Local directory-path traversal in Apple macOS allows an app already running on the host to reach and read sensitive user data outside the directory it is permitted to access. The root cause is insufficient validation of directory paths (CWE-22), and Apple has remediated it in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27. Exploitation requires the attacker to already have code running as a low-privileged local application (AV:L, PR:L) with no user interaction, and no public exploit code has been identified at time of analysis; with an EPSS score of 0.19% (9th percentile) and no CISA KEV listing, this is a genuine but low-to-moderate priority issue rather than an urgent one.
An incorrect authorization check in Apple macOS lets an application already running on a Mac read sensitive user data it should not be able to reach, an impact limited to confidentiality with no code execution, modification, or denial of service. Exploitation requires local code execution on the target (the assessed vector is AV:L/PR:L/UI:N), so it is only reachable by a malicious or attacker-controlled app already present on the device, and only on unpatched systems below macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27. Apple has released fixes in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27; no public exploit code or confirmed active exploitation has been identified, and EPSS is low at 0.19% (9th percentile), making this a moderate, locally-scoped risk rather than an urgent priority.
Local applications on Apple macOS can trigger an integer overflow that terminates the system unexpectedly, affecting macOS versions prior to Golden Gate 27, Sequoia 15.8, and Tahoe 26.7. The flaw is a local, low-privilege availability issue (CVSS 5.5, AV:L/PR:L/A:H) with no confidentiality or integrity impact, and it has been fixed by Apple in the referenced security advisories. Exploitation probability is low (EPSS 0.19%, 9th percentile), there is no CISA KEV listing and no public exploit code identified at time of analysis, so this is a reliability/denial-of-service hardening issue rather than an active threat.
Improper permission checks in macOS snapshot handling allow a locally installed app to read protected user data, an issue Apple resolved with stronger permissions logic in macOS Golden Gate 27. The flaw is a local access-control problem (CWE-284) that requires user interaction but no special privileges (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base score 5.5), and it carries a low EPSS of 0.19% (9th percentile). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation, so this is best treated as a moderate-severity confidentiality issue rather than an urgent priority.
A use-after-free memory-management flaw affects Apple's operating system family prior to the 26.6 releases — iOS and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6 and watchOS 26.6 — and allows a locally installed app to trigger unexpected system termination (a denial-of-service condition). The vulnerability is rated CVSS 5.5 with a local attack vector, low complexity and low privileges required, but no confidentiality or integrity impact; EPSS is only 0.19 percent and there is no CISA KEV listing and no publicly available exploit code identified at time of analysis. Apple has shipped fixes in all four platform advisories, so the practical risk is concentrated on unpatched devices rather than on active exploitation.
A use-after-free in macOS memory management allows a locally running application to crash the operating system, resulting in unexpected termination and loss of unsaved work. The flaw affects macOS Tahoe before 26.6, macOS Sequoia before 15.7.8, and macOS Sonoma before 14.8.8, with exploitation requiring only low privileges (CVSS PR:L) and no additional user interaction. Apple has released fixes (patch available per vendor advisories), and although EPSS is very low at 0.19% (9th percentile) with no CISA KEV listing, no public exploit code identified at time of analysis, the flaw is a memory-safety bug that carries inherent risk of escalation beyond a simple denial of service.
Improper access control in Apple iOS and iPadOS, macOS Tahoe, and visionOS lets a locally installed app read user-sensitive data that it should not be able to reach. The flaw (CWE-284) stems from insufficient validation checks and is remediated in iOS/iPadOS 26.6, macOS Tahoe 26.6, and visionOS 26.6; the assessed vector (CVSS 5.5, AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) means exploitation requires the victim to install and launch a malicious app on an unpatched build, with no remote attack path and no integrity or availability impact. The attacker's app needs no special privileges, but there is no public exploit identified at time of analysis and EPSS is low at 0.19% (9th percentile), so this is a genuine but low-priority confidentiality issue.
Apple macOS contains an improper access-control logic flaw in state management that allows a locally running app to read protected user data outside of its intended permission scope. The issue affects macOS Sequoia, macOS Tahoe and the macOS 27 (Golden Gate) line prior to the fixed releases, and is remediated in macOS Sequoia 15.8, macOS Tahoe 26.7 and macOS Golden Gate 27. The CVSS vector (AV:L/AC:L/PR:N/UI:R, C:H/I:N/A:N) shows this is a local, confidentiality-only issue requiring a user to launch or open the malicious app, with no public exploit identified at time of analysis and a low EPSS score of 0.18% (8th percentile) — real-world exploitation pressure is currently minimal.
Information disclosure in Apple iOS, iPadOS, macOS, tvOS, visionOS and watchOS allows a locally installed and running app to read a persistent account identifier that the operating system should have kept out of its reach. The root cause is a permissions/sandbox restriction gap (CWE-200), fixed by Apple with additional access restrictions in iOS and iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27; successful exploitation requires the user to install and launch a malicious local app (AV:L/PR:N/UI:R), so a remote, unauthenticated network attack is not possible. There is no public exploit identified at time of analysis and EPSS is 0.18% (8th percentile), making this low-to-moderate risk rather than an urgent priority, with impact confined to the confidentiality of one identifier and no integrity or availability effect.
Gatekeeper protection in Apple macOS can be bypassed by a malicious application, allowing unsigned or unnotarized code to launch on unpatched Macs. The flaw is a state-management logic error in the Gatekeeper check, rated CVSS 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N): exploitation is local and requires the victim to download and open an attacker-controlled app, so it depends on user interaction rather than a remote network path, and it yields no confidentiality or availability impact by itself - it must be chained with a malicious payload. Affected systems are macOS versions below Golden Gate 27, Sequoia 15.8, and Tahoe 26.7; there is no public exploit identified at time of analysis, EPSS is low at 0.18% (8th percentile), and no CISA KEV entry exists.
Sensitive user data disclosure in Apple iOS and related platforms allows a locally installed malicious app to bypass entitlement checks and access protected data, affecting Safari before 27, iOS/iPadOS before 26.7 and 27, macOS before Golden Gate 27, and visionOS before 27. The flaw requires local app installation and user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R) and only impacts confidentiality (C:H) with no integrity or availability effect. No public exploit has been identified at time of analysis, and EPSS is 0.18% (7th percentile), indicating low exploitation likelihood.
Archive extraction on Apple platforms fails to properly validate path components, letting a maliciously crafted archive write files outside the intended destination directory. Affected systems include iOS and iPadOS before 26.7 (and before 27), macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate before 27, and visionOS before 27, with the flaw rated CVSS 5.5 (integrity-only, local vector with required user interaction). Apple has released patched versions for every affected platform; there is no CISA KEV listing and no public exploit code identified, and EPSS is only 0.18% (7th percentile), indicating low predicted exploitation activity.
Sensitive user data can be read by a malicious or compromised app on unpatched Apple devices because a logic-validation flaw lets the app cross its data-access boundary. Affected platforms are iOS and iPadOS before 26.7 and before 27, macOS before Sequoia 15.8, before Tahoe 26.7 and before Golden Gate 27, tvOS before 27, and visionOS before 27; the assessed vector (AV:L/AC:L/PR:N/UI:R/C:H/I:N/A:N) shows the attacker must first get a hostile app onto the device and the user must run it, with confidentiality-only impact. Vendor patches are available for every platform, EPSS rates exploitation probability at roughly 0.18% (7th percentile), and no public exploit has been identified at time of analysis.
Improper path validation in Apple macOS allows a locally executing application to read files outside the scope it is authorized to access, resulting in disclosure of restricted data on affected systems. The issue affects macOS versions before 15.8 (Sequoia), before 26.7 (Tahoe), and before 27 (Golden Gate), and is rated CVSS 5.5 with confidentiality-only impact (C:H/I:N/A:N); exploitation requires a malicious or compromised app to be running locally and relies on user interaction (AV:L/UI:R, PR:N). No public exploit code has been identified at time of analysis and the vulnerability is not in CISA KEV; EPSS is low at 0.18% (7th percentile), and vendor-released fixes are available in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27.
A use-after-free memory-management flaw in Apple's operating systems allows a locally installed application to crash the system, causing unexpected termination (denial of service) on affected iPhone, iPad, Mac, and Apple Vision Pro devices. Apple addressed the issue across iOS 26.7/iPadOS 26.7, iOS 27/iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, and visionOS 27. There is no evidence of active exploitation: CISA KEV does not list the CVE, SSVC records exploitation as 'none' and automatable as 'no', EPSS is a low 0.18% (7th percentile), and no public exploit code has been identified at the time of analysis.
Local information disclosure in Apple macOS before Golden Gate 27 allows an installed app to bypass system pasteboard sandbox restrictions and read sensitive pasteboard data, resulting in confidentiality impact only. The flaw is not remotely exploitable; it requires attacker-controlled code already running locally, typically a malicious or compromised app that the user has installed and launched. Apple fixed it in macOS Golden Gate 27, and no public exploit was identified at time of analysis (EPSS 0.17%, CVSS 5.5 Medium).
Apps already running on macOS versions prior to Golden Gate 27 can modify Privacy (TCC) preferences they are not authorized to change, letting a malicious app grant itself access to consent-gated resources such as the camera, microphone, or other protected data without ever prompting the user. The root cause is an incorrect-authorization weakness (CWE-863) that Apple addressed by adding restrictions to the permission check, so exploitation is not remote: the attacker must first deliver and run code on the host (AV:L, PR:L, UI:N), making this primarily a post-compromise, integrity-only escalation of an app's privacy privileges (C:N/I:H/A:N). EPSS is only 0.17% (7th percentile), there is no CISA KEV entry and no public exploit identified at time of analysis, and a vendor-released fix exists in macOS Golden Gate 27.
A use-after-free memory management flaw in Apple iOS and iPadOS allows a locally installed application to crash the system, causing unexpected device termination (denial of service). All versions prior to iOS 27 / iPadOS 27 are affected per the vendor CPE wildcard and ENISA EUVD version range (0 < 27). Apple addressed the issue with improved memory management in iOS 27 and iPadOS 27; no public exploit code has been identified and the EPSS probability is very low (0.17%, 7th percentile), so this is primarily a stability/patch-hygiene issue rather than an active exploitation threat.
Information disclosure in Apple iOS and iPadOS versions before 27 allows a locally installed malicious or compromised app to access sensitive user data after the user installs and opens it. The flaw is a permissions issue (CWE-200) that Apple addressed with additional restrictions in iOS 27 and iPadOS 27. No public exploit identified at time of analysis and EPSS is 0.17% (7th percentile), but the CVSS score of 5.5 reflects the high confidentiality impact; exploitation requires local app execution and user interaction, with no remote path.
Persistent device identifier disclosure in Apple iOS, iPadOS, macOS, tvOS, visionOS and watchOS stems from an incorrect authorization check that lets an ordinary, unprivileged installed app read identifiers it should not be able to access (CWE-863, CVSS 5.5, C:H/I:N/A:N). Exploitation is local-only (AV:L, PR:N) and requires user interaction to install and launch a malicious or compromised application on a device running an unpatched OS; there is no remote or network path, and no public exploit code has been identified at time of analysis, with EPSS at 0.17% (7th percentile) and no CISA KEV listing. Apple has released fixed versions and the impact is confined to confidentiality/privacy rather than code execution or data modification.
A malicious app already running locally on macOS versions prior to Golden Gate 27 can bypass the clickjacking protections that normally guard secure system prompts, allowing a user who interacts with a manipulated dialog to approve an action the operating system intended to require explicit, deliberate consent. Impact is limited to local integrity (C:N/I:H/A:N per CVSS:3.1/AV:L/AC:L/PR:N/UI:R) - no confidentiality or availability loss, and the attacker needs both prior app execution and victim interaction with the prompt. No public exploit code or confirmed active exploitation has been identified, and EPSS is low at 0.17% (7th percentile); a vendor patch is available in macOS Golden Gate 27.
A local permission-assignment flaw in Apple's mobile and desktop operating systems lets an app installed on the device modify protected parts of the file system, giving it an integrity-only foothold outside its normal sandbox boundaries. Affected platforms are iOS and iPadOS before 26.7 and 27, and macOS before Golden Gate 27, Sequoia 15.8, and Tahoe 26.7; exploitation requires a locally-installed, running app plus user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N), with no confidentiality or availability impact and no remote or network reachability. There is no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV), and EPSS sits at 0.17% (7th percentile), so this is a moderate, not urgent, priority that is addressed by vendor-released updates.
Improper access control (CWE-284) in Apple iOS, iPadOS, and macOS allows a locally installed app to read user-sensitive data outside the permission boundary the operating system is supposed to enforce, an information-disclosure impact rated CVSS 5.5 (confidentiality High, integrity None, availability None). Exploitation is local and requires user interaction: the attacker must first get a malicious or compromised app onto the device and convince the user to launch it (AV:L, PR:N, UI:R), so there is no remote, network-triggerable, or self-propagating path. Apple has released fixes in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27; no public exploit code has been identified at time of analysis and EPSS is low at 0.17 percent (7th percentile), with no CISA KEV listing.
Incorrect authorization handling in Apple's iOS, iPadOS, macOS, and tvOS lets a locally installed app reach sensitive user data that should be fenced off by the platform's state and sandbox checks. The flaw is a local, low-privilege issue (CVSS 5.5, AV:L/PR:L) requiring a malicious or compromised app already running on the device — no network vector and no user interaction beyond launching the app. Apple has shipped fixes in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, and tvOS 27; EPSS is very low (0.17%, 6th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis.
A path-validation weakness in Apple macOS lets a malicious application read files outside its permitted scope, exposing restricted data to an app that should not be able to reach it. Exploitation requires local conditions: the attacker must deliver a crafted application to the Mac and convince the user to launch it (CVSS:3.1/AV:L/AC:L/PR:N/UI:R), after which the app can achieve high confidentiality impact but cannot modify data or cause a denial of service. The issue is fixed in macOS Tahoe 26.7, macOS Sequoia 15.8, and macOS Golden Gate 27; there is confirmed actively exploited escalation is not indicated - no public exploit code has been identified at time of analysis and EPSS is low (0.17%, 6th percentile), making this a moderate-severity local information-disclosure flaw rather than an urgent priority, though the upstream fix should still be applied on any unpatched Mac.
A malicious or compromised app running on iOS and iPadOS prior to 26.7 (and prior to 27), and on visionOS prior to 27, can abuse insufficient path validation to write to protected parts of the file system. Apple addressed the path handling flaw with improved validation in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, and visionOS 27, so patched devices are not exposed. Scoring 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N), the issue requires the user to install and launch a hostile app but then needs no additional privileges; EPSS is only 0.17% (6th percentile) and no public exploit code or confirmed active exploitation has been identified at time of analysis, so this is a moderate local-integrity flaw rather than a network-exploitable emergency.
Authorization bypass in Apple macOS allows a locally-running app to read sensitive user data without the user's consent, affecting macOS versions below Sequoia 15.8, below Tahoe 26.7, and below Golden Gate 27. Exploitation requires an attacker to first get a malicious or compromised application onto the machine and running under a standard, non-administrative user account (CVSS 3.1 AV:L/PR:L/UI:N), so this is not remotely reachable and no user interaction is needed once that app executes. Impact is limited to confidentiality of user data (C:H, I:N, A:N) - there is no code execution, privilege escalation, or system modification, and the EPSS score of 0.17% (6th percentile) plus the absence of KEV listing indicate no public exploit identified at time of analysis; Apple has released patched builds.
Sandboxed applications on Apple iOS, iPadOS, macOS, and visionOS can bypass sandbox file-access restrictions and read restricted files because of insufficient path validation in the affected operating system components (CWE-22). Exploitation requires a local attacker to get a crafted sandboxed app installed and launched by the user on a vulnerable device (CVSS 3.1 AV:L/AC:L/PR:N/UI:R), making this a delivery-gated, confidentiality-only information-disclosure flaw rather than a remotely reachable one. Apple has shipped fixes in iOS 26.7 and 27, iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, and visionOS 27; no public exploit code has been identified at time of analysis, the EPSS score is only 0.17% (6th percentile), and the CVE is not listed in CISA KEV.
Local information disclosure in Apple macOS lets a malicious or compromised application read sensitive user data on hosts running versions earlier than macOS Sequoia 15.8, macOS Tahoe 26.7 or macOS Golden Gate 27. Apple fixed the issue with improved checks in three separate security advisories covering each release train. Exploitation requires the attacker to get an app running on the target Mac with user-level privileges; no public exploit code has been identified at time of analysis and EPSS is 0.17% (6th percentile), so this is a low-volume, targeted local threat rather than a mass-exploitation event.
A type confusion flaw (CWE-843) in memory handling across Apple's current operating system family lets a malicious app crash the affected device or component, producing a local denial of service. Exploitation requires the victim to install and launch a crafted app — the CVSS vector is AV:L/PR:N/UI:R with availability-only impact, so there is no remote unauthenticated path and no confidentiality or integrity loss. Apple has shipped fixes in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7 and macOS Golden Gate 27, plus tvOS 27, visionOS 27 and watchOS 27; EPSS is only 0.17% (6th percentile) and there is no public exploit identified at time of analysis, so this is a routine patch-cycle item rather than an urgent exposure.
A sandboxed application running on Apple iOS/iPadOS, macOS Golden Gate, tvOS, visionOS, or watchOS can bypass authorization checks and read contents of the System Keychain, exposing stored secrets such as credentials, certificates, and tokens. The flaw stems from incorrect authorization combined with faulty state management (CWE-863) and affects all versions prior to the 27 release train; the platform owner has shipped fixes in iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27. The CVSS v3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, score 5.5) is consistent with our independent assessment: this is a genuine but locally-scoped access-control defect that requires an attacker to get a sandboxed app onto the device and have the user launch it (UI:R), so it cannot be triggered remotely over the network. EPSS is 0.16% (6th percentile) and no public exploit code has been identified at time of analysis, with no CISA KEV listing - impact is limited to confidentiality (keychain disclosure) with no integrity or availability effect, and patched 27-or-newer systems are not exposed.
A permissions-validation flaw (CWE-863) in Apple macOS versions prior to 27 (Golden Gate) and Xcode versions prior to 27 allows a locally installed app to reach user-sensitive data it should not be authorized to read. The issue is a local, confidentiality-only defect rated CVSS 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N): no privileges are needed, but the attack requires the victim to run the malicious application. Apple has released fixes in macOS 27 and Xcode 27; there is no CISA KEV listing, no public exploit code identified at time of analysis, and EPSS is very low at 0.16% (5th percentile), so real-world exploitation is unlikely to be widespread.
An improper access-control flaw in Apple macOS allows a locally running application to bypass authorization checks and read sensitive user data it should not be able to reach, with the fix delivered in macOS Sequoia 15.8 and macOS Golden Gate 27. Exploitation is local only and requires user interaction (the victim must launch the malicious or trojanized app), so the CVSS impact is limited to confidentiality (5.5 Medium). EPSS is negligible at 0.16% (5th percentile), there is no CISA KEV listing and no public exploit code identified at time of analysis, making this a routine update rather than an emergency patch.
A malicious application running on Apple macOS (versions prior to 27) or watchOS (versions prior to 27) can leak sensitive user information because the operating system fails to properly manage internal state. Apple addressed the flaw in macOS Golden Gate 27 and watchOS 27, so all earlier releases on both platforms remain exposed. The issue is rated CVSS 5.5 (local vector, low privileges, high confidentiality impact), EPSS is only 0.16% (5th percentile), and there is no public exploit code identified at time of analysis.
A local race condition (CWE-362) in Apple macOS allows any locally running application to trigger unexpected system termination on affected hosts. The flaw affects macOS versions prior to Tahoe 26.7 and Golden Gate 27, is availability-only (C:N/I:N/A:H), and requires local app execution with no user interaction and no privilege escalation. Apple has released fixed versions; there is no public exploit identified, no CISA KEV listing, and EPSS is only 0.16% (5th percentile), indicating low real-world exploitation pressure.
Local applications on macOS releases prior to Golden Gate 27 can bypass the Apple Intelligence security and consent prompts, evading the authorization gate that is supposed to require explicit approval before protected Apple Intelligence functionality is reached. Exploitation is not remote: an attacker must first get a malicious or abusable app onto the machine and running under normal user privileges (CVSS AV:L/PR:L, no user interaction at exploit time), and it is only meaningful where Apple Intelligence is present and enabled. The issue is a low-urgency local authorization flaw rather than an emergency - CVSS 5.5, EPSS 0.15% (5th percentile), no CISA KEV listing, and no public exploit identified at time of analysis - though Apple has addressed it with improved state management in macOS Golden Gate 27.
An out-of-bounds read in Apple's kernel, fixed across iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27, allows a locally installed application to disclose kernel memory to user space. The flaw (CWE-125) stems from insufficient input validation in a kernel code path reached by app-supplied data, and yields high confidentiality impact only - no integrity or availability loss. Apple has released patches for all affected platforms; EPSS is very low (0.15%, 5th percentile), and there is no public exploit code or CISA KEV listing at time of analysis.
Mattermost's access control policy update endpoint fails to enforce role-based authorization boundaries, enabling a channel or team administrator to detach a system-assigned ABAC parent policy by issuing a crafted PUT /api/v4/access_control_policies request with an empty imports list. Affected are Mattermost versions 11.9.0, 11.8.x through 11.8.4, and 11.7.x through 11.7.7, per vendor advisory MMSA-2026-00724. No public exploit identified at time of analysis, and SSVC assessment confirms no known exploitation with partial technical impact.
Local information disclosure in Apple iOS and iPadOS (and visionOS) before version 27 allows an app running on the device to read sensitive user data it should not be able to reach. Apple fixed the flaw through improved file handling in iOS 27, iPadOS 27 and visionOS 27. No public exploit code or active exploitation has been reported, and the EPSS score of 0.15% (5th percentile) plus SSVC 'exploitation: none' point to a low-volume, user-assisted local attack rather than a mass-exploited one.
An improper authorization flaw in Apple iOS/iPadOS and macOS Tahoe allows a locally installed application to reach sensitive user data that the platform's authorization state checks should have blocked. Apple addressed the flaw through improved state management, shipping fixes in iOS 26.6, iPadOS 26.6, and macOS Tahoe 26.6 for all versions prior to those releases. The issue is local-only (CVSS:3.1/AV:L/AC:L/PR:L/UI:N, 5.5) with confidentiality impact only; EPSS is 0.15% (5th percentile), CISA SSVC rates exploitation as 'none' and technical impact as 'partial', and no public exploit code was identified at time of analysis.
Improper access control in Apple's Keychain service lets a locally installed app delete credentials stored by other applications on iOS 27, iPadOS 27, macOS Golden Gate 27, and visionOS 27 (all versions prior to these releases). The bug is fixed by removing the vulnerable code path; it is rated CVSS 5.5 with integrity-only impact, and there is no public exploit or CISA KEV confirmation at time of analysis (EPSS 0.15%).
Double-free memory corruption in Apple macOS (all versions prior to macOS Golden Gate 27) is reachable by a locally installed or executed untrusted application, which can then trigger unexpected system termination and a local denial of service; confidentiality and integrity are unaffected and there is no remote or network-triggered path. Exploitation requires the attacker to already be able to run code as an application on the target Mac (CVSS:3.1/AV:L/AC:L/PR:L/UI:N, i.e. local, low-privilege context), which is the primary limiting factor against real-world abuse; no public exploit identified at time of analysis and EPSS is very low at 0.14% (4th percentile).
Unauthorized local network access on Apple macOS (all releases prior to Golden Gate 27) lets a malicious or compromised application communicate with local network devices without triggering the macOS Local Network consent prompt. The root cause is improper permission state management (CWE-284), and exploitation is strictly local: the user must launch the offending app (CVSS UI:R), with no remote or unauthenticated path. The independent assessment downgrades confidentiality impact to Low relative to the published CVSS 5.5, limiting practical consequences to reconnaissance of LAN-adjacent devices; no public exploit code has been identified and EPSS is only 0.14% (4th percentile), consistent with a low-priority, targeted issue. Apple has fixed the flaw in macOS Golden Gate 27.
Improper state management in Apple macOS (all versions prior to macOS 27 "Golden Gate") lets a locally installed application reach sensitive user data that normal macOS privacy and access controls are supposed to protect. The attack is local and needs the victim to launch the malicious app (AV:L, UI:R, PR:N), and the impact is confidentiality-only (C:H/I:N/A:N), which yields a moderate CVSS of 5.5. The issue is fixed in macOS 27 per Apple's advisory, EPSS is very low (0.14%, 3rd percentile), there is no CISA KEV listing, and no public exploit code has been identified.
A local denial-of-service flaw in SSSD (System Security Services Daemon) lets an attacker who can connect to the PAM responder socket crash the responder by sending a crafted protocol request that omits the service item while the pam_app_services option is enabled, triggering a NULL pointer dereference. Only availability is affected (CVSS 5.5, C:N/I:N/A:H), but a crash of the PAM responder disrupts authentication on the host until the service is restarted. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV; EPSS data was not provided in the source feeds.
Memory leak in the flatcc FlatBuffers C compiler (versions 0.6.0-0.6.3) allows remote attackers to exhaust process memory by supplying crafted schema input that triggers repeated calls to fb_clear_parser() without releasing the keyword_index hash table in the root schema instance. The specific omission - the missing fb_name_table_clear() call on P->schema.root_schema_instance.keyword_index - is confirmed by the patch commit. A proof-of-concept exploit has been publicly disclosed (GitHub issue #389), and SSVC marks the attack as automatable with partial technical impact.
An improper authentication flaw (CWE-287) in IBM Langflow OSS versions 1.0.0 through 1.10.2 lets a remote attacker who already holds a valid low-privileged account change the password of another user's account, resulting in account takeover rather than direct code execution. The CVSS 3.1 score is 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L), reflecting that exploitation requires an authenticated session and primarily damages integrity and availability of the targeted account. No public exploit code has been identified and the issue is not listed in CISA KEV, but SSVC flags partial technical impact and the vendor has published a fix; the exact patched version string is not enumerated in the available data.
Authorization bypass in IBM Cloud Pak for Business Automation allows authenticated remote users to invoke restricted API endpoints by supplying manipulated HTTP headers that the platform fails to adequately validate. Affected version lines include 24.0.0, 24.0.1, 25.0.0, and 26.0.0, each bounded by specific interim fix thresholds. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
IBM Sterling B2B Integrator (6.2.0.0 through 6.2.0.6_2, 6.2.1.0-6.2.1.2, 6.2.2.0-6.2.2.1) and IBM Sterling File Gateway Standard Edition in the same version ranges contain an improper authentication flaw (CWE-287) that lets a remote authenticated attacker bypass security restrictions. The CVSS 3.1 base score is 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), indicating a low-privilege authenticated network attacker can gain limited read and modify capability without user interaction, but no confidentiality-integrity-availability loss beyond partial. There is no CISA KEV listing, no public exploit code identified, and no EPSS score supplied in the available intelligence, so this appears to be a targeted-patch issue rather than a mass-exploitation emergency.
Stored cross-site scripting in IBM Cognos Analytics 12.0.4 through 12.0.4 FP2 and 12.1.0 through 12.1.3 FP1 allows any authenticated non-privileged user to embed JavaScript in their own given name or surname profile fields. The payload is later rendered without encoding in the administrative user-account management panel, so the script executes in an administrator's browser session when that account's permissions are reviewed, potentially exposing the administrator's session cookies. The issue is rated CVSS 5.4 (medium) and a vendor patch is available; no public exploit code or CISA KEV entry was present in the provided intelligence, so active exploitation is not confirmed.