Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,565 results · page 9 of 52
Jul 9, 2026A local privilege escalation vulnerability in Palo Alto Networks Prisma® Browser allows a locally authenticated administrator with access to the macOS local filCVE-2026-0275 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comLow 2
A local privilege escalation vulnerability in Palo Alto Networks Prisma® Browser allows a locally authenticated administrator with access to the macOS local filesystem to perform actions on the device with root privileges. This issue only affects Prisma® Browser on macOS.
- Product
- Prisma Browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.paloaltonetworks.com
Jul 6, 2026The OpenAI Codex desktop app for macOS rendered remote images from Markdown in model responses.CVE-2026-14898 · Other software · OpenAI · reported by 8f4f43ab-ba69-4d92-aa1d-d772184d6fb7Medium 6.5
The OpenAI Codex desktop app for macOS rendered remote images from Markdown in model responses. An attacker who could place an indirect prompt injection in content processed by Codex, such as a connected-tool result or another untrusted source, could induce the model to construct a remote image URL containing sensitive data. The app automatically fetched that URL when rendering the response, sending the embedded data to an attacker-controlled server without a separate user click. Successful exploitation could exfiltrate secrets and other information accessible in the Codex session, including API keys, source code, and data returned by connected tools. No direct integrity or availability impact was demonstrated, and there is no known exploitation in the wild.
- Product
- Codex desktop app for macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2026A vulnerability was detected in react create-react-app up to 5.0.1 on macOS.CVE-2026-14802 · Other software · react · reported by VulDBMedium 5.5
A vulnerability was detected in react create-react-app up to 5.0.1 on macOS. This affects the function startBrowserProcess of the file openBrowser.js of the component react-dev-utils. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- create-react-app
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026OpenClaw before 2026.5.6 contains an allowlist bypass vulnerability in the macOS Swift exec feature that misses combined POSIX inline-command flags.CVE-2026-53861 · Other software · OpenClaw · reported by VulnCheckMedium 5.3
OpenClaw before 2026.5.6 contains an allowlist bypass vulnerability in the macOS Swift exec feature that misses combined POSIX inline-command flags. Attackers can execute shell content outside the intended allowlist check by using combined flag forms, potentially allowing unauthorized command execution depending on operator configuration.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jun 15, 2026Incorrect default permissions in Kiro IDE on macOS and Linux before version 0.11.133 could expose the authentication token cache file to other local users or prCVE-2026-11931 · Other software · AWS · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5Medium 6.8
Incorrect default permissions in Kiro IDE on macOS and Linux before version 0.11.133 could expose the authentication token cache file to other local users or processes via world-readable permissions (0644) instead of owner-restricted permissions (0600). To remediate this issue, users should upgrade to Kiro IDE version 0.11.133 or later. After upgrading and restarting the application, the cache file permissions are automatically updated on the next token refresh. Users operating in a multi-user environment can invalidate existing tokens by reauthenticating.
- Product
- Kiro IDE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comkiro.dev
Jun 11, 2026A permissions issue was addressed with additional restrictions.CVE-2025-46315 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.5
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.1. An app may be able to access protected user data.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2026A logging issue was addressed with improved data redaction.CVE-2025-46313 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
A logging issue was addressed with improved data redaction. This issue is fixed in macOS Tahoe 26.1. An app may be able to access sensitive user data.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2026This issue was addressed with improved handling of symlinks.CVE-2025-46293 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.4. An app may be able to access protected user data.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2026An access issue was addressed with additional sandbox restrictions.CVE-2025-43339 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Tahoe 26.1. A malicious app may be able to access sensitive user data.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2026This issue was addressed with improved handling of symlinks.CVE-2025-43278 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.4. An app may be able to access protected user data.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2026The issue was addressed with improved checks.CVE-2025-31272 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4. An app may be able to bypass launch constraint protections and execute malicious code with elevated privileges.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2026A privacy issue was addressed by removing the vulnerable code.CVE-2025-30459 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
A privacy issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.4. An app may be able to access sensitive user data.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2026The issue was addressed with improved checks.CVE-2025-30431 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A malicious app may be able to access private information.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Jun 11, 2026This issue was addressed with improved checks to prevent unauthorized actions.CVE-2025-24284 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in macOS Sequoia 15.4. An app may be able to break out of its sandbox.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2026A parsing issue in the handling of directory paths was addressed with improved path validation.CVE-2025-24268 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.4. An app may be able to access sensitive user data.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2026A permissions issue was addressed with additional restrictions.CVE-2025-24165 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to cause unexpected system termination.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Jun 10, 2026An information exposure vulnerability in the Palo Alto Networks GlobalProtect app on macOS enables a local user to learn the configured passcodes for disabling,CVE-2026-0267 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comMedium 4.4
An information exposure vulnerability in the Palo Alto Networks GlobalProtect app on macOS enables a local user to learn the configured passcodes for disabling, disconnecting, or uninstalling the GlobalProtect app. After the passcode is known, the user can perform these actions even if the GlobalProtect app configuration would not normally permit them to do so.
- Product
- GlobalProtect App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.paloaltonetworks.comsecurity.paloaltonetworks.com
Jun 10, 2026A person with access to a Mac may be able to bypass Login Window.CVE-2022-48575 · Computers, phones & browsers · Apple · reported by product-security@apple.comLow 3.5
A person with access to a Mac may be able to bypass Login Window. A consistency issue was addressed with improved state handling. This issue is fixed in macOS Monterey 12.4.
- Product
- macOS Monterey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Jun 10, 2026A malicious application may cause unexpected changes in memory shared between processes.CVE-2022-26758 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.1
A malicious application may cause unexpected changes in memory shared between processes. A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.4.
- Product
- macOS Monterey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Jun 10, 2026CleanWipe Removal Tool (macOS), prior to 16.0.0.65, may be susceptible to an Local Privilege Escalation vulnerability, which is a type of issue whereby an attacCVE-2026-11626 · Other software · Broadcom · reported by secure@symantec.comMedium 5.4
CleanWipe Removal Tool (macOS), prior to 16.0.0.65, may be susceptible to an Local Privilege Escalation vulnerability, which is a type of issue whereby an attacker with limited privilege access on an affected system can escalate their privileges to gain administrative control.
- Product
- Symantec Endpoint Protection CleanWipe Removal Tool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2026Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.helper.tool, which exposes the XPC service com.slaCVE-2026-24067 · Other software · Slate Digital LLC · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfHigh 8.4
Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.helper.tool, which exposes the XPC service com.slatedigital.connect.privileged.helper.tool2. The helper validates connecting XPC clients by obtaining the client's process identifier and using it to retrieve code-signing information for the process. This PID-based client validation is subject to a time-of-check time-of-use race condition because process identifiers can be reused. A local attacker can exploit PID reuse so that validation is performed against a trusted process instead of the original connecting process. This allows unauthorized access to privileged helper functionality and may lead to local privilege escalation.
- Product
- Slate Digital Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordr.sec-consult.comsec-consult.com
Jun 10, 2026Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.helper.tool, which exposes the XPC service com.slaCVE-2026-24066 · Other software · Slate Digital LLC · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfHigh 8.4
Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.helper.tool, which exposes the XPC service com.slatedigital.connect.privileged.helper.tool2. The helper validates connecting XPC clients by checking only the subject.OU value of the client's signing certificate and does not verify that the certificate chains to a trusted code-signing authority. A local attacker can sign a malicious client with a self-signed certificate containing the expected organizational unit value and connect to the privileged XPC service. This allows unauthorized access to privileged helper functionality and may lead to local privilege escalation.
- Product
- Slate Digital Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordr.sec-consult.comsec-consult.com
Jun 9, 2026Omnissa Workspace ONE® Assist for macOS contains a Local Privilege Escalation Vulnerability.CVE-2026-22926 · Other software · Omnissa · reported by de5a6978-88fe-4c27-a7df-d0d5b52d5b52High 7.8
Omnissa Workspace ONE® Assist for macOS contains a Local Privilege Escalation Vulnerability.
- Product
- Omnissa Workspace ONE® Assist for macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordomnissa.comomnissa.com
Jun 9, 2026Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerability in the privileged helper service.CVE-2026-24065 · Other software · Waves Audio Ltd. · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfHigh 8.1
Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerability in the privileged helper service. The helper validates connecting XPC clients using the client process identifier (PID) to verify code-signing identity. Because process identifiers can be reused, a local attacker can exploit a race condition between the time a connection request is made and the time the helper performs validation, causing the helper to trust an attacker-controlled process. This allows the attacker to invoke privileged operations, resulting in arbitrary code execution as root. The issue is fixed in version 16.6.2.
- Product
- Waves Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordr.sec-consult.comsec-consult.com
Jun 9, 2026Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerability.CVE-2026-24064 · Other software · Waves Audio Ltd. · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfHigh 7.8
Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerability. A trusted XPC client component included with the product is signed with hardened runtime entitlements that permit dynamic library injection. A local attacker can set the DYLD_INSERT_LIBRARIES environment variable to inject an attacker-controlled dynamic library into the trusted client process at launch. The injected code runs within the signed process and can connect to the product's privileged helper service to invoke privileged operations, resulting in arbitrary code execution as root. The issue is fixed in version 16.6.2.
- Product
- Waves Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordr.sec-consult.comr.sec-consult.com
Jun 9, 2026A vulnerability in the quarantine and restore workflow of the X-VPN macOS website versions 77.0 through 77.5 allow a local attacker to leverage a race conditionCVE-2026-2638 · Other software · X-VPN · reported by help@fluidattacks.comHigh 7.3
A vulnerability in the quarantine and restore workflow of the X-VPN macOS website versions 77.0 through 77.5 allow a local attacker to leverage a race condition and symlink manipulation to achieve privileged file corruption.
- Product
- X-VPN macOS website
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comxvpn.io
Jun 8, 2026Insufficient validation of untrusted input in Dawn in Google Chrome on macOS prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer CVE-2026-11686 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comLow 3.1
Insufficient validation of untrusted input in Dawn in Google Chrome on macOS prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
May 28, 2026Improper handling of symbolic links in the installer of CUPS Printer Driver for macOS(*) may allow a local attacker with login privileges to exploit a speciallyCVE-2026-6892 · Other software · Canon Inc. · reported by f98c90f0-e9bd-4fa7-911b-51993f3571fdMedium 5.1
Improper handling of symbolic links in the installer of CUPS Printer Driver for macOS(*) may allow a local attacker with login privileges to exploit a specially crafted symbolic link during installation to modify permissions of directories for which they would not normally have authorization. *:Canon PIXUS iX6800 Series CUPS Printer Driver for macOS Version 16.91.0.0 or earlier (Japan) Canon PIXMA MG2500 Series and iX6800 Series CUPS Printer Driver for macOS Version 16.91.0.0 or earlier (US and Europe)
- Product
- Canon PIXUS iX6800 Series CUPS Printer Driver for macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2026Improper handling of symbolic links in the installer of My Image Garden for macOS Version 3.6.8 or earlier may allow a local attacker with login privileges to eCVE-2026-6891 · Other software · Canon Inc. · reported by f98c90f0-e9bd-4fa7-911b-51993f3571fdMedium 5.1
Improper handling of symbolic links in the installer of My Image Garden for macOS Version 3.6.8 or earlier may allow a local attacker with login privileges to exploit a specially crafted symbolic link during installation to modify permissions of files for which they would not normally have authorization.
- Product
- My Image Garden for macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2026An issue was discovered in Canonical Multipass for macOS before version 1.16.3 due to an incomplete fix for CVE-2025-5199.CVE-2026-49237 · Other software · Canonical · reported by security@ubuntu.comHigh 7.8
An issue was discovered in Canonical Multipass for macOS before version 1.16.3 due to an incomplete fix for CVE-2025-5199. While the patch in version 1.16.0 updated the ownership of the multipassd daemon binary to root:wheel, five co-located binaries (multipass, qemu-img, qemu-system-aarch64, qemu-system-x86_64, and sshfs_server) in /Library/Application Support/com.canonical.multipass/bin/ retain ownership by the installing user and remain writable. Because the root LaunchDaemon (com.canonical.multipassd.plist) configures a PATH environment variable that prioritizes this user-writable directory and invokes these auxiliary binaries by their bare names, a local attacker can replace an auxiliary binary (such as qemu-img) with a malicious wrapper. When the root daemon subsequently triggers the binary during routine execution (e.g., via multipass launch), the malicious code executes with root privileges, leading to local privilege escalation.
- Product
- Multipass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026A logic issue was addressed with improved restrictions.CVE-2025-46307 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Tahoe 26. An app may be able to access sensitive user data.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026A race condition was addressed with additional validation.CVE-2025-46284 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7
A race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.7, macOS Tahoe 26. An app may be able to gain root privileges.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
May 26, 2026An out-of-bounds read was addressed with improved bounds checking.CVE-2025-46280 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Tahoe 26. An app may be able to cause unexpected system termination.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026A permissions issue was addressed by removing the vulnerable code.CVE-2025-43451 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Tahoe 26. An app may be able to access sensitive user data.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026A logic issue was addressed with improved checks.CVE-2025-43306 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. A malicious app may be able to gain root privileges.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
May 26, 2026A permissions issue was addressed with additional restrictions.CVE-2025-43290 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app may be able to modify protected parts of the file system.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
May 26, 2026A logic issue was addressed with improved validation.CVE-2025-43289 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
A logic issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. A malicious app may be able to access sensitive user data.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
May 26, 2026Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS allows attackers to execute arbitrary commands with elevated privileCVE-2026-9560 · Other software · OpenVPN Inc · reported by security@openvpn.netCritical 9.4
Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS allows attackers to execute arbitrary commands with elevated privileges via local IPC channel
- Product
- OpenVPN Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026The MLX inference backend in Docker Model Runner on macOS uses the MLX-LM library, which unconditionally imports and executes arbitrary Python files from model CVE-2026-5843 · Other software · Docker · reported by security@docker.comHigh 8.8
The MLX inference backend in Docker Model Runner on macOS uses the MLX-LM library, which unconditionally imports and executes arbitrary Python files from model directories via the model_file configuration field in config.json. When a model's config.json specifies a model_file pointing to a Python file, MLX-LM uses importlib to load and execute it with no trust_remote_code gate or equivalent safety check. The MLX backend runs without sandboxing, resulting in arbitrary code execution on the Docker host as the Docker Desktop user. Any container on the Docker network can trigger this by calling the model-runner.docker.internal API to pull a malicious model from an attacker-controlled OCI registry and request inference.
- Product
- Docker Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026The vllm-metal inference backend in Docker Model Runner on macOS unconditionally sets trust_remote_code=True when loading model tokenizers, and runs without sanCVE-2026-5817 · Other software · Docker · reported by security@docker.comHigh 8.8
The vllm-metal inference backend in Docker Model Runner on macOS unconditionally sets trust_remote_code=True when loading model tokenizers, and runs without sandboxing. This causes transformers.AutoTokenizer.from_pretrained() to import and execute arbitrary Python files included in any model pulled from an OCI registry, resulting in arbitrary code execution on the Docker host as the Docker Desktop user when inference is triggered. Any container on the Docker network can trigger this by calling the model-runner.docker.internal API to pull a malicious model and request inference.
- Product
- Docker Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2026A code injection vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to its AppleScript interface allowing a locally CVE-2026-0236 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comHigh 7.3
A code injection vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to its AppleScript interface allowing a locally authenticated non-admin user to leverage this exposed Apple Event handler to send unauthorized commands to the browser.
- Product
- Prisma Browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.paloaltonetworks.com
May 13, 2026An improper protection of alternate path vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to an internal automatioCVE-2026-0237 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comHigh 7.3
An improper protection of alternate path vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to an internal automation bridge. This allows a locally authenticated non-admin user to leverage an exposed communication channel to send unauthorized commands to the browser, bypassing security controls.
- Product
- Prisma Browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.paloaltonetworks.com
May 12, 2026An access issue was addressed with additional sandbox restrictions.CVE-2025-43524 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.2. An app may be able to break out of its sandbox.
- Product
- macOS Sequoia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026A permissions issue was addressed with additional restrictions.CVE-2026-43652 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.5
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.5. An app may be able to access protected user data.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026A path handling issue was addressed with improved logic.CVE-2026-39871 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.5
A path handling issue was addressed with improved logic. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to observe unprotected user data.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
May 11, 2026The issue was addressed with improved memory handling.CVE-2026-39870 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.5
The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. Processing a maliciously crafted image may corrupt process memory.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
May 11, 2026A permissions issue was addressed with additional restrictions.CVE-2026-28978 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. A malicious app may be able to break out of its sandbox.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
May 11, 2026An information leakage was addressed with additional validation.CVE-2026-28976 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.5
An information leakage was addressed with additional validation. This issue is fixed in macOS Tahoe 26.5. An app may be able to gain root privileges.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026This issue was addressed with improved checks.CVE-2026-28961 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 4.6
This issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5. An attacker with physical access to a locked device may be able to view sensitive user information.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
May 11, 2026A permissions issue was addressed with additional restrictions.CVE-2026-28930 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.5
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.8, macOS Tahoe 26.5. An app may be able to access protected user data.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.