CVE-2025-24165
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventur
CVSS
5.5
Medio
EPSS
0.1%
p2
KEV
—
Exploit Today
1
0-100
Publicado: 11 jun 2026 · Última mod.: 7 oct 2026 · CWE-284
0.1%EPSS · 30 días0.1%
2026-10-052026-11-02
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to cause unexpected system termination.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1214167.1 ALT—
———SurrealDB 2.0.0 before 3.3.1 does not enforce --deny-funcs restrictions on method-style function calls in the streaming engine, because MethodPart::evaluate invokes resolved functions without a capability check. Authenticated users who can submit queries can run denied functions via method syntax, e.g. [1,2].map() or $f.put()/$f.get() to write and read file bucket data despite file::* denials.4hCVE-2026-169007.5 ALT—
——0Zohocorp ManageEngine Log360 and EventLog Analyzer versions 13071 and below are vulnerable to an authentication bypass in local collector registration, allowing unauthenticated actor to register a local collector by sending a specially crafted registration request.4hCVE-2026-135949.1 CRÍ—
——0Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an issue that could allow an adversary to gain unauthorized access to the product.4hCVE-2026-1205033.3 BAJ—
——0A vulnerability was detected in EchoHS GeekezBrowser up to 1.7.2/1.8.0. This affects an unknown part of the file /api/status of the component Public API. The manipulation results in information disclosure. The attack requires a local approach. The exploit is now public and may be used. Upgrading to version 1.8.1 is able to mitigate this issue. The patch is identified as 9317a89aa0fd2715d9c2bd27bdbb52b5d228dd9e. Upgrading the affected component is recommended.22hCVE-2026-285888.4 ALT—
——0In shouldBlockDirectoryFromTree of ExternalStorageProvider.java, there is a possible way to access protected data due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.5hCVE-2026-00538.4 ALT—
——0In multiple locations, there is a possible method for a primary user to disable secure nfc on other full users due to insufficient isolation between Android users. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.2h