CVE-2026-64813
In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development session
PUBLISHED
- Vendor
- JetBrains
- Product
- IntelliJ IDEA
- Provider severity
- CRITICAL
- Conflicts
- 0
Data & Insights
CVE Explorer
Search one exact, source-linked CVE snapshot by CVE ID or explicit vendor and product tokens. Provider severity, KEV, conflicts, and stale state remain separate observations—not a Baitaphish risk rating.
Exact snapshot results
353,537 CVE records
CVE-2026-64812
In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session
PUBLISHED
- Vendor
- JetBrains
- Product
- IntelliJ IDEA
- Provider severity
- CRITICAL
- Conflicts
- 0
CVE-2026-64811
In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting project trust via development container configuration
PUBLISHED
- Vendor
- JetBrains
- Product
- IntelliJ IDEA
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-64810
In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification, allowing silent user activity tracking
PUBLISHED
- Vendor
- JetBrains
- Product
- IntelliJ IDEA
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-64809
In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured interpreter
PUBLISHED
- Vendor
- JetBrains
- Product
- PhpStorm
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-64808
In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via project tooling
PUBLISHED
- Vendor
- JetBrains
- Product
- PhpStorm
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-64807
In JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a project-supplied linter configuration
PUBLISHED
- Vendor
- JetBrains
- Product
- WebStorm
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-64806
In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured Node.js interpreter
PUBLISHED
- Vendor
- JetBrains
- Product
- WebStorm
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-64805
In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local package-manager tooling
PUBLISHED
- Vendor
- JetBrains
- Product
- WebStorm
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-64804
In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local linter tooling
PUBLISHED
- Vendor
- JetBrains
- Product
- WebStorm
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-64803
In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust via the configured Go SDK
PUBLISHED
- Vendor
- JetBrains
- Product
- GoLand
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-64802
In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules integration
PUBLISHED
- Vendor
- JetBrains
- Product
- GoLand
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-64800
In JetBrains GoLand before 2026.2 sensitive configuration values written to log files by default
PUBLISHED
- Vendor
- JetBrains
- Product
- GoLand
- Provider severity
- LOW
- Conflicts
- 0
CVE-2026-64799
Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions - Content-controlled image URLs could request private or reserved network services, follow unsafe redirects and save responses without validating that they were images. This could result in SSRF, internal-data access or writing attacker-controlled files into a web-accessible folder.
PUBLISHED
- Vendor
- regularlabs.com, regularlabs.com
- Product
- Users Anywhere Pro extension for Joomla, Articles Anywhere Pro extension for Joomla
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-64798
Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension - Persistent URL login keys were also generated using a non-cryptographic random generator with insufficient entropy.
PUBLISHED
- Vendor
- regularlabs.com
- Product
- IP Login extension for Joomla
- Provider severity
- CRITICAL
- Conflicts
- 0
CVE-2026-64797
Joomla Extension - regularlabs.com - IP spoofing vulnerability in IP login extension - IP Login trusted forwarded client-IP headers without requiring a configured trusted proxy. Attackers could spoof the IP used for automatic login and potentially impersonate mapped accounts.
PUBLISHED
- Vendor
- regularlabs.com
- Product
- IP Login extension for Joomla
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-64796
Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension - Free did not require both the article creator and last modifier to be Super Users before executing article PHP. Pro did not consistently enforce configured CSS, JavaScript and PHP permissions across tags, attributes, files and both article owners. PHP include attributes could also escape the configured include folder, and executable script/style variants could bypass detection.
PUBLISHED
- Vendor
- regularlabs.com
- Product
- Sourcerer extension for Joomla
- Provider severity
- CRITICAL
- Conflicts
- 0
CVE-2026-64795
Joomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs extensions - Tag-provided custom HTML, module content/title overrides and decoded modal or tooltip values could execute unsafe markup. A content author could inject JavaScript that ran in visitors’ browsers.
PUBLISHED
- Vendor
- regularlabs.com, regularlabs.com, regularlabs.com, regularlabs.com, regularlabs.com
- Product
- Articles Anywhere Pro extension for Joomla, Modules Anywhere Pro extension for Joomla, Users Anywhere Pro extension for Joomla, Modals extension for Joomla, Tooltips extension for Joomla
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-64794
Joomla Extension - regularlabs.com - restricted user-data exposure in Users Anywhere and Articles Anywhere extensions - User tags, filters and conditions allowed access to insufficiently restricted user fields. Crafted content could expose authentication-related data, raw user parameters or restricted contact details.
PUBLISHED
- Vendor
- regularlabs.com, regularlabs.com
- Product
- Articles Anywhere extension for Joomla, Users Anywhere extension for Joomla
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-64793
Joomla Extension - regularlabs.com - Content access and publication bypass in Articles Anywhere and Modules Anywhere extensions - Content tags could use ignore flags or property overrides to render restricted or unpublished articles or modules. A content author could thereby expose content to visitors who lacked the required access.
PUBLISHED
- Vendor
- regularlabs.com, regularlabs.com
- Product
- Modules Anywhere extension for Joomla, Articles Anywhere extension for Joomla
- Provider severity
- CRITICAL
- Conflicts
- 1
CVE-2026-64792
Joomla Extension - regularlabs.com - disclosure of restricted content via search index in various Regular Labs extensions - Smart Search indexing could render generated content using the indexing administrator’s identity instead of a public guest. Restricted or administrator-only content could consequently be stored in the public search index and disclosed to visitors.
PUBLISHED
- Vendor
- regularlabs.com, regularlabs.com, regularlabs.com, regularlabs.com, regularlabs.com, regularlabs.com, regularlabs.com
- Product
- ReReplacer extension for Joomla, Sourcerer extension for Joomla, Tabs & Accordions Pro extension for Joomla, Articles Anywhere extension for Joomla, Modules Anywhere extension for Joomla, Conditional Content extension for Joomla, Snippets Pro extension for Joomla
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-64791
Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs Extension Manager - Administrator routes and install/update/uninstall processing did not consistently enforce component-management and installation permissions. An unauthorized backend user or CSRF attack could install, update or remove extensions.
PUBLISHED
- Vendor
- regularlabs.com
- Product
- Regular Labs Extension Manager extension for Joomla
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-6479
Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AF_UNIX socket to achieve sustained denial of service. If SSL and GSS are both disabled, an attacker can do the same via access to a PostgreSQL TCP socket. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
PUBLISHED
- Vendor
- n/a
- Product
- PostgreSQL
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-64785
SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling or response splitting. This vulnerability is addressed in swift-nio-http2 version 1.45.0.
PUBLISHED
- Vendor
- Apple
- Product
- swift-nio-http2
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-64783
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.
PUBLISHED
- Vendor
- Apple, Apple, Apple, Apple, Apple
- Product
- watchOS, macOS, Safari, visionOS, iOS and iPadOS
- Provider severity
- HIGH
- Conflicts
- 2
CVE-2026-6478
Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. This does not affect scram-sha-256 passwords, the default in all supported releases. However, current databases may have MD5-hashed passwords originating in upgrades from PostgreSQL 13 or earlier. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
PUBLISHED
- Vendor
- Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, n/a, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
- Product
- Red Hat Enterprise Linux 9, Red Hat Hardened Images, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Update Infrastructure 5, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Hardened Images, Red Hat Enterprise Linux 9, PostgreSQL, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.6 Extended Update Support, Self-service automation portal 2, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
- Provider severity
- HIGH, MEDIUM
- Conflicts
- 2
CVE-2026-64776
The issue was addressed with improved bounds checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to disclose kernel memory.
PUBLISHED
- Vendor
- Apple
- Product
- macOS
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-64775
A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination.
PUBLISHED
- Vendor
- Apple, Apple, Apple, Apple, Apple
- Product
- visionOS, macOS, iOS and iPadOS, tvOS, watchOS
- Provider severity
- CRITICAL
- Conflicts
- 2
CVE-2026-64774
An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6. A remote attacker may be able to cause unexpected application termination or heap corruption.
PUBLISHED
- Vendor
- Apple, Apple, Apple, Apple
- Product
- macOS, iOS and iPadOS, tvOS, visionOS
- Provider severity
- CRITICAL
- Conflicts
- 2
CVE-2026-64772
An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6. A remote attacker may be able to cause unexpected application termination or heap corruption.
PUBLISHED
- Vendor
- Apple, Apple, Apple, Apple
- Product
- macOS, tvOS, visionOS, iOS and iPadOS
- Provider severity
- CRITICAL
- Conflicts
- 2
CVE-2026-64771
A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6. A remote attacker may be able to cause unexpected application termination or heap corruption.
PUBLISHED
- Vendor
- Apple, Apple, Apple, Apple
- Product
- iOS and iPadOS, tvOS, macOS, visionOS
- Provider severity
- CRITICAL
- Conflicts
- 2
CVE-2026-64770
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6. A remote attacker may be able to cause unexpected application termination or heap corruption.
PUBLISHED
- Vendor
- Apple, Apple, Apple, Apple
- Product
- iOS and iPadOS, macOS, tvOS, visionOS
- Provider severity
- CRITICAL
- Conflicts
- 2
CVE-2026-6477
A flaw was found in PostgreSQL libpq. A server superuser can exploit a buffer overflow vulnerability in the PQfn function, which is used by client functions such as lo_export(), lo_read(), lo_lseek64(), and lo_tell64(). This allows the superuser to send an arbitrarily large response, overwriting the client's stack memory, specifically in tools like psql and pg_dump. This could lead to arbitrary code execution on the client system.
PUBLISHED
- Vendor
- Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, n/a, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
- Product
- Red Hat Update Infrastructure 5, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Self-service automation portal 2, PostgreSQL, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Hardened Images, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8, Red Hat Hardened Images, Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
- Provider severity
- HIGH
- Conflicts
- 3
CVE-2026-64769
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6. A remote attacker may be able to cause unexpected application termination or heap corruption.
PUBLISHED
- Vendor
- Apple, Apple, Apple, Apple
- Product
- macOS, visionOS, tvOS, iOS and iPadOS
- Provider severity
- CRITICAL
- Conflicts
- 2
CVE-2026-64768
An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6. A remote attacker may cause an unexpected app termination.
PUBLISHED
- Vendor
- Apple, Apple, Apple, Apple
- Product
- visionOS, tvOS, macOS, iOS and iPadOS
- Provider severity
- HIGH
- Conflicts
- 2
CVE-2026-64767
A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A remote attacker may be able to cause unexpected system termination or corrupt kernel memory.
PUBLISHED
- Vendor
- Apple
- Product
- macOS
- Provider severity
- CRITICAL
- Conflicts
- 1
CVE-2026-64766
An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.
PUBLISHED
- Vendor
- Apple, Apple, Apple, Apple, Apple
- Product
- visionOS, macOS, watchOS, tvOS, iOS and iPadOS
- Provider severity
- HIGH
- Conflicts
- 2
CVE-2026-64765
An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.
PUBLISHED
- Vendor
- Apple, Apple, Apple, Apple, Apple
- Product
- iOS and iPadOS, watchOS, visionOS, macOS, tvOS
- Provider severity
- HIGH
- Conflicts
- 2
CVE-2026-64764
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.
PUBLISHED
- Vendor
- Apple, Apple, Apple, Apple, Apple
- Product
- watchOS, iOS and iPadOS, macOS, visionOS, tvOS
- Provider severity
- HIGH
- Conflicts
- 2
CVE-2026-64763
An out-of-bounds write issue was addressed by removing the vulnerable code. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.
PUBLISHED
- Vendor
- Apple, Apple, Apple, Apple, Apple
- Product
- macOS, visionOS, iOS and iPadOS, tvOS, watchOS
- Provider severity
- HIGH
- Conflicts
- 2
CVE-2026-64762
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to cause unexpected system termination.
PUBLISHED
- Vendor
- Apple
- Product
- macOS
- Provider severity
- CRITICAL
- Conflicts
- 1
CVE-2026-6476
SQL injection in PostgreSQL pg_createsubscriber allows an attacker with pg_create_subscription rights to execute arbitrary SQL as a superuser. The attack takes effect when pg_createsubscriber next runs. Within major versions 17 and 18, minor versions before PostgreSQL 18.4 and 17.10 are affected. Versions before PostgreSQL 17 are unaffected.
PUBLISHED
- Vendor
- n/a
- Product
- PostgreSQL
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-64758
The issue was addressed with improved bounds checks. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted file may lead to unexpected app termination.
PUBLISHED
- Vendor
- Apple, Apple, Apple, Apple, Apple
- Product
- macOS, visionOS, tvOS, iOS and iPadOS, watchOS
- Provider severity
- HIGH
- Conflicts
- 2
CVE-2026-64757
A memory corruption issue was addressed with improved state management. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.
PUBLISHED
- Vendor
- Apple, Apple, Apple, Apple, Apple
- Product
- watchOS, macOS, visionOS, Safari, iOS and iPadOS
- Provider severity
- HIGH
- Conflicts
- 2
CVE-2026-64755
An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.6 and iPadOS 26.6. An app may be able to access sensitive user data.
PUBLISHED
- Vendor
- Apple
- Product
- iOS and iPadOS
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-64754
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted file may lead to a denial-of-service.
PUBLISHED
- Vendor
- Apple, Apple, Apple, Apple, Apple
- Product
- macOS, tvOS, visionOS, watchOS, iOS and iPadOS
- Provider severity
- MEDIUM
- Conflicts
- 2
CVE-2026-64751
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination or write kernel memory.
PUBLISHED
- Vendor
- Apple, Apple, Apple, Apple, Apple
- Product
- visionOS, watchOS, macOS, tvOS, iOS and iPadOS
- Provider severity
- CRITICAL
- Conflicts
- 2
CVE-2026-6475
Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that hijack the operating system account. It will remain the case that starting the server after these commands implicitly trusts the origin superuser, due to features like shared_preload_libraries. Hence, the attack has practical implications only if one takes relevant action between these commands and server start, like moving the fi
PUBLISHED
- Vendor
- n/a
- Product
- PostgreSQL
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-64749
The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Tahoe 26.6, visionOS 26.6. An app may be able to cause unexpected system termination or corrupt kernel memory.
PUBLISHED
- Vendor
- Apple, Apple, Apple
- Product
- iOS and iPadOS, macOS, visionOS
- Provider severity
- HIGH
- Conflicts
- 2
CVE-2026-64747
A buffer overflow was addressed with improved size validation. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to execute arbitrary code with kernel privileges.
PUBLISHED
- Vendor
- Apple, Apple, Apple, Apple, Apple
- Product
- tvOS, visionOS, iOS and iPadOS, watchOS, macOS
- Provider severity
- HIGH
- Conflicts
- 2