Vulnerability Research

Apple / macOS

  • CVE-2026-43783 (DesktopServices)
    Race condition leading to root privilege escalation
  • CVE-2026-43805 (IOKit)
    Race condition allowing kernel memory writes
  • CVE-2026-43672 (Assets)
    Authorization issue allowing Privacy preference bypass
  • CVE-2026-65404 (Accounts)
    Authorization issue allowing Privacy preference bypass
  • CVE-2026-43789 (CoreMedia)
    Access control issue exposing user-sensitive data
  • CVE-2026-43759 (CoreMedia)
    Authorization issue exposing sensitive user data
  • CVE-2026-43756 (Control Center)
    Logic issue exposing user-sensitive data
  • CVE-2026-65345 (Storage)
    Permissions issue exposing user-sensitive data
  • CVE-2026-28969 (IOKit)
    Use-after-free causing unexpected system termination

Apache

  • CVE-2025-66524 (NiFi)
    Unsafe deserialization RCE (CVSS 7.5)
  • CVE-2025-67895 (Airflow)
    Edge3 Worker RPC RCE

NVIDIA

  • CVE-2026-24156 (DALI)
    Code execution (CVSS 7.3)
  • CVE-2026-24173 (Triton Inference Server)
    Heap overflow (CVSS 7.5)

NASA

  • CVE-2026-21897 (CryptoLib)
    Out-of-bounds write in GVCID managed parameters (CVSS 7.3)
  • CVE-2026-21898 (CryptoLib)
    Out-of-bounds read in AOS frame parsing (CVSS 7.5)

QEMU

  • CVE-2025-14876
    Denial of Service in virtio device emulation (CVSS 5.5)

LangChain

  • CVE-2026-26013
    Server-Side Request Forgery (CVSS 3.7)

Envoy Proxy

  • CVE-2026-26309
    Off-by-one write in JsonEscaper::escapeString() (CVSS 5.3)

Tunnelblick

  • CVE-2026-31893
    Local arbitrary file read via symlink following in tunnelblickd (CVSS 6.5)