First day on Intigriti: our agent harness found and proved a remote code execution bug, paid €3,000.

CVE-2026-64790

HighCVSS 7.8/10Last modified Sep 16, 2026

Description

A path handling issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to gain elevated privileges.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published: Sep 14, 2026
Last modified: Sep 16, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-647918.8Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs Extension Manager - Administrator rou CVE-2026-647927.5Joomla Extension - regularlabs.com - disclosure of restricted content via search index in various Regular Labs extensions - Smart Search ind CVE-2026-647939.1Joomla Extension - regularlabs.com - Content access and publication bypass in Articles Anywhere and Modules Anywhere extensions - Content ta CVE-2026-647946.5Joomla Extension - regularlabs.com - restricted user-data exposure in Users Anywhere and Articles Anywhere extensions - User tags, filters a CVE-2026-647955.4Joomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs extensions - Tag-provided custom HTML, modul CVE-2026-647969.8Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension - Free did not require both the article creator a CVE-2026-647977.5Joomla Extension - regularlabs.com - IP spoofing vulnerability in IP login extension - IP Login trusted forwarded client-IP headers without CVE-2026-647989.1Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension - Persistent URL login keys were also generated using a n CVE-2026-647997.5Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions - Content-controlled CVE-2026-648005.7In JetBrains GoLand before 2026.2 sensitive configuration values written to log files by default CVE-2026-648027.8In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules integration CVE-2026-648037.8In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust via the configured Go SDK

CVE-2026-64790: High severity, CVSS 7.8 | Vulnix