CVE-2025-43260

Privileged App Entitlement Hijacking in macOS

This issue was addressed with improved data protection. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7. An app may be able to hijack entitlements granted to other privileged apps.

CVSS 3.1 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos Macos Sequoia Macos Sonoma

CVE-2026-29646

Privilege and Virtualization Isolation Breach in OpenXiangShan NEMU

In OpenXiangShan NEMU prior to 55295c4, when running with RVH (Hypervisor extension) enabled, a VS-mode guest write to the supervisor interrupt-enable CSR (sie) may be handled incorrectly and can influence machine-level interrupt enable state (mie). This breaks privilege/virtualization isolation and can lead to denial of service or privilege-boundary violation in environments relying on NEMU for correct interrupt virtualization.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Openxiangshan

Products

Nemu

CVE-2026-29647

OpenXiangShan NEMU Cross-Context IMSIC State Leakage

In OpenXiangShan NEMU, insufficient Smstateen permission enforcement allows lower-privileged code to access IMSIC state via stopei/vstopei CSRs even when mstateen0.IMSIC is cleared, potentially enabling cross-context information leakage or disruption of interrupt handling.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Openxiangshan

Products

Nemu

CVE-2026-29648

Privilege Escalation via Improper CSRs Access in OpenXiangShan NEMU

In OpenXiangShan NEMU, when Smstateen is enabled, clearing mstateen0.ENVCFG does not correctly restrict access to henvcfg and senvcfg. As a result, less-privileged code may read or write these CSRs without the required exception, potentially bypassing intended state-enable based isolation controls in virtualized or multi-privilege environments.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Openxiangshan

Products

Nemu

CVE-2026-6878

ByteDance verl grader.py math_equal sandbox

A vulnerability was identified in ByteDance verl up to 0.7.0. Affected is the function math_equal of the file prime_math/grader.py. The manipulation leads to sandbox issue. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bytedance

Products

Verl

CVE-2026-22337

WordPress Directorist Social Login plugin < 2.1.4 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in Directorist Directorist Social Login allows Privilege Escalation.This issue affects Directorist Social Login: from n/a before 2.1.4.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Directorist Wordpress

Products

Directorist Social Login Wordpress

CVE-2026-7142

Wooey API Endpoint scripts.py add_or_update_script improper authorization

A vulnerability was determined in Wooey up to 0.13.2. The impacted element is the function add_or_update_script of the file wooey/api/scripts.py of the component API Endpoint. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.13.3rc1 and 0.14.0 is sufficient to resolve this issue. This patch is called f7846fc0c323da8325422cab32623491757f1b88. The affected component should be upgraded.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wooey

Products

Wooey

CVE-2025-24130

Privilege Escalation by Modifying Protected Filesystem Components

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. An app may be able to modify protected parts of the file system.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos

CVE-2025-24258

Privilege Escalation via Permissions Bypass on macOS

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. An app may be able to gain root privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos

CVE-2025-24183

macOS Local Privilege Escalation via Improper Filesystem Check

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. A local user may be able to modify protected parts of the file system.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos

CVE-2025-31229

Passcode Exposure via VoiceOver in iOS and iPadOS

A logic issue was addressed with improved checks. This issue is fixed in iOS 18.6 and iPadOS 18.6. Passcode may be read aloud by VoiceOver.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ipados Iphone Os

CVE-2025-43256

Privilege Escalation via Improper State Management in macOS

This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7. An app may be able to gain root privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos Macos Sequoia Macos Sonoma

CVE-2025-43188

Privilege Escalation via Permissions Issue in macOS Sequoia

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6. A malicious app may be able to gain root privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos Macos Sequoia

CVE-2025-24119

macOS Sandbox Escape Allowing Privilege Escalation

This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos Macos Sequoia Macos Sonoma and 1 more

CVE-2026-7109

code-projects Invoice System in Laravel API Endpoint item improper authorization

A vulnerability was detected in code-projects Invoice System in Laravel 1.0. This impacts an unknown function of the file /item of the component API Endpoint. Performing a manipulation results in improper authorization. It is possible to initiate the attack remotely. The exploit is now public and may be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Code-projects

Products

Invoice System In Laravel

CVE-2025-43199

macOS Privilege Escalation via Permissions Bypass

A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. A malicious app may be able to gain root privileges.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos Macos Sequoia Macos Sonoma and 1 more

CVE-2025-43320

Privileged Code Execution via Launch Constraint Bypass in macOS

The issue was addressed by adding additional logic. This issue is fixed in macOS Sequoia 15.7.3, macOS Tahoe 26. An app may be able to bypass launch constraint protections and execute malicious code with elevated privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos Macos Sequoia

CVE-2025-12573

Bookingor <= 1.0.12 - Subscriber+ Category Deletion

The Bookingor WordPress plugin through 1.0.12 exposes authenticated AJAX actions without capability or nonce checks, allowing low-privileged users to delete Bookingor WordPress plugin through 1.0.12 data.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2026-6977

vanna-ai vanna Legacy Flask API improper authorization

A security vulnerability has been detected in vanna-ai vanna up to 2.0.2. The affected element is an unknown function of the component Legacy Flask API. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Vanna-ai

Products

Vanna

CVE-2026-30269

Doorman Improper Access Control Allows Privilege Escalation

Improper access control in Doorman v0.1.0 and v1.0.2 allows any authenticated user to update their own account role to a non-admin privileged role via /platform/user/{username}. The `role` field is accepted by the update model without a manage_users permission check for self-updates, enabling privilege escalation to high-privileged roles.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Apidoorman Doorman

Products

Doorman Doorman