequoia, Sonoma, Tahoe) allowing an app to cause unexpected system termination or write kernel memory. Fixed with improved memory handling.
Vulnerability in macOS (Sequoia, Sonoma, Tahoe) allowing a remote user to cause unexpected system termination or corrupt kernel memory. Fixed with improved memory handling.
Connecting to a malicious SMB server may lead to unexpected system termination. The issue was addressed with improved memory handling.
A remote user may be able to cause unexpected system termination or corrupt kernel memory. A race condition was addressed with improved locking.
A use-after-free vulnerability in Apple systems. An app may cause unexpected system termination.
A memory handling vulnerability in macOS systems. A malicious app may corrupt memory of a system process.
Pheditor ships with a hardcoded default password 'admin' (SHA-512 hash). No mechanism forces a password change on first login. Any deployment using default credentials grants full access to file editor, upload, and terminal, enabling arbitrary file read/write and remote code execution.
An OS Command Injection vulnerability in Pheditor allows an authenticated user to execute arbitrary OS commands by injecting shell metacharacters into the 'dir' POST parameter, bypassing the TERMINAL_COMMANDS whitelist.
A vulnerability in Plack::App::Prerender before version 0.3.0 for Perl allows proxying to an arbitrary host via unvalidated REQUEST_URI concatenation. When the rewrite base is a plain string, the REQUEST_URI is appended without checking if the path starts with a forward slash. An attacker can change the host by sending a request starting with '@', enabling access to internal or restricted hosts.
In JetBrains TeamCity before versions 2026.1.3 and 2025.11.7, unauthenticated remote code execution is possible via the agent polling protocol.
An input validation vulnerability exists in an API component of the Arista orchestrator. An authenticated user can manipulate backend queries, leading to unauthorized data access and unintended outbound network connections.