Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2025-43504exploit | 4.9 medium | 0.00% | apple, xcode | A buffer overflow was addressed with improved bounds checking. This issue is fixed in Xcode 26.1. A user in a privileged network position may be able to cause a denial-of-service. | 18 Oct |
| CVE-2019-3855 | 8.8 high | 9.0% | libssh2, fedoraproject, fedora, debian_linux | An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server. | 14 Oct |
| CVE-2019-14379 | 9.8 critical | 8.0% | fasterxml, debian, jackson-databind, debian_linux, active_iq_unified_manager | SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution. | 8 Oct |
| CVE-2026-7416 | 5.5 medium | 2.0% | no CPE yet | A vulnerability was found in PolarVista xcode-mcp-server 1.0.0. This issue affects the function build_project/run_tests of the file src/index.ts of the component MCP Interface. The manipulation of the argument Request results in os command injection. The attack may be launched remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet. | Mon 26 Oct |
| CVE-2026-86949 | 8.8 high | 0.00% | no CPE yet | This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. A malicious app may be able to break out of its sandbox. | 21 Oct |
| CVE-2025-43505 | 8.8 high | 0.00% | apple, xcode | An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in Xcode 26.1. Processing a maliciously crafted file may lead to heap corruption. | 18 Oct |
| CVE-2026-86875 | 4.3 medium | 0.00% | no CPE yet | An input validation issue was addressed with improved input validation. This issue is fixed in Xcode 27. Parsing a maliciously crafted binary may lead to unexpected app termination. | 20 Oct |
| CVE-2026-86874 | 3.3 low | 0.00% | no CPE yet | An out-of-bounds read was addressed with improved input validation. This issue is fixed in Xcode 27. Parsing a maliciously crafted binary may lead to unexpected tool termination. | 20 Oct |
| CVE-2026-65393 | unscored | 0.00% | apple, xcode, macos | A permissions issue was addressed with improved validation. This issue is fixed in Xcode 27, macOS Golden Gate 27. An app may be able to access user-sensitive data. | Mon 26 Oct |
| CVE-2026-86948 | unscored | 0.00% | no CPE yet | This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. An app may be able to break out of its sandbox. | 21 Oct |
10 of 10
Download these 10 as CSV · subscribe to this list.
EPSS scores: 2026-10-28. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.