CVE-2025-14979

HighCVSS 7.8/10Last modified Oct 7, 2026

Description

AirVPN Eddie on MacOS contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root.This issue affects Eddie: 2.24.6.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-732

Affected software

No affected versions have been published.

Timeline

Published: Jan 6, 2026
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-149806.5The BetterDocs plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.3 via the scri CVE-2025-149824.3The Booking Calendar plugin for WordPress is vulnerable to Missing Authorization leading to Sensitive Information Exposure in all versions u CVE-2025-149836.4The Advanced Custom Fields: Font Awesome Field plugin for WordPress is vulnerable to Cross-Site Scripting in all versions up to, and includi CVE-2025-149846.4The Gutenverse Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file upload in all versions up to, and includi CVE-2025-149856.4The Alpha Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘alpha_block_css’ parameter in all versions up to CVE-2025-149861.3When frontend.enableExecuteMultiOperation is enabled, the server can apply namespace-scoped validation and feature gates for the embedded St CVE-2025-149875.3When system.enableCrossNamespaceCommands is enabled (on by default), the Temporal server permits certain workflow task commands (e.g. StartC CVE-2025-1498810.0A security issue has been identified in ibaPDA that could allow unauthorized actions on the file system under certain conditions. This may i CVE-2025-149899.8A vulnerability was identified in Campcodes Complete Online Beauty Parlor Management System 1.0. This issue affects some unknown processing CVE-2025-14996.5IBM InfoSphere Information Server 11.7 stores credential information for database authentication in a cleartext parameter file that could be CVE-2025-149909.8A security flaw has been discovered in Campcodes Complete Online Beauty Parlor Management System 1.0. Impacted is an unknown function of the CVE-2025-149914.8A weakness has been identified in Campcodes Complete Online Beauty Parlor Management System 1.0. The affected element is an unknown function