medium · CVSS v3 5.5 · EPSS 0.00164

CVE-2026-84508

This issue was addressed with improved validation of the caller's access. This issue is fixed in iOS 27 and iPadOS 27, m…

Description

This issue was addressed with improved validation of the caller's access. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, visionOS 27. An app may be able to access protected user data.

Scores

Severity
medium
CVSS v2
4.6
CVSS v3
5.5
CVSS v4
—
EPSS
0.00164

← All CVEs

Related CVEs

medium

CVE-2026-96902

The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allowing unauthenticated users to read details a site has chosen to hide on published listings, such as the asking price, sold price, street address and exact map coordinates.

View analysis

medium

CVE-2026-8355

IBM ContextForge MCP Gateway contains a Server-Side Request Forgery (SSRF) vulnerability in the OAuth configuration handling. Authenticated users with gateway creation privileges can force the server to send HTTP POST requests to internal network resources or cloud metadata endpoints. This allows for potential data exfiltration and internal network reconnaissance.

View analysis

medium

CVE-2026-109441

LangAlpha versions through 2026.09.07 suffer from an improper isolation flaw where tenant sandbox containers share a default Docker bridge network. This configuration allows authenticated users to bypass workspace ownership checks and access other tenants' containers, potentially exposing sensitive data like vault secrets.

View analysis

medium

CVE-2026-28850

An authorization issue was addressed with improved state management. This issue is fixed in visionOS 27. An app may be able to access sensitive user data.

View analysis