What’s Vulnerable › Vulnerabilities

CVE-2026-19755: NoSleep 1.5.1 - Unauthorized disclosure of root-owned files through privileged XPC helper

• Severity: medium (CVSS 6.9 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-20 · updated 2026-10-26
• Weakness: CWE-862

Description

NoSleep 1.5.1 exposes a privileged XPC Mach service and accepts raw dictionary messages containing attacker-controlled command and NSBundlePath values.This issue affects NoSleep: 1.5.1.

Affected products

• NoSleep: 1.5.1

References

• https://fluidattacks.com/advisories/iggy
• https://github.com/integralpro/nosleep/

Get alerted when CVE-2026-19755 or the next vulnerability affects your stack