CVE-2026-65327 is a logic issue in macOS that has been addressed with improved checks. The vulnerability allows a local attacker to potentially elevate their privileges. The issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, and macOS Tahoe 26.7.2.
CVE-2026-65392 addresses a permissions issue in macOS where an app with root privileges could access private information. The vulnerability has been fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, and macOS Tahoe 26.7 by adding additional restrictions to permissions.
A local flaw in turboderp-org ExLlamaV2 up to version 0.3.2 allows out-of-bounds write via manipulation of the g_idx argument in the QMatrix::make_sequential function within the GPTQ Index Handler component. The issue was reported early but remains unpatched. The vulnerability has a medium severity rating with a CVSS score of 4.4.
A vulnerability was addressed by improved checks that prevent an app from breaking out of its sandbox. The issue is fixed in iOS 26.7.2, iPadOS 26.7.2, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8.2, and macOS Tahoe 26.7.2.
CVE-2026-65368 is a logic issue in macOS that could allow a maliciously crafted disk image to bypass Gatekeeper checks. The issue has been fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, and macOS Tahoe 26.7.2 through improved validation.
An out-of-bounds write vulnerability in Apple operating systems was fixed by improved bounds checking. The flaw could be triggered by processing a maliciously crafted font, potentially causing unexpected app termination or memory corruption. The issue is resolved in iOS 27.2, iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, and watchOS 27.2.
A critical command injection vulnerability exists in TOTOLINK A950RG firmware version 4.1.2cu.5268_B20221104. The flaw affects the getDeviceInfo function related to the /var/lib/misc/udhcpd.leases file in the device-information handler. An attacker with high privileges can remotely manipulate the MAC address argument to execute arbitrary commands. Public exploit code is available, increasing the risk of exploitation.
A critical command injection vulnerability exists in the apmib_set function of the firewall.so file in TOTOLINK A950RG version 4.1.2cu.5268_B20221104. This vulnerability can be exploited remotely and has been publicly disclosed. It allows an attacker with low privileges to execute arbitrary commands, potentially leading to full system compromise.
A critical command injection vulnerability exists in TOTOLINK A950RG firmware version 4.1.2cu.5268_B20221104. The flaw is in the setCloudUpgradeFW function of the Cloud Upgrade component, allowing remote attackers to execute arbitrary commands via the FileName argument. Public exploit code is available, increasing the risk of exploitation.
A logic issue in Safari and related Apple operating systems was fixed by improved checks. The flaw allowed websites to use a media format that should be restricted when Lockdown Mode is enabled. The issue is resolved in Safari 27.2, iOS 26.7.2 and 27.2, iPadOS 26.7.2 and 27.2, and macOS Golden Gate 27.2.
A vulnerability in macOS Golden Gate allows an app to cause unexpected system termination or corrupt kernel memory due to improper memory handling. This issue has been fixed in macOS Golden Gate version 27.2 with improved memory management.
An out-of-bounds read vulnerability in macOS Golden Gate 27.2 was addressed by improved bounds checking. The flaw could allow an application to cause unexpected system termination. The issue is fixed in macOS Golden Gate 27.2.
An out-of-bounds read vulnerability in macOS Golden Gate 27.2 was addressed by improved bounds checking. This flaw could allow an application to cause unexpected system termination. The issue is fixed in macOS Golden Gate 27.2.
An out-of-bounds read vulnerability in macOS Golden Gate 27.2 was addressed by improving bounds checking. The flaw could allow an application to cause unexpected system termination. This issue is fixed in macOS Golden Gate 27.2.
A vulnerability in macOS Golden Gate 27.2 allows unpacking of maliciously crafted archives that may cause unexpected application termination or arbitrary code execution. The issue is addressed by improved access restrictions and fixed in version 27.2.
CVE-2026-113949 is a type confusion vulnerability in Safari and related Apple operating systems that was addressed by improved state management. The flaw could allow processing of maliciously crafted web content to cause memory corruption. The issue is fixed in Safari 27.2, iOS 26.7.2 and 27.2, iPadOS 26.7.2 and 27.2, macOS Golden Gate 27.2, and visionOS 27.2.
An out-of-bounds read vulnerability in macOS Golden Gate was addressed by improved bounds checking. This flaw could allow an application to cause unexpected system termination or read kernel memory. The issue is fixed in macOS Golden Gate version 27.2.
CVE-2026-113944 is an out-of-bounds read vulnerability in macOS Golden Gate that could allow an application to cause unexpected system termination or read kernel memory. The issue has been fixed in macOS Golden Gate version 27.2 with improved bounds checking.
CVE-2026-113939 is an out-of-bounds write vulnerability in macOS Golden Gate that could be triggered by mounting a maliciously crafted disk image. This flaw may cause unexpected system termination or kernel memory corruption. The issue has been fixed in macOS Golden Gate version 27.2 with improved bounds checking.
An out-of-bounds read vulnerability in macOS Golden Gate was addressed by improved bounds checking. This flaw could allow an application to cause unexpected system termination or read kernel memory. The issue is fixed in macOS Golden Gate version 27.2.