CVE-2026-64789 is a vulnerability in macOS where a malicious application may bypass Gatekeeper checks due to insufficient validation of file attributes. The issue has been fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, and macOS Tahoe 26.7.2 by improving the validation process.
An authentication issue in iOS and iPadOS was addressed by improving state management. The vulnerability could allow a malicious app to access Bluetooth functionality without user consent. This issue is fixed in iOS 26.7.2, iPadOS 26.7.2, iOS 27.2, and iPadOS 27.2.
An out-of-bounds write vulnerability was identified and fixed in multiple Apple operating systems including iOS, iPadOS, visionOS, and watchOS. The flaw could cause memory corruption and unexpected application termination. The issue has been addressed by improved bounds checking and fixed in versions iOS 26.7.2, iPadOS 26.7.2, iOS 27.2, iPadOS 27.2, visionOS 27.2, and watchOS 27.2.
An infinite loop vulnerability exists in Xpdf version 4.06 and earlier due to improper validation of the progression order field in JPEG 2000 images. This flaw can cause the application to hang when processing crafted images.
A use-after-free vulnerability was addressed by improving memory management in multiple Apple operating systems. The flaw could allow an app to cause unexpected system termination or corrupt kernel memory. The issue is fixed in iOS 26.7.2 and 27.2, iPadOS 26.7.2 and 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, and watchOS 27.2.
An out-of-bounds read vulnerability in macOS Golden Gate was addressed by improving input validation. The flaw could allow a remote attacker to cause an unexpected process termination. The issue is fixed in macOS Golden Gate version 27.2.
A permissions issue in macOS was addressed by adding additional restrictions to prevent a malicious app from gaining root privileges. The vulnerability is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, and macOS Tahoe 26.7.2.
An integer overflow vulnerability was addressed through improved input validation in multiple Apple operating systems. The flaw could be triggered by processing a maliciously crafted image, potentially allowing arbitrary code execution. The issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7.
An out-of-bounds write vulnerability was fixed by improving bounds checking in Apple operating systems. The flaw could lead to memory corruption when processing a maliciously crafted image. The issue is addressed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8.2, and macOS Tahoe 26.7.2.
CVE-2026-65327 is a logic issue in macOS that has been addressed with improved checks. The vulnerability allows a local attacker to potentially elevate their privileges. The issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, and macOS Tahoe 26.7.2.
CVE-2026-65392 addresses a permissions issue in macOS where an app with root privileges could access private information. The vulnerability has been fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, and macOS Tahoe 26.7 by adding additional restrictions to permissions.
A local flaw in turboderp-org ExLlamaV2 up to version 0.3.2 allows out-of-bounds write via manipulation of the g_idx argument in the QMatrix::make_sequential function within the GPTQ Index Handler component. The issue was reported early but remains unpatched. The vulnerability has a medium severity rating with a CVSS score of 4.4.
A vulnerability was addressed by improved checks that prevent an app from breaking out of its sandbox. The issue is fixed in iOS 26.7.2, iPadOS 26.7.2, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8.2, and macOS Tahoe 26.7.2.
CVE-2026-65368 is a logic issue in macOS that could allow a maliciously crafted disk image to bypass Gatekeeper checks. The issue has been fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, and macOS Tahoe 26.7.2 through improved validation.
An out-of-bounds write vulnerability in Apple operating systems was fixed by improved bounds checking. The flaw could be triggered by processing a maliciously crafted font, potentially causing unexpected app termination or memory corruption. The issue is resolved in iOS 27.2, iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, and watchOS 27.2.
A critical command injection vulnerability exists in TOTOLINK A950RG firmware version 4.1.2cu.5268_B20221104. The flaw affects the getDeviceInfo function related to the /var/lib/misc/udhcpd.leases file in the device-information handler. An attacker with high privileges can remotely manipulate the MAC address argument to execute arbitrary commands. Public exploit code is available, increasing the risk of exploitation.
A critical command injection vulnerability exists in the apmib_set function of the firewall.so file in TOTOLINK A950RG version 4.1.2cu.5268_B20221104. This vulnerability can be exploited remotely and has been publicly disclosed. It allows an attacker with low privileges to execute arbitrary commands, potentially leading to full system compromise.
A critical command injection vulnerability exists in TOTOLINK A950RG firmware version 4.1.2cu.5268_B20221104. The flaw is in the setCloudUpgradeFW function of the Cloud Upgrade component, allowing remote attackers to execute arbitrary commands via the FileName argument. Public exploit code is available, increasing the risk of exploitation.
A logic issue in Safari and related Apple operating systems was fixed by improved checks. The flaw allowed websites to use a media format that should be restricted when Lockdown Mode is enabled. The issue is resolved in Safari 27.2, iOS 26.7.2 and 27.2, iPadOS 26.7.2 and 27.2, and macOS Golden Gate 27.2.
A vulnerability in macOS Golden Gate allows an app to cause unexpected system termination or corrupt kernel memory due to improper memory handling. This issue has been fixed in macOS Golden Gate version 27.2 with improved memory management.