This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.5 and iPadOS 26.5. An attacker with physical access may be able to pair a device with an AirPlay receiver from the lock screen.
A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. An attacker in Bluetooth range may be able to corrupt process memory.
CVE-2026-113969 is a logic flaw in Apple AirPlay that allows an attacker on the same network to bypass the rate limiting on pairing code attempts. This vulnerability was addressed by improved state management and fixed in multiple Apple OS versions including iOS 18.7.12, iPadOS 18.7.12, iOS 26.7.3, iPadOS 26.7.3, iOS 27.2.1, iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, and watchOS 27.2.1. The flaw could allow an attacker to attempt AirPlay pairing codes without the normal rate limiting controls.
A logic issue was addressed with improved state management. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts.
This issue was addressed with improved checks. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. A malicious Bluetooth device may be able to establish a pairing without user interaction.
A logic issue was addressed with improved state management. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts and pair with a device without user interaction.
An authorization issue was addressed with improved state management. This issue is fixed in iOS 27.2.1 and iPadOS 27.2.1, visionOS 27.2.1, watchOS 27.2.1. An app may be able to access sensitive user data.
An authorization issue was addressed with improved validation. This issue is fixed in iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 27.2.1. A remote attacker may be able to join an iMessage group chat and receive its messages.
A vulnerability in Apple iMessage allows a user added to a group chat to access messages sent before they joined. This issue affects multiple Apple operating systems and has been fixed in recent updates.
Replicate Cog versions up to 0.23.1 have a server-side request forgery (SSRF) vulnerability. This flaw allows attackers to submit prediction inputs containing attacker-controlled URLs that are not properly validated, causing the Cog process to make unauthorized HTTP requests. Malicious URLs or HTTP redirects in cog.File and cog.Path predictor inputs can be exploited to force requests to internal network addresses, potentially exposing sensitive internal services or credentials.
python-tuf versions prior to 7.0.0 have a case sensitivity handling flaw in delegated role path authorization on Windows. This allows an attacker to exploit path-based delegations that differ only by case, potentially causing the client to accept a malicious target from an incorrect delegation. Linux and macOS clients are not affected. The issue is fixed in version 7.0.0.
Microsoft's FORGE Lab discovered several memory safety issues in Rust's standard library (std and core), including cases where safe Rust code can trigger undefined behavior due to bugs in unsafe code. These issues arise from misplaced trust in unsafe code, such as assuming code will not panic, trusting user-provided implementations, and relying on the underlying system. The findings highlight challenges in maintaining Rust's safety guarantees, especially since much of the standard library relies on unsafe code internally. Some reported issues remain open, with ongoing efforts by Rust maintainers to address them.
CVE-2026-84410 is a privilege escalation vulnerability in Canonical's apport before version 2.37.0. It allows an unprivileged local attacker to gain root privileges by exploiting the automatic crash report processing pipeline, which runs as root and executes the ldd command on attacker-controlled crash files in /var/crash. This leads to arbitrary code execution with root privileges.
CVE-2026-86692 is a path traversal vulnerability in Canonical's apport software before version 2.37.0. It allows an attacker who can supply a crafted crash report to cause unintended file creation or overwriting outside the intended extraction directory during processing with apport-unpack. The vulnerability arises because base64-encoded keys are not properly validated, enabling arbitrary file writes such as to .bashrc or .profile, potentially leading to persistence or code execution in the user's context.
isomorphic-git contains a path traversal vulnerability in its tree parser that allows a malicious repository to write files outside the intended working directory during clone or checkout operations. This occurs because the parser does not reject the reserved name '..' as a tree entry, enabling unbounded directory traversal. Exploitation requires cloning from a non-GitHub remote or a man-in-the-middle attack, as GitHub rejects such trees. Overwriting files outside the working directory can lead to code execution by modifying shell or configuration files. A fix is available in version 1.38.6.
Apache Commons Codec's Blake3 class has a documented behavior mismatch in its doFinalize method. The method's documentation states that consecutive calls to doFinalize would produce different outputs, but in reality, repeated calls without new input return the same output. This affects key derivation processes that rely on multiple doFinalize calls to generate distinct keys, causing them to produce identical keys instead. The issue affects versions from 1.16.0 up to but not including 1.23.0. Version 1.23.0 corrects the documentation but does not change the method's behavior. Users must adjust their code to derive multiple keys correctly by requesting the combined length in a single call and splitting the output.
A vulnerability in Apache Commons Codec versions 1.22.0 up to but not including 1.23.0 allows crafted tree entry names containing NUL bytes to cause different directory trees to serialize to the same Git tree identifier or SWHID. This occurs because the GitIdentifiers class did not reject NUL bytes in tree entry names. The impact is limited since common file systems disallow NUL bytes in file names, so only applications building trees from external sources like archive formats permitting NUL bytes (e.g., ZIP) or direct API input are affected. The issue is fixed in version 1.23.0.
isomorphic-git versions prior to 1.38.6 are vulnerable to a denial of service caused by circular symbolic references. A malicious server can advertise symrefs that reference each other in a loop, which are then written to disk by the client. The GitRefManager.resolve() method does not detect cycles or enforce a default depth limit, causing operations that resolve these refs (e.g., log, status, checkout) to hang indefinitely. This results in a persistent denial of service, rendering the repository unusable until fixed.
CVE-2026-123805 is an out-of-bounds read vulnerability in the sipsorcery library for C# and .NET, specifically in the SCTP SACK chunk parser. Versions prior to 10.0.14 improperly read fields from attacker-controlled SCTP SACK chunks without validating chunk length, allowing a malformed chunk to cause an IndexOutOfRangeException. This exception bypasses the recoverable handler, terminating the SCTP association and all data channels permanently. The issue is fixed in version 10.0.14.
isomorphic-git versions prior to 1.38.6 contain a vulnerability in the checkout process where directory symlinks are not properly checked before writing files. This allows a malicious repository to write files outside the intended working directory by exploiting directory symlinks, potentially leading to arbitrary file writes on the host system. The impact varies by filesystem provider, with the highest risk on POSIX systems using Node's fs module, where remote code execution (RCE) is possible by injecting attacker-controlled files such as SSH authorized keys or Git hooks. The issue is fixed in version 1.38.6.