Use-after-free in the Linux kernel's SMC-R (Shared Memory Communications over RDMA) subsystem allows a race between the CDC receive tasklet and socket close to operate on freed memory, enabling a kernel crash and potential memory corruption on hosts using SMC-R. The flaw lives in smc_cdc_rx_handler(), which looks up a connection under conns_lock, releases the lock, and then dereferences the socket via sock_hold() in smc_cdc_msg_recv() without holding a reference across the window. It affects only systems that have SMC-R enabled and active; there is no public exploit identified at time of analysis and EPSS is low (0.18%, 7th percentile).
A type confusion vulnerability in macOS allows an application to cause unexpected system termination (denial of service). Affected versions include macOS Sequoia, Sonoma, and Tahoe prior to the fixed releases; the issue has been patched by Apple. No public exploit is known, and EPSS indicates very low exploitation probability, with no active exploitation reported.
A data protection flaw in multiple Apple operating systems allows a locally-installed app to fingerprint the user. An attacker can use this information disclosure vulnerability to track the user’s identity across different contexts, violating privacy. The issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6, and no active exploitation or public exploit code has been observed.
Local denial-of-service (kernel double-free/UAF) in the Linux kernel NVMe/TCP target driver (nvmet-tcp) affects hosts serving block storage over NVMe-over-TCP with data digest enabled. When a data-digest mismatch occurs on a non-final H2C_DATA PDU during an R2T-based transfer, the command is uninited but not marked complete, so queue teardown uninits it a second time, causing a double percpu_ref_put against a single get. There is no public exploit identified at time of analysis; EPSS is low (0.17%, 7th percentile) and the flaw is not in CISA KEV.
Denial-of-service (unexpected system termination) affects Apple's shared OS platforms - iOS/iPadOS before 26.6, macOS Sequoia before 15.7.8, macOS Sonoma before 14.8.8, macOS Tahoe/tvOS/visionOS/watchOS before 26.6 - where a use-after-free (CWE-416) lets a locally installed app crash the system. There is no public exploit identified at time of analysis and the NVD CVSS 9.8 (C:H/I:H/A:H) conflicts with Apple's own description, which states only 'unexpected system termination' (availability impact), suggesting the true impact is a DoS crash rather than full compromise. EPSS is low (0.17%, 6th percentile) and the issue is not in CISA KEV.
Local denial-of-service in Apple operating systems via a use-after-free vulnerability allows an app to cause unexpected system termination. Affected versions include iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. While the NVD assigns CVSS 9.8, the actual impact is limited to availability; no active exploitation or public exploit code is identified, and EPSS indicates very low exploitation probability (0.17%).
Use-after-free memory corruption in Apple's iOS 26.6-era platform family lets an already-installed app crash the operating system kernel or a system service, producing an unexpected system termination (denial of service). Affected software spans iOS/iPadOS before 26.6, macOS Sequoia before 15.7.8, macOS Sonoma before 14.8.8, macOS Tahoe before 26.6, and tvOS, visionOS and watchOS before 26.6; exploitation requires the attacker's app to run locally on the device, since the flaw is only reachable from within an executing process. The headline input score of CVSS 9.8 (AV:N) overstates the issue - Apple's own advisory describes impact limited to a crashing app, EPSS is a low 0.17% (6th percentile), CISA SSVC records no exploitation and no public exploit code exists, and no KEV listing or POC is associated with CVE-2026-43822.
Denial of service in Apple operating systems (iOS/iPadOS 26.6, macOS Sonoma 14.8.8, macOS Sequoia 15.7.8, macOS Tahoe 26.6, tvOS/visionOS/watchOS 26.6) allows a locally installed app to trigger an integer overflow that causes unexpected system termination. The flaw was reported and patched by Apple, and CISA's SSVC framework rates exploitation as 'none' with EPSS at just 0.17% (6th percentile), indicating no public exploit identified at time of analysis. Note a significant signal conflict: the NVD CVSS vector of 9.8 (AV:N, full C/I/A impact) is inconsistent with the description, which describes only an app-triggered crash.
Kernel memory corruption in Apple iOS, iPadOS, macOS, tvOS, visionOS, and watchOS allows a malicious app to cause system termination or corrupt kernel memory. A use-after-free issue in the kernel’s memory management could be triggered by an app, leading to unexpected system behavior or potential code execution. Patches are available across all affected operating systems; no active exploitation has been observed.
Missing authorization in Apple's Contacts framework across iOS/iPadOS, macOS Tahoe, visionOS, and watchOS (all versions before 26.6) allows an installed app to add contact entries without triggering the user's authorization prompt. Apple fixed the flaw with improved validation in the 26.6 releases. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low at 0.16% (6th percentile), consistent with a low-severity local privacy-scope bypass despite the input's inflated 9.8 score.
Physical-proximity memory corruption in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, watchOS, visionOS) allows a nearby attacker to corrupt process memory, potentially leading to arbitrary code execution or denial of service. No active exploitation is known, and vendor-released patches are available. EPSS score is low (0.16%), and the CVSS vector supplied (AV:N) conflicts with the required physical proximity.
Denial of service in Apple iOS, macOS, and related operating systems due to a use-after-free flaw could allow a malicious app to crash the device. Apple's advisory only confirms unexpected system termination, but an independent CVSS score of 9.8 suggests potential for full system compromise; however, the CVSS vector appears inconsistent with the vendor description. The vulnerability is patched in versions 26.6 for all affected OSes, and no active exploitation or public exploit code is known.
A race condition in Apple operating systems (iOS, iPadOS, macOS, tvOS, watchOS) fixed in version 26.6 allows a local malicious app to cause unexpected system termination, resulting in a denial-of-service condition. No evidence of active exploitation or public exploit code exists, and EPSS indicates very low exploitation probability (0.16%). The NVD-assigned CVSS 9.8 appears inconsistent with the actual impact, which is limited to availability.
Unexpected system termination in iOS and iPadOS prior to 26.6, as well as in certain versions of macOS, tvOS, and visionOS, resulting from a use-after-free memory corruption. Apple's description indicates a local denial-of-service where a malicious app can crash the system, while the NVD-assigned CVSS 9.8 erroneously implies unauthenticated remote code execution. A patch is available, no active exploitation has been reported, and EPSS suggests a very low probability of wide exploitation.
Use-after-free memory corruption in Apple's core operating-system platforms - iOS/iPadOS, macOS Tahoe, tvOS, and watchOS before version 26.6 - allows a locally installed and executed application to crash or unexpectedly terminate the system. Exploitation requires the victim to run attacker-supplied code as an app on an unpatched device; there is no remote attack surface, and the demonstrable impact is availability only (system termination/reboot), with no data disclosure, modification, or code execution established - meaning the publicly circulated CVSS 9.8 network vector materially overstates the real reachability and impact of this bug. No public exploit identified at time of analysis, EPSS is low at 0.16% (6th percentile), CISA SSVC records Exploitation: none with total technical impact if reached, and Apple has shipped fixes in 26.6 across all four platforms.
A use-after-free memory-corruption flaw in Apple's mobile and desktop operating systems lets an app already running on the device trigger an unexpected system termination - a denial-of-service condition affecting availability only. The issue is fixed in iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, and watchOS 26.6, meaning every device running an earlier build of those platforms is exposed. There is no evidence of active exploitation (not in CISA KEV, SSVC exploitation: none) and no public exploit code has been identified; EPSS is just 0.16% (6th percentile), and the widely circulated CVSS 9.8 AV:N/PR:N vector is grossly inflated relative to the assessed AV:L/AC:L/PR:N/UI:N impact of C:N/I:N/A:H.
Unexpected system termination in macOS prior to Sequoia 15.7.8, Sonoma 14.8.8, or Tahoe 26.6 allows a local application to trigger a denial-of-service via an out-of-bounds read. No active exploitation or public exploit is known, and EPSS indicates a low exploitation probability. The high CVSS score likely overstates the risk, as only a crash is confirmed in the description.
Memory corruption in macOS prior to Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 allows a local app to cause unexpected system termination or corrupt kernel memory. Despite a CVSS score of 9.8, the attack vector is local and no public exploit or active exploitation has been identified; EPSS estimates exploitation probability at 0.16%, and CISA SSVC confirms no current exploitation but notes the issue is automatable with total technical impact.
Improper validation of environment variables in macOS enables a local application to trigger unexpected system termination, causing a denial-of-service condition. The vulnerability affects macOS versions prior to Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. No active exploitation or public exploit has been identified, and the EPSS score is very low at 0.16%.
An out-of-bounds write vulnerability in macOS allows a malicious application to cause unexpected system termination. Apple addressed this in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. No active exploitation or public exploit is known, and EPSS indicates very low exploitation probability.
Mounting a maliciously crafted disk image on macOS may cause unexpected system termination or corrupt kernel memory. Affected versions include macOS Sequoia prior to 15.7.8, macOS Sonoma prior to 14.8.8, and macOS Tahoe prior to 26.6. The vulnerability is an out-of-bounds read in the kernel's disk image handling, exploitable by a locally authenticated user with no privileges beyond the ability to mount a disk image.
Memory corruption in macOS allows a malicious app to write kernel memory or cause unexpected system termination. Affected versions include macOS Sequoia prior to 15.7.8, macOS Sonoma prior to 14.8.8, and macOS Tahoe prior to 26.6. Successful exploitation could lead to complete system compromise with kernel-level privileges, though no active exploitation or public exploit code has been identified and EPSS indicates a low probability (0.16%) of widespread attacks.
A memory handling vulnerability in macOS kernel allows a local malicious application to read kernel memory or trigger an unexpected system termination, without requiring elevated privileges. Fixed versions are macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. No public exploit code is known, and the extremely low EPSS likelihood (0.16%) indicates no active exploitation attempts.
An integer overflow vulnerability in macOS can be triggered by a malicious app to cause unexpected system termination, effectively a denial-of-service. The flaw affects macOS versions prior to Sonoma 14.8.8, Sequoia 15.7.8, and Tahoe 26.6. Although the public CVSS score suggests critical remote code execution, the actual impact appears limited to system crashes, and there is no evidence of active exploitation or public proof-of-concept code.
Unexpected system termination in Apple macOS allows a local application to trigger an integer overflow, causing denial-of-service. Versions prior to Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 are affected. The vulnerability has a low exploitation likelihood (EPSS 0.16%) and no known active exploitation or public exploit code.
A logic flaw in macOS allows a malicious app to intercept network connections intended for other processes. Affected versions prior to macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 can be exploited to read or modify traffic of other apps. No active exploitation or public exploit code has been reported, and EPSS indicates low probability of widespread attack.
A use-after-free vulnerability in macOS allows a local application to cause a denial-of-service by crashing the system or a key service. The flaw affects multiple macOS versions prior to the Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 updates. Despite an assigned CVSS score of 9.8 suggesting remote pre-authentication full compromise, the Apple advisory explicitly describes only a local denial-of-service impact, and the EPSS exploitation probability is very low (0.16%). No active exploitation or public proof-of-concept has been reported, and a vendor patch is available.
Sandbox escape in macOS allows a malicious app to break out of its restrictions and gain full system access. Affected systems include macOS Sonoma before 14.8.8, macOS Sequoia before 15.7.8, and macOS Tahoe before 26.6. No active exploitation or public exploit code has been reported, and the EPSS exploitation probability is low at 0.16%.
Sandbox escape in macOS allows a malicious application to break out of its sandbox and gain arbitrary access to the underlying operating system. All versions prior to the fixed releases (macOS Sequoia 15.7.8, Sonoma 14.8.8, Tahoe 26.6) are affected. No public exploit or active exploitation has been observed at the time of analysis.
Denial of service (and potential use-after-free) in the Linux kernel's NVMe-over-TCP target (nvmet-tcp) subsystem allows a connected NVMe-oF initiator to trigger a refcount underflow via a crafted data-digest mismatch. When a command that previously failed nvmet_req_init() (marked NVMET_TCP_F_INIT_FAILED) hits a data digest error, nvmet_req_uninit() runs an unbalanced percpu_ref_put(), producing a percpu_ref warning, a use-after-free diagnostic, and ultimately a permanent workqueue deadlock that hangs the target. No public exploit identified at time of analysis; EPSS is low at 0.16% (6th percentile), and it is not listed in CISA KEV, so despite the 9.8 NVD score this is realistically a stability/DoS bug confined to hosts acting as NVMe-oF TCP targets with data digest enabled.
Sandbox escape in macOS Sequoia and Tahoe allows a malicious app to break out of its sandbox via a path traversal flaw (CWE-22). Patched in Sequoia 15.7.8 and Tahoe 26.6, the vulnerability enables unauthorized file access from a sandboxed application. No public exploit code is known, and EPSS predicts low exploitation probability (0.16%).
Unexpected system termination due to memory initialization flaw in Apple iOS, iPadOS, macOS, tvOS, watchOS, and visionOS allows a malicious application to forcibly crash the device. All versions prior to the listed fixed releases are affected. No active exploitation or publicly available exploit code was identified at time of analysis; EPSS indicates a low (0.16%) probability of exploitation.
A use-after-free vulnerability in Apple operating systems allows a malicious app to cause unexpected system termination or write to kernel memory. The issue affects iOS
Kernel memory corruption via race condition in Apple OS allows a malicious app to write arbitrary kernel memory or cause unexpected system termination. The issue affects iOS, iPadOS, macOS, and watchOS versions prior to the June 2026 security fixes, and has been patched by Apple. No public exploit or active exploitation is known, and EPSS indicates a low probability of widespread exploitation at this time.
User fingerprinting in Apple iOS, iPadOS, macOS, tvOS, visionOS, and watchOS allows a malicious app to collect device or user identifiers due to a permissions issue. All versions prior to the 26.6 updates are affected. No public exploit code or active exploitation has been identified, and EPSS indicates a low 0.15% probability of exploitation.
Type confusion in macOS and tvOS may allow a malicious app to trigger unexpected system termination and potentially achieve arbitrary code execution with kernel-level privileges. The issue is addressed in macOS Tahoe 26.6 and tvOS 26.6; no active exploitation or public proof-of-concept is known at the time of analysis.
Unexpected system termination in macOS prior to Sequoia 15.7.8 and Tahoe 26.6 allows a local application to crash the operating system via an out-of-bounds write. Although the vulnerability is assigned a critical CVSS 9.8 due to potential memory corruption risks, the Apple advisory only confirms denial-of-service impact. No active exploitation is reported, and EPSS (0.15%) indicates low exploitation probability.
We are to produce a JSON object with the required fields, synthesizing all available data. Input data: - CVE: CVE-2026-64762 - Description: An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to cause unexpected system termination. - CVSS: 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CWE: CWE-125 (Out-of-bounds Read) - EPSS: 0.15% (percentile 5%), so low exploitation probability. - Patch: Available from vendor - Tags: Apple, Buffer Overflow, Information Disclosure (but CWE is CWE-125, not buffer overflow. Tags may be inaccurate. Description says out-of-bounds read, not buffer overflow. We'll note CWE.) - SSVC: Exploitation: none, Automatable: yes, Technical Impact: total - ENISA EUVD: ID EUVD-2026-49480, affected versions: macOS 0 <14.8.8, macOS 0 <26.6, macOS 0 <15.7.8. Note: "macOS 0" probably means all versions before those fixes, including Sonoma 14.x before 14.8.8, sequoia before 15.7.8, Tahoe before 26.6. But product is macOS. - References: three Apple support articles. Those likely contain patch info. - CPE: cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:* No KEV mention, so not actively exploited. POC status unknown. So exploitation status: "no public exploit identified at time of analysis" unless there is POC flag, but data says Tags: Apple, ... no mention of POC. I'll assume no public exploit. Now, for each field, construct strings per instructions. product_name: "macOS" (just 3 words? "macOS" is one word. Could be "Apple macOS", but instructions say product name only, not vendor. So "macOS" is fine.) summary: Must not copy or paraphrase description. Synthesize. Provide impact, product, and what attacker can do. Start with specific impact verb and product. Options: "Unexpected system termination in macOS through out-of-bounds read allows...". But description says an app may cause unexpected system termination. So local app can crash the syst
Out-of-bounds read in macOS allows a malicious app to trigger unexpected system termination. Patches are available in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. No active exploitation or public exploit code has been identified, and EPSS indicates low probability of widespread exploitation.
Connecting to a malicious SMB server can cause unexpected system termination in macOS due to a memory handling vulnerability (CWE-119). The issue affects all macOS versions prior to Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 and has been addressed with improved memory handling. No known active exploitation or public exploit code exists, and the EPSS probability of exploitation is very low (0.15%).
Kernel memory corruption in macOS allows remote code execution with high impact on confidentiality, integrity, and availability. A buffer overflow vulnerability allows network-based attackers to execute arbitrary code with kernel privileges, potentially compromising the system. Patches are available in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6, and while no active exploitation has been reported, the remotely exploitable nature without authentication makes patching critical.
Buffer overflow in Apple macOS allows a malicious app to cause unexpected system termination. Affects macOS versions prior to 26.6 (Tahoe). No active exploitation or public exploit code is known, and EPSS indicates a low 0.15% probability of exploitation.
Email sender-address forgery and mail relay abuse affects the SP Page Builder extension for Joomla (by JoomShaper) in all versions before 6.7.1, where a hardcoded, product-wide secret lets unauthenticated remote attackers forge the 'mail from' address of form submissions. Because the same secret ships across every deployment of the extension, any attacker who knows it can drive the server to send spoofed emails, enabling phishing and spam relayed through the trusted Joomla host. No public exploit code has been identified at time of analysis, EPSS risk is low (0.14%, 4th percentile), and CISA SSVC lists exploitation status as none.
Memory corruption in macOS may allow a malicious app to corrupt the memory of a system process, potentially leading to arbitrary code execution. This issue is fixed in macOS Sonoma 14.8.8 and macOS Tah
Sandbox escape in macOS allows a malicious app to read files outside its sandbox. Affects macOS Sonoma prior to 14.8.8, Sequoia prior to 15.7.8, and Tahoe prior to 26.6. No active exploitation or public exploit
Reflected cross-site scripting in SiYuan Desktop before v3.7.2 enables remote code execution by luring a user to open a malicious siyuan:// deep link. The vulnerability resides in the bazaar plugin readme handler, which uses insertAdjacentHTML to render unsanitized plugin names from the link, allowing injected JavaScript to run with full Node.js access in the insecure Electron renderer. Active exploitation is not confirmed, but a public proof-of-concept is available.
Remote code execution in phpMyFAQ before version 4.1.6 allows authenticated administrators with CONFIGURATION_EDIT and ATTACHMENT_ADD privileges to write arbitrary PHP files to the server. By uploading a malicious ZIP file as an attachment and then manipulating the upgrade.lastDownloadedPackage configuration setting to point to that file, an attacker can extract attacker-controlled PHP code into the web root, leading to code execution as the web server user. No known public exploit code or active exploitation has been reported at the time of this analysis.
Stored cross-site scripting (XSS) in SiYuan before v3.7.2 allows remote code execution. Attackers with editor permissions can inject a malicious `title-img` Individual Attribute List value, which is unescaped when rendering Gallery and Kanban cover images, executing arbitrary JavaScript in the Electron renderer with full Node.js access. This vendor-disclosed vulnerability is not known to be actively exploited, but exploitation is feasible with editor-level access.
Stored and reflected cross-site scripting (XSS) in SiYuan versions prior to 3.7.3 allows authenticated attackers to execute arbitrary JavaScript in the application origin by embedding script payloads in SVG elements that evade the HTML
A sandbox escape vulnerability in Apple operating systems allows a malicious app to break out of its containment and gain full access to the device. Affected versions include iOS and iPadOS prior to 26.6, multiple macOS versions (Sonoma before 14.8.8, Sequoia before 15.7.8, Tahoe before 26.6), and tvOS before 26.6. No public exploit or active exploitation has been identified, and EPSS indicates a low probability of real-world attacks.