Kernel memory corruption in the Linux kernel's BPF sockmap subsystem allows a local actor able to load a BPF sk_msg program to trigger an out-of-bounds write via an integer overflow in bpf_msg_push_data(). A crafted u32 'len' argument (typed ARG_ANYTHING) wraps the 'copy + len' page-allocation size to a small value, producing an undersized allocation followed by an oversized memcpy that corrupts kernel heap memory, enabling denial of service and potential privilege escalation. There is no public exploit identified at time of analysis and the EPSS score is low (0.18%), but the flaw is confirmed and patched upstream by kernel maintainers.
Out-of-bounds kernel write in the Linux virtio-net driver's receive_big() path allows a malicious or compromised virtio backend (host/hypervisor-side device emulator) to corrupt guest kernel memory. The length validation meant to bound device-announced packet size still permits a ~20-byte gap, so a crafted len drives page_to_skb() one fragment past the page chain, writing into skb_shinfo()->frags[MAX_SKB_FRAGS] and passing a NULL frag up the receive path. There is no public exploit identified at time of analysis and EPSS is low (0.17%), but the flaw carries a high CVSS (8.4) due to kernel-level memory corruption.
Authenticated arbitrary file deletion in SP Page Builder before 6.7.1 allows attackers with administrative access to Joomla to delete any file on the server via a path traversal flaw in the media manager. The vulnerability is not known to be actively exploited or have a public exploit, but the high CVSS score reflects the severe integrity impact once administrative privileges are obtained.
Erlang/OTP nodes that decode External Term Format (ETF) from untrusted sources can be aborted outright by a single malformed term, in versions from OTP 27.0 up to but not including the fixed releases OTP 29.0.4, 28.5.0.4 and 27.3.4.15 (erts 15.0 up to 17.0.4, 16.4.0.4 and 15.2.7.11). The BIT_BINARY_EXT tag (77) handler accepts an encoding with zero length and zero trailing bits, causing an unsigned underflow in the computed bitstring size; the resulting value near 2^64 is handed to the allocator, which terminates the entire VM with an abort rather than raising a catchable Erlang exception. The vulnerability is unauthenticated (CVSS 4.0 vector PR:N) but requires the target application to feed attacker-controlled bytes into binary_to_term/1,2 or enif_binary_to_term(), an application-design precondition reflected as AT:P in the vendor vector and assessed as AC:H in our CVSS 3.1 evaluation; impact is availability-only (C:N/I:N/A:H). There is no indication of active exploitation (not in CISA KEV; SSVC exploitation: none) and EPSS is low at 0.32% (24th percentile), and no public exploit code has been identified at time of analysis. Vendor-released patches are available.
Sandbox escape via path traversal in macOS allows a malicious app to read and write files outside its sandbox, potentially accessing sensitive data. Affects macOS versions prior to Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6, with no privileges needed but requiring user interaction to launch the crafted app. No active exploitation or public exploit code known at time of analysis; EPSS indicates low exploitation probability.
A sandbox escape in macOS allows a malicious application to break out of its sandbox due to an authorization flaw in state management. Fixed in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6, the vulnerability could enable a local app with user interaction to read and modify protected data. No active exploitation or public proof-of-concept code has been identified.
SQL injection in the SP Page Builder extension for Joomla versions prior to 6.7.1 allows an authenticated attacker with high privileges to inject arbitrary SQL via the media manager’s search and date filter parameters. Exploitation can lead to unauthorized access to sensitive database contents, including data outside the extension’s scope. No public exploit or active exploitation has been confirmed at this time.
Reflected cross-site scripting in XMLRPC-C Library versions 1.07 through 1.67.01 allows unauthenticated attackers to execute arbitrary JavaScript when a victim clicks a crafted link, as the error page component reflects unsanitized user input. This can lead to theft of sensitive session data or other browser-accessible information from affected services. No public exploit code or active exploitation has been reported at this time.
Remote attackers can cause unexpected application termination and potentially read sensitive memory on affected Apple devices. This out-of-bounds read vulnerability, tracked as CVE-2026-64768, affects iOS, iPadOS, macOS, tvOS, and visionOS due to insufficient input validation. No active exploitation or public proof-of-concept code has been identified.
Out-of-bounds read in the Linux kernel's net1080 USB networking driver allows a malicious NetChip 1080 (NC1080) USB device to read slab memory past the end of a socket buffer during RX processing. In net1080_rx_fixup(), an even attacker-controlled packet_len is used to index a pad byte (skb->data[packet_len]) before it is validated against the actual frame length, so a short frame advertising a large even packet_len (e.g. 0x4000, bounded only by NC_MAX_PACKET) triggers a KASAN slab-out-of-bounds read in softirq/ksoftirqd context. This is a vendor-fixed kernel hardening bug with no public exploit identified at time of analysis; EPSS is low (0.18%) and it is not in CISA KEV.
Out-of-bounds kernel heap read in the Linux kernel's usbnet gl620a driver allows a malicious GeneLink (GL620A) USB link-cable device to leak adjacent slab memory into the network stack. The flaw is in genelink_rx_fixup(), which trusts a device-supplied per-packet length (bounded only by GL_MAX_PACKET_LEN of 1514 bytes) without checking it against the number of bytes actually received in the URB. Rated CVSS 8.1, it is unauthenticated (PR:N) and needs no user login, but no public exploit identified at time of analysis and EPSS is low at 0.18% (7th percentile).
Information disclosure in Apple Safari and OS-integrated WebKit allows websites to detect if a user has visited specific URLs. Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS prior to version 26.6 are affected. No public exploit code or active attacks have been reported, and the probability of exploitation is very low (EPSS 0.17%).
Out-of-bounds kernel memory reads in the Linux kernel's staging rtl8723bs Realtek Wi-Fi driver allow a malicious or spoofed access point within radio range to leak adjacent kernel memory or crash the system by sending beacon/probe-response frames carrying truncated or undersized information elements (IEs). The flaw lives in is_ap_in_tkip(), which parses IEs without bounds-checking the IE header or payload length before dereferencing WLAN_EID_VENDOR_SPECIFIC (needs length >= 16) and WLAN_EID_RSN (needs length >= 12) data. No public exploit identified at time of analysis; EPSS probability is low (0.16%, 6th percentile), and the issue is not listed in CISA KEV.
Out-of-bounds read in Apple Safari's web content processing can crash the browser and potentially leak sensitive memory contents. This vulnerability affects all Apple platforms where Safari rendering is used and is fixed in Safari 26.6, iOS/iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. Exploitation requires user interaction to visit a malicious site; no known active exploits or public proof-of-concept exist.
Privilege escalation via Missing Authorization in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows authenticated low-privileged users to perform unrestricted administrative operations through the REST API, potentially leading to full system compromise. The vulnerability is caused by improper access controls on API endpoints. A vendor advisory has been published, but no public exploit or active exploitation is reported at this time.
Privilege escalation to root via incorrect authorization in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated low-privilege attacker to fully compromise the affected appliance. Exploitation requires network adjacency to the management interface and low-privileged credentials, with no user interaction. No public exploit is identified, and there is no evidence of active exploitation at the time of analysis.
OS command injection in NVIDIA NeMo for Linux allows a local authenticated attacker to execute arbitrary commands, leading to full system compromise (code execution, privilege escalation, data tampering, and information disclosure). No public exploit code or active exploitation has been identified at the time of analysis.
Arbitrary code execution in Apple macOS through image processing is fixed in macOS Sonoma 14.8.8, Sequoia 15.7.8, and Tahoe 26.6. A buffer overflow in handling maliciously crafted images allows local attackers to execute arbitrary code with the victim's privileges upon opening the file. No active exploitation or public proof-of-concept is reported; EPSS predicts low exploitation probability (0.19%).
We are tasked with producing a JSON analysis for CVE-2026-64747. We must use all provided data, including EPSS, SSVC, patch availability, CPE, and tags. The vulnerability is a buffer overflow in Apple products, with an app potentially executing arbitrary code with kernel privileges. CVSS 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). CWE-120. Patch available from vendor. EPSS 0.19% (low). SSVC: Exploitation none, Automatable no, Technical impact total. KEV status? Not in input, so not KEV. POC? Not mentioned. Tags include RCE, Apple, Buffer Overflow, etc. Affected products: iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. CPEs confirm. References are Apple support pages. We must produce fields: - product_name: 1-3 words, specific product. Since it spans many OSes, the "primary one"? The CVE description mentions iOS and iPadOS, macOS, tvOS, visionOS, watchOS. The common underlying component is likely the kernel or something. But the product is Apple's operating systems. Could say "Apple OS Family" or "Apple Kernel". The description says "An app may be able to execute arbitrary code with kernel privileges." So the vulnerability is in the kernel, accessible via an app. So product could be "Apple Kernel" or "Apple Operating Systems". But the instruction says "The specific product or service name affected. Examples: 'Apache Tomcat', 'WordPress', 'Linux Kernel'." So maybe "Apple Kernel". However, it's not explicitly named. The CPEs list specific products: ios_and_ipados, macos, tvos, visionos, watchos. So I'll use "Apple OS Family" but that is 3 words. "Apple Kernel" is 2 words. I'll go with "Apple Kernel" as the vulnerable component. The description isn't clear if it's the kernel itself or a system library, but "kernel privileges" suggests kernel execution. So "Apple Kernel" is appropriate. - summary: 2-3 sentences, original synthesis, avoid starting with "A vulnerability". Start with impact verb a
Out-of-bounds memory access in the Linux kernel's ntfs3 filesystem driver allows a crafted NTFS image to corrupt kernel memory during NTFS log replay. When log_replay() converts version 0 restart-table records (DIR_PAGE_ENTRY_32 to DIR_PAGE_ENTRY), it derives a memmove() length directly from the attacker-controlled on-disk lcns_follow field, which check_rstbl() does not bound against the entry size; an oversized value drives reads/writes past the allocated restart-table buffer. There is no public exploit identified at time of analysis and EPSS is low (0.17%), but the flaw carries CVSS 7.8 with high confidentiality, integrity, and availability impact because it executes in kernel context when a malicious volume is mounted.
Processing a maliciously crafted file on unpatched Apple operating systems (iOS, iPadOS, macOS, tvOS, watchOS, visionOS) may allow arbitrary code execution due to an integer overflow in file handling. The vulnerability affects all versions prior to the latest OS updates and requires user interaction (opening a file) to trigger. No active exploitation or public exploit code has been identified, and patches are available in the vendor-released updates.
Arbitrary code execution via malicious file processing affects multiple Apple operating systems due to an out-of-bounds write. Fixed in iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. No active exploitation or public exploit is known, and EPSS predicts a very low probability of real-world attacks.
Processing a maliciously crafted file on Apple operating systems can lead to arbitrary code execution due to an integer overflow vulnerability (CWE-190). Affected products include iOS, iPadOS, macOS, tvOS, visionOS, and watchOS, all prior to their respective fixed versions. No public exploit code has been identified, and the EPSS score of 0.17% indicates a very low probability of near-term exploitation, though the impact could be severe.
Arbitrary code execution in Apple iOS and iPadOS, macOS, tvOS, visionOS, and watchOS permits an attacker to run code or terminate apps by luring a user into opening a crafted file. The out-of-bounds write issue was fixed in all supported Apple operating systems via June 2026 updates. No active exploitation or public proof-of-concept has been reported at time of analysis, and EPSS indicates a low probability of future exploitation.
Memory corruption in Apple's cross-platform image-processing stack allows a maliciously crafted image to corrupt process memory across iOS/iPadOS, macOS, tvOS, visionOS, and watchOS. Apple self-reported and patched the flaw (fixed in iOS/iPadOS 26.6, macOS Sequoia 15.7.8, Sonoma 14.8.8, Tahoe 26.6, and the 26.6 releases of tvOS/visionOS/watchOS). No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and CISA SSVC records exploitation status as none, though the technical impact is rated total.
Privilege escalation in macOS versions prior to Sequoia 15.7.8 and Tahoe 26.6 allows a local authenticated attacker to gain elevated privileges. The vulnerability carries a CVSS 7.8 high severity but has a low EPSS exploitation probability (0.17%) and no active exploitation or public exploit known. Apple addressed the logic flaw with improved restrictions.
Untrusted texture processing on unpatched Apple devices triggers an integer overflow (CWE-190) in a graphics/texture-parsing component, causing the affected application to terminate unexpectedly. The flaw affects iOS and iPadOS before 26.6, macOS Sequoia before 15.7.8, macOS Sonoma before 14.8.8, and macOS Tahoe, tvOS, visionOS and watchOS before 26.6; exploitation requires local access plus user interaction, specifically the victim opening or rendering an attacker-supplied texture (CVSS AV:L/UI:R). Multiple independent signals point to low real-world risk: EPSS is only 0.17% (6th percentile), there is no CISA KEV entry, SSVC rates exploitation as 'none' and automatable as 'no', and no public exploit code has been identified at time of analysis - the demonstrated consequence is availability loss (app termination), not proven code execution, and vendor patches are already available for every affected platform.
Local privilege escalation and kernel memory corruption in the Linux kernel's TIPC subsystem occurs because bearer_disable() frees the discoverer object (b->disc) with a plain kfree() via tipc_disc_delete(), while tipc_disc_rcv() still dereferences it in RX softirq under rcu_read_lock(); for UDP bearers the synchronize_net() grace period is deferred to a workqueue, so the object is freed with no RCU protection. The flaw is reachable from an unprivileged user namespace because the TIPCv2 generic-netlink family is netnsok and its bearer commands carry no GENL_ADMIN_PERM, requiring only that the kernel be built with CONFIG_TIPC and CONFIG_TIPC_MEDIA_UDP. No public exploit is identified at time of analysis and EPSS is low (0.17%, 6th percentile), but the KASAN-confirmed use-after-free yields a high-impact memory-corruption primitive affecting confidentiality, integrity and availability.
Out-of-bounds heap write in the Linux kernel's ntfs3 filesystem driver allows a crafted NTFS volume to corrupt kernel memory when the journal is replayed. The flaw lives in do_action()'s UpdateRecordDataRoot and UpdateRecordDataAllocation log-replay cases (fs/ntfs3/fslog.c), where the on-disk NTFS_DE field view.data_off is used as a memmove destination offset without bounding it against the entry size, letting an attacker-controlled offset (demonstrated at 0xFFFC) push a write ~32 bytes past the NTFS_DE. There is no public exploit identified at time of analysis and EPSS risk is low (0.16%), but the CVSS 7.8 rating reflects the kernel-level memory corruption impact against any system that mounts the malicious volume.
Memory corruption vulnerability in Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS) allows an attacker with a maliciously crafted image to corrupt process memory, potentially leading to arbitrary code execution. The issue is fixed in iOS/iPadOS 26.6, macOS Sequoia 15.7.8/macOS Tahoe 26.6, tvOS 26.6, and visionOS 26.6. No active exploitation has been reported (CISA KEV not listed), and the EPSS score of 0.16% indicates low exploitation likelihood.
A memory corruption vulnerability in Apple iOS, iPadOS, and macOS when processing a crafted image can allow an attacker to corrupt process memory, potentially leading to arbitrary code execution. Exploitation requires local access and user interaction. Patches are available in iOS 26.6/iPadOS 26.6, macOS Sequoia 15.7.8, and macOS Tahoe 26.6, and no active exploitation or public exploit code
Local privilege-boundary memory-safety flaw in the Linux kernel's Open vSwitch (openvswitch) datapath allows a local user with network-configuration capability to desynchronize the validated action stream from the one later executed. Introduced by commit a1e64addf3ff which removed the 64 KiB actions-length guard, the bug lets a generated nested action container (e.g. CLONE/CT) exceed U16_MAX and close with a truncated 16-bit nla_len, so subsequent bytes are reinterpreted as independent actions during dump or teardown. No public exploit identified at time of analysis; EPSS is low (0.16%, 6th percentile), and it is not in CISA KEV.
Stack out-of-bounds write in the Linux kernel Bluetooth subsystem (net/bluetooth/eir.c) lets a local privileged user corrupt kernel stack memory when an LE-only controller assembles legacy advertising data. eir_create_adv_data() prepends a 3-byte 'Flags' AD structure to a fixed 31-byte buffer without accounting for it in the length check, so an advertising instance created with flags == 0 and a maximal adv_data_len causes a 3-byte overflow past the buffer during hci_update_adv_data_sync(). There is no public exploit identified at time of analysis and EPSS is low (0.16%), consistent with a local, capability-gated memory-corruption bug rather than a mass-exploitation target.
A local privilege escalation vulnerability in macOS allows a malicious app to gain root privileges by exploiting incorrect default permissions. Affected macOS versions are prior to Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. No active exploitation or public exploit code has been reported, though the high CVSS score reflects potential for complete system compromise.
Memory corruption in Apple's audio processing framework affects iOS, iPadOS, macOS (Sonoma, Sequoia, Tahoe), tvOS, visionOS, and watchOS, where parsing a maliciously crafted audio file can corrupt process memory and potentially lead to arbitrary code execution. The flaw requires a victim to open or process the malicious file (local vector, user interaction) but no prior privileges. Apple has shipped fixes across all platforms; no public exploit identified at time of analysis and EPSS is low (0.16%).
Processing a maliciously crafted video file may lead to memory corruption enabling possible arbitrary code execution on multiple Apple operating systems. Affected platforms include iOS, iPadOS, macOS, tvOS, watchOS, and visionOS; fixes are available in the latest updates (iOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6). User interaction is required to open the malicious video, and no public exploit or active exploitation is known at this time.
Memory corruption vulnerability in Apple operating system kernels (iOS, iPadOS, macOS, visionOS) arises from improper memory handling (CWE-119) and can be triggered by a locally installed application. Successful exploitation may allow an attacker to cause unexpected
Memory corruption vulnerability in multiple Apple operating systems allows local attackers to achieve arbitrary code execution by processing a maliciously crafted file. Affected versions include iOS, iPadOS, macOS, tvOS, visionOS, and watchOS prior to 26.6. No active exploitation has been confirmed, and patches are available.
Memory corruption in the macOS kernel allows a local app to disclose kernel memory, potentially enabling further exploitation. Fixed in macOS Sequoia 15.7.8 and Sonoma 14.8.8, the vulnerability requires user interaction but no elevated privileges. No public exploit code or active exploitation has been identified, and the EPSS probability is very low (0.15%).
Local privilege escalation in macOS before Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 allows an app to gain root privileges via an argument injection flaw. Apple has addressed the issue with improved validation, and no public exploit or active exploitation has been reported. The low attack complexity and full system compromise warrant immediate patching.
Arbitrary code execution via buffer overflow in Apple iOS, iPadOS, and macOS. Processing a maliciously crafted file can
Arbitrary code execution in GIMP when opening a crafted FITS file due to an integer overflow in the file-fits plugin that leads to a heap buffer overflow. An attacker can achieve memory corruption and potentially execute arbitrary code with the user's privileges. No public exploit or active exploitation has been identified at time of analysis.
Local privilege escalation in macOS allows a malicious app to gain root privileges through a path traversal vulnerability in directory path handling. Affected versions include macOS Sonoma prior to 14.
Local privilege escalation in the Linux kernel's CAN Broadcast Manager (BCM) module allows an unprivileged local user to execute arbitrary code in kernel context. The flaw stems from an expired pointer dereference (CWE-825) in the handling of tasklets and timers, leading to use-after-free. No active exploitation or public exploit code has been identified, but successful exploitation results in full root compromise of the system.
Local privilege escalation in Apple macOS due to incorrect default permissions (C
Kernel privilege escalation in Zephyr RTOS v3.3.0-v4.4.1 is enabled by a signed/unsigned integer comparison error in the userspace syscall verifier for log_filter_set. An unprivileged user thread can supply a negative src_id value that bypasses the userspace bounds check, propagates into supervisor-mode kernel code, and - after implicit widening to uint32_t - indexes far out of bounds into kernel memory adjacent to the log_dynamic linker section, producing a constrained but attacker-directed read-modify-write primitive exploitable for privilege escalation. No public exploit has been identified at time of analysis; the fix, which replaces the flawed signed comparison with an unsigned one, is available in commit 56a15114.
SQL injection vulnerability in the WPBot WordPress plugin before version 8.5.2 allows authenticated administrators to inject arbitrary SQL queries via unsanitized field identifiers. This injection executes when a site visitor triggers a search, potentially leading to low-level data exposure or modification. A public exploit is available, though no active exploitation has been confirmed by CISA KEV.
Privilege separation flaw in containerized-data-importer's view ClusterRole allows authenticated users with cluster-wide view permissions and write access to any namespace to clone and exfiltrate PersistentVolumeClaim (PVC) contents into a controlled namespace, bypassing namespace isolation and read-only guarantees. The vulnerability permits data theft across the cluster without requiring direct access to source namespaces.
Local kernel memory disclosure and denial-of-service vulnerability in macOS 14.x and 15.x prior to patches. An unauthenticated attacker with local access can trigger a memory handling flaw to read kernel memory or cause unexpected system termination. No active exploitation or public exploit code is known; EPSS score is very low (0.14%).
Ghost Robotics Vision 60 mobile app (APK v5.5.0) fails to enforce single-client sessions, allowing an unauthenticated attacker with a modified app on the adjacent network to connect to the robot while a legitimate operator is active. The attacker can intercept real-time video and send commands without alerting the legitimate user, compromising confidentiality and operational control. No active exploitation or public exploit code has been identified; a vendor patch is available.