Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Critical9.8ZDI-26-651: (Pwn2Own) OpenAI Codex External Control of System or Configuration Setting Remote Code Execution VulnerabilityEPSS 0.4%Sep 1, 2026
- Critical9.8Apple macOS Improper Authentication VulnerabilityKEVEPSS 1.7%Aug 6, 2026
- High7.8An issue was discovered in Canonical Multipass for macOS before version 1.16.3 due to an incomplete fix for CVE-2025-5199.EPSS 0.2%May 28, 2026
- Medium5.5A logic issue was addressed with improved restrictions.EPSS 0.1%May 26, 2026
- High7.0A race condition was addressed with additional validation.EPSS 0.1%May 26, 2026
- Medium5.5An out-of-bounds read was addressed with improved bounds checking.EPSS 0.1%May 26, 2026
- Medium5.5A permissions issue was addressed by removing the vulnerable code.EPSS 0.1%May 26, 2026
- High7.8A logic issue was addressed with improved checks.EPSS 0.1%May 26, 2026
- Medium5.5A permissions issue was addressed with additional restrictions.EPSS 0.1%May 26, 2026
- Medium5.5A logic issue was addressed with improved validation.EPSS 0.1%May 26, 2026
- Critical9.4Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS allows attackers to execute arbitrary commands with elevated privileges via…May 26, 2026
- Medium4.3Algernon is a small self-contained pure-Go web server.May 26, 2026
- High8.8The MLX inference backend in Docker Model Runner on macOS uses the MLX-LM library, which unconditionally imports and executes arbitrary Python files from model directo…May 22, 2026
- High8.8The vllm-metal inference backend in Docker Model Runner on macOS unconditionally sets trust_remote_code=True when loading model tokenizers, and runs without sandboxing.May 22, 2026
- High8.6IINA before 1.4.3 contains a user-assisted command execution vulnerability that allows remote attackers to execute arbitrary commands by supplying malicious mpv_-prefi…May 21, 2026
- Medium5.5Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases.May 20, 2026
- High7.8Mullvad VPN is a VPN client app for desktop and mobile.May 19, 2026
- Medium6.0Fleet is open source device management software.May 14, 2026
- Medium5.9Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allow a local user to escalate their privileges to NT AUTHORITY\SYSTEM…EPSS 0.2%May 13, 2026
- Medium6.2An improper certificate validation vulnerability in the Prisma Access Agent® for Android and Chrome OS enables an attacker to perform a man-in-the-middle (MitM) attack…EPSS 0.2%May 13, 2026
- Medium5.9A vulnerability with a privilege management mechanism in the Palo Alto Networks Prisma Access Agent® enables a locally authenticated non-administrative user to escalat…EPSS 0.1%May 13, 2026
- High7.3A code injection vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to its AppleScript interface allowing a locally authent…EPSS 0.2%May 13, 2026
- High7.3An improper protection of alternate path vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to an internal automation bridge.EPSS 0.1%May 13, 2026
- High8.8An access issue was addressed with additional sandbox restrictions.EPSS 0.1%May 12, 2026
- High7.5A use after free issue was addressed with improved memory management.May 11, 2026