Missing authentication on the API Command Endpoint in 0x4m4's HexStrike AI (hexstrike_server.py) allows any remote, unauthenticated caller to invoke server-side API commands without presenting credentials. All commits through d689933ff579 in the hexstrike-ai repository are affected; the project uses rolling releases with no discrete versioning, and the maintainer has not responded to the responsible disclosure filed in GitHub issue #223. A public exploit has been disclosed (CVSS 4.0 E:P), lowering the bar for exploitation to any HTTP client with network reach to the exposed server.
SQL injection in Yot CMS 3.3.x via the Login function in global.php allows remote unauthenticated attackers to supply crafted SQL payloads through the yot3_user and yot3_pass cookie values, bypassing authentication and forging administrator sessions. The researcher-published GitHub PoC (by dddwmr) explicitly demonstrates full admin session forgery as the end result, making the assigned CVSS 5.5 score a material understatement of actual impact. Publicly available exploit code exists; no CISA KEV listing was confirmed at time of analysis.
Unexpected system termination can be triggered on Apple devices by a locally executed app that exploits a use-after-free memory corruption in shared system code, which Apple addressed through improved memory management. The flaw affects essentially every current Apple OS branch below the fixed releases — iOS/iPadOS 26.6+, macOS 15.8/26.6+/27, tvOS 26.6+/27, visionOS 26.6+/27 and watchOS 26.6+/27 — with CVSS 5.5 reflecting an availability-only impact and a local attack vector. EPSS is low (0.24%, 16th percentile), no public exploit code has been identified, and there is no CISA KEV entry, so this is a routine patch-cycle item rather than an urgent threat.
A buffer overflow in multiple Apple operating systems — iOS 18.7.10, iPadOS 18.7.10, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.7.8, and macOS Sonoma 14.8.8 and earlier — allows a locally executing app to crash the affected system or process, producing a denial of service. The flaw stems from insufficient bounds checking (CWE-120) and is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N, availability-only impact), meaning an attacker must already have the ability to run code as a low-privileged app on the device. Apple has released patches and there is no CISA KEV listing, no public exploit code identified, and EPSS is low at 0.21% (12th percentile), so real-world exploitation pressure is currently minimal.
Apple fixed a kernel uninitialized-memory flaw (CWE-457) across iOS/iPadOS, macOS, tvOS, visionOS, and watchOS in which a locally installed app can determine kernel memory layout, defeating address-space randomization. The impact is information disclosure only - high confidentiality, no integrity or availability impact - and exploitation requires a local app plus user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R, 5.5). Apple shipped patches on [dates not specified] for iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27; no public exploit code or active exploitation is indicated, and EPSS is low (0.21%, 11th percentile).
An out-of-bounds write in Apple's operating system kernel (CWE-787) allows a locally installed app to corrupt kernel memory or force an unexpected system termination, affecting iOS/iPadOS, macOS, tvOS, visionOS, and watchOS. Apple fixed the flaw with improved bounds checking in iOS 26.7 and 27, iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27. Exploitation requires a local app (CVSS PR:L) with no user interaction, so real-world risk is currently low - EPSS is only 0.21% (11th percentile), the issue is not listed in CISA KEV, and no public exploit code has been identified.
A use-after-free (CWE-416) in Apple's memory management code allows a locally running application on iOS, iPadOS, macOS, tvOS, visionOS and watchOS to crash the affected system, producing an unexpected termination or reboot. The flaw affects all platforms before the fixed releases (iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27) and rates CVSS 5.5 (AV:L/PR:L/UI:N, availability-only impact). No public exploit code or active exploitation has been identified, and EPSS is low at 0.21% (11th percentile), so this is a patched, availability-only issue rather than an urgent remote-code-execution threat.
An authorization flaw in Apple's operating systems lets a locally installed malicious app bypass Privacy preferences on affected iOS, iPadOS, and macOS builds. Apple addressed the issue through improved state management in iOS 18.7.10, iPadOS 18.7.10, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.7.8, and macOS Sonoma 14.8.8. The CVSS 3.1 base score is 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N), EPSS is 0.21% (11th percentile), there is no CISA KEV listing and no public exploit code identified at the time of analysis.
Information disclosure in Apple's iOS, iPadOS, macOS, tvOS and watchOS platforms allows an app running on the device to reach sensitive user data that the operating system's data protection mechanisms were supposed to keep isolated from it. Apple resolved the issue with improved data protection in iOS and iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27 and watchOS 27, with vendor advisories published across seven support pages. No public exploit code or active exploitation has been reported, EPSS is low at 0.20% (10th percentile), and the issue is not listed in CISA KEV, so this reads as a routine hardening fix rather than an urgent emergency-patch event.
Improper authorization checks in Apple's headphone motion data handling allow a locally installed app to read motion sensor data from connected headphones without prompting the user for consent, affecting iOS/iPadOS 26.7 and 27 and earlier, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27 and watchOS 27 and earlier. Exploitation requires a malicious or compromised app and user interaction, and the impact is limited to confidentiality of headphone sensor data (CVSS 5.5, C:H/I:N/A:N). Apple has shipped fixes in all affected operating systems; EPSS is low (0.20%, 10th percentile), there is no CISA KEV listing and no public exploit code identified at time of analysis.
Improper access control in Apple's operating system family (iOS/iPadOS, macOS, tvOS, visionOS, watchOS) lets a locally installed app bypass intended permission restrictions and read sensitive user data it should not be able to reach. Apple addressed the flaw with additional restrictions in iOS 26.7/iPadOS 26.7, iOS 27/iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27. Exploitation requires the attacker to already run code on the device as an app (PR:L, AV:L), and no public exploit code or active exploitation has been identified; EPSS is only 0.20% (10th percentile) and CISA SSVC records exploitation as 'none'.
A path validation weakness in Apple's iOS, iPadOS, and macOS allows a malicious application to reach files outside its intended sandbox and read user-sensitive data. Apple addressed the flaw with improved path validation in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, and macOS Sequoia 15.8, so all older releases remain exposed until updated. Exploitation requires a locally installed app and some user interaction (CVSS AV:L/UI:R), exploit probability is currently very low (EPSS 0.20%, 10th percentile), and no public exploit code or CISA KEV entry has been identified at time of analysis.
Improper memory handling in Apple iOS, iPadOS, and macOS lets a locally running application trigger an unexpected system termination, crashing the device or the operating system; affected versions are iOS/iPadOS prior to 26.7 or 27, and macOS prior to Golden Gate 27, Sequoia 15.8, and Tahoe 26.7. The only prerequisite is the ability to run a malicious or malformed app on the target device (local access, PR:L, no user interaction and no network reachability), and the demonstrated impact is limited to availability - no code execution, privilege escalation, or data access. No public exploit identified at time of analysis, no evidence of active exploitation (not in CISA KEV), EPSS is 0.20% (10th percentile), and vendor patches have been released.
Integer overflow (CWE-190) in macOS allows a locally present application to crash an affected component or the operating system, producing a denial-of-service condition rather than code execution or data theft. Apple fixed the flaw with improved input validation in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27 per advisories 149035, 149042 and 149043. Exploitation requires a malicious app to be running on the target Mac and the user to interact with it (AV:L/UI:R); no public exploit code has been identified and EPSS is only 0.19% (9th percentile), so this is a routine patch-cycle item rather than an urgent one.
Local directory-path traversal in Apple macOS allows an app already running on the host to reach and read sensitive user data outside the directory it is permitted to access. The root cause is insufficient validation of directory paths (CWE-22), and Apple has remediated it in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27. Exploitation requires the attacker to already have code running as a low-privileged local application (AV:L, PR:L) with no user interaction, and no public exploit code has been identified at time of analysis; with an EPSS score of 0.19% (9th percentile) and no CISA KEV listing, this is a genuine but low-to-moderate priority issue rather than an urgent one.
Local applications on Apple macOS can trigger an integer overflow that terminates the system unexpectedly, affecting macOS versions prior to Golden Gate 27, Sequoia 15.8, and Tahoe 26.7. The flaw is a local, low-privilege availability issue (CVSS 5.5, AV:L/PR:L/A:H) with no confidentiality or integrity impact, and it has been fixed by Apple in the referenced security advisories. Exploitation probability is low (EPSS 0.19%, 9th percentile), there is no CISA KEV listing and no public exploit code identified at time of analysis, so this is a reliability/denial-of-service hardening issue rather than an active threat.
A use-after-free memory-management flaw affects Apple's operating system family prior to the 26.6 releases — iOS and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6 and watchOS 26.6 — and allows a locally installed app to trigger unexpected system termination (a denial-of-service condition). The vulnerability is rated CVSS 5.5 with a local attack vector, low complexity and low privileges required, but no confidentiality or integrity impact; EPSS is only 0.19 percent and there is no CISA KEV listing and no publicly available exploit code identified at time of analysis. Apple has shipped fixes in all four platform advisories, so the practical risk is concentrated on unpatched devices rather than on active exploitation.
A use-after-free in macOS memory management allows a locally running application to crash the operating system, resulting in unexpected termination and loss of unsaved work. The flaw affects macOS Tahoe before 26.6, macOS Sequoia before 15.7.8, and macOS Sonoma before 14.8.8, with exploitation requiring only low privileges (CVSS PR:L) and no additional user interaction. Apple has released fixes (patch available per vendor advisories), and although EPSS is very low at 0.19% (9th percentile) with no CISA KEV listing, no public exploit code identified at time of analysis, the flaw is a memory-safety bug that carries inherent risk of escalation beyond a simple denial of service.
Improper access control in Apple iOS and iPadOS, macOS Tahoe, and visionOS lets a locally installed app read user-sensitive data that it should not be able to reach. The flaw (CWE-284) stems from insufficient validation checks and is remediated in iOS/iPadOS 26.6, macOS Tahoe 26.6, and visionOS 26.6; the assessed vector (CVSS 5.5, AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) means exploitation requires the victim to install and launch a malicious app on an unpatched build, with no remote attack path and no integrity or availability impact. The attacker's app needs no special privileges, but there is no public exploit identified at time of analysis and EPSS is low at 0.19% (9th percentile), so this is a genuine but low-priority confidentiality issue.
Apple macOS contains an improper access-control logic flaw in state management that allows a locally running app to read protected user data outside of its intended permission scope. The issue affects macOS Sequoia, macOS Tahoe and the macOS 27 (Golden Gate) line prior to the fixed releases, and is remediated in macOS Sequoia 15.8, macOS Tahoe 26.7 and macOS Golden Gate 27. The CVSS vector (AV:L/AC:L/PR:N/UI:R, C:H/I:N/A:N) shows this is a local, confidentiality-only issue requiring a user to launch or open the malicious app, with no public exploit identified at time of analysis and a low EPSS score of 0.18% (8th percentile) — real-world exploitation pressure is currently minimal.
Information disclosure in Apple iOS, iPadOS, macOS, tvOS, visionOS and watchOS allows a locally installed and running app to read a persistent account identifier that the operating system should have kept out of its reach. The root cause is a permissions/sandbox restriction gap (CWE-200), fixed by Apple with additional access restrictions in iOS and iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27; successful exploitation requires the user to install and launch a malicious local app (AV:L/PR:N/UI:R), so a remote, unauthenticated network attack is not possible. There is no public exploit identified at time of analysis and EPSS is 0.18% (8th percentile), making this low-to-moderate risk rather than an urgent priority, with impact confined to the confidentiality of one identifier and no integrity or availability effect.
Gatekeeper protection in Apple macOS can be bypassed by a malicious application, allowing unsigned or unnotarized code to launch on unpatched Macs. The flaw is a state-management logic error in the Gatekeeper check, rated CVSS 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N): exploitation is local and requires the victim to download and open an attacker-controlled app, so it depends on user interaction rather than a remote network path, and it yields no confidentiality or availability impact by itself - it must be chained with a malicious payload. Affected systems are macOS versions below Golden Gate 27, Sequoia 15.8, and Tahoe 26.7; there is no public exploit identified at time of analysis, EPSS is low at 0.18% (8th percentile), and no CISA KEV entry exists.
Sensitive user data disclosure in Apple iOS and related platforms allows a locally installed malicious app to bypass entitlement checks and access protected data, affecting Safari before 27, iOS/iPadOS before 26.7 and 27, macOS before Golden Gate 27, and visionOS before 27. The flaw requires local app installation and user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R) and only impacts confidentiality (C:H) with no integrity or availability effect. No public exploit has been identified at time of analysis, and EPSS is 0.18% (7th percentile), indicating low exploitation likelihood.
Archive extraction on Apple platforms fails to properly validate path components, letting a maliciously crafted archive write files outside the intended destination directory. Affected systems include iOS and iPadOS before 26.7 (and before 27), macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate before 27, and visionOS before 27, with the flaw rated CVSS 5.5 (integrity-only, local vector with required user interaction). Apple has released patched versions for every affected platform; there is no CISA KEV listing and no public exploit code identified, and EPSS is only 0.18% (7th percentile), indicating low predicted exploitation activity.
Sensitive user data can be read by a malicious or compromised app on unpatched Apple devices because a logic-validation flaw lets the app cross its data-access boundary. Affected platforms are iOS and iPadOS before 26.7 and before 27, macOS before Sequoia 15.8, before Tahoe 26.7 and before Golden Gate 27, tvOS before 27, and visionOS before 27; the assessed vector (AV:L/AC:L/PR:N/UI:R/C:H/I:N/A:N) shows the attacker must first get a hostile app onto the device and the user must run it, with confidentiality-only impact. Vendor patches are available for every platform, EPSS rates exploitation probability at roughly 0.18% (7th percentile), and no public exploit has been identified at time of analysis.
Improper path validation in Apple macOS allows a locally executing application to read files outside the scope it is authorized to access, resulting in disclosure of restricted data on affected systems. The issue affects macOS versions before 15.8 (Sequoia), before 26.7 (Tahoe), and before 27 (Golden Gate), and is rated CVSS 5.5 with confidentiality-only impact (C:H/I:N/A:N); exploitation requires a malicious or compromised app to be running locally and relies on user interaction (AV:L/UI:R, PR:N). No public exploit code has been identified at time of analysis and the vulnerability is not in CISA KEV; EPSS is low at 0.18% (7th percentile), and vendor-released fixes are available in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27.
A use-after-free memory-management flaw in Apple's operating systems allows a locally installed application to crash the system, causing unexpected termination (denial of service) on affected iPhone, iPad, Mac, and Apple Vision Pro devices. Apple addressed the issue across iOS 26.7/iPadOS 26.7, iOS 27/iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, and visionOS 27. There is no evidence of active exploitation: CISA KEV does not list the CVE, SSVC records exploitation as 'none' and automatable as 'no', EPSS is a low 0.18% (7th percentile), and no public exploit code has been identified at the time of analysis.
A use-after-free memory management flaw in Apple iOS and iPadOS allows a locally installed application to crash the system, causing unexpected device termination (denial of service). All versions prior to iOS 27 / iPadOS 27 are affected per the vendor CPE wildcard and ENISA EUVD version range (0 < 27). Apple addressed the issue with improved memory management in iOS 27 and iPadOS 27; no public exploit code has been identified and the EPSS probability is very low (0.17%, 7th percentile), so this is primarily a stability/patch-hygiene issue rather than an active exploitation threat.
Information disclosure in Apple iOS and iPadOS versions before 27 allows a locally installed malicious or compromised app to access sensitive user data after the user installs and opens it. The flaw is a permissions issue (CWE-200) that Apple addressed with additional restrictions in iOS 27 and iPadOS 27. No public exploit identified at time of analysis and EPSS is 0.17% (7th percentile), but the CVSS score of 5.5 reflects the high confidentiality impact; exploitation requires local app execution and user interaction, with no remote path.
Persistent device identifier disclosure in Apple iOS, iPadOS, macOS, tvOS, visionOS and watchOS stems from an incorrect authorization check that lets an ordinary, unprivileged installed app read identifiers it should not be able to access (CWE-863, CVSS 5.5, C:H/I:N/A:N). Exploitation is local-only (AV:L, PR:N) and requires user interaction to install and launch a malicious or compromised application on a device running an unpatched OS; there is no remote or network path, and no public exploit code has been identified at time of analysis, with EPSS at 0.17% (7th percentile) and no CISA KEV listing. Apple has released fixed versions and the impact is confined to confidentiality/privacy rather than code execution or data modification.
A malicious app already running locally on macOS versions prior to Golden Gate 27 can bypass the clickjacking protections that normally guard secure system prompts, allowing a user who interacts with a manipulated dialog to approve an action the operating system intended to require explicit, deliberate consent. Impact is limited to local integrity (C:N/I:H/A:N per CVSS:3.1/AV:L/AC:L/PR:N/UI:R) - no confidentiality or availability loss, and the attacker needs both prior app execution and victim interaction with the prompt. No public exploit code or confirmed active exploitation has been identified, and EPSS is low at 0.17% (7th percentile); a vendor patch is available in macOS Golden Gate 27.
Improper access control (CWE-284) in Apple iOS, iPadOS, and macOS allows a locally installed app to read user-sensitive data outside the permission boundary the operating system is supposed to enforce, an information-disclosure impact rated CVSS 5.5 (confidentiality High, integrity None, availability None). Exploitation is local and requires user interaction: the attacker must first get a malicious or compromised app onto the device and convince the user to launch it (AV:L, PR:N, UI:R), so there is no remote, network-triggerable, or self-propagating path. Apple has released fixes in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27; no public exploit code has been identified at time of analysis and EPSS is low at 0.17 percent (7th percentile), with no CISA KEV listing.
Incorrect authorization handling in Apple's iOS, iPadOS, macOS, and tvOS lets a locally installed app reach sensitive user data that should be fenced off by the platform's state and sandbox checks. The flaw is a local, low-privilege issue (CVSS 5.5, AV:L/PR:L) requiring a malicious or compromised app already running on the device — no network vector and no user interaction beyond launching the app. Apple has shipped fixes in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, and tvOS 27; EPSS is very low (0.17%, 6th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis.
A path-validation weakness in Apple macOS lets a malicious application read files outside its permitted scope, exposing restricted data to an app that should not be able to reach it. Exploitation requires local conditions: the attacker must deliver a crafted application to the Mac and convince the user to launch it (CVSS:3.1/AV:L/AC:L/PR:N/UI:R), after which the app can achieve high confidentiality impact but cannot modify data or cause a denial of service. The issue is fixed in macOS Tahoe 26.7, macOS Sequoia 15.8, and macOS Golden Gate 27; there is confirmed actively exploited escalation is not indicated - no public exploit code has been identified at time of analysis and EPSS is low (0.17%, 6th percentile), making this a moderate-severity local information-disclosure flaw rather than an urgent priority, though the upstream fix should still be applied on any unpatched Mac.
A malicious or compromised app running on iOS and iPadOS prior to 26.7 (and prior to 27), and on visionOS prior to 27, can abuse insufficient path validation to write to protected parts of the file system. Apple addressed the path handling flaw with improved validation in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, and visionOS 27, so patched devices are not exposed. Scoring 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N), the issue requires the user to install and launch a hostile app but then needs no additional privileges; EPSS is only 0.17% (6th percentile) and no public exploit code or confirmed active exploitation has been identified at time of analysis, so this is a moderate local-integrity flaw rather than a network-exploitable emergency.
Authorization bypass in Apple macOS allows a locally-running app to read sensitive user data without the user's consent, affecting macOS versions below Sequoia 15.8, below Tahoe 26.7, and below Golden Gate 27. Exploitation requires an attacker to first get a malicious or compromised application onto the machine and running under a standard, non-administrative user account (CVSS 3.1 AV:L/PR:L/UI:N), so this is not remotely reachable and no user interaction is needed once that app executes. Impact is limited to confidentiality of user data (C:H, I:N, A:N) - there is no code execution, privilege escalation, or system modification, and the EPSS score of 0.17% (6th percentile) plus the absence of KEV listing indicate no public exploit identified at time of analysis; Apple has released patched builds.
Sandboxed applications on Apple iOS, iPadOS, macOS, and visionOS can bypass sandbox file-access restrictions and read restricted files because of insufficient path validation in the affected operating system components (CWE-22). Exploitation requires a local attacker to get a crafted sandboxed app installed and launched by the user on a vulnerable device (CVSS 3.1 AV:L/AC:L/PR:N/UI:R), making this a delivery-gated, confidentiality-only information-disclosure flaw rather than a remotely reachable one. Apple has shipped fixes in iOS 26.7 and 27, iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, and visionOS 27; no public exploit code has been identified at time of analysis, the EPSS score is only 0.17% (6th percentile), and the CVE is not listed in CISA KEV.
Local information disclosure in Apple macOS lets a malicious or compromised application read sensitive user data on hosts running versions earlier than macOS Sequoia 15.8, macOS Tahoe 26.7 or macOS Golden Gate 27. Apple fixed the issue with improved checks in three separate security advisories covering each release train. Exploitation requires the attacker to get an app running on the target Mac with user-level privileges; no public exploit code has been identified at time of analysis and EPSS is 0.17% (6th percentile), so this is a low-volume, targeted local threat rather than a mass-exploitation event.
A type confusion flaw (CWE-843) in memory handling across Apple's current operating system family lets a malicious app crash the affected device or component, producing a local denial of service. Exploitation requires the victim to install and launch a crafted app — the CVSS vector is AV:L/PR:N/UI:R with availability-only impact, so there is no remote unauthenticated path and no confidentiality or integrity loss. Apple has shipped fixes in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7 and macOS Golden Gate 27, plus tvOS 27, visionOS 27 and watchOS 27; EPSS is only 0.17% (6th percentile) and there is no public exploit identified at time of analysis, so this is a routine patch-cycle item rather than an urgent exposure.
A sandboxed application running on Apple iOS/iPadOS, macOS Golden Gate, tvOS, visionOS, or watchOS can bypass authorization checks and read contents of the System Keychain, exposing stored secrets such as credentials, certificates, and tokens. The flaw stems from incorrect authorization combined with faulty state management (CWE-863) and affects all versions prior to the 27 release train; the platform owner has shipped fixes in iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27. The CVSS v3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, score 5.5) is consistent with our independent assessment: this is a genuine but locally-scoped access-control defect that requires an attacker to get a sandboxed app onto the device and have the user launch it (UI:R), so it cannot be triggered remotely over the network. EPSS is 0.16% (6th percentile) and no public exploit code has been identified at time of analysis, with no CISA KEV listing - impact is limited to confidentiality (keychain disclosure) with no integrity or availability effect, and patched 27-or-newer systems are not exposed.
A permissions-validation flaw (CWE-863) in Apple macOS versions prior to 27 (Golden Gate) and Xcode versions prior to 27 allows a locally installed app to reach user-sensitive data it should not be authorized to read. The issue is a local, confidentiality-only defect rated CVSS 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N): no privileges are needed, but the attack requires the victim to run the malicious application. Apple has released fixes in macOS 27 and Xcode 27; there is no CISA KEV listing, no public exploit code identified at time of analysis, and EPSS is very low at 0.16% (5th percentile), so real-world exploitation is unlikely to be widespread.
An improper access-control flaw in Apple macOS allows a locally running application to bypass authorization checks and read sensitive user data it should not be able to reach, with the fix delivered in macOS Sequoia 15.8 and macOS Golden Gate 27. Exploitation is local only and requires user interaction (the victim must launch the malicious or trojanized app), so the CVSS impact is limited to confidentiality (5.5 Medium). EPSS is negligible at 0.16% (5th percentile), there is no CISA KEV listing and no public exploit code identified at time of analysis, making this a routine update rather than an emergency patch.
A malicious application running on Apple macOS (versions prior to 27) or watchOS (versions prior to 27) can leak sensitive user information because the operating system fails to properly manage internal state. Apple addressed the flaw in macOS Golden Gate 27 and watchOS 27, so all earlier releases on both platforms remain exposed. The issue is rated CVSS 5.5 (local vector, low privileges, high confidentiality impact), EPSS is only 0.16% (5th percentile), and there is no public exploit code identified at time of analysis.
A local race condition (CWE-362) in Apple macOS allows any locally running application to trigger unexpected system termination on affected hosts. The flaw affects macOS versions prior to Tahoe 26.7 and Golden Gate 27, is availability-only (C:N/I:N/A:H), and requires local app execution with no user interaction and no privilege escalation. Apple has released fixed versions; there is no public exploit identified, no CISA KEV listing, and EPSS is only 0.16% (5th percentile), indicating low real-world exploitation pressure.
An out-of-bounds read in Apple's kernel, fixed across iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27, allows a locally installed application to disclose kernel memory to user space. The flaw (CWE-125) stems from insufficient input validation in a kernel code path reached by app-supplied data, and yields high confidentiality impact only - no integrity or availability loss. Apple has released patches for all affected platforms; EPSS is very low (0.15%, 5th percentile), and there is no public exploit code or CISA KEV listing at time of analysis.
Local information disclosure in Apple iOS and iPadOS (and visionOS) before version 27 allows an app running on the device to read sensitive user data it should not be able to reach. Apple fixed the flaw through improved file handling in iOS 27, iPadOS 27 and visionOS 27. No public exploit code or active exploitation has been reported, and the EPSS score of 0.15% (5th percentile) plus SSVC 'exploitation: none' point to a low-volume, user-assisted local attack rather than a mass-exploited one.
An improper authorization flaw in Apple iOS/iPadOS and macOS Tahoe allows a locally installed application to reach sensitive user data that the platform's authorization state checks should have blocked. Apple addressed the flaw through improved state management, shipping fixes in iOS 26.6, iPadOS 26.6, and macOS Tahoe 26.6 for all versions prior to those releases. The issue is local-only (CVSS:3.1/AV:L/AC:L/PR:L/UI:N, 5.5) with confidentiality impact only; EPSS is 0.15% (5th percentile), CISA SSVC rates exploitation as 'none' and technical impact as 'partial', and no public exploit code was identified at time of analysis.
Improper access control in Apple's Keychain service lets a locally installed app delete credentials stored by other applications on iOS 27, iPadOS 27, macOS Golden Gate 27, and visionOS 27 (all versions prior to these releases). The bug is fixed by removing the vulnerable code path; it is rated CVSS 5.5 with integrity-only impact, and there is no public exploit or CISA KEV confirmation at time of analysis (EPSS 0.15%).
Improper state management in Apple macOS (all versions prior to macOS 27 "Golden Gate") lets a locally installed application reach sensitive user data that normal macOS privacy and access controls are supposed to protect. The attack is local and needs the victim to launch the malicious app (AV:L, UI:R, PR:N), and the impact is confidentiality-only (C:H/I:N/A:N), which yields a moderate CVSS of 5.5. The issue is fixed in macOS 27 per Apple's advisory, EPSS is very low (0.14%, 3rd percentile), there is no CISA KEV listing, and no public exploit code has been identified.
A local denial-of-service flaw in SSSD (System Security Services Daemon) lets an attacker who can connect to the PAM responder socket crash the responder by sending a crafted protocol request that omits the service item while the pam_app_services option is enabled, triggering a NULL pointer dereference. Only availability is affected (CVSS 5.5, C:N/I:N/A:H), but a crash of the PAM responder disrupts authentication on the host until the service is restarted. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV; EPSS data was not provided in the source feeds.