95
CVEs
12
Critical
24
High
0
KEV
4
PoC
12
Unpatched C/H
82.1%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
12
HIGH
24
MEDIUM
51
LOW
6
Monthly CVE Trend
Affected Products (30)
Iphone Os
2995
Mac Os X
2043
macOS
1992
Tvos
1628
Watchos
1439
Ipados
1375
Safari
931
Itunes
619
iOS
554
Ios Xe
465
Icloud
342
Visionos
251
Debian Linux
246
Ios And Ipados
196
Fedora
193
Ios Xr
160
Ubuntu Linux
152
Chrome
123
Opensuse
97
Webkitgtk
92
Windows
90
Xcode
82
Enterprise Linux Server
80
Enterprise Linux Workstation
79
Enterprise Linux Desktop
77
Quicktime
73
Webkit
68
Leap
66
Ipad Os
63
Acrobat Reader
55
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-54550 | Path traversal in IzPack's UnpackerBase.unpack() enables arbitrary file writes under victim privileges when a user executes a trojanized installer JAR. The unpacking pipeline calls IoHelper.translatePath(), which performs only file-separator substitution with no canonical-path check, no startsWith(installDir) containment guard, and no normalization of '../' sequences, allowing attacker-controlled PackFile entries to escape the install directory entirely. Because IzPack JARs are standard unsigned ZIPs with no integrity protection, any legitimate IzPack installer can be silently repackaged with malicious entries; a publicly available proof-of-concept confirms the escape. The CVE is not listed in CISA KEV, but the trivial repacking method and social-engineering distribution vector make this a credible supply-chain threat to organizations consuming IzPack-packaged software from untrusted sources. | HIGH | 7.4 | 0.4% | 57 |
PoC
|
| CVE-2026-53965 | Memory exhaustion denial-of-service in MCP PHP SDK's HttpTransport crashes client processes when connected to a malicious or compromised MCP server. Affected versions (mcp/sdk >= 0.5.0, < 0.7.1) accumulate SSE stream data into an unbounded in-memory buffer inside processSSEStream() - a server that withholds the SSE event delimiter ('\n\n') forces the buffer to grow at 4 KiB per tick until the PHP process hits its memory_limit and crashes with a fatal OOM error. A proof-of-concept is publicly available and reproduces the crash deterministically against the released Packagist package; this is not confirmed in CISA KEV. | MEDIUM | 6.9 | 0.4% | 55 |
PoC
|
| CVE-2026-55593 | Froxlor's standalone AJAX endpoint (lib/ajax.php) entirely bypasses the CSRF token enforcement present in lib/init.php, allowing a remote attacker to forge state-changing POST requests on behalf of any authenticated administrator who visits a malicious page. Successful exploitation modifies administrator API key properties - specifically injecting the attacker's IP into the allowed_from whitelist and setting valid_until to -1 (never expires) - creating a persistent foothold for future API abuse if the API secret is later obtained. A working proof-of-concept HTML page is included in the public GitHub security advisory (GHSA-xpr4-8vp6-c87j); no CISA KEV listing found at time of analysis. EPSS data was not provided, but the UI:R requirement and niche product footprint constrain real-world exploitation. | MEDIUM | 6.5 | 0.2% | 53 |
PoC
|
| CVE-2026-51376 | Unauthenticated BLE packet injection in BitChat for iOS v1.5.0 (reported in the CVE as v1.15.0) allows any device within Bluetooth adjacency range to inject crafted MESSAGE packets into the mesh gossip cache, causing denial of service for all mesh participants. The attack exploits a TTL=0 validation bypass in BLEService.swift that accepted packets as anonymous without full sender authentication. A public proof-of-concept is available at a named GitHub repository; no active exploitation has been confirmed by CISA KEV. | MEDIUM | 6.5 | 0.2% | 53 |
PoC
No patch
|
| CVE-2026-30612 | Remote code execution in Time4Popcorn - a Popcorn Time media-streaming fork - affects the Windows client (<= 6.2.1.18), macOS client (<= 6.2.1.17), and Android client (<= 3.5.0.173) through the application's auto-update mechanism (updater.exe on Windows, the PT.updd component on macOS). Because the updater fetches and executes update payloads without verifying their integrity (CWE-494), an attacker able to influence the update channel can deliver and run arbitrary code on the victim host. No CISA KEV listing, no public exploit is identified at time of analysis, and EPSS is low at 0.26% (18th percentile). | CRITICAL | 9.8 | 0.3% | 49 |
No patch
|
| CVE-2026-39255 | Arbitrary code execution in SteelSeries GG for macOS v107.0.0 stems from a buffer overflow in the bundled libSSEdevice.dylib, specifically its dup_wcs (wide-character string duplication) routine, letting an attacker who can feed crafted input to the client run code with the privileges of the SteelSeries process. The flaw is disclosed by MITRE with an accompanying Cipher Security Labs research write-up (publicly available research/exploit material), but it is not on the CISA KEV list and EPSS is low at 0.21% (12th percentile). Note a material discrepancy: the CVSS vector is scored AV:N (network) yet the affected component is a local desktop peripheral-management library, which typically implies attacker-supplied data rather than an exposed network service. | CRITICAL | 9.8 | 0.2% | 49 |
No patch
|
| CVE-2026-39254 | Memory-corruption remote code execution affects SteelSeries GG for macOS v107.0.0, where a classic buffer overflow (CWE-120) in the bundled libSSEdevice.dylib-specifically the CxAudioHidDevice::DeviceGetDescriptionString routine-lets an attacker overwrite memory while the client parses a device description string and thereby run arbitrary code in the context of the GG process. NVD rates it CVSS 9.8 with an unauthenticated network vector, though the affected component is a HID (USB audio device) descriptor parser, which points toward a malicious-device attack surface rather than pure network reachability. A third-party research writeup (Cipher-Security-Labs CSL-2026-03) is referenced, but there is no CISA KEV listing and EPSS is low at 0.21% (12th percentile). | CRITICAL | 9.8 | 0.2% | 49 |
No patch
|
| CVE-2026-43798 | Remote unauthenticated code execution is possible in swift-nio-ssh, Apple's Swift implementation of the SSH2 protocol built on SwiftNIO, where a single crafted SSH message triggers an out-of-bounds stack write of attacker-controlled length and content. Any server or client application built on swift-nio-ssh before 0.14.1 is affected, and an attacker can corrupt stack memory pre-authentication to potentially achieve arbitrary code execution. No public exploit identified at time of analysis, and despite the maximal 9.8 CVSS the EPSS probability is currently low (0.14%, 4th percentile). | CRITICAL | 9.8 | 0.1% | 49 |
|
| CVE-2026-19593 | Arbitrary code execution in OpenAI Codex Desktop (Windows and macOS, including the Microsoft Store package) occurs when a user opens a workspace containing an attacker-prepared Git repository whose local .git/config is intact. Because Codex automatically inspects Git metadata and working-tree status on open, a malicious attr.tree setting combined with a clean/process filter causes Git to launch an attacker-controlled program outside Codex's command sandbox, with the signed-in user's privileges and no trust prompt, approval, or model interaction. No public exploit is identified at time of analysis and EPSS is low (0.14%), but the outcome is full local compromise of the user's files and credentials. | CRITICAL | 9.8 | 0.1% | 49 |
No patch
|
| CVE-2026-78964 | Sandbox-escaping remote code execution is possible in Google Chrome for iOS before 152.0.7977.65, where a use-after-free in the Sync component can be triggered by a victim visiting a crafted HTML page, potentially letting a remote attacker run arbitrary code outside the renderer sandbox. Google has shipped a fixed stable build, and there is no public exploit identified at time of analysis; the flaw is not listed in CISA KEV and SSVC records exploitation status as none. Notably, Chromium's own severity rating for this bug is Low, which stands in sharp contrast to the 9.6 CVSS score in the input. | CRITICAL | 9.6 | 0.5% | 49 |
|
| CVE-2026-78935 | Sandbox-escaping remote code execution in Google Chrome for iOS (versions prior to 152.0.7977.65) stems from use of an uninitialized variable that a remote attacker can trigger with a crafted HTML page, potentially running arbitrary code outside the renderer sandbox. Rated Critical by Chromium with a CVSS 9.6 (scope-changed) vector, it requires the victim to visit a malicious page but no authentication. There is no public exploit identified and it is not on CISA KEV; EPSS is low at 0.41% (34th percentile). | CRITICAL | 9.6 | 0.4% | 48 |
|
| CVE-2026-85047 | Sandbox-escape remote code execution affects Google Chrome on iOS prior to 152.0.7977.82, where improper input validation (CWE-20) in the browser's Transactions Platform component lets a remote attacker potentially run arbitrary code outside the renderer sandbox when a victim loads a crafted HTML page. Google shipped a fix in the stable channel and Chromium rated the underlying issue Medium severity, though the supplied CVSS vector scores it 9.6. There is no public exploit identified and CISA's SSVC framework records exploitation status as none. | CRITICAL | 9.6 | 0.3% | 48 |
|
| CVE-2026-87609 | Remote code execution in Google Chrome on iOS before 153.0.8010.36 stems from a use-after-free in the Sharing component (CWE-416), letting a remote attacker who lures a victim to crafted network content execute arbitrary code outside the browser sandbox. Google has shipped a patched Chrome build; no public exploit is identified at time of analysis, and Google/Chromium rated the underlying bug 'Medium' severity even though the assigned CVSS base score is 9.6. | CRITICAL | 9.6 | 0.2% | 48 |
|
| CVE-2026-59111 | OS command injection in the Digitální a informační agentura (DIA) eObčanka-Identifikace macOS client (the Czech national electronic-ID 'eOP' identification app) lets a remote attacker execute arbitrary shell commands by luring a victim to open a crafted czeeopauth:// URL. Versions prior to 3.6.0 pass incoming URL-scheme parameters into a compiled AppleScript wrapper via string concatenation without sanitization, so attacker-controlled input breaks out of the intended command. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the CVSS 9.3 rating reflects unauthenticated network-reachable code execution requiring only that the user follow a malicious link. | CRITICAL | 9.3 | 0.8% | 47 |
No patch
|
| CVE-2026-82454 | Authentication bypass in the Omnivore API (packages/api) before commit abf53d6 lets a remote unauthenticated attacker impersonate any Apple-linked account through a JWT algorithm-confusion flaw in Apple sign-in. Because decodeAppleToken trusted the attacker-controlled 'alg' header and jsonwebtoken v8 does not enforce key/algorithm compatibility, an attacker can switch the token to HS256 and sign it with Apple's public RSA key used as the HMAC secret. Reported by VulnCheck; no public exploit identified at time of analysis, though the technique is a well-documented class of attack. | CRITICAL | 9.3 | 0.2% | 47 |
|