CVE Vulnerability Catalog

A vulnerability in macOS Golden Gate 27 related to app bundle integrity checks. A maliciously modified app may not be prevented from launching.

A vulnerability in macOS Sequoia 15.8 and macOS Tahoe 26.7 due to improper checks. An app may be able to elevate privileges.

An authorization issue was addressed with improved state management. Fixed in macOS Sequoia 15.8 and visionOS 27. An app may be able to access sensitive user data.

OpenSRE through 0.1.2026.10.19 contains an approval gate bypass vulnerability because the headless presenter's execution_allowed() always returns True. Attackers can inject instructions into alerts or Slack messages triaged by the agent to run shell commands on the host and exfiltrate LLM, Slack and cloud credentials.

JoySafeter through 1.0.0 contains a remote code execution vulnerability that allows authenticated users to run operating system commands via an unsandboxed execute tool in Copilot standard mode. Attackers can self-register, select standard mode in the WebSocket chat.start extension, and have the agent invoke subprocess.run with shell=True on the host to access other tenants' data and server secrets.

piflow 2.0.0 through 2.0.1 contains a remote code execution vulnerability in its DeepAgents chat agent, whose POST /chat and POST /chat/stream endpoints lack authentication. Attackers can instruct the agent to call the exec_shell tool, which runs arbitrary commands via subprocess.run without human approval or an allow-list, exposing environment secrets such as LLM API keys and database credentials.

LangAlpha through 2026.09.07 contains an improper isolation vulnerability that places all tenants' sandbox containers on Docker's shared default bridge network with inter-container communication enabled. An authenticated user with code execution in their own sandbox can connect directly to other tenants' containers, bypassing require_workspace_owner checks.

LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands or Python by planting instructions in web content retrieved by the agent. Because Bash and ExecuteCode lack an allow-list and human-in-the-loop approval, attackers can run code in the workspace sandbox and exfiltrate vault secrets from _internal/.vault_secrets.json.

Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references and literal runs. Attackers can supply crafted LZF streams to applications using the default LZFDecoder to leak unrelated JVM heap memory into decompressed output or crash the JVM.

Before version 0.9.0, Pingora accepted HTTP/2 requests where the Host header differed from the :authority pseudo-header. Request filters, cache keys, and logs saw the :authority value, but the upstream received the client-supplied Host value. Pingora also accepted :authority values containing userinfo (e.g., [email protected]), violating RFC 9113 Section 8.3.1.

Before version 0.8.1, Pingora's HTTP/2 server used the h2 crate's default limits, allowing a remote, unauthenticated client to send 1-byte HPACK references to a near-empty header. This caused the server to allocate hundreds of thousands of header fields per stream across an unlimited number of streams on one connection, potentially exhausting memory and terminating the Pingora process.

A Server-Side Request Forgery (SSRF) vulnerability in IBM ContextForge MCP Gateway versions 0.1.0 through 1.0.5. An authenticated user with gateway creation privileges can perform arbitrary HTTP POST requests to internal network resources and cloud metadata endpoints by supplying a malicious oauth_config.token_url parameter during OAuth-enabled gateway registration.

A security vulnerability was detected in H3C Magic NX15 NX15V100R017 affecting the sub_416874 function in /usr/bin/usrlist. Manipulation leads to a stack-based buffer overflow, and the attack can be launched remotely. The exploit has been publicly disclosed and may be used.

IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 Appliance could allow a physically proximate attacker to gain elevated privileges due to the use of hard-coded credentials.

IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper authentication.

IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authenticated user can bulk-delete another user's messages, overwrite message content to inject malicious prompts, or hijack an entire conversation session by reassigning its session ID.

IBM Sterling Connect Direct for Unix 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6 could allow a local attacker to gain elevated privileges due to improper privilege management.

A vulnerability in the Bluetooth Classic Hands-Free Profile HF role (hfp_hf.c) causes AT command buffers still queued on hf->tx_pending to be leaked when the RFCOMM DLC goes down, permanently draining the fixed hf_pool. Additionally, hfp_hf_disconnected() leaves BT_HFP_HF_FLAG_CONNECTED set, and hfp_hf_create() may memset() the object while work items are still pending or running, corrupting shared kernel workqueue state. A remote Audio Gateway peer can exhaust the buffer pool and stall the Bluetooth RX thread.

A vulnerability in the Zephyr RTOS syscall verifier: z_vrfy_rtio_cqe_get_mempool_buffer() validated its output parameters buff and buff_len with K_SYSCALL_MEMORY_READ() instead of K_SYSCALL_MEMORY_WRITE(). This allows an unprivileged user-mode thread to invoke the syscall with pointers to read-only memory, causing a supervisor-mode store outside the permitted region or a kernel fault that halts or reboots the device.

IBM Storage TS4500 Library versions 1.1.1.6 through 1.12.0.3 could allow a remote authenticated attacker to gain unauthorized administrative privileges due to a race condition.