Cross-site scripting in RT Mega Menu <=1.5.1 allows authenticated attackers with subscriber-level access to inject malicious JavaScript into menu items. The injected script executes in the context of any user visiting a page with the corrupted mega menu, enabling session token theft, site defacement, or redirection. No active exploitation or public exploit code is currently confirmed.
Missing authorization in the Events Made Easy plugin for WordPress up to version 3.1.3 permits unauthenticated remote attackers to modify event data and partially disrupt service availability without user interaction. This broken access control flaw stems from a missing capability check (CWE-862) on a REST API or AJAX endpoint, leading to low integrity and availability impact with no confidentiality loss.
Denial-of-service in Erlang OTP's epmd daemon due to improper handling of file descriptor exhaustion allows an unauthenticated remote attacker to terminate the daemon. The vulnerability arises from calling epmd_cleanup_exit() on EMFILE/ENFILE errors instead of recovering, and can lead to permanent service failure on Debian/Ubuntu systems using systemd. No active exploitation identified (SSVC exploitation none, EPSS 0.39%) and no public exploit code is known.
Stored cross-site scripting in TastyIgniter's Media Manager allows low-privileged authenticated users to execute arbitrary JavaScript when an administrator views a malicious SVG file. Chaining with CSRF enables an attacker to steal the admin's CSRF token and take full control of the administrative account. No public exploit or active exploitation has been identified; EPSS is low (0.23%), and the vulnerability is rated CVSS 6.3 in CVSS 4.0.
Denial of service in SQLite 3.41 due to a use-after-free in the JSON extraction function. A local unauthenticated attacker can trigger a crash by supplying a malicious JSON input, causing the host application to terminate. No active exploitation has been confirmed in the wild, but public exploit proof-of-concept may exist.
Cross-site scripting in Milk Admin versions up to 0.9.8 enables remote attackers to inject arbitrary web scripts or HTML via the action parameter of the Docs module. A public proof-of-concept exploit is available, though active exploitation has not been reported. The vulnerability requires user interaction and could lead to session hijacking or other browser-based attacks.
Cross-site scripting (XSS) in Apache Wicket versions 9.0.0-9.23.0 and 10.0.0-10.9.0 allows attackers to inject client-side scripts into pages rendered by the affected application, potentially compromising user sessions or redirecting victims. The vulnerability arises from insufficient neutralization of user input during HTML generation, enabling script injection via crafted URLs or form submissions. No public exploit is known, but upgrading to version 10.10.0 eliminates the issue.
Server-side request forgery in Google's MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 0.19.1 through 1.4.0 lets the cloud-healthcare-fhir-fetch-page tool dispatch an outbound HTTP GET to an attacker-chosen URL using an authenticated HTTP client, which automatically attaches an Authorization: Bearer credential to every request regardless of destination host - so supplying an arbitrary pageURL (directly in the tool payload or implicitly through a data-driven pagination loop) exfiltrates the caller's OAuth token or the broader Application Default Credentials service-account token to an attacker-controlled listener. Exploitation requires an attacker who can reach and influence the tool as an authenticated MCP client (CVSS PR:L) and depends on credential configuration for the more damaging service-account outcome, matching the vendor's high attack-complexity rating; no public exploit code has been identified at time of analysis (SSVC exploitation: none, Automatable: no) and EPSS is low at 0.25% (16th percentile), so this is a genuine-but-moderate credential-disclosure issue rather than an urgent one.
Stored cross-site scripting (XSS) in the WooCommerce Checkout Manager plugin allows authenticated shop managers to inject arbitrary JavaScript into checkout field settings. When another administrator views the affected configuration, the malicious script executes in their browser session, potentially leading to session hijacking or unauthorized actions. No active exploitation has been reported, and the vulnerability is not listed as known exploited by CISA.
Stored cross-site scripting (XSS) in Orbit Fox by ThemeIsle versions 3.0.7 and below allows authenticated administrators to inject malicious scripts that execute when another administrator views the affected plugin content. This vulnerability requires high privileges and user interaction; no public exploit has been identified.
Cross-site scripting (XSS) in Abandoned Cart Lite for WooCommerce allows authenticated shop managers with high privileges to inject malicious scripts, potentially leading to account takeover or data theft when an administrator views crafted content. No public exploit identified at time of analysis.
Out-of-bounds heap read in GNU Binutils linker when processing 32-bit XCOFF files allows local attackers to disclose heap memory and cause denial of service. Affects Red Hat Enterprise Linux 6 through 10, Hardened Images, and OpenShift Container Platform 4. No public exploit or active exploitation identified at time of analysis; EPSS data unavailable.
A buffer overflow in the processing of 3D models on Apple iOS, iPadOS, and macOS leads to disclosure of process memory. Affected versions include iOS/iPadOS prior to 26.6 and macOS prior to Sequoia 15.7.8 and Tahoe 26.6. An attacker who can deliver a malicious 3D model to a victim could leak sensitive information; no active exploitation or public exploit has been reported, and the EPSS probability is low (0.18%).
Information disclosure in Apple Contacts across iOS, iPadOS, macOS, visionOS, and watchOS allows a local attacker to leak sensitive data by processing a maliciously crafted contact. Apple has released patches in iOS 26.6 and other updates. No public exploit is identified, and EPSS indicates
Kernel memory disclosure in macOS allows a local app to read uninitialized kernel memory, potentially exposing sensitive information. Apple has released patches in macOS Sonoma 14.8.8, Sequoia 15.7.8, and Tahoe 26.6. The vulnerability has a low EPSS score (0.17%) with no known active exploitation or public exploit code.
A file quarantine bypass in Apple macOS allows a malicious application to evade Gatekeeper integrity checks. Affected versions include macOS prior to 15.7.8, 14.8.8, and 26.6. Local attackers with user interaction can leverage this to execute unsigned code that would normally be blocked, leading to potential integrity compromise.
Information disclosure in Apple iOS and iPadOS 26.6, along with macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6, allows a local app to access sensitive user data due to a state management flaw. The vulnerability was addressed with improved state handling, and no public exploit code or active exploitation has been identified; EPSS indicates a low likelihood of real-world attacks.
Local information disclosure in Apple iOS/iPadOS 26.x, macOS Tahoe 26.x, macOS Sequoia 15.x, macOS Sonoma 14.x, tvOS 26.x, visionOS 26.x and watchOS 26.x lets an app installed and run by the user read sensitive user data because of insufficient access checks (CWE-200), a flaw Apple fixed in iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, visionOS 26.6 and watchOS 26.6. Exploitation requires the user to install and launch a malicious or malicious-behaving app on an unpatched device (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 5.5); there is no remote or network-reachable path and no privilege escalation is needed, so the practical exposure is limited to confidentiality on devices where sideloaded or otherwise untrusted apps are allowed. There is no public exploit identified at time of analysis, CISA's SSVC decision framework records exploitation as none and technical impact as partial, and EPSS is only 0.17% (6th percentile), so every signal aligns with a genuine but low-priority issue that should be resolved by routine patch cycles rather than emergency response.
Kernel memory disclosure in Apple iOS and iPadOS (fixed in 26.6), macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6 and watchOS 26.6 allows a locally running app to read kernel memory that should be inaccessible to it, undermining the isolation boundary between user-space apps and the kernel. The prerequisite is meaningful: an attacker must first get attacker-controlled code executing on the device (a malicious, sideloaded, or compromised app), and the flaw itself yields only disclosure - high confidentiality impact but no integrity or availability impact, so it is best characterized as one link in a larger privilege-escalation or jailbreak chain rather than a standalone compromise. Vendor patches are available for every affected platform; there is no remote or network attack vector, no public exploit code identified at time of analysis, no confirmed active exploitation (CISA SSVC exploitation: none), and EPSS is low at 0.17% (7th percentile), consistent with the moderate 5.5 severity and the local-only, code-execution-gated exploitation model.
Denial-of-service via out-of-bounds write in Apple CoreAudio when processing malicious audio streams. Affected iOS, iPadOS, macOS, tvOS, watchOS, and visionOS versions are vulnerable. No known active exploitation or public exploit code exists at time of analysis, and EPSS probability is low (0.17%).
Denial-of-service in multiple Apple operating systems allows a local network attacker to cause resource exhaustion and system unavailability. The vulnerability is addressed in iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. No public exploit or active exploitation has been identified at this time, and the EPSS score is low (0.17%).
A malicious app can access sensitive user
Protected user data exposure in Apple operating systems allows a malicious app with on-device access to read sensitive information through insufficient input sanitization. This CVE-2026-43714 affects iOS and iPadOS before 26.6, macOS Sequoia before 15.7.8, Sonoma before 14.8.8, Tahoe before 26.6, visionOS before 26.6, and watchOS before 26.6. No public exploit has been identified and the low EPSS score
Denial-of-service via type confusion in Apple ImageIO affects iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. Processing a maliciously crafted image can crash an application, with no code execution. No active exploitation or public exploit is known; EPSS 0.17% indicates low likelihood of widespread attacks.
Unauthorized reading of a persistent device identifier in Apple iOS, iPadOS, tvOS, watchOS, and visionOS allows a malicious app to access a unique identifier without user consent. The issue originates from a permissions enforcement weakness fixed in iOS 26.6, iPadOS 26.6, tvOS 26.6, watchOS 26.6, and visionOS 26.6. No active exploitation or public exploit code is known, and EPSS predicts a very low exploitation probability (0.16%).
A permissions validation flaw across Apple's iOS, iPadOS, macOS, and visionOS could allow a local malicious app to delete arbitrary files, leading to data loss. The issue has a low exploitation probability (EPSS 0.16%) and no known active exploits or public exploit code. Patches are available in the respective OS updates.
Local information disclosure in Apple iOS and iPadOS 26.6 and earlier, as well as multiple macOS versions, allows an app to leak sensitive user data due to missing entitlement checks. The vulnerability requires user interaction and local access, but has low exploitation probability (EPSS 0.16%) and no known public exploits or active exploitation per CISA KEV.
A local denial-of-service vulnerability in Apple's operating systems allows a malicious app to cause unexpected system termination by triggering an out-of-bounds read. Fixes are available in version 26.6 for iOS, iPadOS, macOS, tvOS, visionOS, and watchOS; no active exploitation or public exploit has been identified, and EPSS indicates a low probability of exploitation.
Information disclosure in Apple iOS/iPadOS versions prior to 26.6 allows a locally installed app to access sensitive user data without proper permissions. Apple has released patches in iOS/iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, and watchOS 26.6. No public exploit or active exploitation has been reported, and the EPSS score indicates a low likelihood of exploitation.
An out-of-bounds write vulnerability in Apple iOS 26.6 and earlier allows a malicious app to cause unexpected system termination (kernel panic). No public exploit or active exploitation has been reported; patch available from Apple.
Sensitive user data can be accessed by unauthorized apps on macOS and watchOS due to an authorization flaw in state management. Apple released patches in macOS Sequoia 15.7.8, Sonoma 14.8.8, Tahoe 26.6, and watchOS 26.6. No public exploit or active exploitation is known; EPSS indicates a low likelihood of exploitation.
Denial of service in Apple operating systems via out-of-bounds write allows a local app to cause unexpected system termination. Affected versions include iOS/iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS prior to 26.6. No active exploitation has been reported, EPSS risk is low at 0.16%, and no public exploit code identified at time of analysis.
Information disclosure in macOS prior to 15.7.8, 14.8.8, and 26.6 allows a malicious app to leak sensitive user information. The vulnerability arises from improper removal of sensitive data, which Apple addressed in these updates. No active exploitation is known, and EPSS indicates a low probability of exploitation (0.16%).
A malicious app on macOS can read kernel memory due to insufficient validation. This information disclosure vulnerability is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6. No active exploitation or public exploit code has been identified, and the EPSS score is very low (0.16%).
Denial of service in macOS versions prior to Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 allows a local malicious app to trigger memory corruption and crash the system. Exploitation requires user interaction to run the app; no active exploitation is known (not in CISA KEV) and EPSS indicates a very low probability (0.16%). Apple has released updates to address the logic issue.
Local denial of service in macOS allows a malicious app to trigger unexpected system termination via memory exhaustion. Affects macOS Sequoia prior to 15.7.8, macOS Sonoma prior to 14.8.8, and macOS Tahoe prior to 26.6. No active exploitation or public exploit identified; EPSS probability is low (0.16%).
Sensitive user data exposure in macOS allows a malicious app to read private information by bypassing access controls. Affected versions are prior to Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. No public exploit or active exploitation has been identified; EPSS score of 0.16% indicates a very low probability of widespread attacks.
Out-of-bounds read in Apple macOS allows a local app to access sensitive user data. The vulnerability (CWE-787) has been patched in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. Exploitation requires user interaction (opening a malicious app or file), and no public exploits are known to be in the wild.
Sensitive kernel state leak in macOS allows a local application to read kernel memory. Apple fixed this in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 by improving redaction. The vulnerability has low exploitation probability (EPSS 0.16%) and is not known to be actively exploited.
We are tasked with synthesizing data from multiple intelligence sources about CVE-2026-64754 into a comprehensive analysis, returning a JSON object with specific fields. All fields must be plain text strings (paragraphs). We must use all provided data and cross-reference to add value. The output must be grounded in the input data, not invented. Let's extract and analyze the provided data: - CVE ID: CVE-2026-64754 - Description: "An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted file may lead to a denial-of-service." - CVSS Score: 5.5, Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CWE: CWE-787 (Out-of-bounds Write) - EPSS: 0.16% (percentile 5%) — low exploitation probability. - Patch: Available from vendor (Yes). The fix is listed in the versions above. - Reported by: apple - CPE: apple:ios_and_ipados, apple:macos, apple:tvos, apple:visionos, apple:watchos — all with *:*:*:*:*:*:*. Specific version ranges given by EUVD: macOS 0 <15.7.8, macOS 0 <14.8.8, iOS and iPadOS 0 <26.6, macOS 0 <26.6, watchOS 0 <26.6, tvOS 0 <26.6, visionOS 0 <26.6. Note the macOS versions include Sequoia 15.7.8 fix, Sonoma 14.8.8, Tahoe 26.6. "macOS 0 <26.6" likely means macOS Tahoe (version 26.x). So affected products: all Apple operating systems before these fixed versions. - Tags: Apple, Buffer Overflow, Ios And Ipados, Tvos, Visionos, Watchos, Memory Corruption. Also "Memory Corruption" tag is relevant. - References: All are Apple support pages: 128066, 128067, 128068, 128069, 128070, 128071, 128072. Also ENISA EUVD ID: EUVD-2026-49465, with link to NVD. Now, we need to produce each field as a paragraph. 1. product_name: "1-3 words ONLY. The specific product or service name affected. Examples: 'Apache Tomcat', 'WordPress', 'Linux Kernel', 'nginx-ui', 'GoAnywhere MFT'. NOT
Kernel memory disclosure in Apple macOS allows a rogue application to read sensitive kernel data via an out-of-bounds read. Fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6. No public exploit identified and EPSS score is low (0.15%), indicating low exploitation risk in the wild.
Information disclosure in macOS asset catalog processing allows local attackers to read process memory by enticing a user to open a malicious asset catalog. Affected versions prior to macOS Sequoia 15.7.8 and Sonoma 14.8.8 are vulnerable. No active exploitation or public exploit code exists; EPSS indicates low exploitation probability.
An authorization bypass vulnerability in Apple macOS allows a local application to access sensitive user data without proper authorization. This issue is fixed in macOS Sequoia 15.7.8 and macOS Tahoe 26.6. No active exploitation (not in CISA KEV) or public proof-of-concept has been identified, and EPSS scores the exploitation probability as low (0.15%).
Local information disclosure in macOS Tahoe and watchOS allows an installed app to access sensitive user data without proper authorization. The vulnerability requires user interaction and is fixed in macOS Tahoe 26.6 and watchOS 26.6. No active exploitation or public exploit has been reported, and EPSS probability is low at 0.15%.
Information disclosure in Apple iOS, iPadOS, and macOS Tahoe allows a malicious app with local access to read a user's contacts database. The flaw is fixed in iOS 26.6, iPadOS 26.6, and macOS Tahoe 26.6. No public exploit or active exploitation has been reported, and the EPSS score (0.15%) indicates low exploitation likelihood.
An information disclosure vulnerability in Apple macOS allows a local malicious application to access sensitive user data without proper authorization. This issue was resolved in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. No active exploitation or public exploit code has been identified at this time, and EPSS indicates a very low probability of exploitation.
A file quarantine bypass in macOS Gatekeeper allows maliciously crafted ZIP archives to evade security checks. Affected versions include macOS Sequoia before 15.7.8 and macOS Sonoma before 14.8.8. Exploitation is not confirmed in the wild, public exploit code has not been identified, and EPSS indicates very low likelihood of widespread attacks.
A Gatekeeper bypass in macOS allows maliciously crafted ZIP archives to evade security checks, enabling installation of untrusted applications. Affected are macOS Sonoma 14.x prior to 14.8.8 and Sequoia 15.x prior to 15.7.8; exploitation requires user interaction. No active exploitation or public exploit code is known, and a vendor patch is available.
Information disclosure in macOS allows a malicious app to access user-sensitive data when the user is tricked into running it. Affected versions include macOS Sequoia before 15.7.8, Sonoma before 14.8.8, and Tahoe before 26.6. No active exploitation has been confirmed, and the EPSS score is low (0.15%), indicating minimal real-world risk at this time.
A symlink handling vulnerability in macOS allows a malicious application to modify protected parts of the file system. Affected versions include macOS prior to Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. Exploitation requires user interaction (opening a malicious app), and no public exploit code or active exploitation has been identified.