Logo
Retour à la veille

CVE-2026-84616

Publié : 14 septembre 2026
Modifié : 18 septembre 2026
Lien officiel NVD
Score CVSS
5.5
MEDIUM

Description détaillée

A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Références et Patchs

https://support.apple.com/en-us/149034https://support.apple.com/en-us/149035https://support.apple.com/en-us/149036https://support.apple.com/en-us/149037https://support.apple.com/en-us/149038https://support.apple.com/en-us/149041https://support.apple.com/en-us/149042https://support.apple.com/en-us/149043

Dernières Vulnérabilités

CVE-2026-93960

A vulnerability was identified in Pixelfed up to 0.12.11. Impacted is the function instancePeers of the file app/Http/Controllers/Api/ApiV1Controller.php of the component OAuth Scope Handler. Such manipulation of the argument ID leads to missing authentication. The attack may be performed from remote. The exploit is publicly available and might be used. Upgrading to version 0.12.10 is recommended to address this issue. The name of the patch is 68dca5097305fa0065d029587b2233524636025a. Upgrading the affected component is advised.

VOIR DÉTAILS

CVE-2026-86553

SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process. Using the acquired SmartLife application authentication parameters, an attacker can directly call the backend interface /account/verify.serv to obtain the real account ID corresponding to a registered email address. By spoofing the application authentication information together with the target account ID, the attacker can reset the password of the target account.

VOIR DÉTAILS

CVE-2026-86552

SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acquired SmartLife application authentication credentials, an attacker can directly complete registration using any arbitrary email address via the backend interface /account/person/signup.serv. Email ownership is not verified prior to registration.

VOIR DÉTAILS