A use-after-free vulnerability in macOS allows a local application to cause a denial-of-service by crashing the system or a key service. The flaw affects multiple macOS versions prior to the Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 updates. Despite an assigned CVSS score of 9.8 suggesting remote pre-authentication full compromise, the Apple advisory explicitly describes only a local denial-of-service impact, and the EPSS exploitation probability is very low (0.16%). No active exploitation or public proof-of-concept has been reported, and a vendor patch is available.
Sandbox escape in macOS allows a malicious app to break out of its restrictions and gain full system access. Affected systems include macOS Sonoma before 14.8.8, macOS Sequoia before 15.7.8, and macOS Tahoe before 26.6. No active exploitation or public exploit code has been reported, and the EPSS exploitation probability is low at 0.16%.
Sandbox escape in macOS allows a malicious application to break out of its sandbox and gain arbitrary access to the underlying operating system. All versions prior to the fixed releases (macOS Sequoia 15.7.8, Sonoma 14.8.8, Tahoe 26.6) are affected. No public exploit or active exploitation has been observed at the time of analysis.
Denial of service (and potential use-after-free) in the Linux kernel's NVMe-over-TCP target (nvmet-tcp) subsystem allows a connected NVMe-oF initiator to trigger a refcount underflow via a crafted data-digest mismatch. When a command that previously failed nvmet_req_init() (marked NVMET_TCP_F_INIT_FAILED) hits a data digest error, nvmet_req_uninit() runs an unbalanced percpu_ref_put(), producing a percpu_ref warning, a use-after-free diagnostic, and ultimately a permanent workqueue deadlock that hangs the target. No public exploit identified at time of analysis; EPSS is low at 0.16% (6th percentile), and it is not listed in CISA KEV, so despite the 9.8 NVD score this is realistically a stability/DoS bug confined to hosts acting as NVMe-oF TCP targets with data digest enabled.
Sandbox escape in macOS Sequoia and Tahoe allows a malicious app to break out of its sandbox via a path traversal flaw (CWE-22). Patched in Sequoia 15.7.8 and Tahoe 26.6, the vulnerability enables unauthorized file access from a sandboxed application. No public exploit code is known, and EPSS predicts low exploitation probability (0.16%).
Unexpected system termination due to memory initialization flaw in Apple iOS, iPadOS, macOS, tvOS, watchOS, and visionOS allows a malicious application to forcibly crash the device. All versions prior to the listed fixed releases are affected. No active exploitation or publicly available exploit code was identified at time of analysis; EPSS indicates a low (0.16%) probability of exploitation.
A use-after-free vulnerability in Apple operating systems allows a malicious app to cause unexpected system termination or write to kernel memory. The issue affects iOS
Kernel memory corruption via race condition in Apple OS allows a malicious app to write arbitrary kernel memory or cause unexpected system termination. The issue affects iOS, iPadOS, macOS, and watchOS versions prior to the June 2026 security fixes, and has been patched by Apple. No public exploit or active exploitation is known, and EPSS indicates a low probability of widespread exploitation at this time.
User fingerprinting in Apple iOS, iPadOS, macOS, tvOS, visionOS, and watchOS allows a malicious app to collect device or user identifiers due to a permissions issue. All versions prior to the 26.6 updates are affected. No public exploit code or active exploitation has been identified, and EPSS indicates a low 0.15% probability of exploitation.
Type confusion in macOS and tvOS may allow a malicious app to trigger unexpected system termination and potentially achieve arbitrary code execution with kernel-level privileges. The issue is addressed in macOS Tahoe 26.6 and tvOS 26.6; no active exploitation or public proof-of-concept is known at the time of analysis.
Unexpected system termination in macOS prior to Sequoia 15.7.8 and Tahoe 26.6 allows a local application to crash the operating system via an out-of-bounds write. Although the vulnerability is assigned a critical CVSS 9.8 due to potential memory corruption risks, the Apple advisory only confirms denial-of-service impact. No active exploitation is reported, and EPSS (0.15%) indicates low exploitation probability.
We are to produce a JSON object with the required fields, synthesizing all available data. Input data: - CVE: CVE-2026-64762 - Description: An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to cause unexpected system termination. - CVSS: 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CWE: CWE-125 (Out-of-bounds Read) - EPSS: 0.15% (percentile 5%), so low exploitation probability. - Patch: Available from vendor - Tags: Apple, Buffer Overflow, Information Disclosure (but CWE is CWE-125, not buffer overflow. Tags may be inaccurate. Description says out-of-bounds read, not buffer overflow. We'll note CWE.) - SSVC: Exploitation: none, Automatable: yes, Technical Impact: total - ENISA EUVD: ID EUVD-2026-49480, affected versions: macOS 0 <14.8.8, macOS 0 <26.6, macOS 0 <15.7.8. Note: "macOS 0" probably means all versions before those fixes, including Sonoma 14.x before 14.8.8, sequoia before 15.7.8, Tahoe before 26.6. But product is macOS. - References: three Apple support articles. Those likely contain patch info. - CPE: cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:* No KEV mention, so not actively exploited. POC status unknown. So exploitation status: "no public exploit identified at time of analysis" unless there is POC flag, but data says Tags: Apple, ... no mention of POC. I'll assume no public exploit. Now, for each field, construct strings per instructions. product_name: "macOS" (just 3 words? "macOS" is one word. Could be "Apple macOS", but instructions say product name only, not vendor. So "macOS" is fine.) summary: Must not copy or paraphrase description. Synthesize. Provide impact, product, and what attacker can do. Start with specific impact verb and product. Options: "Unexpected system termination in macOS through out-of-bounds read allows...". But description says an app may cause unexpected system termination. So local app can crash the syst
Out-of-bounds read in macOS allows a malicious app to trigger unexpected system termination. Patches are available in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. No active exploitation or public exploit code has been identified, and EPSS indicates low probability of widespread exploitation.
Connecting to a malicious SMB server can cause unexpected system termination in macOS due to a memory handling vulnerability (CWE-119). The issue affects all macOS versions prior to Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 and has been addressed with improved memory handling. No known active exploitation or public exploit code exists, and the EPSS probability of exploitation is very low (0.15%).
Kernel memory corruption in macOS allows remote code execution with high impact on confidentiality, integrity, and availability. A buffer overflow vulnerability allows network-based attackers to execute arbitrary code with kernel privileges, potentially compromising the system. Patches are available in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6, and while no active exploitation has been reported, the remotely exploitable nature without authentication makes patching critical.
Buffer overflow in Apple macOS allows a malicious app to cause unexpected system termination. Affects macOS versions prior to 26.6 (Tahoe). No active exploitation or public exploit code is known, and EPSS indicates a low 0.15% probability of exploitation.
Email sender-address forgery and mail relay abuse affects the SP Page Builder extension for Joomla (by JoomShaper) in all versions before 6.7.1, where a hardcoded, product-wide secret lets unauthenticated remote attackers forge the 'mail from' address of form submissions. Because the same secret ships across every deployment of the extension, any attacker who knows it can drive the server to send spoofed emails, enabling phishing and spam relayed through the trusted Joomla host. No public exploit code has been identified at time of analysis, EPSS risk is low (0.14%, 4th percentile), and CISA SSVC lists exploitation status as none.
Memory corruption in macOS may allow a malicious app to corrupt the memory of a system process, potentially leading to arbitrary code execution. This issue is fixed in macOS Sonoma 14.8.8 and macOS Tah
Reflected cross-site scripting in SiYuan Desktop before v3.7.2 enables remote code execution by luring a user to open a malicious siyuan:// deep link. The vulnerability resides in the bazaar plugin readme handler, which uses insertAdjacentHTML to render unsanitized plugin names from the link, allowing injected JavaScript to run with full Node.js access in the insecure Electron renderer. Active exploitation is not confirmed, but a public proof-of-concept is available.
Remote code execution in phpMyFAQ before version 4.1.6 allows authenticated administrators with CONFIGURATION_EDIT and ATTACHMENT_ADD privileges to write arbitrary PHP files to the server. By uploading a malicious ZIP file as an attachment and then manipulating the upgrade.lastDownloadedPackage configuration setting to point to that file, an attacker can extract attacker-controlled PHP code into the web root, leading to code execution as the web server user. No known public exploit code or active exploitation has been reported at the time of this analysis.
Stored cross-site scripting (XSS) in SiYuan before v3.7.2 allows remote code execution. Attackers with editor permissions can inject a malicious `title-img` Individual Attribute List value, which is unescaped when rendering Gallery and Kanban cover images, executing arbitrary JavaScript in the Electron renderer with full Node.js access. This vendor-disclosed vulnerability is not known to be actively exploited, but exploitation is feasible with editor-level access.
Stored and reflected cross-site scripting (XSS) in SiYuan versions prior to 3.7.3 allows authenticated attackers to execute arbitrary JavaScript in the application origin by embedding script payloads in SVG elements that evade the HTML
A sandbox escape vulnerability in Apple operating systems allows a malicious app to break out of its containment and gain full access to the device. Affected versions include iOS and iPadOS prior to 26.6, multiple macOS versions (Sonoma before 14.8.8, Sequoia before 15.7.8, Tahoe before 26.6), and tvOS before 26.6. No public exploit or active exploitation has been identified, and EPSS indicates a low probability of real-world attacks.
Unauthenticated SQL injection in the AWP Classifieds WordPress plugin (≤4.4.7) allows remote attackers to extract sensitive data from the database via crafted HTTP requests, potentially exposing user information and other site data. The vulnerability exists in the plugin's handling of unsanitized input, enabling attackers to perform SQL injection without authentication. No public exploit or active exploitation has been reported at this time.
Unauthenticated SQL injection in rtMedia for WordPress, BuddyPress and bbPress versions ≤4.7.
Unauthenticated SQL injection in the Gamipress WordPress plugin (versions up to 7.9.7) allows remote attackers to execute arbitrary SQL queries against the site's database. This can lead to unauthorized extraction of sensitive data (such as user credentials) and potential denial of service through resource exhaustion. No active exploitation or public proof-of-concept has been reported at the time of analysis.
SQL injection in the Relevanssi Light WordPress plugin (≤1.2.2) allows unauthenticated attackers to execute arbitrary SQL queries on the backend database, leading to exposure of sensitive information and limited data corruption. The vulnerability carries a critical CVSS score of 9.3 due to low attack complexity and high confidentiality impact. No public exploit or CISA KEV listing was identified at the time of analysis.
Unauthenticated SQL injection in the MapSVG WordPress plugin up to version 8.14.0 allows remote attackers to extract sensitive data from the database without credentials. The vulnerability can be triggered via specially crafted requests and has a critical CVSS score of 9.3. No public exploit code or active exploitation has been reported at the time of analysis.
Stored cross-site scripting in Lookyloo (versions up to and including 1.40.0) lets an attacker inject arbitrary HTML/JavaScript into the capture tree visualization page. Because the serialized capture tree was rendered directly into an inline <script> block via the Jinja `safe` filter, attacker-controlled content captured from a target website can break out of the script element and execute in the browser of any analyst who later views that capture tree. No public exploit identified at time of analysis; EPSS is low (0.28%, 20th percentile), consistent with the SSVC assessment of no observed exploitation, but the impact rating is total.
Unauthenticated SQL injection in the SP Page Builder Joomla extension before version 6.7.1 allows remote attackers to extract sensitive database contents via the loadMoreArticles endpoint. The vulnerability stems from improper validation of the catid parameter, which can be manipulated to execute arbitrary SQL queries. No public exploit or active exploitation has been reported at this time.
Unauthenticated SQL injection in SP Page Builder for Joomla prior to version 6.7.1 allows remote attackers to extract sensitive data from the Joomla database via crafted order parameters in the Dynamic Content endpoint. The vulnerability, assigned CVE-2026-65766, has a CVSS 4.0 score of 9.2 but is not listed in CISA's KEV and has no known public exploits at time of analysis.
An on-path attacker can force an Erlang/OTP TLS 1.2 or DTLS client to accept an anonymous cipher suite not offered by the client, bypassing certificate validation and enabling full traffic decryption and manipulation. This affects OTP versions 17.0 through prior to 27.3.4.15, 28.5.0.4, and 29.0.4. The vulnerability is resolved in patched releases; no active exploitation or public proof-of-concept is known at this time.
Use-after-free in SQLite 3.41 expression parsing leads to memory corruption, allowing remote attackers to crash applications and leak sensitive memory contents via crafted SQL queries. Public proof-of-concept exists but there is no evidence of active exploitation. The vulnerability is triggered by sending malicious SQL statements that cause the parser to access a freed expression object.
Server-side request forgery in Plack::App::Prerender before 0.3.0 allows unauthenticated remote attackers to proxy requests to arbitrary internal hosts by crafting a request URI starting with '@'. The application appends the raw REQUEST_URI to a plain string rewrite base without validating the path, enabling an attacker to change the destination authority and access restricted resources. No public exploit is known, and active exploitation has not been observed.
Uninitialized kernel memory disclosure in the Linux kernel SCTP stack allows a remote peer to leak stale kernel heap/stack bytes by sending a malformed ERROR chunk carrying a STALE_COOKIE cause. When an association is in the COOKIE_ECHOED state, sctp_sf_do_5_2_6_stale() reads a 4-byte 'Measure of Staleness' from the first cause in the chunk without verifying that the field is actually present, and echoes that value back to the peer in the Cookie Preservative of the reply INIT. It is reachable by any peer - including an unprivileged local process using a raw SCTP socket inside a user+network namespace - and there is no public exploit identified at time of analysis (EPSS 0.18%, not in CISA KEV).