{"schema":"voidly-atlas-federal-dataset/v1","dataset":"nvd-cves","title":"NVD — Known Software Vulnerabilities","agency":"NIST","source":"NIST National Vulnerability Database","source_url":"https://nvd.nist.gov/vuln","mission":"The circumvention and secure-comms stack — VPNs, routers, browsers, messengers — is built on this software. A flaw here is a flaw in the tools activists and journalists rely on to evade censorship safely.","filter_note":null,"provider":"Voidly","license":"Source data is U.S. federal public domain (17 U.S.C. §105). Re-surfaced by Voidly under CC BY 4.0.","disclaimer":"This is the agency's own public-domain data, curated and made citable by Voidly. Voidly adds no independent claim — always verify against the linked canonical source.","record_count":168126,"returned":50,"offset":0,"generated_at":"2026-10-20T14:22:06.876Z","records":[{"id":"CVE-2026-86981","cve_id":"CVE-2026-86981","published":"2026-10-20T01:17:29.540","last_modified":"2026-10-20T01:17:29.540","status":"Received","description":"An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause unexpected system termination.","cvss_score":null,"cvss_severity":null,"cvss_vector":null,"cwes":null,"cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86981","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-86981"},{"id":"CVE-2026-86979","cve_id":"CVE-2026-86979","published":"2026-10-20T01:17:29.450","last_modified":"2026-10-20T01:17:29.450","status":"Received","description":"A privacy issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27. An app may be able to access sensitive user data.","cvss_score":null,"cvss_severity":null,"cvss_vector":null,"cwes":null,"cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86979","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-86979"},{"id":"CVE-2026-86977","cve_id":"CVE-2026-86977","published":"2026-10-20T01:17:29.353","last_modified":"2026-10-20T01:17:29.353","status":"Received","description":"An authorization issue was addressed with improved network restrictions. This issue is fixed in iOS 27 and iPadOS 27. An app may be able to initiate calls or send messages.","cvss_score":null,"cvss_severity":null,"cvss_vector":null,"cwes":null,"cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86977","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-86977"},{"id":"CVE-2026-86976","cve_id":"CVE-2026-86976","published":"2026-10-20T01:17:29.260","last_modified":"2026-10-20T01:17:29.260","status":"Received","description":"An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. An app may be able to access sensitive user data.","cvss_score":null,"cvss_severity":null,"cvss_vector":null,"cwes":null,"cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86976","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-86976"},{"id":"CVE-2026-86975","cve_id":"CVE-2026-86975","published":"2026-10-20T01:17:29.160","last_modified":"2026-10-20T01:17:29.160","status":"Received","description":"An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted image may lead to unexpected process termination.","cvss_score":null,"cvss_severity":null,"cvss_vector":null,"cwes":null,"cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86975","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-86975"},{"id":"CVE-2026-86963","cve_id":"CVE-2026-86963","published":"2026-10-20T01:17:29.060","last_modified":"2026-10-20T01:17:29.060","status":"Received","description":"A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27. An attacker in a privileged network position may be able to cause a denial-of-service.","cvss_score":null,"cvss_severity":null,"cvss_vector":null,"cwes":null,"cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86963","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-86963"},{"id":"CVE-2026-86962","cve_id":"CVE-2026-86962","published":"2026-10-20T01:17:28.957","last_modified":"2026-10-20T01:17:28.957","status":"Received","description":"A double free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination.","cvss_score":null,"cvss_severity":null,"cvss_vector":null,"cwes":null,"cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86962","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-86962"},{"id":"CVE-2026-86961","cve_id":"CVE-2026-86961","published":"2026-10-20T01:17:28.857","last_modified":"2026-10-20T01:17:28.857","status":"Received","description":"A race condition was addressed with additional validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. A malicious app may be able to break out of its sandbox.","cvss_score":null,"cvss_severity":null,"cvss_vector":null,"cwes":null,"cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86961","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-86961"},{"id":"CVE-2026-86959","cve_id":"CVE-2026-86959","published":"2026-10-20T01:17:28.763","last_modified":"2026-10-20T01:17:28.763","status":"Received","description":"An input validation issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Processing a maliciously crafted image may lead to unexpected process termination.","cvss_score":null,"cvss_severity":null,"cvss_vector":null,"cwes":null,"cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86959","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-86959"},{"id":"CVE-2026-86957","cve_id":"CVE-2026-86957","published":"2026-10-20T01:17:28.660","last_modified":"2026-10-20T01:17:28.660","status":"Received","description":"An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An attacker in wireless proximity may be able to cause unexpected system termination.","cvss_score":null,"cvss_severity":null,"cvss_vector":null,"cwes":null,"cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86957","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-86957"},{"id":"CVE-2026-86955","cve_id":"CVE-2026-86955","published":"2026-10-20T01:17:28.570","last_modified":"2026-10-20T01:17:28.570","status":"Received","description":"An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27. An app may be able to access sensitive user data.","cvss_score":null,"cvss_severity":null,"cvss_vector":null,"cwes":null,"cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86955","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-86955"},{"id":"CVE-2026-86953","cve_id":"CVE-2026-86953","published":"2026-10-20T01:17:28.467","last_modified":"2026-10-20T01:17:28.467","status":"Received","description":"An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. An attacker in physical proximity may be able to cause a denial-of-service.","cvss_score":null,"cvss_severity":null,"cvss_vector":null,"cwes":null,"cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86953","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-86953"},{"id":"CVE-2026-86949","cve_id":"CVE-2026-86949","published":"2026-10-20T01:17:28.370","last_modified":"2026-10-20T01:17:28.370","status":"Received","description":"This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. A malicious app may be able to break out of its sandbox.","cvss_score":null,"cvss_severity":null,"cvss_vector":null,"cwes":null,"cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86949","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-86949"},{"id":"CVE-2026-86948","cve_id":"CVE-2026-86948","published":"2026-10-20T01:17:28.270","last_modified":"2026-10-20T01:17:28.270","status":"Received","description":"This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. An app may be able to break out of its sandbox.","cvss_score":null,"cvss_severity":null,"cvss_vector":null,"cwes":null,"cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86948","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-86948"},{"id":"CVE-2026-86944","cve_id":"CVE-2026-86944","published":"2026-10-20T01:17:28.177","last_modified":"2026-10-20T01:17:28.177","status":"Received","description":"An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause unexpected system termination.","cvss_score":null,"cvss_severity":null,"cvss_vector":null,"cwes":null,"cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86944","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-86944"},{"id":"CVE-2026-86940","cve_id":"CVE-2026-86940","published":"2026-10-20T01:17:28.080","last_modified":"2026-10-20T01:17:28.080","status":"Received","description":"This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Golden Gate 27. An app may be able to disclose kernel memory.","cvss_score":null,"cvss_severity":null,"cvss_vector":null,"cwes":null,"cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86940","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-86940"},{"id":"CVE-2026-86935","cve_id":"CVE-2026-86935","published":"2026-10-20T01:17:27.990","last_modified":"2026-10-20T01:17:27.990","status":"Received","description":"This issue was addressed by removing additional entitlements. This issue is fixed in macOS Golden Gate 27. An app may be able to access user-sensitive data.","cvss_score":null,"cvss_severity":null,"cvss_vector":null,"cwes":null,"cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86935","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-86935"},{"id":"CVE-2026-86933","cve_id":"CVE-2026-86933","published":"2026-10-20T01:17:27.890","last_modified":"2026-10-20T01:17:27.890","status":"Received","description":"A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Golden Gate 27. An app may be able to access information about a user's contacts.","cvss_score":null,"cvss_severity":null,"cvss_vector":null,"cwes":null,"cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86933","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-86933"},{"id":"CVE-2026-86932","cve_id":"CVE-2026-86932","published":"2026-10-20T01:17:27.793","last_modified":"2026-10-20T01:17:27.793","status":"Received","description":"An authorization issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. An app may be able to access sensitive user data.","cvss_score":null,"cvss_severity":null,"cvss_vector":null,"cwes":null,"cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86932","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-86932"},{"id":"CVE-2026-86928","cve_id":"CVE-2026-86928","published":"2026-10-20T01:17:27.697","last_modified":"2026-10-20T01:17:27.697","status":"Received","description":"A path handling issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27. An app may be able to access protected user data.","cvss_score":null,"cvss_severity":null,"cvss_vector":null,"cwes":null,"cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86928","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-86928"},{"id":"CVE-2026-86922","cve_id":"CVE-2026-86922","published":"2026-10-20T01:17:27.600","last_modified":"2026-10-20T01:17:27.600","status":"Received","description":"A type confusion issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Processing maliciously crafted web content may lead to arbitrary code execution.","cvss_score":null,"cvss_severity":null,"cvss_vector":null,"cwes":null,"cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86922","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-86922"},{"id":"CVE-2026-86921","cve_id":"CVE-2026-86921","published":"2026-10-20T01:17:27.493","last_modified":"2026-10-20T01:17:27.493","status":"Received","description":"A permissions issue was addressed with improved validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. A local attacker may be able to overwrite restricted files.","cvss_score":null,"cvss_severity":null,"cvss_vector":null,"cwes":null,"cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86921","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-86921"},{"id":"CVE-2026-86919","cve_id":"CVE-2026-86919","published":"2026-10-20T01:17:27.390","last_modified":"2026-10-20T01:17:27.390","status":"Received","description":"A stack overflow was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27. An attacker with a paired Bluetooth device may be able to execute arbitrary code.","cvss_score":null,"cvss_severity":null,"cvss_vector":null,"cwes":null,"cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86919","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-86919"},{"id":"CVE-2026-86918","cve_id":"CVE-2026-86918","published":"2026-10-20T01:17:27.287","last_modified":"2026-10-20T01:17:27.287","status":"Received","description":"An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted image may lead to unexpected app termination.","cvss_score":null,"cvss_severity":null,"cvss_vector":null,"cwes":null,"cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86918","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-86918"},{"id":"CVE-2026-86915","cve_id":"CVE-2026-86915","published":"2026-10-20T01:17:27.100","last_modified":"2026-10-20T01:17:27.100","status":"Received","description":"A race condition was addressed with improved locking. This issue is fixed in macOS Golden Gate 27. An app may be able to cause unexpected system termination.","cvss_score":null,"cvss_severity":null,"cvss_vector":null,"cwes":null,"cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86915","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-86915"},{"id":"CVE-2026-86914","cve_id":"CVE-2026-86914","published":"2026-10-20T01:17:27.000","last_modified":"2026-10-20T01:17:27.000","status":"Received","description":"An information disclosure issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access sensitive network connection information.","cvss_score":null,"cvss_severity":null,"cvss_vector":null,"cwes":null,"cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86914","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-86914"},{"id":"CVE-2026-86913","cve_id":"CVE-2026-86913","published":"2026-10-20T01:17:26.893","last_modified":"2026-10-20T01:17:26.893","status":"Received","description":"A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory.","cvss_score":null,"cvss_severity":null,"cvss_vector":null,"cwes":null,"cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86913","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-86913"},{"id":"CVE-2026-86907","cve_id":"CVE-2026-86907","published":"2026-10-20T01:17:26.530","last_modified":"2026-10-20T01:17:26.530","status":"Received","description":"An authorization issue was addressed with improved entitlement checks. This issue is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7. An app with admin privileges may be able to modify the System Keychain.","cvss_score":null,"cvss_severity":null,"cvss_vector":null,"cwes":null,"cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86907","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-86907"},{"id":"CVE-2026-86875","cve_id":"CVE-2026-86875","published":"2026-10-20T01:17:25.557","last_modified":"2026-10-20T01:17:25.557","status":"Received","description":"An input validation issue was addressed with improved input validation. This issue is fixed in Xcode 27. Parsing a maliciously crafted binary may lead to unexpected app termination.","cvss_score":null,"cvss_severity":null,"cvss_vector":null,"cwes":null,"cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86875","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-86875"},{"id":"CVE-2026-86874","cve_id":"CVE-2026-86874","published":"2026-10-20T01:17:25.457","last_modified":"2026-10-20T01:17:25.457","status":"Received","description":"An out-of-bounds read was addressed with improved input validation. This issue is fixed in Xcode 27. Parsing a maliciously crafted binary may lead to unexpected tool termination.","cvss_score":null,"cvss_severity":null,"cvss_vector":null,"cwes":null,"cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86874","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-86874"},{"id":"CVE-2026-86872","cve_id":"CVE-2026-86872","published":"2026-10-20T01:17:25.357","last_modified":"2026-10-20T01:17:25.357","status":"Received","description":"A logic issue was addressed with improved state management. This issue is fixed in Safari 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to unexpected behavior.","cvss_score":null,"cvss_severity":null,"cvss_vector":null,"cwes":null,"cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86872","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-86872"},{"id":"CVE-2026-86871","cve_id":"CVE-2026-86871","published":"2026-10-20T01:17:25.253","last_modified":"2026-10-20T01:17:25.253","status":"Received","description":"An integer underflow was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker with control of a network file server may be able to cause unexpected system termination.","cvss_score":null,"cvss_severity":null,"cvss_vector":null,"cwes":null,"cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86871","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-86871"},{"id":"CVE-2026-86868","cve_id":"CVE-2026-86868","published":"2026-10-20T01:17:24.980","last_modified":"2026-10-20T01:17:24.980","status":"Received","description":"An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker may be able to impersonate other users.","cvss_score":null,"cvss_severity":null,"cvss_vector":null,"cwes":null,"cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86868","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-86868"},{"id":"CVE-2026-84613","cve_id":"CVE-2026-84613","published":"2026-10-20T01:17:24.163","last_modified":"2026-10-20T01:17:24.163","status":"Received","description":"An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An attacker in radio range may be able to cause unexpected system termination.","cvss_score":null,"cvss_severity":null,"cvss_vector":null,"cwes":null,"cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84613","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-84613"},{"id":"CVE-2026-84582","cve_id":"CVE-2026-84582","published":"2026-10-20T01:17:23.697","last_modified":"2026-10-20T01:17:23.697","status":"Received","description":"A privacy issue was addressed with improved access restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. An app may be able to access sensitive user data.","cvss_score":null,"cvss_severity":null,"cvss_vector":null,"cwes":null,"cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84582","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-84582"},{"id":"CVE-2026-84579","cve_id":"CVE-2026-84579","published":"2026-10-20T01:17:23.593","last_modified":"2026-10-20T01:17:23.593","status":"Received","description":"A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Opening a file referencing a network share may lead to unexpected software execution.","cvss_score":null,"cvss_severity":null,"cvss_vector":null,"cwes":null,"cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84579","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-84579"},{"id":"CVE-2026-84547","cve_id":"CVE-2026-84547","published":"2026-10-20T01:17:22.190","last_modified":"2026-10-20T01:17:22.190","status":"Received","description":"A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker in physical proximity may be able to corrupt process memory.","cvss_score":null,"cvss_severity":null,"cvss_vector":null,"cwes":null,"cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84547","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-84547"},{"id":"CVE-2026-84508","cve_id":"CVE-2026-84508","published":"2026-10-20T01:17:20.937","last_modified":"2026-10-20T01:17:20.937","status":"Received","description":"This issue was addressed with improved validation of the caller's access. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, visionOS 27. An app may be able to access protected user data.","cvss_score":null,"cvss_severity":null,"cvss_vector":null,"cwes":null,"cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84508","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-84508"},{"id":"CVE-2026-84490","cve_id":"CVE-2026-84490","published":"2026-10-20T01:17:20.553","last_modified":"2026-10-20T01:17:20.553","status":"Received","description":"This issue was addressed through improved state management. This issue is fixed in iOS 27 and iPadOS 27. An attacker with physical access to a locked device may be able to bypass Digital ID authentication when iPhone Mirroring is active.","cvss_score":null,"cvss_severity":null,"cvss_vector":null,"cwes":null,"cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84490","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-84490"},{"id":"CVE-2026-77938","cve_id":"CVE-2026-77938","published":"2026-10-20T01:17:20.410","last_modified":"2026-10-20T01:17:20.410","status":"Received","description":"Letta through 0.16.8 contains an information disclosure vulnerability that allows users running tools to read server secrets because LocalSandbox subprocesses inherit the full server environment. Attackers can run code via POST /v1/tools/run or custom tools to read LETTA_PG_URI, POSTGRES_PASSWORD, and provider API keys, then access cross-tenant database data.","cvss_score":6.5,"cvss_severity":"MEDIUM","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cwes":"CWE-526","cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77938","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-77938"},{"id":"CVE-2026-77937","cve_id":"CVE-2026-77937","published":"2026-10-20T01:17:20.263","last_modified":"2026-10-20T01:17:20.263","status":"Received","description":"Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate other users by supplying a self-asserted user_id HTTP header. Attackers can set user_id to another tenant's ID, even with LETTA_SERVER_SECURE enabled, to read and modify that user's agents, memory and configuration.","cvss_score":8.1,"cvss_severity":"HIGH","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwes":"CWE-639","cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77937","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-77937"},{"id":"CVE-2026-77936","cve_id":"CVE-2026-77936","published":"2026-10-20T01:17:20.107","last_modified":"2026-10-20T01:17:20.107","status":"Received","description":"Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware is never added and all API routes are unauthenticated, and it exposes a superuser PostgreSQL port with default credentials. Remote attackers can execute arbitrary Python via POST /v1/tools/run, manage /v1/admin users, or run OS commands via COPY PROGRAM.","cvss_score":9.8,"cvss_severity":"CRITICAL","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":"CWE-1188","cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77936","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-77936"},{"id":"CVE-2026-77935","cve_id":"CVE-2026-77935","published":"2026-10-20T01:17:19.970","last_modified":"2026-10-20T01:17:19.970","status":"Received","description":"Coze Studio through 0.5.1 contains an insecure direct object reference vulnerability in workflow.go that allows authenticated users to access other spaces' workflows by supplying foreign workflowIDs. Attackers can pair their own spaceID with another tenant's workflowID in save, update_meta, batch_delete, canvas, test_run and nodeDebug routes to read, run, overwrite or delete workflows.","cvss_score":8.3,"cvss_severity":"HIGH","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","cwes":"CWE-639","cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77935","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-77935"},{"id":"CVE-2026-77934","cve_id":"CVE-2026-77934","published":"2026-10-20T01:17:19.823","last_modified":"2026-10-20T01:17:19.823","status":"Received","description":"Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user to execute commands by running workflow code nodes in an unsandboxed python3 subprocess. Attackers can bypass the regex import filter with __import__('subprocess') to run commands, stealing environment variables, model API keys, and accessing MySQL, MinIO, Redis and etcd.","cvss_score":8.8,"cvss_severity":"HIGH","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":"CWE-1188","cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77934","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-77934"},{"id":"CVE-2026-77933","cve_id":"CVE-2026-77933","published":"2026-10-20T01:17:19.670","last_modified":"2026-10-20T01:17:19.783","status":"Deferred","description":"DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static MYSQL_ROOT_PASSWORD and publishes port 3306 on all interfaces. Attackers reaching port 3306 or the shared dbgptnet network can authenticate as root@% to gain full database access including FILE and SUPER privileges.","cvss_score":9.8,"cvss_severity":"CRITICAL","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":"CWE-1392","cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77933","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-77933"},{"id":"CVE-2026-77932","cve_id":"CVE-2026-77932","published":"2026-10-20T01:17:19.503","last_modified":"2026-10-20T01:17:19.623","status":"Deferred","description":"DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerability because the /api/v1/chat/react-agent endpoint relies on a mock get_user_from_headers function that grants every caller the admin role. Unauthenticated attackers can send prompts that make the ReAct agent's unsandboxed code_interpreter and shell_interpreter tools run arbitrary Python or bash as root in the webserver container, including reaching the bundled database with default credentials.","cvss_score":9.8,"cvss_severity":"CRITICAL","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":"CWE-306","cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77932","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-77932"},{"id":"CVE-2026-77930","cve_id":"CVE-2026-77930","published":"2026-10-20T01:17:19.360","last_modified":"2026-10-20T01:17:19.360","status":"Received","description":"EvoScientist 0.1.0 before 0.2.5 contains an approval bypass vulnerability that allows attackers to run host shell commands by delegating them to async sub-agents lacking an interrupt_on gate. Attackers can plant instructions in ingested content such as fetched web pages, so the agent calls start_async_task and runs commands with user privileges and environment secrets.","cvss_score":8.8,"cvss_severity":"HIGH","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":"CWE-862","cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77930","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-77930"},{"id":"CVE-2026-77926","cve_id":"CVE-2026-77926","published":"2026-10-20T01:17:19.213","last_modified":"2026-10-20T01:17:19.213","status":"Received","description":"Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin users to run operating system commands through the ChatBI common agent's ungated deepagents execute tool. Attackers can send crafted chat input to POST /dify/get_answer or upload documents with malicious text to run host commands, exposing datasource credentials and model API keys.","cvss_score":8.8,"cvss_severity":"HIGH","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":"CWE-749","cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77926","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-77926"},{"id":"CVE-2026-75128","cve_id":"CVE-2026-75128","published":"2026-10-20T01:17:19.063","last_modified":"2026-10-20T01:17:19.063","status":"Received","description":"Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call API endpoint that invokes any registered tool by name without authentication, leaving the always-registered shell tool callable. Remote attackers can send a single request naming the shell tool to execute arbitrary OS commands as the server user (root in the shipped Docker image).","cvss_score":9.8,"cvss_severity":"CRITICAL","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":"CWE-306","cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75128","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-75128"},{"id":"CVE-2026-65396","cve_id":"CVE-2026-65396","published":"2026-10-20T01:17:18.313","last_modified":"2026-10-20T01:17:18.313","status":"Received","description":"A buffer overflow was addressed with improved size validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause unexpected system termination.","cvss_score":null,"cvss_severity":null,"cvss_vector":null,"cwes":null,"cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65396","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-65396"}]}