Calysteon

**Name of the Vulnerable Software and Affected Versions** Safari versions prior to 26.5.2 iOS versions prior to 26.5.2 iPadOS versions prior to 26.5.2 macOS Tahoe versions prior to 26.5.2 **Description** Processing maliciously crafted web content may result in the disclosure of process memory due to improper memory handling. **Recommendations** Update Safari to version 26.5.2. Update iOS to version 26.5.2. Update iPadOS to version 26.5.2. Update macOS Tahoe to version 26.5.2.

**Name of the Vulnerable Software and Affected Versions** Safari versions prior to 26.5.2 iOS versions prior to 26.5.2 iPadOS versions prior to 26.5.2 macOS Tahoe versions prior to 26.5.2 **Description** A use-after-free issue, which occurs when a program continues to use a pointer after it has been freed, was addressed with improved memory management. Processing maliciously crafted web content may lead to an unexpected process crash. **Recommendations** Update Safari to version 26.5.2. Update iOS to version 26.5.2. Update iPadOS to version 26.5.2. Update macOS Tahoe to version 26.5.2.

**Name of the Vulnerable Software and Affected Versions** Google Chrome on Mac versions prior to 148.0.7778.168 **Description** A heap buffer overflow in ANGLE allows a remote attacker to potentially perform a sandbox escape by using a crafted HTML page. A heap buffer overflow occurs when a program writes more data to a buffer allocated on the heap than it can hold, potentially leading to memory corruption. **Recommendations** Update to version 148.0.7778.168 or later.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 18.7.9 iOS versions prior to 26.5 iPadOS versions prior to 18.7.9 iPadOS versions prior to 26.5 macOS Sequoia versions prior to 15.7.7 macOS Sonoma versions prior to 14.8.7 macOS Tahoe versions prior to 26.5 tvOS versions prior to 26.5 visionOS versions prior to 26.5 watchOS versions prior to 26.5 **Description** An app may be able to disclose kernel memory due to improper memory handling. **Recommendations** Update iOS to version 18.7.9 or 26.5. Update iPadOS to version 18.7.9 or 26.5. Update macOS Sequoia to version 15.7.7. Update macOS Sonoma to version 14.8.7. Update macOS Tahoe to version 26.5. Update tvOS to version 26.5. Update visionOS to version 26.5. Update watchOS to version 26.5.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 26.5 iPadOS versions prior to 26.5 macOS Tahoe versions prior to 26.5 tvOS versions prior to 26.5 visionOS versions prior to 26.5 watchOS versions prior to 26.5 **Description** Processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling. **Recommendations** Update iOS to version 26.5. Update iPadOS to version 26.5. Update macOS Tahoe to version 26.5. Update tvOS to version 26.5. Update visionOS to version 26.5. Update watchOS to version 26.5.

**Name of the Vulnerable Software and Affected Versions** Zlib versions prior to the patched version. **Description** A buffer overflow issue exists in the Zlib::GzipReader component. The vulnerability could potentially allow for unexpected behavior. **Recommendations** Update to the patched version to resolve this issue.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to Tahoe 26.3 iOS versions prior to 18.7.5 iPadOS versions prior to 18.7.5 visionOS versions prior to 26.3 Safari versions prior to 26.3 **Description** The issue involves improved memory handling. A remote attacker may be able to cause a denial-of-service. **Recommendations** Update macOS to version Tahoe 26.3. Update iOS to version 18.7.5. Update iPadOS to version 18.7.5. Update visionOS to version 26.3. Update Safari to version 26.3.

**Name of the Vulnerable Software and Affected Versions** Xcode version 26 **Description** Processing an overly large path value may crash a process. This issue is fixed with improved checks. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Xcode versions prior to 26 **Description** A path handling issue was addressed with improved validation. Processing an overly large path value may crash a process. **Recommendations** Update to Xcode version 26.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to Sequoia 15.7 macOS versions prior to Sonoma 14.8 macOS versions prior to Tahoe 26 **Description** The issue was addressed with improved bounds checks. Processing a maliciously crafted string may lead to heap corruption. **Recommendations** Update to macOS Sequoia 15.7 or later. Update to macOS Sonoma 14.8 or later. Update to macOS Tahoe 26 or later.

**Name of the Vulnerable Software and Affected Versions** macOS Sequoia versions prior to 15.7 macOS Sonoma versions prior to 14.8 macOS Tahoe versions prior to 26 iOS versions prior to 18.7 iPadOS versions prior to 18.7 **Description** A denial-of-service issue was addressed with improved validation. An app may be able to cause a denial-of-service. **Recommendations** Update macOS to version 15.7 or later. Update macOS to version 14.8 or later. Update macOS to version 26 or later. Update iOS to version 18.7 or later. Update iPadOS to version 18.7 or later.

**Name of the Vulnerable Software and Affected Versions** macOS Sequoia versions prior to 15.7 macOS Sonoma versions prior to 14.8 macOS Tahoe versions prior to 26 iOS versions prior to 18.7 iPadOS versions prior to 18.7 **Description** A denial-of-service issue was addressed with improved validation. An app may be able to cause a denial-of-service. **Recommendations** Update macOS to version 15.7 or later. Update macOS to version 14.8 or later. Update macOS to version 26 or later. Update iOS to version 18.7 or later. Update iPadOS to version 18.7 or later.

Name of the Vulnerable Software and Affected Versions: Job Iteration API versions prior to 1.11.0 Description: The Job Iteration API, an extension for ActiveJob, has an arbitrary code execution issue in the `CsvEnumerator` class. Exploitation of this issue can lead to unauthorized access, data leakage, or complete system compromise. The issue is fixed in versions 1.11.0 and above. Users should avoid using untrusted input in the `CsvEnumerator` class and ensure that any file paths are properly sanitized and validated before being passed to the class methods. Users should avoid using the `count of rows in file` method with untrusted CSV filenames. Recommendations: Update to Job Iteration API version 1.11.0 or later. Avoid using the `count of rows in file` method with untrusted CSV filenames. Ensure that any file paths are properly sanitized and validated before being passed to the `CsvEnumerator` class methods. Avoid using untrusted input in the `CsvEnumerator` class.