WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product ion✕
Overview 9,333 matches · 1,092 in Waratek scope · 124 protected · 228 exploited · 127 CISA KEV · 858 public PoC · 277 EPSS ≥ 0.5
split by peak 1,063 / year
Not applicable: 7,859Outside Waratek scope: 382No exploit published: 943Mitigation candidate: 23Protected by Waratek: 126 High: 9,333 not blocked: 9,207partly blocked: 2blocked by ARMR today: 124 No public exploit: 8,021Forecast only: 70Proof of concept only: 349Working exploit published: 665Exploited: 228
19962 Not applicable2 High2 not blocked2 Working exploit published2 19971 Not applicable1 High1 not blocked1 No public exploit1 19983 Not applicable3 High3 not blocked3 Working exploit published1 No public exploit2 199919 No exploit published1 Not applicable18 High19 not blocked19 Exploited1 Working exploit published8 No public exploit10 200019 No exploit published1 Outside Waratek scope1 Not applicable17 High19 not blocked19 Exploited1 Working exploit published9 No public exploit9 200137 Protected by Waratek1 No exploit published3 Outside Waratek scope1 Not applicable32 High37 blocked by ARMR today1 not blocked36 Exploited3 Working exploit published7 No public exploit27 200245 Protected by Waratek1 No exploit published4 Outside Waratek scope4 Not applicable36 High45 blocked by ARMR today1 not blocked44 Working exploit published8 Forecast only3 No public exploit34 200323 Not applicable23 High23 not blocked23 Exploited2 Working exploit published5 No public exploit16 200463 Protected by Waratek1 No exploit published1 Outside Waratek scope4 Not applicable57 High63 blocked by ARMR today1 not blocked62 Working exploit published21 No public exploit42 2005124 No exploit published7 Not applicable117 High124 not blocked124 Working exploit published44 Forecast only1 No public exploit79 2006128 Protected by Waratek1 No exploit published29 Outside Waratek scope11 Not applicable87 High128 blocked by ARMR today1 not blocked127 Working exploit published44 No public exploit84 2007197 Protected by Waratek1 No exploit published28 Outside Waratek scope7 Not applicable161 High197 blocked by ARMR today1 not blocked196 Exploited2 Working exploit published58 Forecast only1 No public exploit136 2008199 No exploit published14 Outside Waratek scope19 Not applicable166 High199 not blocked199 Exploited1 Working exploit published58 Forecast only5 No public exploit135 2009187 No exploit published13 Outside Waratek scope8 Not applicable166 High187 not blocked187 Exploited6 Working exploit published63 No public exploit118 2010118 Protected by Waratek2 No exploit published4 Outside Waratek scope15 Not applicable97 High118 blocked by ARMR today2 not blocked116 Exploited4 Working exploit published35 No public exploit79 201196 Mitigation candidate2 No exploit published4 Outside Waratek scope17 Not applicable73 High96 not blocked96 Exploited2 Working exploit published23 No public exploit71 2012161 No exploit published12 Outside Waratek scope5 Not applicable144 High161 not blocked161 Exploited4 Working exploit published24 Proof of concept only1 No public exploit132 2013176 Protected by Waratek3 No exploit published8 Outside Waratek scope12 Not applicable153 High176 blocked by ARMR today3 not blocked173 Exploited9 Working exploit published18 No public exploit149 2014184 Protected by Waratek3 Mitigation candidate1 No exploit published6 Outside Waratek scope8 Not applicable166 High184 blocked by ARMR today3 not blocked181 Exploited7 Working exploit published24 No public exploit153 2015217 Protected by Waratek1 Mitigation candidate1 No exploit published17 Outside Waratek scope12 Not applicable186 High217 blocked by ARMR today1 not blocked216 Exploited6 Working exploit published24 Proof of concept only1 No public exploit186 2016294 Protected by Waratek4 Mitigation candidate1 No exploit published25 Outside Waratek scope13 Not applicable251 High294 blocked by ARMR today4 not blocked290 Exploited9 Working exploit published28 Proof of concept only1 Forecast only6 No public exploit250 2017462 Protected by Waratek8 Mitigation candidate1 No exploit published40 Outside Waratek scope23 Not applicable390 High462 blocked by ARMR today6 partly blocked2 not blocked454 Exploited17 Working exploit published44 Proof of concept only2 Forecast only1 No public exploit398 2018683 Protected by Waratek15 Mitigation candidate1 No exploit published49 Outside Waratek scope32 Not applicable586 High683 blocked by ARMR today15 not blocked668 Exploited17 Working exploit published34 Proof of concept only2 Forecast only2 No public exploit628 2019563 Protected by Waratek11 Mitigation candidate2 No exploit published47 Outside Waratek scope58 Not applicable445 High563 blocked by ARMR today11 not blocked552 Exploited10 Working exploit published25 Proof of concept only8 Forecast only9 No public exploit511 2020597 Protected by Waratek17 Mitigation candidate4 No exploit published87 Outside Waratek scope38 Not applicable451 High597 blocked by ARMR today17 not blocked580 Exploited5 Working exploit published19 Proof of concept only12 Forecast only6 No public exploit555 2021764 Protected by Waratek20 Mitigation candidate6 No exploit published86 Outside Waratek scope46 Not applicable606 High764 blocked by ARMR today20 not blocked744 Exploited19 Working exploit published13 Proof of concept only12 Forecast only14 No public exploit706 2022852 Protected by Waratek10 Mitigation candidate2 No exploit published39 Outside Waratek scope17 Not applicable784 High852 blocked by ARMR today10 not blocked842 Exploited18 Working exploit published9 Proof of concept only81 Forecast only13 No public exploit731 2023845 Protected by Waratek9 Mitigation candidate2 No exploit published22 Outside Waratek scope8 Not applicable804 High845 blocked by ARMR today9 not blocked836 Exploited26 Working exploit published6 Proof of concept only66 Forecast only4 No public exploit743 2024636 Protected by Waratek3 No exploit published30 Outside Waratek scope12 Not applicable591 High636 blocked by ARMR today3 not blocked633 Exploited22 Working exploit published3 Proof of concept only45 Forecast only5 No public exploit561 2025575 No exploit published20 Outside Waratek scope4 Not applicable551 High575 not blocked575 Exploited20 Working exploit published8 Proof of concept only59 No public exploit488 20261,063 Protected by Waratek15 No exploit published346 Outside Waratek scope7 Not applicable695 High1,063 blocked by ARMR today15 not blocked1,048 Exploited17 Proof of concept only59 No public exploit987
19961999200220052008201120142017202020232026
9,333 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 1 of 94 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2026-113567 High 2026-11-10 Not applicable No public exploit Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-113565 High 2026-11-10 Not applicable No public exploit Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-113563 High 2026-11-10 Not applicable No public exploit Audition is affected by a Violation of Secure Design Principles vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
CVE-2026-113562 High 2026-11-10 Not applicable No public exploit Audition is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
CVE-2026-113560 High 2026-11-10 Not applicable No public exploit Audition is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
CVE-2026-113558 High 2026-11-10 Not applicable No public exploit Audition is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
CVE-2026-113557 High 2026-11-10 Not applicable No public exploit Audition is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
CVE-2026-113555 High 2026-11-10 Not applicable No public exploit Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-113553 High 2026-11-10 Not applicable No public exploit Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-113551 High 2026-11-10 Not applicable No public exploit Audition is affected by a Violation of Secure Design Principles vulnerability that could result in privilege escalation. A low-privileged attacker could leverage this vulnerability to gain elevated access. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-120733 High 2026-11-03 Not applicable No public exploit Cleartext storage of sensitive information in the user account data in Devolutions Server 2026.3.12.0 and earlier allows an attacker with read access to the database or a database backup to obtain users' TOTP shared secrets via the unencrypted copy of the security key written when an administrator saves a user.
CVE-2026-120715 High 2026-11-03 Not applicable No public exploit Server-side request forgery in the Active Directory credential validation in Devolutions Server 2026.3.12.0 and earlier allows an authenticated low-privileged user to capture the NetNTLMv2 hash of the DVLS service account via an attacker-controlled domain name in the request.
CVE-2026-119636 High 2026-11-03 Not applicable No public exploit Improper release of expired privileged access checkouts in the PAM scheduled check-in task in Devolutions Server 2025.3.2.0 through 2026.2.22.0 allows an authenticated user with checkout rights on a PAM account to retain access to that account on the target system after the checkout expires via a backlog of 21 or more newer active checkouts that prevents the expired checkout from being checked in and its password from being rotated.
CVE-2026-111560 High 2026-11-02 Not applicable Exploited Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.
CVE-2026-45049 High 2026-10-29 No exploit published No public exploit Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `Cross-Domain Single Sign-On` (`CDSSO`) servlet allows a logged-in user's raw OpenAM session token to be POSTed to an attacker-controlled URL. An attacker who induces an authenticated victim to visit a crafted URL can receive the session credential and potentially hijack the session. Deployments must have `CDSSO` enabled, as is common in multi-domain deployments, and exploitation is additionally gated on a non-default configuration being absent. This issue is fixed in version 16.1.1.
CVE-2026-86992 High 2026-10-26 Not applicable No public exploit The issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted video file may lead to unexpected app termination.
CVE-2026-86991 High 2026-10-26 Not applicable No public exploit A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted file may lead to unexpected process termination.
CVE-2026-86986 High 2026-10-26 Not applicable No public exploit A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
CVE-2026-86974 High 2026-10-26 Not applicable No public exploit A type confusion issue was addressed with improved checks. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to memory corruption.
CVE-2026-86972 High 2026-10-26 Not applicable No public exploit A buffer overflow was addressed with improved size validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted audio file may lead to memory corruption.
CVE-2026-86968 High 2026-10-26 Not applicable No public exploit An access issue was addressed with improved access control. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. A malicious app may be able to access restricted system interfaces or launder launch attribution.
CVE-2026-86964 High 2026-10-26 Not applicable No public exploit A null pointer dereference was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7.2, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination.
CVE-2026-84627 High 2026-10-26 Not applicable No public exploit A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7.2, visionOS 27. Processing a maliciously crafted image may lead to heap corruption.
CVE-2026-84599 High 2026-10-26 Not applicable No public exploit The issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination or corrupt kernel memory.
CVE-2026-84495 High 2026-10-26 Not applicable No public exploit A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to cause unexpected system termination or write kernel memory.
CVE-2026-84494 High 2026-10-26 Not applicable No public exploit An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. An app may be able to cause unexpected system termination or write kernel memory.
CVE-2026-65385 High 2026-10-26 Not applicable No public exploit An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, visionOS 27.2, watchOS 27.2. A buffer overflow may result in memory corruption and unexpected app termination.
CVE-2026-65350 High 2026-10-26 Not applicable No public exploit A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to cause unexpected system termination or corrupt kernel memory.
CVE-2026-113949 High 2026-10-26 Not applicable No public exploit A type confusion issue was addressed with improved state management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to memory corruption.
CVE-2026-113912 High 2026-10-26 Not applicable No public exploit An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2. Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory.
CVE-2026-113909 High 2026-10-26 Not applicable No public exploit A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. An attacker in physical proximity may be able to corrupt process memory.
CVE-2026-112697 High 2026-10-26 Not applicable No public exploit A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing maliciously crafted web content may lead to arbitrary code execution.
CVE-2026-112696 High 2026-10-26 Not applicable No public exploit An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. An app may be able to cause unexpected system termination or corrupt kernel memory.
CVE-2026-112683 High 2026-10-26 Not applicable No public exploit An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted font may lead to unexpected app termination or corrupt process memory.
CVE-2026-112682 High 2026-10-26 Not applicable No public exploit An input validation issue was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Tahoe 26.7.2, visionOS 27.2, watchOS 27.2. A remote attacker may be able to cause unexpected app termination.
CVE-2026-112679 High 2026-10-26 Not applicable No public exploit A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to cause unexpected system termination or corrupt kernel memory.
CVE-2026-112676 High 2026-10-26 Not applicable No public exploit This issue was addressed with additional entitlement checks. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. An app may be able to access a user's Photos Library.
CVE-2026-112671 High 2026-10-26 Not applicable No public exploit A resource exhaustion issue was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. A remote attacker may be able to cause a denial-of-service.
CVE-2026-112659 High 2026-10-26 Not applicable No public exploit A type confusion issue was addressed with improved memory handling. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to arbitrary code execution.
CVE-2026-112655 High 2026-10-26 Not applicable No public exploit A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing maliciously crafted web content may lead to arbitrary code execution.
CVE-2026-112654 High 2026-10-26 Not applicable No public exploit A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to an unexpected process termination.
CVE-2026-112651 High 2026-10-26 Not applicable No public exploit A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to arbitrary code execution.
CVE-2026-112640 High 2026-10-26 Not applicable No public exploit A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing maliciously crafted web content may lead to memory corruption.
CVE-2026-112639 High 2026-10-26 Not applicable No public exploit A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to arbitrary code execution.
CVE-2026-112638 High 2026-10-26 Not applicable No public exploit A heap buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An attacker in radio range may be able to cause unexpected system termination.
CVE-2026-112637 High 2026-10-26 Not applicable No public exploit A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing maliciously crafted web content may lead to arbitrary code execution.
CVE-2026-112626 High 2026-10-26 Not applicable No public exploit A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing maliciously crafted web content may lead to arbitrary code execution.
CVE-2026-112623 High 2026-10-26 Not applicable No public exploit A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to arbitrary code execution.
CVE-2026-112621 High 2026-10-26 Not applicable Proof of concept only An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing a maliciously crafted image may result in memory corruption.
CVE-2026-112620 High 2026-10-26 Not applicable No public exploit A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2. An attacker in a privileged network position may be able to cause a denial-of-service.
CVE-2026-112619 High 2026-10-26 Not applicable No public exploit An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted calendar invitation may lead to memory corruption.
CVE-2026-112606 High 2026-10-26 Not applicable No public exploit A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to cause unexpected system termination.
CVE-2026-112567 High 2026-10-26 Not applicable No public exploit This issue was addressed with improved checks. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. A malicious application may be able to bypass Privacy preferences.
CVE-2026-112565 High 2026-10-26 Not applicable No public exploit An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted 3D model may lead to memory corruption.
CVE-2026-112546 High 2026-10-26 Not applicable No public exploit An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted file may lead to unexpected app termination.
CVE-2026-112517 High 2026-10-26 Not applicable No public exploit A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to cause unexpected system termination or corrupt kernel memory.
CVE-2026-112515 High 2026-10-26 Not applicable No public exploit An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An attacker may be able to cause unexpected system termination or read kernel memory.
CVE-2026-112486 High 2026-10-26 Not applicable No public exploit An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a 3D model may lead to unexpected app termination.
CVE-2026-112485 High 2026-10-26 Not applicable No public exploit The issue was addressed with improved memory handling. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2. Processing a maliciously crafted 3D model may lead to memory corruption.
CVE-2026-112477 High 2026-10-26 Not applicable No public exploit A race condition was addressed with improved locking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to cause unexpected system termination or corrupt kernel memory.
CVE-2026-112476 High 2026-10-26 Not applicable No public exploit An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to cause unexpected system termination.
CVE-2026-112474 High 2026-10-26 Not applicable No public exploit A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to cause unexpected system termination or write kernel memory.
CVE-2026-112470 High 2026-10-26 Not applicable No public exploit An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to cause unexpected system termination or corrupt kernel memory.
CVE-2026-112469 High 2026-10-26 Not applicable No public exploit An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2. An app may be able to cause unexpected system termination or corrupt kernel memory.
CVE-2026-112466 High 2026-10-26 Not applicable No public exploit An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to cause unexpected system termination or read kernel memory.
CVE-2026-112464 High 2026-10-26 Not applicable No public exploit An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2. Processing a maliciously crafted file may lead to heap corruption.
CVE-2026-112461 High 2026-10-26 Not applicable No public exploit An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted 3D model may lead to memory corruption.
CVE-2026-112454 High 2026-10-26 Not applicable No public exploit The issue was addressed with improved memory handling. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory.
CVE-2026-112449 High 2026-10-26 Not applicable No public exploit An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted 3D model may lead to memory corruption.
CVE-2026-112446 High 2026-10-26 Not applicable No public exploit This issue was addressed with additional entitlement checks. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27, macOS Golden Gate 27.2, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to access sensitive user data.
CVE-2026-112417 High 2026-10-26 Not applicable No public exploit An integer overflow was addressed with improved input validation. This issue is fixed in visionOS 27.2. Processing a maliciously crafted 3D model may lead to memory corruption.
CVE-2026-93631 High 2026-10-23 Not applicable No public exploit A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition allows an attacker to link an attacker-controlled external account to a victim's mailbox. The OAuth callback does not bind its state value or authorization code to the initiating Zimbra session and instead selects the destination mailbox from the browser's current authentication cookie. On a deployment with the provider configured, an attacker can induce a signed-in victim to load a callback containing a fresh code for the attacker's provider account. This creates a persistent data source that imports attacker-controlled contacts or events. With bidirectional CalDAV synchronization, appointments subsequently created or edited in the linked calendar are also disclosed to the attacker. ZCS 10.1.16 and 10.1.20 are affected.
CVE-2026-50053 High 2026-10-23 Not applicable No public exploit A request attribute override vulnerability in Zimbra Collaboration Suite (ZCS) allows unauthenticated requests to /h/* to populate servlet attributes intended for trusted internal dispatch. RestFilter copies URL parameters specifying an authentication token, target account, target item and dispatch state into the request attributes consumed by the Classic Web Client. Combined with CVE-2026-10632 on ZCS 10.1.16, this allows an attacker to supply their own valid token and document identifiers and execute JavaScript in another user's signed-in browser session. ZCS 10.1.17 blocks that XSS chain by changing the document renderer, but retains the request attribute override.
CVE-2026-91627 High 2026-10-20 No exploit published No public exploit Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: Platform). Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Billing and Revenue Management executes to compromise Oracle Communications Billing and Revenue Management. Successful attacks of this vulnerability can result in takeover of Oracle Communications Billing and Revenue Management. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-91532 High 2026-10-20 No exploit published No public exploit Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Manager. Successful attacks of this vulnerability can result in takeover of Oracle Applications Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-86922 High 2026-10-20 Not applicable No public exploit A type confusion issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Processing maliciously crafted web content may lead to arbitrary code execution.
CVE-2026-86919 High 2026-10-20 Not applicable No public exploit A stack overflow was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27. An attacker with a paired Bluetooth device may be able to execute arbitrary code.
CVE-2026-82891 High 2026-10-20 Not applicable No public exploit IBM Guardium Data Protection 12.1, and 12.2 could allow a remote attacker to obtain sensitive information due to use of a hard-coded cryptographic key.
CVE-2026-101837 High 2026-10-20 No exploit published No public exploit Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Shipping Execution. While the vulnerability is in Oracle Shipping Execution, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Shipping Execution as well as unauthorized update, insert or delete access to some of Oracle Shipping Execution accessible data and unauthorized read access to a subset of Oracle Shipping Execution accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H).
CVE-2026-101835 High 2026-10-20 No exploit published No public exploit Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Shipping Execution. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Shipping Execution accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVE-2026-101834 High 2026-10-20 No exploit published No public exploit Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Shipping Execution. Successful attacks of this vulnerability can result in takeover of Oracle Shipping Execution. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-101791 High 2026-10-20 No exploit published No public exploit Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications (component: Security). The supported version that is affected is 15.2.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via TLS to compromise Oracle Communications BRM - Elastic Charging Engine. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Communications BRM - Elastic Charging Engine accessible data as well as unauthorized access to critical data or complete access to all Oracle Communications BRM - Elastic Charging Engine accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
CVE-2026-101759 High 2026-10-20 No exploit published No public exploit Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server). Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Billing and Revenue Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Communications Billing and Revenue Management accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVE-2026-101742 High 2026-10-20 No exploit published No public exploit Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Diagnostics). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Manager. Successful attacks of this vulnerability can result in takeover of Oracle Applications Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-101566 High 2026-10-20 No exploit published No public exploit Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: DB Privileges). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Application Object Library executes to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-101552 High 2026-10-20 No exploit published No public exploit Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Flexfields). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-101551 High 2026-10-20 No exploit published No public exploit Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Oracle Diagnostics Interfaces). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Applications Manager accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVE-2026-44084 High 2026-10-15 Not applicable No public exploit An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow remote attackers to obtain sensitive data. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later
CVE-2026-34015 High 2026-10-15 Not applicable No public exploit A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later
CVE-2026-26245 High 2026-10-15 Not applicable No public exploit A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later
CVE-2026-26244 High 2026-10-15 Not applicable No public exploit A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later
CVE-2025-66275 High 2026-10-15 Not applicable No public exploit A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.5 and later
CVE-2025-66272 High 2026-10-15 Not applicable No public exploit A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.5 and later
CVE-2026-96943 High 2026-10-13 Not applicable No public exploit Integer overflow or wraparound in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network.
CVE-2026-95696 High 2026-10-13 No exploit published No public exploit IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of service due to an uncaught exception.
CVE-2026-93905 High 2026-10-13 Protected by Waratek No public exploit IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances.
CVE-2026-88075 High 2026-10-13 Not applicable No public exploit Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network.
CVE-2026-87696 High 2026-10-13 Not applicable No public exploit Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-87695 High 2026-10-13 Not applicable No public exploit Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
CVE-2026-87692 High 2026-10-13 Not applicable No public exploit Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
‹ prev page 1 of 94 next ›