Posted by Apple Product Security via Fulldisclosure on Oct 27

APPLE-SA-10-26-2026-5 macOS Tahoe 26.7.2

macOS Tahoe 26.7.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/149522.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Accelerate Framework
Available for: macOS Tahoe
Impact: Processing a maliciously crafted image may lead to unexpected
app...

Posted by Apple Product Security via Fulldisclosure on Oct 27

APPLE-SA-10-26-2026-10 Safari 27.2

Safari 27.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/149527.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

LinkPresentation
Available for: macOS Sequoia and macOS Tahoe
Impact: Processing a maliciously crafted image may result in memory...

Posted by Apple Product Security via Fulldisclosure on Oct 27

APPLE-SA-10-26-2026-9 visionOS 27.2

visionOS 27.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/149526.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Accelerate Framework
Available for: Apple Vision Pro (all models)
Impact: Processing a maliciously crafted image may lead to...

Posted by Apple Product Security via Fulldisclosure on Oct 27

APPLE-SA-10-26-2026-8 watchOS 27.2

watchOS 27.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/149525.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Accounts
Available for: Apple Watch Series 9 and later
Impact: A malicious application may be able to bypass Privacy
preferences...

Posted by Apple Product Security via Fulldisclosure on Oct 27

APPLE-SA-10-26-2026-7 tvOS 27.2

tvOS 27.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/149524.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Accounts
Available for: Apple TV 4K 2nd generation and later
Impact: A malicious application may be able to bypass Privacy
preferences...

Posted by Apple Product Security via Fulldisclosure on Oct 27

APPLE-SA-10-26-2026-6 macOS Sequoia 15.8.2

macOS Sequoia 15.8.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/149523.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Accelerate
Available for: macOS Sequoia
Impact: An app may be able to cause a denial-of-service
Description: An...

Posted by Apple Product Security via Fulldisclosure on Oct 27

APPLE-SA-10-26-2026-4 macOS Golden Gate 27.2

macOS Golden Gate 27.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/149521.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Accelerate Framework
Available for: macOS Golden Gate
Impact: Processing a maliciously crafted image may lead to...

Posted by Apple Product Security via Fulldisclosure on Oct 27

APPLE-SA-10-26-2026-3 iOS 18.7.11 and iPadOS 18.7.11

iOS 18.7.11 and iPadOS 18.7.11 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/149225.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Audio
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th
generationAir 4th generation...

Posted by Apple Product Security via Fulldisclosure on Oct 27

APPLE-SA-10-26-2026-2 iOS 26.7.2 and iPadOS 26.7.2

iOS 26.7.2 and iPadOS 26.7.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/149227.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Accelerate Framework
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later,...

Posted by Apple Product Security via Fulldisclosure on Oct 27

APPLE-SA-10-26-2026-1 iOS 27.2 and iPadOS 27.2

iOS 27.2 and iPadOS 27.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/149230.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Accelerate Framework
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro...

Posted by jose on Oct 27

CVE-2026-109618: Pointer underflow in PHP's CGI SAPI enables
unauthenticated remote code execution.

Affected: ALL PHP versions 5.x through 8.4.26 with cgi.fix_pathinfo=1
(default configuration). Same vulnerability class as CVE-2019-11043
(PHP-FPM, CVSS 9.8, patched 2019) — the CGI SAPI never received the
equivalent fix.

Fix: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 (scheduled Oct 21, 2026 14:00 UTC)
PHP 8.1 and earlier (EOL) receive NO fix....

Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Oct 27

SEC Consult Vulnerability Lab Security Advisory < 20261023-0 >
=======================================================================
title: Multiple Cross-Site Scripting Vulnerabilities
           product: VertiGIS WebOrderSystem (KundenManager, AuftragsManager)
vulnerable version: <=7.0.8.6
     fixed version: unknown
CVE number: CVE-2026-4950, CVE-2026-4951, CVE-2026-4952
           ...

Posted by KC Chambers via Fulldisclosure on Oct 27

APPLE-SA-10-26-2026-5 macOS Tahoe 26.7.2

macOS Tahoe 26.7.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/149522.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Accelerate Framework
Available for: macOS Tahoe
Impact: Processing a maliciously crafted image may lead to unexpected
app...

Posted by David Brown via Fulldisclosure on Oct 27

Privilege escalation via request replaying in Lobster_pro
=========================================================

Due to improper permission checks in Lobster_pro, attackers are able to
interact with
endpoints that should require administrative privileges. This issue
affects Lobster_pro
version 4.12.12-LTS and potentially other versions prior to 25.1.3.

Metadata
========

- Affected product: Lobster_pro
- Affected version: 4.12.12-LTS and...

Posted by disclosure via Fulldisclosure on Oct 20

0day Rubbish Research Team is publicly disclosing a vulnerability in TRENDnet
TV-IP302PI firmware 1.02.38, the closed-source IP surveillance camera from
TRENDnet (United States). The camera's application daemon is shipped at
/hunt/hunt_server: an ARM 32-bit EABI5 version 5TE soft-float binary,
dynamically linked against /lib/ld-linux.so.3, 4.5 MB and stripped. Its own
string pool carries hunt_camera, HuntAudioConverter, HuntDataDirect and...

Posted by advisories on Sep 30

----------------------------------------------------------------------------
NotCVE Advisory — NotCVE-2026-0019
----------------------------------------------------------------------------

[-] Summary:
An out-of-bounds read in the VGM command interpreter of game-music-emu
(libgme), the open-source video game music emulation library, allows an
attacker who supplies a crafted .vgm or .vgz file to read heap memory past
the end of the buffer...

Posted by advisories on Sep 30

----------------------------------------------------------------------------
NotCVE Advisory — NotCVE-2026-0018
----------------------------------------------------------------------------

[-] Summary:
An out-of-bounds read in the GYM playback path of game-music-emu (libgme),
the open-source video game music emulation library, allows an attacker who
supplies a crafted .gym file to read heap memory past the end of the
allocation holding the...

Posted by advisories on Sep 30

----------------------------------------------------------------------------
NotCVE Advisory — NotCVE-2026-0017
----------------------------------------------------------------------------

[-] Summary:
A NULL pointer dereference in the AY file loader of game-music-emu
(libgme), the open-source video game music emulation library, allows an
attacker who supplies a crafted .ay file to terminate any application that
begins playback of it. CVSS:3.1...

Posted by advisories on Sep 30

----------------------------------------------------------------------------
NotCVE Advisory — NotCVE-2026-0016
----------------------------------------------------------------------------

[-] Summary:
An out-of-bounds read in the VGM command interpreter of game-music-emu
(libgme), the open-source video game music emulation library, allows an
attacker who supplies a crafted .vgm or .vgz file to crash the hosting
process or to have adjacent...

Posted by Apple Product Security via Fulldisclosure on Sep 28

APPLE-SA-09-28-2026-3 macOS Sequoia 15.8.1

macOS Sequoia 15.8.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/149229.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

CoreGraphics
Available for: macOS Sequoia
Impact: Processing a maliciously crafted file may lead to arbitrary code...