1 mentions in 7 days · 2 in 30 days · 2 total · first seen · last
CUPS 2.4.20 will ship multiple security fixes under a revised disclosure policy.
CUPS maintainer Zdenek Dohnal said the upcoming 2.4.20 release contains multiple security fixes. Because of report volume and CVE assignment delays, flaws scoring above CVSS 7.0 will be embargoed, while lower-scoring issues will be fixed and published immediately under GHSA identifiers. The message names no CVE IDs and does not report exploitation.
Apple's September 2026 updates patch 45+ flaws, including a 9.8 Screen Sharing authentication bypass (CVE-2026-65400) already listed in CISA's KEV.
ZDI's review of Apple's September 2026 security updates catalogs dozens of CVEs across macOS, iOS, iPadOS, watchOS and other platforms. CVE-2026-65400 (CVSS 9.8) lets a network attacker authenticate to Screen Sharing Server without valid credentials and is flagged as KEV, while CVE-2026-65414 (CVSS 9.8) enables remote code execution via Bluetooth. The set also includes 8.8-rated memory corruption flaws in WebKit, WebRTC, CUPS, ImageIO and the kernel, plus sandbox escapes, privilege escalations to root, and arbitrary code execution via crafted files.