Vulnarycritical

the critical ledger · updated hourly

Critical vulnerability intelligence.

New critical security flaws land every day. Vulnary tells you what each one actually is, who it hits, how serious it really is, and the exact steps to shut it down.

Browse the feed ↓Am I affected? →

scroll

1,598critical tracked/171new today/23known-exploited/0exploit available/1,598critical tracked/171new today/23known-exploited/0exploit available/1,598critical tracked/171new today/23known-exploited/0exploit available/1,598critical tracked/171new today/23known-exploited/0exploit available/

The feed (latest)

1,598 entries

Your stack

Add the software you run to see what affects you.

view

source

fromto

CVE-2026-43773

A flaw in macOS allows an attacker to read memory beyond intended bounds when a specially crafted disk image is mounted. This can cause the system to crash or corrupt kernel memory. The issue is fixed in newer releases of macOS Sequoia, Sonoma, and Tahoe.

Critical· 9.8<1% likelyfix available

published 3d agodeletes in 28d

CVE-2026-43769

Apple Ipados +5 more

An integer overflow vulnerability in Apple operating systems could cause the system to crash. The issue has been fixed in recent OS releases. Users should update to the latest version to protect their devices.

Critical· 9.8<1% likelyfix available

published 3d agodeletes in 28d

CVE-2026-43764

An integer overflow in macOS can cause the system to terminate unexpectedly. Apple fixed the issue with improved input validation in newer releases. Users on older versions should update to avoid the risk.

Critical· 9.8<1% likelyfix available

published 3d agodeletes in 28d

CVE-2026-43757

CVE-2026-43757 is a critical out-of-bounds read vulnerability (CWE-125) in macOS that could allow an app to cause unexpected system termination. The flaw is fixed in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6.

Critical· 9.8<1% likelyfix available

published 3d agodeletes in 28d

CVE-2026-43750

A buffer overflow in macOS can let an application run code outside its sandbox or with elevated privileges. The flaw has been fixed in recent macOS releases. Users should update to the latest version to protect themselves.

Critical· 9.8<1% likelyfix available

published 3d agodeletes in 28d

CVE-2026-43748

A flaw in how the system handles memory allows an application to write data outside of its intended boundaries. This error can lead to unexpected system crashes or shutdowns.

Critical· 9.8<1% likelyfix available

published 3d agodeletes in 28d

CVE-2026-43730

Apple Ipados +5 more

A permissions flaw could let apps identify a user. Apple has fixed the issue in the latest OS releases. Users should update to the newest version to protect their privacy.

Critical· 9.8<1% likelyfix available

published 3d agodeletes in 28d

CVE-2026-43710

A critical memory handling flaw in macOS can cause the system to crash or corrupt kernel memory. The issue has been fixed in newer releases of macOS Sequoia, Sonoma, and Tahoe. Users should update to the latest version to protect their systems.

Critical· 9.8<1% likelyfix available

published 3d agodeletes in 28d

CVE-2026-43694

A critical memory handling flaw in macOS can let an attacker crash the system or corrupt kernel memory. The issue is fixed in newer releases of macOS Sequoia, Sonoma, and Tahoe. Users should update to the latest OS version to protect their computers.

Critical· 9.8<1% likelyfix available

published 3d agodeletes in 28d

CVE-2026-43682

A serious memory handling flaw in macOS can let a remote attacker crash the system or corrupt kernel memory. The issue is fixed in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. Users should update to these or newer releases.

Critical· 9.8<1% likelyfix available

published 3d agodeletes in 29d

CVE-2026-39873

A memory handling flaw in macOS can cause the system to crash when it connects to a malicious SMB server. The vulnerability is critical, with a CVSS score of 9.8, and has been fixed in recent macOS releases.

Critical· 9.8<1% likelyfix available

published 3d agodeletes in 28d

CVE-2026-28982

CVE-2026-28982 is a critical race condition vulnerability in macOS that could allow remote attackers to cause system crashes or corrupt kernel memory. Apple fixed this in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 by improving locking mechanisms.

Critical· 9.8<1% likelyfix available

published 3d agodeletes in 28d

CVE-2026-28931

A buffer overflow in the NFS client can corrupt kernel memory. The flaw is fixed in iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, and watchOS 26.6. Updating to these versions removes the risk.

Critical· 9.8<1% likelyfix available

published 3d agodeletes in 28d

CVE-2026-28928

Apple Ipados +4 more

A use‑after‑free bug could let a malicious app crash Apple’s operating systems. The flaw was fixed in the 26.6 releases of iOS, iPadOS, macOS, tvOS, and watchOS. Updating to those or newer versions protects devices.

Critical· 9.8<1% likelyfix available

published 3d agodeletes in 28d

CVE-2026-28911

A critical vulnerability (CVE-2026-28911) allows a malicious app to corrupt memory of a system process on macOS. The flaw is a memory handling issue (CWE-119). It has been fixed in macOS Sonoma 14.8.8 and macOS Tahoe 26.6.

Critical· 9.8<1% likelyfix available

published 3d agodeletes in 28d

CVE-2026-55579

Pheditor, a PHP-based single-file editor, shipped versions 2.0.1 through 2.0.5 with a hard‑coded default password of "admin". Because there is no forced password change on first login, any installation using these versions can be accessed by anyone who knows the default credentials.

Critical· 9.8<1% likelyfix available

published 3d agodeletes in 27d

CVE-2026-48030

Pheditor, a PHP‑based file manager, had a critical OS command injection flaw that let authenticated users run any shell command. The bug existed in versions 2.0.1 through 2.0.3 and was fixed in version 2.0.4.

Critical· 9.92% likelyfix available

published 3d agodeletes in 27d

CVE-2026-17552

This vulnerability allows attackers to trick the web application into sending requests to arbitrary hosts by manipulating the request URI. By doing so, an attacker can cause the server to fetch content from internal or restricted systems. The flaw is present in older versions of Plack::App::Prerender before 0.3.0.

Critical· 9.1<1% likelyfix available

published 3d agodeletes in 28d