WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product ion✕
Overview 10,757 matches · 1,506 in Waratek scope · 150 protected · 101 exploited · 31 CISA KEV · 620 public PoC · 123 EPSS ≥ 0.5
split by peak 866 / year
Not applicable: 8,354Outside Waratek scope: 897No exploit published: 1,321Mitigation candidate: 35Protected by Waratek: 150 Medium: 10,757 not established: 1not blocked: 10,606blocked by ARMR today: 150 No public exploit: 9,455Forecast only: 42Proof of concept only: 631Working exploit published: 528Exploited: 101
19972 Not applicable2 Medium2 not blocked2 Working exploit published2 19982 Not applicable2 Medium2 not blocked2 Working exploit published1 No public exploit1 199920 Not applicable20 Medium20 not blocked20 Working exploit published6 No public exploit14 200027 Mitigation candidate1 Not applicable26 Medium27 not blocked27 Exploited1 Working exploit published14 No public exploit12 200127 Mitigation candidate1 No exploit published2 Outside Waratek scope1 Not applicable23 Medium27 not blocked27 Working exploit published8 Forecast only1 No public exploit18 200259 No exploit published9 Outside Waratek scope2 Not applicable48 Medium59 not blocked59 Exploited2 Working exploit published15 Forecast only3 No public exploit39 200337 No exploit published2 Not applicable35 Medium37 not blocked37 Working exploit published14 No public exploit23 200460 Mitigation candidate1 No exploit published3 Outside Waratek scope1 Not applicable55 Medium60 not blocked60 Working exploit published15 No public exploit45 2005141 Mitigation candidate1 No exploit published10 Outside Waratek scope1 Not applicable129 Medium141 not blocked141 Exploited1 Working exploit published41 Forecast only1 No public exploit98 2006152 Protected by Waratek1 Mitigation candidate1 No exploit published18 Not applicable132 Medium152 blocked by ARMR today1 not blocked151 Working exploit published44 No public exploit108 2007147 Protected by Waratek1 Mitigation candidate1 No exploit published19 Outside Waratek scope4 Not applicable122 Medium147 blocked by ARMR today1 not blocked146 Working exploit published28 No public exploit119 2008155 Mitigation candidate2 No exploit published18 Outside Waratek scope7 Not applicable128 Medium155 not blocked155 Working exploit published36 No public exploit119 2009173 Mitigation candidate1 No exploit published41 Outside Waratek scope2 Not applicable129 Medium173 not blocked173 Exploited3 Working exploit published47 Forecast only2 No public exploit121 2010142 Protected by Waratek3 Mitigation candidate1 No exploit published35 Outside Waratek scope2 Not applicable101 Medium142 blocked by ARMR today3 not blocked139 Exploited4 Working exploit published23 No public exploit115 2011168 Protected by Waratek1 Mitigation candidate2 No exploit published43 Outside Waratek scope7 Not applicable115 Medium168 blocked by ARMR today1 not blocked167 Exploited1 Working exploit published16 Proof of concept only1 No public exploit150 2012275 Protected by Waratek2 Mitigation candidate6 No exploit published51 Outside Waratek scope8 Not applicable208 Medium275 blocked by ARMR today2 not blocked272 not established1 Exploited6 Working exploit published37 Forecast only8 No public exploit224 2013343 Protected by Waratek2 Mitigation candidate3 No exploit published63 Outside Waratek scope26 Not applicable249 Medium343 blocked by ARMR today2 not blocked341 Exploited6 Working exploit published22 Forecast only3 No public exploit312 2014544 Protected by Waratek5 Mitigation candidate3 No exploit published86 Outside Waratek scope53 Not applicable397 Medium544 blocked by ARMR today5 not blocked539 Exploited2 Working exploit published28 Forecast only3 No public exploit511 2015413 Protected by Waratek1 Mitigation candidate1 No exploit published65 Outside Waratek scope30 Not applicable316 Medium413 blocked by ARMR today1 not blocked412 Exploited3 Working exploit published18 Proof of concept only1 Forecast only1 No public exploit390 2016340 Protected by Waratek12 Mitigation candidate1 No exploit published62 Outside Waratek scope9 Not applicable256 Medium340 blocked by ARMR today12 not blocked328 Exploited4 Working exploit published20 Proof of concept only1 Forecast only4 No public exploit311 2017555 Protected by Waratek7 Mitigation candidate1 No exploit published45 Outside Waratek scope47 Not applicable455 Medium555 blocked by ARMR today7 not blocked548 Exploited2 Working exploit published18 Proof of concept only1 No public exploit534 2018866 Protected by Waratek29 Mitigation candidate1 No exploit published79 Outside Waratek scope121 Not applicable636 Medium866 blocked by ARMR today29 not blocked837 Exploited8 Working exploit published22 Proof of concept only2 No public exploit834 2019776 Protected by Waratek15 No exploit published67 Outside Waratek scope133 Not applicable561 Medium776 blocked by ARMR today15 not blocked761 Exploited5 Working exploit published16 Forecast only1 No public exploit754 2020754 Protected by Waratek16 No exploit published114 Outside Waratek scope142 Not applicable482 Medium754 blocked by ARMR today16 not blocked738 Exploited11 Working exploit published3 Proof of concept only3 Forecast only2 No public exploit735 2021750 Protected by Waratek16 Mitigation candidate6 No exploit published65 Outside Waratek scope110 Not applicable553 Medium750 blocked by ARMR today16 not blocked734 Exploited13 Working exploit published12 Proof of concept only13 Forecast only4 No public exploit708 2022764 Protected by Waratek17 No exploit published99 Outside Waratek scope98 Not applicable550 Medium764 blocked by ARMR today17 not blocked747 Exploited5 Working exploit published4 Proof of concept only39 Forecast only5 No public exploit711 2023730 Protected by Waratek6 Mitigation candidate1 No exploit published50 Outside Waratek scope31 Not applicable642 Medium730 blocked by ARMR today6 not blocked724 Exploited6 Working exploit published7 Proof of concept only88 Forecast only2 No public exploit627 2024802 Protected by Waratek5 No exploit published42 Outside Waratek scope37 Not applicable718 Medium802 blocked by ARMR today5 not blocked797 Exploited8 Working exploit published3 Proof of concept only170 Forecast only1 No public exploit620 2025778 Protected by Waratek4 No exploit published60 Outside Waratek scope9 Not applicable705 Medium778 blocked by ARMR today4 not blocked774 Exploited8 Working exploit published6 Proof of concept only273 Forecast only1 No public exploit490 2026755 Protected by Waratek7 No exploit published173 Outside Waratek scope16 Not applicable559 Medium755 blocked by ARMR today7 not blocked748 Exploited2 Working exploit published2 Proof of concept only39 No public exploit712
1999200220052008201120142017202020232026
10,757 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 1 of 108 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2026-113549 Medium 2026-11-10 Not applicable No public exploit Audition is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-84229 Medium 2026-11-08 Not applicable No public exploit IBM Guardium Data Protection 12.2.4 could allow a remote attacker to bypass security restrictions due to improper validation of CSRF tokens for GET requests.
CVE-2026-84030 Medium 2026-11-08 Not applicable No public exploit IBM Guardium Data Protection 12.2.4 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.
CVE-2026-82830 Medium 2026-11-08 Not applicable No public exploit IBM Guardium Data Protection 12.2.4 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of argument delimiters.
CVE-2026-120734 Medium 2026-11-03 Not applicable No public exploit Cleartext transmission of sensitive information in the email configuration test in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with access to the test action to obtain the stored SMTP password via a request that names an attacker-controlled SMTP host.
CVE-2026-120716 Medium 2026-11-03 Not applicable No public exploit Insertion of sensitive information into sent data in the identity provider user synchronization in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with the delegated permission to update users from the identity provider to obtain other users' MFA secrets via the synchronization API response.
CVE-2026-86990 Medium 2026-10-26 Not applicable No public exploit An access issue was addressed with improved access restrictions. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Tahoe 26.7.2, visionOS 27.2. A malicious app may be able to access the camera without user permission.
CVE-2026-86988 Medium 2026-10-26 Not applicable No public exploit The issue was addressed with improved checks. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted image may result in disclosure of process memory.
CVE-2026-86971 Medium 2026-10-26 Not applicable No public exploit An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted image may lead to unexpected app termination.
CVE-2026-86970 Medium 2026-10-26 Not applicable No public exploit An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted font may result in the disclosure of process memory.
CVE-2026-86966 Medium 2026-10-26 Not applicable No public exploit This issue was addressed with improved handling of symlinks. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27. An app may be able to modify protected parts of the file system.
CVE-2026-86954 Medium 2026-10-26 Not applicable No public exploit An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted image may lead to unexpected app termination.
CVE-2026-86942 Medium 2026-10-26 Not applicable No public exploit An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27. An app may be able to cause a denial-of-service.
CVE-2026-86925 Medium 2026-10-26 Not applicable No public exploit An authorization issue was addressed with improved state management. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. An app may be able to access sensitive user data.
CVE-2026-86920 Medium 2026-10-26 Not applicable No public exploit An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27. An app may be able to access sensitive user data.
CVE-2026-84634 Medium 2026-10-26 Not applicable No public exploit A race condition was addressed with additional validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. An app may be able to cause unexpected system termination or write kernel memory.
CVE-2026-84595 Medium 2026-10-26 Not applicable No public exploit An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27. An app may be able to cause unexpected system termination.
CVE-2026-65397 Medium 2026-10-26 Not applicable No public exploit An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. An app may be able to access sensitive user data.
CVE-2026-113950 Medium 2026-10-26 Not applicable No public exploit An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted font may lead to unexpected app termination or corrupt process memory.
CVE-2026-113915 Medium 2026-10-26 Not applicable No public exploit A race condition was addressed with additional validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to access sensitive user data.
CVE-2026-113913 Medium 2026-10-26 Not applicable No public exploit An input validation issue was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing web content may disclose sensitive information.
CVE-2026-113910 Medium 2026-10-26 Not applicable No public exploit A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to disclose kernel memory.
CVE-2026-113907 Medium 2026-10-26 Not applicable No public exploit A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to cause unexpected system termination or corrupt process memory.
CVE-2026-113904 Medium 2026-10-26 Not applicable No public exploit A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing maliciously crafted web content may lead to an unexpected process crash.
CVE-2026-113903 Medium 2026-10-26 Not applicable No public exploit A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to unexpected memory modification.
CVE-2026-113901 Medium 2026-10-26 Not applicable No public exploit A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to an unexpected process crash.
CVE-2026-113896 Medium 2026-10-26 Not applicable No public exploit A race condition was addressed with additional validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. An app may be able to access sensitive user data.
CVE-2026-112706 Medium 2026-10-26 Not applicable Proof of concept only A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to access sensitive user data.
CVE-2026-112699 Medium 2026-10-26 Not applicable No public exploit An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may result in the disclosure of process memory.
CVE-2026-112695 Medium 2026-10-26 Not applicable No public exploit A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to an unexpected process termination.
CVE-2026-112693 Medium 2026-10-26 Not applicable No public exploit A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
CVE-2026-112692 Medium 2026-10-26 Not applicable No public exploit This issue was addressed with additional entitlement checks. This issue is fixed in iOS 27.2 and iPadOS 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to access sensitive user data.
CVE-2026-112691 Medium 2026-10-26 Not applicable No public exploit An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to cause unexpected system termination.
CVE-2026-112685 Medium 2026-10-26 Not applicable No public exploit An authorization issue was addressed with improved state management. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to access sensitive user data.
CVE-2026-112684 Medium 2026-10-26 Not applicable No public exploit This issue was addressed through improved state management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing maliciously crafted web content may lead to an unexpected process crash.
CVE-2026-112680 Medium 2026-10-26 Not applicable No public exploit An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may result in the disclosure of process memory.
CVE-2026-112678 Medium 2026-10-26 Not applicable No public exploit A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2, watchOS 27.2. An app may be able to access sensitive user data.
CVE-2026-112673 Medium 2026-10-26 Not applicable No public exploit A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to an unexpected process termination.
CVE-2026-112653 Medium 2026-10-26 Not applicable No public exploit A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to an unexpected process termination.
CVE-2026-112652 Medium 2026-10-26 Not applicable No public exploit A logic issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. An malicious app may be able to bypass certificate validation.
CVE-2026-112646 Medium 2026-10-26 Not applicable No public exploit An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, visionOS 27.2. An app may be able to cause unexpected system termination or corrupt process memory.
CVE-2026-112642 Medium 2026-10-26 Not applicable No public exploit An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2. Processing a maliciously crafted font may result in the disclosure of process memory.
CVE-2026-112634 Medium 2026-10-26 Not applicable No public exploit An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted image may lead to unexpected app termination.
CVE-2026-112632 Medium 2026-10-26 Not applicable No public exploit An uninitialized memory issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted image may result in disclosure of process memory.
CVE-2026-112629 Medium 2026-10-26 Not applicable No public exploit An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted image may lead to unexpected app termination.
CVE-2026-112628 Medium 2026-10-26 Not applicable No public exploit This issue was addressed with improved data access restriction. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. An app may be able to access sensitive user data.
CVE-2026-112627 Medium 2026-10-26 Not applicable No public exploit An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted image may result in disclosure of process memory.
CVE-2026-112624 Medium 2026-10-26 Not applicable No public exploit This issue was addressed with improved checks. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. An app may be able to bypass Privacy preferences.
CVE-2026-112618 Medium 2026-10-26 Not applicable No public exploit An access issue was addressed with improved access restrictions. This issue is fixed in iOS 27.2 and iPadOS 27.2, visionOS 27.2. An app may be able to access sensitive user data.
CVE-2026-112616 Medium 2026-10-26 Not applicable No public exploit An authorization issue was addressed with improved access control. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. An app may be able to access sensitive user data.
CVE-2026-112615 Medium 2026-10-26 Not applicable No public exploit A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing maliciously crafted web content may lead to an unexpected process termination.
CVE-2026-112608 Medium 2026-10-26 Not applicable No public exploit An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted Bluetooth packet may result in disclosure of process memory.
CVE-2026-112599 Medium 2026-10-26 Not applicable No public exploit A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing maliciously crafted web content may lead to an unexpected process crash.
CVE-2026-112596 Medium 2026-10-26 Not applicable No public exploit An integer overflow was addressed with improved bounds checking. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted video file may lead to unexpected system termination.
CVE-2026-112576 Medium 2026-10-26 Not applicable No public exploit A memory integrity issue was addressed with improved handling of copy-on-write pages. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to cause unexpected changes to copy-on-write memory.
CVE-2026-112571 Medium 2026-10-26 Not applicable No public exploit A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted image may result in disclosure of process memory.
CVE-2026-112566 Medium 2026-10-26 Not applicable No public exploit A null pointer dereference was addressed with improved validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An attacker in physical proximity may be able to cause a denial-of-service.
CVE-2026-112563 Medium 2026-10-26 Not applicable No public exploit An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2. Processing a maliciously crafted file may lead to unexpected app termination.
CVE-2026-112561 Medium 2026-10-26 Not applicable No public exploit An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted image may result in disclosure of process memory.
CVE-2026-112560 Medium 2026-10-26 Not applicable No public exploit An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted image may result in disclosure of process memory.
CVE-2026-112559 Medium 2026-10-26 Not applicable No public exploit An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2, watchOS 27.2. An app may be able to access sensitive user data.
CVE-2026-112518 Medium 2026-10-26 Not applicable No public exploit An issue with signature validation was addressed with improved checks. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An attacker in a privileged network position may be able to impersonate a Kerberos KDC.
CVE-2026-112516 Medium 2026-10-26 Not applicable No public exploit A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to cause unexpected system termination.
CVE-2026-112501 Medium 2026-10-26 Not applicable No public exploit A race condition was addressed with improved state handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to cause unexpected system termination.
CVE-2026-112500 Medium 2026-10-26 Not applicable No public exploit A logic issue was addressed with improved restrictions. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. The user's original email address may be leaked when using the Hide My Email feature.
CVE-2026-112491 Medium 2026-10-26 Not applicable No public exploit An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2. Processing a maliciously crafted file may lead to unexpected app termination.
CVE-2026-112488 Medium 2026-10-26 Not applicable No public exploit A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted image may corrupt process memory.
CVE-2026-112468 Medium 2026-10-26 Not applicable No public exploit An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2. An app may be able to cause unexpected system termination or corrupt kernel memory.
CVE-2026-112455 Medium 2026-10-26 Not applicable No public exploit An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to access sensitive user data.
CVE-2026-112432 Medium 2026-10-26 Not applicable No public exploit A logging issue was addressed with improved data redaction. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to access sensitive user data.
CVE-2026-112423 Medium 2026-10-26 Not applicable No public exploit An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents.
CVE-2026-112416 Medium 2026-10-26 Not applicable No public exploit An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2. Processing a maliciously crafted video file may lead to unexpected app termination.
CVE-2026-112415 Medium 2026-10-26 Not applicable No public exploit An out-of-bounds write was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. An app may be able to cause unexpected system termination or corrupt process memory.
CVE-2026-112414 Medium 2026-10-26 Not applicable No public exploit A stack overflow was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted message may lead to a denial-of-service.
CVE-2026-93638 Medium 2026-10-23 Not applicable No public exploit A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite (ZCS) allows an unauthenticated attacker to execute JavaScript through the zrememberme parameter. A crafted relogin URL selects a two-factor error display that inserts the parameter into a hidden input attribute without HTML encoding. A victim who opens the URL receives attacker-controlled script and page content under the legitimate Zimbra origin, allowing credential capture through a replacement login form. The relogin path logs out an existing session before rendering the payload, so the demonstrated attack does not inherit that session's mailbox access. ZCS 10.1.16 and 10.1.17 are affected.
CVE-2026-93636 Medium 2026-10-23 Not applicable No public exploit An LDAP filter injection vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to query otherwise unreturned attributes of calendar resources through SearchCalendarResourcesRequest. Zimbra escapes search values but inserts the supplied attribute names directly into LDAP filter expressions without validation. An attacker can inject additional conditions and use repeated matching queries to recover readable resource attributes such as internal mailbox hostnames and mail transport routes. The search remains restricted to calendar-resource objects and the LDAP service account's access rights. ZCS 10.1.16 and 10.1.21 are affected.
CVE-2026-93634 Medium 2026-10-23 Not applicable No public exploit A cross-account authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to insert forged shared-file records into another user's mailbox through FileSharedWithMeRequest. The request bypasses delegated-account authorization and accepts attacker-selected file metadata, owner identifiers and declared sizes without validating a corresponding document share. An attacker can plant entries attributed to another real local account without that account sharing a document. No victim interaction is required. ZCS 10.1.16 and 10.1.20 are affected.
CVE-2026-93633 Medium 2026-10-23 Not applicable No public exploit A CSS sanitization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user with Briefcase access to publish a document that displays attacker-controlled content under the Zimbra origin. When processing a stylesheet containing non-ASCII characters, DefangFilter appends the final ASCII segment without sanitizing it. HTML stored as application/x-zimbra-doc can therefore retain CSS URL references that the normal sanitizer removes. An attacker can share a crafted document that loads external resources and displays a credential-collection form using Zimbra's own visual assets. Exploitation requires the victim to open the document in a browser that renders the content type inline; credential theft additionally requires form submission. ZCS 10.1.16 and 10.1.20 are affected.
CVE-2026-115786 Medium 2026-10-23 Not applicable No public exploit A mailbox quota-accounting vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to consume another user’s mailbox quota by repeatedly sharing and revoking a document. Creation of the recipient’s shared-file record charges the document size to mailbox-wide usage. Revocation deletes the record and reverses its folder counters without reversing the mailbox-wide charge. Repeated normal share notifications therefore accumulate quota usage after the visible records are gone. On accounts with a finite quota, this can prevent incoming mail and other size-increasing operations without recipient interaction. The issue affects ZCS 10.1.16 and 10.1.20.
CVE-2026-115785 Medium 2026-10-23 Not applicable No public exploit An SMTP command injection vulnerability in the data-source testing functionality of Zimbra Collaboration Suite (ZCS) allows an ordinary authenticated user with account options enabled to inject CR/LF into the emailAddress inserted into an SMTP envelope command by a JSON SOAP request. After a successful preliminary POP3 or IMAP login, Zimbra sends the injected commands to the selected SMTP service. If that service accepts the pipelined transaction, the attacker can submit mail with attacker-selected recipients, headers and body content without victim interaction. The vulnerable command-construction path is present in ZCS 10.1.16 and 10.1.20.
CVE-2026-91629 Medium 2026-10-20 No exploit published No public exploit Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: Platform). Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Billing and Revenue Management executes to compromise Oracle Communications Billing and Revenue Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Communications Billing and Revenue Management accessible data. CVSS 3.1 Base Score 4.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N).
CVE-2026-91628 Medium 2026-10-20 No exploit published No public exploit Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server). Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Billing and Revenue Management executes to compromise Oracle Communications Billing and Revenue Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Communications Billing and Revenue Management accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
CVE-2026-86975 Medium 2026-10-20 Not applicable No public exploit An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted image may lead to unexpected process termination.
CVE-2026-86962 Medium 2026-10-20 Not applicable No public exploit A double free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination.
CVE-2026-86957 Medium 2026-10-20 Not applicable No public exploit An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An attacker in wireless proximity may be able to cause unexpected system termination.
CVE-2026-86953 Medium 2026-10-20 Not applicable No public exploit An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. An attacker in physical proximity may be able to cause a denial-of-service.
CVE-2026-86921 Medium 2026-10-20 Not applicable No public exploit A permissions issue was addressed with improved validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. A local attacker may be able to overwrite restricted files.
CVE-2026-86918 Medium 2026-10-20 Not applicable No public exploit An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted image may lead to unexpected app termination.
CVE-2026-86913 Medium 2026-10-20 Not applicable No public exploit A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory.
CVE-2026-86872 Medium 2026-10-20 Not applicable No public exploit A logic issue was addressed with improved state management. This issue is fixed in Safari 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to unexpected behavior.
CVE-2026-84613 Medium 2026-10-20 Not applicable No public exploit An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An attacker in radio range may be able to cause unexpected system termination.
CVE-2026-84582 Medium 2026-10-20 Not applicable No public exploit A privacy issue was addressed with improved access restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. An app may be able to access sensitive user data.
CVE-2026-84508 Medium 2026-10-20 Not applicable No public exploit This issue was addressed with improved validation of the caller's access. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, visionOS 27. An app may be able to access protected user data.
CVE-2026-28850 Medium 2026-10-20 Not applicable No public exploit An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.8, visionOS 27. An app may be able to access sensitive user data.
CVE-2026-101807 Medium 2026-10-20 No exploit published No public exploit Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server). Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Billing and Revenue Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Billing and Revenue Management accessible data as well as unauthorized read access to a subset of Oracle Communications Billing and Revenue Management accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
CVE-2026-101793 Medium 2026-10-20 No exploit published No public exploit Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications (component: Core). Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications BRM - Elastic Charging Engine executes to compromise Oracle Communications BRM - Elastic Charging Engine. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Communications BRM - Elastic Charging Engine accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
CVE-2026-101792 Medium 2026-10-20 No exploit published No public exploit Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications (component: Security). Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Communications BRM - Elastic Charging Engine executes to compromise Oracle Communications BRM - Elastic Charging Engine. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Communications BRM - Elastic Charging Engine accessible data as well as unauthorized read access to a subset of Oracle Communications BRM - Elastic Charging Engine accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N).
CVE-2026-101782 Medium 2026-10-20 No exploit published No public exploit Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Oracle Diagnostics Interfaces). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Applications Manager accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
CVE-2026-101764 Medium 2026-10-20 No exploit published No public exploit Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server). Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Billing and Revenue Management executes to compromise Oracle Communications Billing and Revenue Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Communications Billing and Revenue Management accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
CVE-2026-110806 Medium 2026-10-16 Not applicable No public exploit Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permission to obtain add-on passwords via the unredacted add-on properties returned in connection data.
‹ prev page 1 of 108 next ›