Apple
Monthly
Unexpected system termination (denial of service) in Apple macOS stems from a race condition that a locally running app can win to crash the system; the flaw is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7, so all earlier builds of those release trains are affected. Exploitation requires the attacker to already be able to execute code as a local app with low privileges (CVSS PR:L) and to repeatedly hit a narrow timing window (CVSS AC:H), with no user interaction required at exploit time and no confidentiality or integrity impact (C:N/I:N/A:H, base score 4.7). There is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is only 0.17% (6th percentile), so this is a low-to-moderate priority availability bug rather than a remote or code-execution threat.
Improper permission checks in macOS snapshot handling allow a locally installed app to read protected user data, an issue Apple resolved with stronger permissions logic in macOS Golden Gate 27. The flaw is a local access-control problem (CWE-284) that requires user interaction but no special privileges (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base score 5.5), and it carries a low EPSS of 0.19% (9th percentile). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation, so this is best treated as a moderate-severity confidentiality issue rather than an urgent priority.
Holding a locked iPhone or iPad, an attacker can reach a lockscreen-accessible interface that improperly passes an authentication check, allowing sensitive user information to be viewed without the passcode being entered. The flaw is a logic error classed as CWE-287 (improper authentication) that affects iOS and iPadOS builds prior to 26.7 and 27, and Apple has shipped fixes in iOS/iPadOS 26.7 and iOS/iPadOS 27, so it is fully remediated by updating. Exploitation requires hands-on physical possession of the locked device and cannot be performed remotely or at scale; EPSS is 0.17% (6th percentile) and no public exploit has been identified at time of analysis, making this a low-to-medium real-world priority driven mostly by confidentiality exposure on lost or stolen devices.
Unauthorized local network access on Apple macOS (all releases prior to Golden Gate 27) lets a malicious or compromised application communicate with local network devices without triggering the macOS Local Network consent prompt. The root cause is improper permission state management (CWE-284), and exploitation is strictly local: the user must launch the offending app (CVSS UI:R), with no remote or unauthenticated path. The independent assessment downgrades confidentiality impact to Low relative to the published CVSS 5.5, limiting practical consequences to reconnaissance of LAN-adjacent devices; no public exploit code has been identified and EPSS is only 0.14% (4th percentile), consistent with a low-priority, targeted issue. Apple has fixed the flaw in macOS Golden Gate 27.
A type confusion issue was addressed with improved checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination.
An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27. Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure.
iCloud Private Relay on Apple platforms could disclose a user's real IP address to a website even while the privacy proxy is active, because of a state-management flaw in the relay implementation. The issue affects iOS and iPadOS before 18.7.10 and before 26.6.1, macOS Tahoe before 26.6.2, and visionOS before 26.6.1, and requires the victim to browse to attacker-controlled web content (UI:R, no privileges needed). Severity is modest (CVSS 4.3, confidentiality-only) and there is no CISA KEV listing or public exploit identified at time of analysis, but the privacy impact is disproportionate for users who depend on Private Relay for anonymity.
A use-after-free memory management flaw in Apple iOS and iPadOS allows a locally installed application to crash the system, causing unexpected device termination (denial of service). All versions prior to iOS 27 / iPadOS 27 are affected per the vendor CPE wildcard and ENISA EUVD version range (0 < 27). Apple addressed the issue with improved memory management in iOS 27 and iPadOS 27; no public exploit code has been identified and the EPSS probability is very low (0.17%, 7th percentile), so this is primarily a stability/patch-hygiene issue rather than an active exploitation threat.
An integer underflow in the macOS SMB client allows a malicious SMB server to crash the operating system, resulting in a denial of service, when a user connects to a shared folder or mount. The flaw affects macOS releases prior to Golden Gate 27, Sequoia 15.8 and Tahoe 26.7, and is fixed in those versions. Exploitation requires the victim to initiate a connection to an attacker-controlled SMB endpoint (CVSS UI:R), there is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is very low at 0.19% (9th percentile), so real-world exploitation pressure is currently minimal.
A local permission-assignment flaw in Apple's mobile and desktop operating systems lets an app installed on the device modify protected parts of the file system, giving it an integrity-only foothold outside its normal sandbox boundaries. Affected platforms are iOS and iPadOS before 26.7 and 27, and macOS before Golden Gate 27, Sequoia 15.8, and Tahoe 26.7; exploitation requires a locally-installed, running app plus user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N), with no confidentiality or availability impact and no remote or network reachability. There is no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV), and EPSS sits at 0.17% (7th percentile), so this is a moderate, not urgent, priority that is addressed by vendor-released updates.
An information disclosure flaw in Apple's iCloud Private Relay lets a website determine a visitor's real IP address even when Private Relay is switched on, defeating the core privacy guarantee of the feature. The issue affects iOS and iPadOS before 26.6.1, macOS before 26.6.2 (Tahoe), and visionOS before 26.6.1, and is reachable from the network but requires the victim to browse to an attacker-controlled page. Apple addressed it through improved state management, and no public exploit code or active exploitation has been identified at time of analysis.
A malicious app already running locally on macOS versions prior to Golden Gate 27 can bypass the clickjacking protections that normally guard secure system prompts, allowing a user who interacts with a manipulated dialog to approve an action the operating system intended to require explicit, deliberate consent. Impact is limited to local integrity (C:N/I:H/A:N per CVSS:3.1/AV:L/AC:L/PR:N/UI:R) - no confidentiality or availability loss, and the attacker needs both prior app execution and victim interaction with the prompt. No public exploit code or confirmed active exploitation has been identified, and EPSS is low at 0.17% (7th percentile); a vendor patch is available in macOS Golden Gate 27.
Information disclosure in Apple iOS and iPadOS versions before 27 allows a locally installed malicious or compromised app to access sensitive user data after the user installs and opens it. The flaw is a permissions issue (CWE-200) that Apple addressed with additional restrictions in iOS 27 and iPadOS 27. No public exploit identified at time of analysis and EPSS is 0.17% (7th percentile), but the CVSS score of 5.5 reflects the high confidentiality impact; exploitation requires local app execution and user interaction, with no remote path.
Sensitive user data disclosure in Apple iOS and related platforms allows a locally installed malicious app to bypass entitlement checks and access protected data, affecting Safari before 27, iOS/iPadOS before 26.7 and 27, macOS before Golden Gate 27, and visionOS before 27. The flaw requires local app installation and user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R) and only impacts confidentiality (C:H) with no integrity or availability effect. No public exploit has been identified at time of analysis, and EPSS is 0.18% (7th percentile), indicating low exploitation likelihood.
A path-validation weakness in Apple macOS lets a malicious application read files outside its permitted scope, exposing restricted data to an app that should not be able to reach it. Exploitation requires local conditions: the attacker must deliver a crafted application to the Mac and convince the user to launch it (CVSS:3.1/AV:L/AC:L/PR:N/UI:R), after which the app can achieve high confidentiality impact but cannot modify data or cause a denial of service. The issue is fixed in macOS Tahoe 26.7, macOS Sequoia 15.8, and macOS Golden Gate 27; there is confirmed actively exploited escalation is not indicated - no public exploit code has been identified at time of analysis and EPSS is low (0.17%, 6th percentile), making this a moderate-severity local information-disclosure flaw rather than an urgent priority, though the upstream fix should still be applied on any unpatched Mac.
A malicious or compromised app running on iOS and iPadOS prior to 26.7 (and prior to 27), and on visionOS prior to 27, can abuse insufficient path validation to write to protected parts of the file system. Apple addressed the path handling flaw with improved validation in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, and visionOS 27, so patched devices are not exposed. Scoring 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N), the issue requires the user to install and launch a hostile app but then needs no additional privileges; EPSS is only 0.17% (6th percentile) and no public exploit code or confirmed active exploitation has been identified at time of analysis, so this is a moderate local-integrity flaw rather than a network-exploitable emergency.
Unexpected system termination can be triggered on Apple devices by a locally executed app that exploits a use-after-free memory corruption in shared system code, which Apple addressed through improved memory management. The flaw affects essentially every current Apple OS branch below the fixed releases — iOS/iPadOS 26.6+, macOS 15.8/26.6+/27, tvOS 26.6+/27, visionOS 26.6+/27 and watchOS 26.6+/27 — with CVSS 5.5 reflecting an availability-only impact and a local attack vector. EPSS is low (0.24%, 16th percentile), no public exploit code has been identified, and there is no CISA KEV entry, so this is a routine patch-cycle item rather than an urgent threat.
A sandboxed application running on Apple iOS/iPadOS, macOS Golden Gate, tvOS, visionOS, or watchOS can bypass authorization checks and read contents of the System Keychain, exposing stored secrets such as credentials, certificates, and tokens. The flaw stems from incorrect authorization combined with faulty state management (CWE-863) and affects all versions prior to the 27 release train; the platform owner has shipped fixes in iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27. The CVSS v3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, score 5.5) is consistent with our independent assessment: this is a genuine but locally-scoped access-control defect that requires an attacker to get a sandboxed app onto the device and have the user launch it (UI:R), so it cannot be triggered remotely over the network. EPSS is 0.16% (6th percentile) and no public exploit code has been identified at time of analysis, with no CISA KEV listing - impact is limited to confidentiality (keychain disclosure) with no integrity or availability effect, and patched 27-or-newer systems are not exposed.
Authorization bypass in Apple macOS allows a locally-running app to read sensitive user data without the user's consent, affecting macOS versions below Sequoia 15.8, below Tahoe 26.7, and below Golden Gate 27. Exploitation requires an attacker to first get a malicious or compromised application onto the machine and running under a standard, non-administrative user account (CVSS 3.1 AV:L/PR:L/UI:N), so this is not remotely reachable and no user interaction is needed once that app executes. Impact is limited to confidentiality of user data (C:H, I:N, A:N) - there is no code execution, privilege escalation, or system modification, and the EPSS score of 0.17% (6th percentile) plus the absence of KEV listing indicate no public exploit identified at time of analysis; Apple has released patched builds.
Sensitive user data can be read by a malicious or compromised app on unpatched Apple devices because a logic-validation flaw lets the app cross its data-access boundary. Affected platforms are iOS and iPadOS before 26.7 and before 27, macOS before Sequoia 15.8, before Tahoe 26.7 and before Golden Gate 27, tvOS before 27, and visionOS before 27; the assessed vector (AV:L/AC:L/PR:N/UI:R/C:H/I:N/A:N) shows the attacker must first get a hostile app onto the device and the user must run it, with confidentiality-only impact. Vendor patches are available for every platform, EPSS rates exploitation probability at roughly 0.18% (7th percentile), and no public exploit has been identified at time of analysis.
Gatekeeper protection in Apple macOS can be bypassed by a malicious application, allowing unsigned or unnotarized code to launch on unpatched Macs. The flaw is a state-management logic error in the Gatekeeper check, rated CVSS 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N): exploitation is local and requires the victim to download and open an attacker-controlled app, so it depends on user interaction rather than a remote network path, and it yields no confidentiality or availability impact by itself - it must be chained with a malicious payload. Affected systems are macOS versions below Golden Gate 27, Sequoia 15.8, and Tahoe 26.7; there is no public exploit identified at time of analysis, EPSS is low at 0.18% (8th percentile), and no CISA KEV entry exists.
An incorrect authorization check in Apple macOS lets an application already running on a Mac read sensitive user data it should not be able to reach, an impact limited to confidentiality with no code execution, modification, or denial of service. Exploitation requires local code execution on the target (the assessed vector is AV:L/PR:L/UI:N), so it is only reachable by a malicious or attacker-controlled app already present on the device, and only on unpatched systems below macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27. Apple has released fixes in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27; no public exploit code or confirmed active exploitation has been identified, and EPSS is low at 0.19% (9th percentile), making this a moderate, locally-scoped risk rather than an urgent priority.
Processing a maliciously crafted image on unpatched Apple devices can trigger a memory-corruption fault that crashes the affected process, producing a local denial-of-service (CVSS 3.1 base 5.5, AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Affected platforms are iOS and iPadOS before 18.7.10 and macOS before Sonoma 14.8.8, Sequoia 15.7.8, and Golden Gate 27; the attacker cannot trigger the flaw remotely and must get the victim to open or auto-render the crafted image. All signals point to a low-priority issue: EPSS is 0.20% (10th percentile), no public exploit code has been identified at time of analysis, there is no CISA KEV listing, and vendor patches are already available.
A use-after-free (CWE-416) in the Apple macOS SMB client allows a maliciously crafted SMB network share to crash the operating system, causing system termination. Exploitation requires the user to mount the attacker-controlled share (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 6.5), so impact is limited to denial of service with no confidentiality or integrity loss. Apple has released fixes in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7; there is no CISA KEV listing and no public exploit code identified, and EPSS is low at 0.17% (6th percentile).
A remote denial-of-service flaw in Apple iOS and iPadOS (all versions before 27) stems from insufficient input validation in a code path that processes remotely supplied content, allowing an attacker to crash or hang the affected feature. Exploitation requires the victim to interact with the malicious input (CVSS UI:R) and yields only availability impact - confidentiality and integrity are unaffected. Apple addressed the issue with improved input validation in iOS 27 and iPadOS 27; there is no evidence of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so the practical priority is routine patching rather than emergency response.
Local applications on Apple macOS can trigger an integer overflow that terminates the system unexpectedly, affecting macOS versions prior to Golden Gate 27, Sequoia 15.8, and Tahoe 26.7. The flaw is a local, low-privilege availability issue (CVSS 5.5, AV:L/PR:L/A:H) with no confidentiality or integrity impact, and it has been fixed by Apple in the referenced security advisories. Exploitation probability is low (EPSS 0.19%, 9th percentile), there is no CISA KEV listing and no public exploit code identified at time of analysis, so this is a reliability/denial-of-service hardening issue rather than an active threat.
Improper access control in Apple iOS and iPadOS, macOS Tahoe, and visionOS lets a locally installed app read user-sensitive data that it should not be able to reach. The flaw (CWE-284) stems from insufficient validation checks and is remediated in iOS/iPadOS 26.6, macOS Tahoe 26.6, and visionOS 26.6; the assessed vector (CVSS 5.5, AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) means exploitation requires the victim to install and launch a malicious app on an unpatched build, with no remote attack path and no integrity or availability impact. The attacker's app needs no special privileges, but there is no public exploit identified at time of analysis and EPSS is low at 0.19% (9th percentile), so this is a genuine but low-priority confidentiality issue.
Improper access control (CWE-284) in Apple iOS, iPadOS, and macOS allows a locally installed app to read user-sensitive data outside the permission boundary the operating system is supposed to enforce, an information-disclosure impact rated CVSS 5.5 (confidentiality High, integrity None, availability None). Exploitation is local and requires user interaction: the attacker must first get a malicious or compromised app onto the device and convince the user to launch it (AV:L, PR:N, UI:R), so there is no remote, network-triggerable, or self-propagating path. Apple has released fixes in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27; no public exploit code has been identified at time of analysis and EPSS is low at 0.17 percent (7th percentile), with no CISA KEV listing.
Information disclosure in Apple iOS, iPadOS, macOS, tvOS, visionOS and watchOS allows a locally installed and running app to read a persistent account identifier that the operating system should have kept out of its reach. The root cause is a permissions/sandbox restriction gap (CWE-200), fixed by Apple with additional access restrictions in iOS and iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27; successful exploitation requires the user to install and launch a malicious local app (AV:L/PR:N/UI:R), so a remote, unauthenticated network attack is not possible. There is no public exploit identified at time of analysis and EPSS is 0.18% (8th percentile), making this low-to-moderate risk rather than an urgent priority, with impact confined to the confidentiality of one identifier and no integrity or availability effect.
Persistent device identifier disclosure in Apple iOS, iPadOS, macOS, tvOS, visionOS and watchOS stems from an incorrect authorization check that lets an ordinary, unprivileged installed app read identifiers it should not be able to access (CWE-863, CVSS 5.5, C:H/I:N/A:N). Exploitation is local-only (AV:L, PR:N) and requires user interaction to install and launch a malicious or compromised application on a device running an unpatched OS; there is no remote or network path, and no public exploit code has been identified at time of analysis, with EPSS at 0.17% (7th percentile) and no CISA KEV listing. Apple has released fixed versions and the impact is confined to confidentiality/privacy rather than code execution or data modification.
Improper path validation in Apple macOS allows a locally executing application to read files outside the scope it is authorized to access, resulting in disclosure of restricted data on affected systems. The issue affects macOS versions before 15.8 (Sequoia), before 26.7 (Tahoe), and before 27 (Golden Gate), and is rated CVSS 5.5 with confidentiality-only impact (C:H/I:N/A:N); exploitation requires a malicious or compromised app to be running locally and relies on user interaction (AV:L/UI:R, PR:N). No public exploit code has been identified at time of analysis and the vulnerability is not in CISA KEV; EPSS is low at 0.18% (7th percentile), and vendor-released fixes are available in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27.
Improper access control in Apple's operating system family (iOS/iPadOS, macOS, tvOS, visionOS, watchOS) lets a locally installed app bypass intended permission restrictions and read sensitive user data it should not be able to reach. Apple addressed the flaw with additional restrictions in iOS 26.7/iPadOS 26.7, iOS 27/iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27. Exploitation requires the attacker to already run code on the device as an app (PR:L, AV:L), and no public exploit code or active exploitation has been identified; EPSS is only 0.20% (10th percentile) and CISA SSVC records exploitation as 'none'.
An integer overflow in Apple's file-processing code, fixed through improved input validation, allows a maliciously crafted file to cause disclosure of process memory on affected Apple platforms. Unpatched devices running iOS/iPadOS before 26.7 and 27, macOS before Sequoia 15.8, Tahoe 26.7 or Golden Gate 27, plus tvOS, visionOS and watchOS before 27 are exposed, but exploitation requires the victim to open the crafted file (CVSS UI:R). There is no public exploit code and no evidence of active exploitation; EPSS is very low at 0.18% (8th percentile) and CISA SSVC rates the issue non-automatable with only partial technical impact, and Apple has released patches.
An improper authorization flaw in Apple iOS/iPadOS and macOS Tahoe allows a locally installed application to reach sensitive user data that the platform's authorization state checks should have blocked. Apple addressed the flaw through improved state management, shipping fixes in iOS 26.6, iPadOS 26.6, and macOS Tahoe 26.6 for all versions prior to those releases. The issue is local-only (CVSS:3.1/AV:L/AC:L/PR:L/UI:N, 5.5) with confidentiality impact only; EPSS is 0.15% (5th percentile), CISA SSVC rates exploitation as 'none' and technical impact as 'partial', and no public exploit code was identified at time of analysis.
Sandboxed applications on Apple iOS, iPadOS, macOS, and visionOS can bypass sandbox file-access restrictions and read restricted files because of insufficient path validation in the affected operating system components (CWE-22). Exploitation requires a local attacker to get a crafted sandboxed app installed and launched by the user on a vulnerable device (CVSS 3.1 AV:L/AC:L/PR:N/UI:R), making this a delivery-gated, confidentiality-only information-disclosure flaw rather than a remotely reachable one. Apple has shipped fixes in iOS 26.7 and 27, iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, and visionOS 27; no public exploit code has been identified at time of analysis, the EPSS score is only 0.17% (6th percentile), and the CVE is not listed in CISA KEV.
An out-of-bounds read in Apple's macOS SMB client allows a malicious SMB server to leak kernel memory to an attacker when a user connects to a shared folder, fixed in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. Exploitation requires the victim to initiate a connection to an attacker-controlled or compromised SMB share (CVSS UI:R), so it is user-interaction dependent rather than wormable, and the raw impact is confidentiality only — kernel memory disclosure, not code execution. EPSS is very low (0.17%, 6th percentile), there is no CISA KEV listing, and no public exploit code has been identified; SSVC rates exploitation as 'none', automatable as 'no', and technical impact as 'partial'.
Mounting a crafted disk image on an affected Mac can crash the system: Apple macOS Sequoia, Tahoe and Golden Gate contain a buffer overflow in the disk-image handling path that is triggered when a user opens a malicious image, requiring no credentials. Apple has shipped fixes in macOS Sequoia 15.8, macOS Tahoe 26.7 and macOS Golden Gate 27. EPSS is low (0.19%, 8th percentile), there is no CISA KEV listing and no public exploit code identified at time of analysis, so the practical concern is availability loss (forced termination, potential unsaved-work loss) rather than code execution.
An incorrect-authorization flaw in Apple's Bluetooth state management allows an already-installed app to obtain Bluetooth access it was never granted, undermining the platform's per-app permission model on iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27 - but only on versions prior to those releases. Apple fixed the issue through improved state handling and published coordinated advisories for every affected platform; a local attacker or malicious app is required, so this is not remotely reachable without code execution already on the device. No public exploit code has been identified and EPSS is very low (0.20%, 10th percentile), so this rates as a patching-hygiene item rather than an emergency.
Kernel memory corruption in Apple macOS lets a locally running application crash the operating system or corrupt kernel memory, with the potential for further kernel-level compromise. The flaw is a memory-bounds handling defect (CWE-119) present in macOS versions before Golden Gate 27, Sequoia 15.8, and Tahoe 26.7, and is fixed in those releases per Apple's advisories. Exploitation requires the ability to execute code as a local user (CVSS AV:L/PR:L), EPSS is low at 0.19% (9th percentile), and there is no public exploit code or CISA KEV listing at time of analysis.
A use-after-free memory-management flaw in Apple's operating systems allows a locally installed application to crash the system, causing unexpected termination (denial of service) on affected iPhone, iPad, Mac, and Apple Vision Pro devices. Apple addressed the issue across iOS 26.7/iPadOS 26.7, iOS 27/iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, and visionOS 27. There is no evidence of active exploitation: CISA KEV does not list the CVE, SSVC records exploitation as 'none' and automatable as 'no', EPSS is a low 0.18% (7th percentile), and no public exploit code has been identified at the time of analysis.
Local information disclosure in Apple macOS lets a malicious or compromised application read sensitive user data on hosts running versions earlier than macOS Sequoia 15.8, macOS Tahoe 26.7 or macOS Golden Gate 27. Apple fixed the issue with improved checks in three separate security advisories covering each release train. Exploitation requires the attacker to get an app running on the target Mac with user-level privileges; no public exploit code has been identified at time of analysis and EPSS is 0.17% (6th percentile), so this is a low-volume, targeted local threat rather than a mass-exploitation event.
In the Linux kernel, the following vulnerability has been resolved: cpufreq: apple-soc: Fix OPP table cleanup apple_soc_cpufreq_init() adds OPP tables from firmware, but some failure paths do not remove them. The driver also uses dev_pm_opp_remove_all_dynamic(), which is not the right cleanup helper for OPP tables loaded from firmware. Use the cpumask OPP helper after the policy CPU mask has been populated. Pair it with the matching cpumask remove helper on failure paths and in apple_soc_cpufreq_exit(). This also removes the separate dev_pm_opp_set_sharing_cpus() call, as the cpumask helper loads the DT OPP tables for all CPUs in the policy.
Multiple local privilege escalation flaws in Palo Alto Networks GlobalProtect App on Windows, macOS, and Linux allow any authenticated local user to elevate privileges to NT AUTHORITY\SYSTEM or root. The root cause is CWE-426 (Untrusted Search Path), a class of vulnerability commonly manifesting as DLL search-order hijacking or PATH manipulation that the privileged VPN client process follows. No public exploit is known at time of analysis, and Palo Alto has released fixed versions; iOS, Android, and ChromeOS deployments are explicitly not affected.
Sensitive information disclosure in Google Chrome's Mobile component on iOS (versions prior to 153.0.8010.36) allows remote unauthenticated attackers to leak confidential browser data by luring victims to a crafted HTML page through social engineering. The flaw is platform-specific - affecting only the iOS Mobile code path, not desktop or Android - and is fixed in the 153.0.8010.36 stable channel release. No active exploitation is confirmed (not in CISA KEV) and EPSS probability is 0.17% (7th percentile), consistent with Chromium's own 'Low' severity rating, which contrasts with the NVD CVSS 6.5 Medium score.
Observable discrepancy (CWE-203) in the Safebrowsing component of Google Chrome on iOS prior to 153.0.8010.36 enables a remote attacker with a pre-compromised renderer process to leak sensitive information through behavioral differences when processing a crafted HTML page. The vulnerability is iOS-platform-specific and is chained after renderer compromise rather than exploited standalone. No public exploit exists and EPSS probability is 0.24%, consistent with the multi-stage exploitation requirement.
Cleartext transmission of sensitive information via the HttpsUpgrades component in Google Chrome on iOS (versions prior to 153.0.8010.36) exposes user data to network-positioned attackers through crafted traffic. The HttpsUpgrades mechanism, which is responsible for automatically promoting HTTP requests to HTTPS, fails under certain conditions on iOS, leaving sensitive request content unencrypted in transit. With no public exploit identified and high attack complexity required (network positioning), the real-world risk is moderate despite the C:H confidentiality impact.
Web origin policy bypass in Google Chrome's Mobile component on iOS allows a remote attacker to read cross-origin content via a race condition triggered through a crafted HTML page. Affected versions are all Chrome releases prior to 153.0.8010.36 on iOS. Exploitation requires social engineering to induce the target to visit a malicious page, and the race condition's timing dependency (AC:H) limits reliable exploitation, though a successful attack permits limited cross-origin data disclosure. No public exploit identified at time of analysis.
Heap out-of-bounds read in gdk-pixbuf's ICNS decompression routine allows an attacker to crash GNOME applications or disclose adjacent heap memory by supplying a crafted Apple Icon Image (.icns) file. The uncompress() function, which handles RLE-encoded ICNS data, lacks bounds validation on the source buffer during decompression. Exploitation requires user interaction - the target must open or preview the malicious file - but thumbnail-rendering paths in file managers such as Nautilus may reduce that barrier. No public exploit or KEV listing has been identified at the time of analysis.
Repeated external URL scheme invocations from a malicious webpage can flood Firefox for iOS with system confirmation prompts or trigger cascading external application launches, rendering the browser temporarily unusable. All Firefox for iOS versions prior to 155.1 on Apple iOS devices are affected. No active exploitation has been identified; Mozilla released the fix in Firefox for iOS 155.1, and exploitation requires the user to visit the attacker-controlled page.
Address bar spoofing in Firefox for iOS lets a malicious webpage stall a popup's cross-origin navigation after the browser internally commits it, causing the address bar to display the intended destination's origin while the popup continues rendering attacker-controlled content. All Firefox for iOS releases prior to 155.0 are affected; the fix shipped in version 155.0 per Mozilla advisory MFSA2026-81. No public exploit has been identified and CISA SSVC confirms exploitation status as none, but the phishing potential is realistic given the deceptive UI state.
Out-of-bounds read in Exiv2's RemoteIo::Impl::populateBlocks() function affects versions prior to 0.28.9, exploitable only when the tool is invoked against a remote URL rather than a local file. An attacker controlling a remote server can serve a crafted image to trigger the read when a user runs exiv2 against that URL, potentially causing information disclosure or a crash. No public exploit code or active exploitation has been identified; the vulnerability is rated low severity and fixed in the 0.28.9 release.
Prompt injection in Microsoft Edge for iOS exposes users to network-based spoofing attacks through Microsoft Edge's AI/Copilot integration. Malicious web content can embed adversarial LLM prompts that, when processed by Edge's AI features, manipulate the model to produce spoofed or misleading output - potentially impersonating trusted content or bypassing AI-enforced guardrails. The CVSS vector (PR:N/UI:R) indicates no attacker authentication is required, but a user must interact with Edge on iOS while AI features are active. No public exploit code has been identified at time of analysis, and a vendor-released patch is available via MSRC.
Unauthenticated BLE packet injection in BitChat for iOS v1.5.0 (reported in the CVE as v1.15.0) allows any device within Bluetooth adjacency range to inject crafted MESSAGE packets into the mesh gossip cache, causing denial of service for all mesh participants. The attack exploits a TTL=0 validation bypass in BLEService.swift that accepted packets as anonymous without full sender authentication. A public proof-of-concept is available at a named GitHub repository; no active exploitation has been confirmed by CISA KEV.
HCL Traveler's Apple profile generation page reflects user-submitted Logon Name and Mail Address values into generated Apple device synchronization profiles without verifying those values against the authenticated user's entry in the HCL Domino directory. An authenticated, low-privileged user can therefore embed arbitrary directory values into a generated Apple profile. Practical impact is severely constrained: the resulting profile is incomplete without additional credentials and, per vendor description, can only be used to configure the attacker's own Apple device - making this an authenticated, self-targeting input validation gap rather than a lateral-movement primitive. No public exploit code exists and the CVE is not listed in CISA KEV.
Path traversal in RustDesk's macOS clipboard file-paste feature allows a remote session peer to write files outside the intended target directory by supplying crafted file descriptor names containing parent-directory components or absolute paths. Versions 1.3.9 through 1.4.9 on macOS are affected; exploitation requires an active RustDesk session and passive victim interaction (initiating a clipboard paste). No public exploit code and no CISA KEV listing have been identified at time of analysis; a vendor fix is available via commit 6f1eb164.
Information disclosure in Google Chrome's Mobile component on iOS (all versions prior to 152.0.7977.65) allows a local attacker to read sensitive information by inducing the user to open a crafted file. Exploitation requires physical or logical local access to the device and user interaction, limiting the practical attack surface significantly. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as none with only partial technical impact.
Information disclosure in Google Chrome's Mobile component on iOS exposes sensitive data to local attackers operating via a local program, affecting all Chrome for iOS versions prior to 152.0.7977.65. The vulnerability is classified CWE-200 (Exposure of Sensitive Information) and carries a Chromium internal severity of Low, which aligns with SSVC's assessment of partial technical impact and non-automatable exploitation. No public exploit code exists and no active exploitation has been confirmed; the EPSS score of 0.18% (7th percentile) reflects minimal real-world exploitation pressure.
System access restriction bypass in Google Chrome Mobile on iOS prior to version 152.0.7977.65 enables a remote attacker to circumvent platform-level security controls by luring a victim to a specially crafted HTML page. The flaw stems from improper input validation (CWE-20) in Chrome's iOS mobile implementation and results in a low-integrity impact with no confidentiality or availability consequence. No public exploit code or active exploitation has been identified at time of analysis; EPSS probability is 0.22% (12th percentile), and CISA SSVC classifies exploitation as none and technical impact as partial, consistent with a low-priority patching posture for most organizations.
The Passwords (built-in credential manager) component of Google Chrome on iOS prior to version 152.0.7977.65 leaks sensitive password data to a local attacker who can supply a crafted file, enabling unauthorized retrieval of stored credentials. Only the iOS platform is affected, and the Chromium security team rates this as Low severity internally. No public exploit code exists and EPSS stands at 0.11% (1st percentile), indicating very low near-term exploitation likelihood despite the high confidentiality impact of the exposed data.
Incorrect authorization in Google Chrome Mobile on iOS (versions prior to 152.0.7977.65) allows a remote attacker to bypass system access restrictions by inducing a user to visit a crafted HTML page. The flaw stems from improper authorization enforcement (CWE-863) within the iOS-specific mobile browser code path, permitting limited integrity violations without confidentiality or availability impact. No public exploit has been identified and EPSS sits at a low 0.23% (13th percentile), consistent with a medium-severity, user-interaction-dependent issue not yet seeing active targeting.
Null pointer dereference in iOS and iPadOS allows a locally installed app to trigger unexpected system termination (device crash/reboot) by supplying crafted input that bypasses input validation. Affected versions span the legacy 18.x branch (prior to 18.7.9) and the current 26.x branch (prior to 26.5), covering a broad swath of Apple mobile devices. No active exploitation has been identified - CISA KEV status is absent, SSVC rates exploitation as none, and EPSS sits at the 1st percentile - placing this squarely as a patch-cycle priority rather than an emergency response item.
Buffer overflow in Apple macOS allows a locally-running app with standard user privileges to cause unexpected system termination or write arbitrary data into kernel memory. Affected versions include macOS Sequoia before 15.7.7 and macOS Sonoma before 14.8.7. No public exploit code or active exploitation has been identified at time of analysis; EPSS sits at 0.11% (1st percentile), consistent with SSVC's assessment of no current exploitation.
Insufficient permissions restrictions in iOS and iPadOS (all versions prior to 26.5) allow a malicious locally-installed app to enumerate other applications installed on the device. The flaw, rooted in improper privilege management (CWE-269), exposes app inventory data that Apple's sandbox model is designed to protect. No public exploit identified at time of analysis, EPSS is extremely low at 0.09%, and SSVC exploitation status is confirmed none - placing this squarely as a low-urgency privacy concern rather than an active threat.
Improper access control in Apple watchOS prior to 26.4 allows a person with physical possession of a locked Apple Watch to view the device owner's contacts without authentication. The flaw, classified as CWE-284 (Improper Access Control), stems from insufficient permissions checking on a code path accessible from the lock screen. Apple has confirmed the fix in watchOS 26.4; no active exploitation has been identified per CISA SSVC assessment.
Unexpected application termination in Apple macOS arises when processing a maliciously crafted file, triggering an out-of-bounds read (CWE-125) that crashes the handling application. Affected versions span all three active macOS release trains: Sonoma prior to 14.8.5, Sequoia prior to 15.7.5, and Tahoe prior to 26.4. No public exploit code has been identified and EPSS sits at the 5th percentile (0.15%), indicating low real-world exploitation probability; vendor-released patches are available for all three tracks.
Path traversal in Apple's open-source container runtime (versions before 1.2.0) enables a malicious builder peer to request host files by crafted names that resolve outside the build context, leaking arbitrary host filesystem contents. The CVSS vector (AV:N/AC:L/PR:L) indicates network-accessible exploitation by a low-privileged builder peer with no user interaction required. No active exploitation has been identified (no CISA KEV listing), and SSVC rates exploitation as none and automatability as no, reducing immediate operational urgency.
NIOWebSocket in swift-nio (all versions before 2.101.0) crashes the hosting process when any unauthenticated remote peer sends a single crafted 11-byte WebSocket frame following a completed handshake, terminating all active connections until the service restarts. Frameworks built on swift-nio - including Vapor and Hummingbird - inherit this exposure whenever they accept WebSocket connections. No public exploit code has been identified, but SSVC classifies the attack as automatable, lowering the bar for repeated or scripted denial-of-service.
Memory exhaustion denial-of-service in MCP PHP SDK's HttpTransport crashes client processes when connected to a malicious or compromised MCP server. Affected versions (mcp/sdk >= 0.5.0, < 0.7.1) accumulate SSE stream data into an unbounded in-memory buffer inside processSSEStream() - a server that withholds the SSE event delimiter ('\n\n') forces the buffer to grow at 4 KiB per tick until the PHP process hits its memory_limit and crashes with a fatal OOM error. A proof-of-concept is publicly available and reproduces the crash deterministically against the released Packagist package; this is not confirmed in CISA KEV.
Froxlor's standalone AJAX endpoint (lib/ajax.php) entirely bypasses the CSRF token enforcement present in lib/init.php, allowing a remote attacker to forge state-changing POST requests on behalf of any authenticated administrator who visits a malicious page. Successful exploitation modifies administrator API key properties - specifically injecting the attacker's IP into the allowed_from whitelist and setting valid_until to -1 (never expires) - creating a persistent foothold for future API abuse if the API secret is later obtained. A working proof-of-concept HTML page is included in the public GitHub security advisory (GHSA-xpr4-8vp6-c87j); no CISA KEV listing found at time of analysis. EPSS data was not provided, but the UI:R requirement and niche product footprint constrain real-world exploitation.
External control of file name or path (CWE-73) in Citrix WorkSpace App 2607 on macOS allows a local low-privileged attacker, with active user interaction, to manipulate file system paths and cause high integrity and availability impacts on the vulnerable system. The CVSS 4.0 vector confirms local access with low privileges and required user interaction, resulting in a medium severity score of 5.2. No public exploit code or CISA KEV listing has been identified at time of analysis, but the integrity and availability impacts are rated High, indicating potential for significant data manipulation or denial of service on affected endpoints.
Safari on iOS, iPadOS, and macOS Tahoe crashes when processing specially crafted web content due to improper state management (CWE-703), resulting in a denial-of-service condition. Affected are iOS and iPadOS versions prior to 18.7.10 and 26.6.1, and macOS Tahoe prior to 26.6.2. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; impact is limited entirely to availability.
Kernel state leakage in Apple iOS and iPadOS prior to version 18.7.10 enables a locally-installed, low-privileged app to read sensitive kernel memory through a validation gap classified as CWE-200. The flaw was addressed by Apple with additional input validation, and the fix is confirmed available in iOS 18.7.10 and iPadOS 18.7.10. No public exploit code or active exploitation has been identified at time of analysis, though kernel state disclosure of this type is a common precursor to full privilege escalation chains on mobile platforms.
Safari on Apple iOS, iPadOS, and macOS crashes unexpectedly when processing maliciously crafted web content due to improper state management (CWE-703). Affected platforms include all iOS and iPadOS versions prior to 26.6.1 and macOS Tahoe versions prior to 26.6.2. Impact is limited to a denial-of-service condition - browser crash only, with no confidentiality or integrity consequences - and no public exploit or active exploitation has been identified at time of analysis.
Memory corruption via race condition in Safari's web content processing causes unexpected application crashes on iOS, iPadOS, and macOS. Affected platforms include iOS and iPadOS prior to 18.7.10 and 26.6.1, and macOS Tahoe prior to 26.6.2, covering both the legacy 18.x and current 26.x release trains. No public exploit identified at time of analysis, and exploitation requires high attack complexity due to the race condition timing requirement, making opportunistic mass exploitation unlikely.
Uncontrolled resource consumption in Apple's image processing subsystem affects iOS/iPadOS (prior to 26.6.1) and macOS Tahoe (prior to 26.6.2), enabling a network-reachable denial-of-service when a user processes a specially crafted image. Apple has released patches across both platform families via support advisories 148281 and 148282. No public exploit code exists and EPSS sits at 0.15% (5th percentile), indicating negligible observed exploitation pressure; the vulnerability is not listed in CISA KEV.
Safari on Apple iOS, iPadOS, and macOS Tahoe crashes unexpectedly when processing maliciously crafted web content due to a memory handling flaw classified under CWE-119 (improper restriction of buffer operations). Affected platforms span iOS and iPadOS prior to versions 18.7.10 and 26.6.1, as well as macOS Tahoe prior to 26.6.2. An unauthenticated remote attacker can trigger this availability-only denial-of-service by inducing a victim to visit a crafted webpage; no confidentiality or integrity impact is indicated by the CVSS vector. No public exploit code exists and this vulnerability is not listed in CISA KEV at time of analysis.
Kernel memory corruption in Apple iOS, iPadOS, and macOS Tahoe allows a malicious app to cause unexpected system termination or corrupt kernel memory through improper memory buffer handling. Affected versions are iOS and iPadOS prior to 26.6.1 and macOS Tahoe prior to 26.6.2, with Apple having released patches via security advisories at support.apple.com. No public exploit code has been identified and EPSS stands at 0.15% (5th percentile), indicating low observed exploitation probability at time of analysis.
Safari on Apple iOS, iPadOS, and macOS crashes unexpectedly when processing maliciously crafted web content, resulting in a denial-of-service condition. Affected platforms include iOS and iPadOS prior to 18.7.10 and 26.6.1, and macOS Tahoe prior to 26.6.2. An unauthenticated remote attacker can trigger the crash by luring a user to visit a malicious webpage, with no confidentiality or integrity impact beyond service disruption.
Safari on Apple iOS, iPadOS, and macOS Tahoe crashes unexpectedly when processing specially crafted web content due to a state management flaw. Affected versions span both legacy (iOS/iPadOS <18.7.10) and current-generation (iOS/iPadOS <26.6.1, macOS Tahoe <26.6.2) release trains, meaning a wide range of unpatched Apple devices are vulnerable. The impact is limited to a denial-of-service crash requiring user interaction; no public exploit has been identified at time of analysis, and EPSS probability sits at a very low 0.14% (4th percentile).
Memory corruption in Apple's web content processing stack affects iOS and iPadOS prior to version 26.6.1 and macOS Tahoe prior to 26.6.2, triggered when a user processes maliciously crafted web content. Classified under CWE-119 (improper bounds restriction), the flaw carries a CVSS 5.4 medium rating reflecting limited confidentiality and integrity impact without availability disruption. No public exploit code has been identified and no active exploitation is confirmed by CISA KEV, making this a standard patch-cycle priority rather than an emergency response item.
Safari on Apple iOS, iPadOS, and macOS Tahoe crashes unexpectedly when processing maliciously crafted web content due to a state management flaw in WebKit. Affected are all iOS and iPadOS versions prior to 18.7.10 and 26.6.1, and macOS Tahoe prior to 26.6.2. An attacker can trigger a denial-of-service condition by luring a user to visit a malicious webpage, causing the browser to crash; no public exploit has been identified at time of analysis and EPSS sits at the 4th percentile, indicating very low observed exploitation probability.
Out-of-bounds read (CWE-125) in Safari's web content processing engine causes an application crash when parsing maliciously crafted web pages, affecting iOS, iPadOS, and macOS Tahoe. Impacted platforms include iOS and iPadOS below versions 18.7.10 and 26.6.1, and macOS Tahoe below 26.6.2. Apple has shipped patches across all affected release branches; no public exploit code or active exploitation has been identified at time of analysis.
Memory corruption in Apple's web content processing engine affects iOS, iPadOS, and macOS Tahoe, allowing a remote unauthenticated attacker to trigger CWE-119 buffer mismanagement when a user processes maliciously crafted web content. Affected platforms span both the legacy iOS 18.x branch and the current iOS/iPadOS 26.x line, as well as macOS Tahoe 26.x, indicating broad reach across Apple's device ecosystem. No public exploit identified at time of analysis; EPSS score of 0.14% (4th percentile) reflects very low current exploitation probability, and the vulnerability is not listed in CISA KEV.
Safari on iOS and iPadOS prior to version 18.7.10 crashes unexpectedly when processing maliciously crafted web content due to a memory handling flaw classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). The vulnerability is network-delivered but requires user interaction - a victim must open the crafted page in Safari - and its impact is limited strictly to availability, with no confidentiality or integrity exposure. No public exploit code is identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog.
Unexpected process termination in Apple iOS/iPadOS and macOS Tahoe can be triggered remotely by luring a user to visit maliciously crafted web content, exploiting a use-after-free flaw in the web content rendering engine. The vulnerability affects iOS and iPadOS versions prior to 26.6.1 and macOS Tahoe prior to 26.6.2, with impact limited to availability - crashing the affected browser or WebKit-based process - and no confirmed confidentiality or integrity loss. No public exploit code or CISA KEV listing is identified at time of analysis, though the low-complexity, network-accessible attack surface warrants prompt patching given the broad Apple device install base.
Sensitive user information disclosure in Apple iOS, iPadOS, and macOS Tahoe stems from a logic issue classified as a Protection Mechanism Failure (CWE-693), where security checks were insufficiently enforced, allowing a locally installed app to bypass intended data access controls. Affected platforms include iOS and iPadOS prior to 26.6.1 and macOS Tahoe prior to 26.6.2. No public exploit code has been identified and the EPSS score of 0.17% (7th percentile) signals low exploitation probability, though the high confidentiality impact (C:H) and Apple's broad install base keep this relevant for enterprise mobile management programs.
Safari crashes on Apple iOS, iPadOS, and macOS when processing maliciously crafted web content due to a state management defect classified under CWE-119 (buffer boundary violation). Affected platforms span iOS and iPadOS prior to 18.7.10 and 26.6.1, and macOS Tahoe prior to 26.6.2. An unauthenticated remote attacker can trigger this denial-of-service condition by luring a user to a specially crafted webpage, though impact is limited to an application crash with no confirmed confidentiality or integrity consequence. No public exploit identified at time of analysis, and EPSS at 0.14% (4th percentile) signals negligible current attacker interest.
Memory corruption in Apple's Safari browser across iOS, iPadOS, and macOS Tahoe allows remote attackers to crash Safari by delivering maliciously crafted web content, requiring only passive user interaction - visiting a malicious page. Impact is strictly limited to availability (denial of service via browser crash); no confidentiality or integrity compromise is indicated by either the description or the CVSS vector. No public exploit code has been identified at time of analysis, and the EPSS score of 0.14% (4th percentile) signals very low exploitation probability; Apple has released patches across all affected platforms.
Safari on Apple iOS, iPadOS, and macOS crashes unexpectedly when processing maliciously crafted web content due to improper memory handling (CWE-119) in the underlying WebKit engine. Affected users on iOS/iPadOS below 18.7.10 or 26.6.1, and macOS Tahoe below 26.6.2, are exposed to a denial-of-service condition triggered by visiting an attacker-controlled webpage. No public exploit code has been identified at time of analysis, and EPSS at 0.14% (4th percentile) indicates very low exploitation probability in the wild.
Safari on Apple iOS, iPadOS, and macOS crashes unexpectedly when processing maliciously crafted web content, caused by improper state management in the WebKit rendering engine. Affected platforms span iOS and iPadOS versions prior to 18.7.10 and 26.6.1, and macOS Tahoe prior to 26.6.2. No exploitation has been identified at time of analysis - EPSS sits at the 4th percentile - and impact is strictly confined to availability, making this a standard-cycle patch rather than an emergency response for most organizations.
Unexpected system termination (denial of service) in Apple macOS stems from a race condition that a locally running app can win to crash the system; the flaw is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7, so all earlier builds of those release trains are affected. Exploitation requires the attacker to already be able to execute code as a local app with low privileges (CVSS PR:L) and to repeatedly hit a narrow timing window (CVSS AC:H), with no user interaction required at exploit time and no confidentiality or integrity impact (C:N/I:N/A:H, base score 4.7). There is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is only 0.17% (6th percentile), so this is a low-to-moderate priority availability bug rather than a remote or code-execution threat.
Improper permission checks in macOS snapshot handling allow a locally installed app to read protected user data, an issue Apple resolved with stronger permissions logic in macOS Golden Gate 27. The flaw is a local access-control problem (CWE-284) that requires user interaction but no special privileges (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base score 5.5), and it carries a low EPSS of 0.19% (9th percentile). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation, so this is best treated as a moderate-severity confidentiality issue rather than an urgent priority.
Holding a locked iPhone or iPad, an attacker can reach a lockscreen-accessible interface that improperly passes an authentication check, allowing sensitive user information to be viewed without the passcode being entered. The flaw is a logic error classed as CWE-287 (improper authentication) that affects iOS and iPadOS builds prior to 26.7 and 27, and Apple has shipped fixes in iOS/iPadOS 26.7 and iOS/iPadOS 27, so it is fully remediated by updating. Exploitation requires hands-on physical possession of the locked device and cannot be performed remotely or at scale; EPSS is 0.17% (6th percentile) and no public exploit has been identified at time of analysis, making this a low-to-medium real-world priority driven mostly by confidentiality exposure on lost or stolen devices.
Unauthorized local network access on Apple macOS (all releases prior to Golden Gate 27) lets a malicious or compromised application communicate with local network devices without triggering the macOS Local Network consent prompt. The root cause is improper permission state management (CWE-284), and exploitation is strictly local: the user must launch the offending app (CVSS UI:R), with no remote or unauthenticated path. The independent assessment downgrades confidentiality impact to Low relative to the published CVSS 5.5, limiting practical consequences to reconnaissance of LAN-adjacent devices; no public exploit code has been identified and EPSS is only 0.14% (4th percentile), consistent with a low-priority, targeted issue. Apple has fixed the flaw in macOS Golden Gate 27.
A type confusion issue was addressed with improved checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination.
An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27. Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure.
iCloud Private Relay on Apple platforms could disclose a user's real IP address to a website even while the privacy proxy is active, because of a state-management flaw in the relay implementation. The issue affects iOS and iPadOS before 18.7.10 and before 26.6.1, macOS Tahoe before 26.6.2, and visionOS before 26.6.1, and requires the victim to browse to attacker-controlled web content (UI:R, no privileges needed). Severity is modest (CVSS 4.3, confidentiality-only) and there is no CISA KEV listing or public exploit identified at time of analysis, but the privacy impact is disproportionate for users who depend on Private Relay for anonymity.
A use-after-free memory management flaw in Apple iOS and iPadOS allows a locally installed application to crash the system, causing unexpected device termination (denial of service). All versions prior to iOS 27 / iPadOS 27 are affected per the vendor CPE wildcard and ENISA EUVD version range (0 < 27). Apple addressed the issue with improved memory management in iOS 27 and iPadOS 27; no public exploit code has been identified and the EPSS probability is very low (0.17%, 7th percentile), so this is primarily a stability/patch-hygiene issue rather than an active exploitation threat.
An integer underflow in the macOS SMB client allows a malicious SMB server to crash the operating system, resulting in a denial of service, when a user connects to a shared folder or mount. The flaw affects macOS releases prior to Golden Gate 27, Sequoia 15.8 and Tahoe 26.7, and is fixed in those versions. Exploitation requires the victim to initiate a connection to an attacker-controlled SMB endpoint (CVSS UI:R), there is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is very low at 0.19% (9th percentile), so real-world exploitation pressure is currently minimal.
A local permission-assignment flaw in Apple's mobile and desktop operating systems lets an app installed on the device modify protected parts of the file system, giving it an integrity-only foothold outside its normal sandbox boundaries. Affected platforms are iOS and iPadOS before 26.7 and 27, and macOS before Golden Gate 27, Sequoia 15.8, and Tahoe 26.7; exploitation requires a locally-installed, running app plus user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N), with no confidentiality or availability impact and no remote or network reachability. There is no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV), and EPSS sits at 0.17% (7th percentile), so this is a moderate, not urgent, priority that is addressed by vendor-released updates.
An information disclosure flaw in Apple's iCloud Private Relay lets a website determine a visitor's real IP address even when Private Relay is switched on, defeating the core privacy guarantee of the feature. The issue affects iOS and iPadOS before 26.6.1, macOS before 26.6.2 (Tahoe), and visionOS before 26.6.1, and is reachable from the network but requires the victim to browse to an attacker-controlled page. Apple addressed it through improved state management, and no public exploit code or active exploitation has been identified at time of analysis.
A malicious app already running locally on macOS versions prior to Golden Gate 27 can bypass the clickjacking protections that normally guard secure system prompts, allowing a user who interacts with a manipulated dialog to approve an action the operating system intended to require explicit, deliberate consent. Impact is limited to local integrity (C:N/I:H/A:N per CVSS:3.1/AV:L/AC:L/PR:N/UI:R) - no confidentiality or availability loss, and the attacker needs both prior app execution and victim interaction with the prompt. No public exploit code or confirmed active exploitation has been identified, and EPSS is low at 0.17% (7th percentile); a vendor patch is available in macOS Golden Gate 27.
Information disclosure in Apple iOS and iPadOS versions before 27 allows a locally installed malicious or compromised app to access sensitive user data after the user installs and opens it. The flaw is a permissions issue (CWE-200) that Apple addressed with additional restrictions in iOS 27 and iPadOS 27. No public exploit identified at time of analysis and EPSS is 0.17% (7th percentile), but the CVSS score of 5.5 reflects the high confidentiality impact; exploitation requires local app execution and user interaction, with no remote path.
Sensitive user data disclosure in Apple iOS and related platforms allows a locally installed malicious app to bypass entitlement checks and access protected data, affecting Safari before 27, iOS/iPadOS before 26.7 and 27, macOS before Golden Gate 27, and visionOS before 27. The flaw requires local app installation and user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R) and only impacts confidentiality (C:H) with no integrity or availability effect. No public exploit has been identified at time of analysis, and EPSS is 0.18% (7th percentile), indicating low exploitation likelihood.
A path-validation weakness in Apple macOS lets a malicious application read files outside its permitted scope, exposing restricted data to an app that should not be able to reach it. Exploitation requires local conditions: the attacker must deliver a crafted application to the Mac and convince the user to launch it (CVSS:3.1/AV:L/AC:L/PR:N/UI:R), after which the app can achieve high confidentiality impact but cannot modify data or cause a denial of service. The issue is fixed in macOS Tahoe 26.7, macOS Sequoia 15.8, and macOS Golden Gate 27; there is confirmed actively exploited escalation is not indicated - no public exploit code has been identified at time of analysis and EPSS is low (0.17%, 6th percentile), making this a moderate-severity local information-disclosure flaw rather than an urgent priority, though the upstream fix should still be applied on any unpatched Mac.
A malicious or compromised app running on iOS and iPadOS prior to 26.7 (and prior to 27), and on visionOS prior to 27, can abuse insufficient path validation to write to protected parts of the file system. Apple addressed the path handling flaw with improved validation in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, and visionOS 27, so patched devices are not exposed. Scoring 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N), the issue requires the user to install and launch a hostile app but then needs no additional privileges; EPSS is only 0.17% (6th percentile) and no public exploit code or confirmed active exploitation has been identified at time of analysis, so this is a moderate local-integrity flaw rather than a network-exploitable emergency.
Unexpected system termination can be triggered on Apple devices by a locally executed app that exploits a use-after-free memory corruption in shared system code, which Apple addressed through improved memory management. The flaw affects essentially every current Apple OS branch below the fixed releases — iOS/iPadOS 26.6+, macOS 15.8/26.6+/27, tvOS 26.6+/27, visionOS 26.6+/27 and watchOS 26.6+/27 — with CVSS 5.5 reflecting an availability-only impact and a local attack vector. EPSS is low (0.24%, 16th percentile), no public exploit code has been identified, and there is no CISA KEV entry, so this is a routine patch-cycle item rather than an urgent threat.
A sandboxed application running on Apple iOS/iPadOS, macOS Golden Gate, tvOS, visionOS, or watchOS can bypass authorization checks and read contents of the System Keychain, exposing stored secrets such as credentials, certificates, and tokens. The flaw stems from incorrect authorization combined with faulty state management (CWE-863) and affects all versions prior to the 27 release train; the platform owner has shipped fixes in iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27. The CVSS v3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, score 5.5) is consistent with our independent assessment: this is a genuine but locally-scoped access-control defect that requires an attacker to get a sandboxed app onto the device and have the user launch it (UI:R), so it cannot be triggered remotely over the network. EPSS is 0.16% (6th percentile) and no public exploit code has been identified at time of analysis, with no CISA KEV listing - impact is limited to confidentiality (keychain disclosure) with no integrity or availability effect, and patched 27-or-newer systems are not exposed.
Authorization bypass in Apple macOS allows a locally-running app to read sensitive user data without the user's consent, affecting macOS versions below Sequoia 15.8, below Tahoe 26.7, and below Golden Gate 27. Exploitation requires an attacker to first get a malicious or compromised application onto the machine and running under a standard, non-administrative user account (CVSS 3.1 AV:L/PR:L/UI:N), so this is not remotely reachable and no user interaction is needed once that app executes. Impact is limited to confidentiality of user data (C:H, I:N, A:N) - there is no code execution, privilege escalation, or system modification, and the EPSS score of 0.17% (6th percentile) plus the absence of KEV listing indicate no public exploit identified at time of analysis; Apple has released patched builds.
Sensitive user data can be read by a malicious or compromised app on unpatched Apple devices because a logic-validation flaw lets the app cross its data-access boundary. Affected platforms are iOS and iPadOS before 26.7 and before 27, macOS before Sequoia 15.8, before Tahoe 26.7 and before Golden Gate 27, tvOS before 27, and visionOS before 27; the assessed vector (AV:L/AC:L/PR:N/UI:R/C:H/I:N/A:N) shows the attacker must first get a hostile app onto the device and the user must run it, with confidentiality-only impact. Vendor patches are available for every platform, EPSS rates exploitation probability at roughly 0.18% (7th percentile), and no public exploit has been identified at time of analysis.
Gatekeeper protection in Apple macOS can be bypassed by a malicious application, allowing unsigned or unnotarized code to launch on unpatched Macs. The flaw is a state-management logic error in the Gatekeeper check, rated CVSS 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N): exploitation is local and requires the victim to download and open an attacker-controlled app, so it depends on user interaction rather than a remote network path, and it yields no confidentiality or availability impact by itself - it must be chained with a malicious payload. Affected systems are macOS versions below Golden Gate 27, Sequoia 15.8, and Tahoe 26.7; there is no public exploit identified at time of analysis, EPSS is low at 0.18% (8th percentile), and no CISA KEV entry exists.
An incorrect authorization check in Apple macOS lets an application already running on a Mac read sensitive user data it should not be able to reach, an impact limited to confidentiality with no code execution, modification, or denial of service. Exploitation requires local code execution on the target (the assessed vector is AV:L/PR:L/UI:N), so it is only reachable by a malicious or attacker-controlled app already present on the device, and only on unpatched systems below macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27. Apple has released fixes in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27; no public exploit code or confirmed active exploitation has been identified, and EPSS is low at 0.19% (9th percentile), making this a moderate, locally-scoped risk rather than an urgent priority.
Processing a maliciously crafted image on unpatched Apple devices can trigger a memory-corruption fault that crashes the affected process, producing a local denial-of-service (CVSS 3.1 base 5.5, AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Affected platforms are iOS and iPadOS before 18.7.10 and macOS before Sonoma 14.8.8, Sequoia 15.7.8, and Golden Gate 27; the attacker cannot trigger the flaw remotely and must get the victim to open or auto-render the crafted image. All signals point to a low-priority issue: EPSS is 0.20% (10th percentile), no public exploit code has been identified at time of analysis, there is no CISA KEV listing, and vendor patches are already available.
A use-after-free (CWE-416) in the Apple macOS SMB client allows a maliciously crafted SMB network share to crash the operating system, causing system termination. Exploitation requires the user to mount the attacker-controlled share (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 6.5), so impact is limited to denial of service with no confidentiality or integrity loss. Apple has released fixes in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7; there is no CISA KEV listing and no public exploit code identified, and EPSS is low at 0.17% (6th percentile).
A remote denial-of-service flaw in Apple iOS and iPadOS (all versions before 27) stems from insufficient input validation in a code path that processes remotely supplied content, allowing an attacker to crash or hang the affected feature. Exploitation requires the victim to interact with the malicious input (CVSS UI:R) and yields only availability impact - confidentiality and integrity are unaffected. Apple addressed the issue with improved input validation in iOS 27 and iPadOS 27; there is no evidence of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so the practical priority is routine patching rather than emergency response.
Local applications on Apple macOS can trigger an integer overflow that terminates the system unexpectedly, affecting macOS versions prior to Golden Gate 27, Sequoia 15.8, and Tahoe 26.7. The flaw is a local, low-privilege availability issue (CVSS 5.5, AV:L/PR:L/A:H) with no confidentiality or integrity impact, and it has been fixed by Apple in the referenced security advisories. Exploitation probability is low (EPSS 0.19%, 9th percentile), there is no CISA KEV listing and no public exploit code identified at time of analysis, so this is a reliability/denial-of-service hardening issue rather than an active threat.
Improper access control in Apple iOS and iPadOS, macOS Tahoe, and visionOS lets a locally installed app read user-sensitive data that it should not be able to reach. The flaw (CWE-284) stems from insufficient validation checks and is remediated in iOS/iPadOS 26.6, macOS Tahoe 26.6, and visionOS 26.6; the assessed vector (CVSS 5.5, AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) means exploitation requires the victim to install and launch a malicious app on an unpatched build, with no remote attack path and no integrity or availability impact. The attacker's app needs no special privileges, but there is no public exploit identified at time of analysis and EPSS is low at 0.19% (9th percentile), so this is a genuine but low-priority confidentiality issue.
Improper access control (CWE-284) in Apple iOS, iPadOS, and macOS allows a locally installed app to read user-sensitive data outside the permission boundary the operating system is supposed to enforce, an information-disclosure impact rated CVSS 5.5 (confidentiality High, integrity None, availability None). Exploitation is local and requires user interaction: the attacker must first get a malicious or compromised app onto the device and convince the user to launch it (AV:L, PR:N, UI:R), so there is no remote, network-triggerable, or self-propagating path. Apple has released fixes in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27; no public exploit code has been identified at time of analysis and EPSS is low at 0.17 percent (7th percentile), with no CISA KEV listing.
Information disclosure in Apple iOS, iPadOS, macOS, tvOS, visionOS and watchOS allows a locally installed and running app to read a persistent account identifier that the operating system should have kept out of its reach. The root cause is a permissions/sandbox restriction gap (CWE-200), fixed by Apple with additional access restrictions in iOS and iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27; successful exploitation requires the user to install and launch a malicious local app (AV:L/PR:N/UI:R), so a remote, unauthenticated network attack is not possible. There is no public exploit identified at time of analysis and EPSS is 0.18% (8th percentile), making this low-to-moderate risk rather than an urgent priority, with impact confined to the confidentiality of one identifier and no integrity or availability effect.
Persistent device identifier disclosure in Apple iOS, iPadOS, macOS, tvOS, visionOS and watchOS stems from an incorrect authorization check that lets an ordinary, unprivileged installed app read identifiers it should not be able to access (CWE-863, CVSS 5.5, C:H/I:N/A:N). Exploitation is local-only (AV:L, PR:N) and requires user interaction to install and launch a malicious or compromised application on a device running an unpatched OS; there is no remote or network path, and no public exploit code has been identified at time of analysis, with EPSS at 0.17% (7th percentile) and no CISA KEV listing. Apple has released fixed versions and the impact is confined to confidentiality/privacy rather than code execution or data modification.
Improper path validation in Apple macOS allows a locally executing application to read files outside the scope it is authorized to access, resulting in disclosure of restricted data on affected systems. The issue affects macOS versions before 15.8 (Sequoia), before 26.7 (Tahoe), and before 27 (Golden Gate), and is rated CVSS 5.5 with confidentiality-only impact (C:H/I:N/A:N); exploitation requires a malicious or compromised app to be running locally and relies on user interaction (AV:L/UI:R, PR:N). No public exploit code has been identified at time of analysis and the vulnerability is not in CISA KEV; EPSS is low at 0.18% (7th percentile), and vendor-released fixes are available in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27.
Improper access control in Apple's operating system family (iOS/iPadOS, macOS, tvOS, visionOS, watchOS) lets a locally installed app bypass intended permission restrictions and read sensitive user data it should not be able to reach. Apple addressed the flaw with additional restrictions in iOS 26.7/iPadOS 26.7, iOS 27/iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27. Exploitation requires the attacker to already run code on the device as an app (PR:L, AV:L), and no public exploit code or active exploitation has been identified; EPSS is only 0.20% (10th percentile) and CISA SSVC records exploitation as 'none'.
An integer overflow in Apple's file-processing code, fixed through improved input validation, allows a maliciously crafted file to cause disclosure of process memory on affected Apple platforms. Unpatched devices running iOS/iPadOS before 26.7 and 27, macOS before Sequoia 15.8, Tahoe 26.7 or Golden Gate 27, plus tvOS, visionOS and watchOS before 27 are exposed, but exploitation requires the victim to open the crafted file (CVSS UI:R). There is no public exploit code and no evidence of active exploitation; EPSS is very low at 0.18% (8th percentile) and CISA SSVC rates the issue non-automatable with only partial technical impact, and Apple has released patches.
An improper authorization flaw in Apple iOS/iPadOS and macOS Tahoe allows a locally installed application to reach sensitive user data that the platform's authorization state checks should have blocked. Apple addressed the flaw through improved state management, shipping fixes in iOS 26.6, iPadOS 26.6, and macOS Tahoe 26.6 for all versions prior to those releases. The issue is local-only (CVSS:3.1/AV:L/AC:L/PR:L/UI:N, 5.5) with confidentiality impact only; EPSS is 0.15% (5th percentile), CISA SSVC rates exploitation as 'none' and technical impact as 'partial', and no public exploit code was identified at time of analysis.
Sandboxed applications on Apple iOS, iPadOS, macOS, and visionOS can bypass sandbox file-access restrictions and read restricted files because of insufficient path validation in the affected operating system components (CWE-22). Exploitation requires a local attacker to get a crafted sandboxed app installed and launched by the user on a vulnerable device (CVSS 3.1 AV:L/AC:L/PR:N/UI:R), making this a delivery-gated, confidentiality-only information-disclosure flaw rather than a remotely reachable one. Apple has shipped fixes in iOS 26.7 and 27, iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, and visionOS 27; no public exploit code has been identified at time of analysis, the EPSS score is only 0.17% (6th percentile), and the CVE is not listed in CISA KEV.
An out-of-bounds read in Apple's macOS SMB client allows a malicious SMB server to leak kernel memory to an attacker when a user connects to a shared folder, fixed in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. Exploitation requires the victim to initiate a connection to an attacker-controlled or compromised SMB share (CVSS UI:R), so it is user-interaction dependent rather than wormable, and the raw impact is confidentiality only — kernel memory disclosure, not code execution. EPSS is very low (0.17%, 6th percentile), there is no CISA KEV listing, and no public exploit code has been identified; SSVC rates exploitation as 'none', automatable as 'no', and technical impact as 'partial'.
Mounting a crafted disk image on an affected Mac can crash the system: Apple macOS Sequoia, Tahoe and Golden Gate contain a buffer overflow in the disk-image handling path that is triggered when a user opens a malicious image, requiring no credentials. Apple has shipped fixes in macOS Sequoia 15.8, macOS Tahoe 26.7 and macOS Golden Gate 27. EPSS is low (0.19%, 8th percentile), there is no CISA KEV listing and no public exploit code identified at time of analysis, so the practical concern is availability loss (forced termination, potential unsaved-work loss) rather than code execution.
An incorrect-authorization flaw in Apple's Bluetooth state management allows an already-installed app to obtain Bluetooth access it was never granted, undermining the platform's per-app permission model on iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27 - but only on versions prior to those releases. Apple fixed the issue through improved state handling and published coordinated advisories for every affected platform; a local attacker or malicious app is required, so this is not remotely reachable without code execution already on the device. No public exploit code has been identified and EPSS is very low (0.20%, 10th percentile), so this rates as a patching-hygiene item rather than an emergency.
Kernel memory corruption in Apple macOS lets a locally running application crash the operating system or corrupt kernel memory, with the potential for further kernel-level compromise. The flaw is a memory-bounds handling defect (CWE-119) present in macOS versions before Golden Gate 27, Sequoia 15.8, and Tahoe 26.7, and is fixed in those releases per Apple's advisories. Exploitation requires the ability to execute code as a local user (CVSS AV:L/PR:L), EPSS is low at 0.19% (9th percentile), and there is no public exploit code or CISA KEV listing at time of analysis.
A use-after-free memory-management flaw in Apple's operating systems allows a locally installed application to crash the system, causing unexpected termination (denial of service) on affected iPhone, iPad, Mac, and Apple Vision Pro devices. Apple addressed the issue across iOS 26.7/iPadOS 26.7, iOS 27/iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, and visionOS 27. There is no evidence of active exploitation: CISA KEV does not list the CVE, SSVC records exploitation as 'none' and automatable as 'no', EPSS is a low 0.18% (7th percentile), and no public exploit code has been identified at the time of analysis.
Local information disclosure in Apple macOS lets a malicious or compromised application read sensitive user data on hosts running versions earlier than macOS Sequoia 15.8, macOS Tahoe 26.7 or macOS Golden Gate 27. Apple fixed the issue with improved checks in three separate security advisories covering each release train. Exploitation requires the attacker to get an app running on the target Mac with user-level privileges; no public exploit code has been identified at time of analysis and EPSS is 0.17% (6th percentile), so this is a low-volume, targeted local threat rather than a mass-exploitation event.
In the Linux kernel, the following vulnerability has been resolved: cpufreq: apple-soc: Fix OPP table cleanup apple_soc_cpufreq_init() adds OPP tables from firmware, but some failure paths do not remove them. The driver also uses dev_pm_opp_remove_all_dynamic(), which is not the right cleanup helper for OPP tables loaded from firmware. Use the cpumask OPP helper after the policy CPU mask has been populated. Pair it with the matching cpumask remove helper on failure paths and in apple_soc_cpufreq_exit(). This also removes the separate dev_pm_opp_set_sharing_cpus() call, as the cpumask helper loads the DT OPP tables for all CPUs in the policy.
Multiple local privilege escalation flaws in Palo Alto Networks GlobalProtect App on Windows, macOS, and Linux allow any authenticated local user to elevate privileges to NT AUTHORITY\SYSTEM or root. The root cause is CWE-426 (Untrusted Search Path), a class of vulnerability commonly manifesting as DLL search-order hijacking or PATH manipulation that the privileged VPN client process follows. No public exploit is known at time of analysis, and Palo Alto has released fixed versions; iOS, Android, and ChromeOS deployments are explicitly not affected.
Sensitive information disclosure in Google Chrome's Mobile component on iOS (versions prior to 153.0.8010.36) allows remote unauthenticated attackers to leak confidential browser data by luring victims to a crafted HTML page through social engineering. The flaw is platform-specific - affecting only the iOS Mobile code path, not desktop or Android - and is fixed in the 153.0.8010.36 stable channel release. No active exploitation is confirmed (not in CISA KEV) and EPSS probability is 0.17% (7th percentile), consistent with Chromium's own 'Low' severity rating, which contrasts with the NVD CVSS 6.5 Medium score.
Observable discrepancy (CWE-203) in the Safebrowsing component of Google Chrome on iOS prior to 153.0.8010.36 enables a remote attacker with a pre-compromised renderer process to leak sensitive information through behavioral differences when processing a crafted HTML page. The vulnerability is iOS-platform-specific and is chained after renderer compromise rather than exploited standalone. No public exploit exists and EPSS probability is 0.24%, consistent with the multi-stage exploitation requirement.
Cleartext transmission of sensitive information via the HttpsUpgrades component in Google Chrome on iOS (versions prior to 153.0.8010.36) exposes user data to network-positioned attackers through crafted traffic. The HttpsUpgrades mechanism, which is responsible for automatically promoting HTTP requests to HTTPS, fails under certain conditions on iOS, leaving sensitive request content unencrypted in transit. With no public exploit identified and high attack complexity required (network positioning), the real-world risk is moderate despite the C:H confidentiality impact.
Web origin policy bypass in Google Chrome's Mobile component on iOS allows a remote attacker to read cross-origin content via a race condition triggered through a crafted HTML page. Affected versions are all Chrome releases prior to 153.0.8010.36 on iOS. Exploitation requires social engineering to induce the target to visit a malicious page, and the race condition's timing dependency (AC:H) limits reliable exploitation, though a successful attack permits limited cross-origin data disclosure. No public exploit identified at time of analysis.
Heap out-of-bounds read in gdk-pixbuf's ICNS decompression routine allows an attacker to crash GNOME applications or disclose adjacent heap memory by supplying a crafted Apple Icon Image (.icns) file. The uncompress() function, which handles RLE-encoded ICNS data, lacks bounds validation on the source buffer during decompression. Exploitation requires user interaction - the target must open or preview the malicious file - but thumbnail-rendering paths in file managers such as Nautilus may reduce that barrier. No public exploit or KEV listing has been identified at the time of analysis.
Repeated external URL scheme invocations from a malicious webpage can flood Firefox for iOS with system confirmation prompts or trigger cascading external application launches, rendering the browser temporarily unusable. All Firefox for iOS versions prior to 155.1 on Apple iOS devices are affected. No active exploitation has been identified; Mozilla released the fix in Firefox for iOS 155.1, and exploitation requires the user to visit the attacker-controlled page.
Address bar spoofing in Firefox for iOS lets a malicious webpage stall a popup's cross-origin navigation after the browser internally commits it, causing the address bar to display the intended destination's origin while the popup continues rendering attacker-controlled content. All Firefox for iOS releases prior to 155.0 are affected; the fix shipped in version 155.0 per Mozilla advisory MFSA2026-81. No public exploit has been identified and CISA SSVC confirms exploitation status as none, but the phishing potential is realistic given the deceptive UI state.
Out-of-bounds read in Exiv2's RemoteIo::Impl::populateBlocks() function affects versions prior to 0.28.9, exploitable only when the tool is invoked against a remote URL rather than a local file. An attacker controlling a remote server can serve a crafted image to trigger the read when a user runs exiv2 against that URL, potentially causing information disclosure or a crash. No public exploit code or active exploitation has been identified; the vulnerability is rated low severity and fixed in the 0.28.9 release.
Prompt injection in Microsoft Edge for iOS exposes users to network-based spoofing attacks through Microsoft Edge's AI/Copilot integration. Malicious web content can embed adversarial LLM prompts that, when processed by Edge's AI features, manipulate the model to produce spoofed or misleading output - potentially impersonating trusted content or bypassing AI-enforced guardrails. The CVSS vector (PR:N/UI:R) indicates no attacker authentication is required, but a user must interact with Edge on iOS while AI features are active. No public exploit code has been identified at time of analysis, and a vendor-released patch is available via MSRC.
Unauthenticated BLE packet injection in BitChat for iOS v1.5.0 (reported in the CVE as v1.15.0) allows any device within Bluetooth adjacency range to inject crafted MESSAGE packets into the mesh gossip cache, causing denial of service for all mesh participants. The attack exploits a TTL=0 validation bypass in BLEService.swift that accepted packets as anonymous without full sender authentication. A public proof-of-concept is available at a named GitHub repository; no active exploitation has been confirmed by CISA KEV.
HCL Traveler's Apple profile generation page reflects user-submitted Logon Name and Mail Address values into generated Apple device synchronization profiles without verifying those values against the authenticated user's entry in the HCL Domino directory. An authenticated, low-privileged user can therefore embed arbitrary directory values into a generated Apple profile. Practical impact is severely constrained: the resulting profile is incomplete without additional credentials and, per vendor description, can only be used to configure the attacker's own Apple device - making this an authenticated, self-targeting input validation gap rather than a lateral-movement primitive. No public exploit code exists and the CVE is not listed in CISA KEV.
Path traversal in RustDesk's macOS clipboard file-paste feature allows a remote session peer to write files outside the intended target directory by supplying crafted file descriptor names containing parent-directory components or absolute paths. Versions 1.3.9 through 1.4.9 on macOS are affected; exploitation requires an active RustDesk session and passive victim interaction (initiating a clipboard paste). No public exploit code and no CISA KEV listing have been identified at time of analysis; a vendor fix is available via commit 6f1eb164.
Information disclosure in Google Chrome's Mobile component on iOS (all versions prior to 152.0.7977.65) allows a local attacker to read sensitive information by inducing the user to open a crafted file. Exploitation requires physical or logical local access to the device and user interaction, limiting the practical attack surface significantly. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as none with only partial technical impact.
Information disclosure in Google Chrome's Mobile component on iOS exposes sensitive data to local attackers operating via a local program, affecting all Chrome for iOS versions prior to 152.0.7977.65. The vulnerability is classified CWE-200 (Exposure of Sensitive Information) and carries a Chromium internal severity of Low, which aligns with SSVC's assessment of partial technical impact and non-automatable exploitation. No public exploit code exists and no active exploitation has been confirmed; the EPSS score of 0.18% (7th percentile) reflects minimal real-world exploitation pressure.
System access restriction bypass in Google Chrome Mobile on iOS prior to version 152.0.7977.65 enables a remote attacker to circumvent platform-level security controls by luring a victim to a specially crafted HTML page. The flaw stems from improper input validation (CWE-20) in Chrome's iOS mobile implementation and results in a low-integrity impact with no confidentiality or availability consequence. No public exploit code or active exploitation has been identified at time of analysis; EPSS probability is 0.22% (12th percentile), and CISA SSVC classifies exploitation as none and technical impact as partial, consistent with a low-priority patching posture for most organizations.
The Passwords (built-in credential manager) component of Google Chrome on iOS prior to version 152.0.7977.65 leaks sensitive password data to a local attacker who can supply a crafted file, enabling unauthorized retrieval of stored credentials. Only the iOS platform is affected, and the Chromium security team rates this as Low severity internally. No public exploit code exists and EPSS stands at 0.11% (1st percentile), indicating very low near-term exploitation likelihood despite the high confidentiality impact of the exposed data.
Incorrect authorization in Google Chrome Mobile on iOS (versions prior to 152.0.7977.65) allows a remote attacker to bypass system access restrictions by inducing a user to visit a crafted HTML page. The flaw stems from improper authorization enforcement (CWE-863) within the iOS-specific mobile browser code path, permitting limited integrity violations without confidentiality or availability impact. No public exploit has been identified and EPSS sits at a low 0.23% (13th percentile), consistent with a medium-severity, user-interaction-dependent issue not yet seeing active targeting.
Null pointer dereference in iOS and iPadOS allows a locally installed app to trigger unexpected system termination (device crash/reboot) by supplying crafted input that bypasses input validation. Affected versions span the legacy 18.x branch (prior to 18.7.9) and the current 26.x branch (prior to 26.5), covering a broad swath of Apple mobile devices. No active exploitation has been identified - CISA KEV status is absent, SSVC rates exploitation as none, and EPSS sits at the 1st percentile - placing this squarely as a patch-cycle priority rather than an emergency response item.
Buffer overflow in Apple macOS allows a locally-running app with standard user privileges to cause unexpected system termination or write arbitrary data into kernel memory. Affected versions include macOS Sequoia before 15.7.7 and macOS Sonoma before 14.8.7. No public exploit code or active exploitation has been identified at time of analysis; EPSS sits at 0.11% (1st percentile), consistent with SSVC's assessment of no current exploitation.
Insufficient permissions restrictions in iOS and iPadOS (all versions prior to 26.5) allow a malicious locally-installed app to enumerate other applications installed on the device. The flaw, rooted in improper privilege management (CWE-269), exposes app inventory data that Apple's sandbox model is designed to protect. No public exploit identified at time of analysis, EPSS is extremely low at 0.09%, and SSVC exploitation status is confirmed none - placing this squarely as a low-urgency privacy concern rather than an active threat.
Improper access control in Apple watchOS prior to 26.4 allows a person with physical possession of a locked Apple Watch to view the device owner's contacts without authentication. The flaw, classified as CWE-284 (Improper Access Control), stems from insufficient permissions checking on a code path accessible from the lock screen. Apple has confirmed the fix in watchOS 26.4; no active exploitation has been identified per CISA SSVC assessment.
Unexpected application termination in Apple macOS arises when processing a maliciously crafted file, triggering an out-of-bounds read (CWE-125) that crashes the handling application. Affected versions span all three active macOS release trains: Sonoma prior to 14.8.5, Sequoia prior to 15.7.5, and Tahoe prior to 26.4. No public exploit code has been identified and EPSS sits at the 5th percentile (0.15%), indicating low real-world exploitation probability; vendor-released patches are available for all three tracks.
Path traversal in Apple's open-source container runtime (versions before 1.2.0) enables a malicious builder peer to request host files by crafted names that resolve outside the build context, leaking arbitrary host filesystem contents. The CVSS vector (AV:N/AC:L/PR:L) indicates network-accessible exploitation by a low-privileged builder peer with no user interaction required. No active exploitation has been identified (no CISA KEV listing), and SSVC rates exploitation as none and automatability as no, reducing immediate operational urgency.
NIOWebSocket in swift-nio (all versions before 2.101.0) crashes the hosting process when any unauthenticated remote peer sends a single crafted 11-byte WebSocket frame following a completed handshake, terminating all active connections until the service restarts. Frameworks built on swift-nio - including Vapor and Hummingbird - inherit this exposure whenever they accept WebSocket connections. No public exploit code has been identified, but SSVC classifies the attack as automatable, lowering the bar for repeated or scripted denial-of-service.
Memory exhaustion denial-of-service in MCP PHP SDK's HttpTransport crashes client processes when connected to a malicious or compromised MCP server. Affected versions (mcp/sdk >= 0.5.0, < 0.7.1) accumulate SSE stream data into an unbounded in-memory buffer inside processSSEStream() - a server that withholds the SSE event delimiter ('\n\n') forces the buffer to grow at 4 KiB per tick until the PHP process hits its memory_limit and crashes with a fatal OOM error. A proof-of-concept is publicly available and reproduces the crash deterministically against the released Packagist package; this is not confirmed in CISA KEV.
Froxlor's standalone AJAX endpoint (lib/ajax.php) entirely bypasses the CSRF token enforcement present in lib/init.php, allowing a remote attacker to forge state-changing POST requests on behalf of any authenticated administrator who visits a malicious page. Successful exploitation modifies administrator API key properties - specifically injecting the attacker's IP into the allowed_from whitelist and setting valid_until to -1 (never expires) - creating a persistent foothold for future API abuse if the API secret is later obtained. A working proof-of-concept HTML page is included in the public GitHub security advisory (GHSA-xpr4-8vp6-c87j); no CISA KEV listing found at time of analysis. EPSS data was not provided, but the UI:R requirement and niche product footprint constrain real-world exploitation.
External control of file name or path (CWE-73) in Citrix WorkSpace App 2607 on macOS allows a local low-privileged attacker, with active user interaction, to manipulate file system paths and cause high integrity and availability impacts on the vulnerable system. The CVSS 4.0 vector confirms local access with low privileges and required user interaction, resulting in a medium severity score of 5.2. No public exploit code or CISA KEV listing has been identified at time of analysis, but the integrity and availability impacts are rated High, indicating potential for significant data manipulation or denial of service on affected endpoints.
Safari on iOS, iPadOS, and macOS Tahoe crashes when processing specially crafted web content due to improper state management (CWE-703), resulting in a denial-of-service condition. Affected are iOS and iPadOS versions prior to 18.7.10 and 26.6.1, and macOS Tahoe prior to 26.6.2. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; impact is limited entirely to availability.
Kernel state leakage in Apple iOS and iPadOS prior to version 18.7.10 enables a locally-installed, low-privileged app to read sensitive kernel memory through a validation gap classified as CWE-200. The flaw was addressed by Apple with additional input validation, and the fix is confirmed available in iOS 18.7.10 and iPadOS 18.7.10. No public exploit code or active exploitation has been identified at time of analysis, though kernel state disclosure of this type is a common precursor to full privilege escalation chains on mobile platforms.
Safari on Apple iOS, iPadOS, and macOS crashes unexpectedly when processing maliciously crafted web content due to improper state management (CWE-703). Affected platforms include all iOS and iPadOS versions prior to 26.6.1 and macOS Tahoe versions prior to 26.6.2. Impact is limited to a denial-of-service condition - browser crash only, with no confidentiality or integrity consequences - and no public exploit or active exploitation has been identified at time of analysis.
Memory corruption via race condition in Safari's web content processing causes unexpected application crashes on iOS, iPadOS, and macOS. Affected platforms include iOS and iPadOS prior to 18.7.10 and 26.6.1, and macOS Tahoe prior to 26.6.2, covering both the legacy 18.x and current 26.x release trains. No public exploit identified at time of analysis, and exploitation requires high attack complexity due to the race condition timing requirement, making opportunistic mass exploitation unlikely.
Uncontrolled resource consumption in Apple's image processing subsystem affects iOS/iPadOS (prior to 26.6.1) and macOS Tahoe (prior to 26.6.2), enabling a network-reachable denial-of-service when a user processes a specially crafted image. Apple has released patches across both platform families via support advisories 148281 and 148282. No public exploit code exists and EPSS sits at 0.15% (5th percentile), indicating negligible observed exploitation pressure; the vulnerability is not listed in CISA KEV.
Safari on Apple iOS, iPadOS, and macOS Tahoe crashes unexpectedly when processing maliciously crafted web content due to a memory handling flaw classified under CWE-119 (improper restriction of buffer operations). Affected platforms span iOS and iPadOS prior to versions 18.7.10 and 26.6.1, as well as macOS Tahoe prior to 26.6.2. An unauthenticated remote attacker can trigger this availability-only denial-of-service by inducing a victim to visit a crafted webpage; no confidentiality or integrity impact is indicated by the CVSS vector. No public exploit code exists and this vulnerability is not listed in CISA KEV at time of analysis.
Kernel memory corruption in Apple iOS, iPadOS, and macOS Tahoe allows a malicious app to cause unexpected system termination or corrupt kernel memory through improper memory buffer handling. Affected versions are iOS and iPadOS prior to 26.6.1 and macOS Tahoe prior to 26.6.2, with Apple having released patches via security advisories at support.apple.com. No public exploit code has been identified and EPSS stands at 0.15% (5th percentile), indicating low observed exploitation probability at time of analysis.
Safari on Apple iOS, iPadOS, and macOS crashes unexpectedly when processing maliciously crafted web content, resulting in a denial-of-service condition. Affected platforms include iOS and iPadOS prior to 18.7.10 and 26.6.1, and macOS Tahoe prior to 26.6.2. An unauthenticated remote attacker can trigger the crash by luring a user to visit a malicious webpage, with no confidentiality or integrity impact beyond service disruption.
Safari on Apple iOS, iPadOS, and macOS Tahoe crashes unexpectedly when processing specially crafted web content due to a state management flaw. Affected versions span both legacy (iOS/iPadOS <18.7.10) and current-generation (iOS/iPadOS <26.6.1, macOS Tahoe <26.6.2) release trains, meaning a wide range of unpatched Apple devices are vulnerable. The impact is limited to a denial-of-service crash requiring user interaction; no public exploit has been identified at time of analysis, and EPSS probability sits at a very low 0.14% (4th percentile).
Memory corruption in Apple's web content processing stack affects iOS and iPadOS prior to version 26.6.1 and macOS Tahoe prior to 26.6.2, triggered when a user processes maliciously crafted web content. Classified under CWE-119 (improper bounds restriction), the flaw carries a CVSS 5.4 medium rating reflecting limited confidentiality and integrity impact without availability disruption. No public exploit code has been identified and no active exploitation is confirmed by CISA KEV, making this a standard patch-cycle priority rather than an emergency response item.
Safari on Apple iOS, iPadOS, and macOS Tahoe crashes unexpectedly when processing maliciously crafted web content due to a state management flaw in WebKit. Affected are all iOS and iPadOS versions prior to 18.7.10 and 26.6.1, and macOS Tahoe prior to 26.6.2. An attacker can trigger a denial-of-service condition by luring a user to visit a malicious webpage, causing the browser to crash; no public exploit has been identified at time of analysis and EPSS sits at the 4th percentile, indicating very low observed exploitation probability.
Out-of-bounds read (CWE-125) in Safari's web content processing engine causes an application crash when parsing maliciously crafted web pages, affecting iOS, iPadOS, and macOS Tahoe. Impacted platforms include iOS and iPadOS below versions 18.7.10 and 26.6.1, and macOS Tahoe below 26.6.2. Apple has shipped patches across all affected release branches; no public exploit code or active exploitation has been identified at time of analysis.
Memory corruption in Apple's web content processing engine affects iOS, iPadOS, and macOS Tahoe, allowing a remote unauthenticated attacker to trigger CWE-119 buffer mismanagement when a user processes maliciously crafted web content. Affected platforms span both the legacy iOS 18.x branch and the current iOS/iPadOS 26.x line, as well as macOS Tahoe 26.x, indicating broad reach across Apple's device ecosystem. No public exploit identified at time of analysis; EPSS score of 0.14% (4th percentile) reflects very low current exploitation probability, and the vulnerability is not listed in CISA KEV.
Safari on iOS and iPadOS prior to version 18.7.10 crashes unexpectedly when processing maliciously crafted web content due to a memory handling flaw classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). The vulnerability is network-delivered but requires user interaction - a victim must open the crafted page in Safari - and its impact is limited strictly to availability, with no confidentiality or integrity exposure. No public exploit code is identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog.
Unexpected process termination in Apple iOS/iPadOS and macOS Tahoe can be triggered remotely by luring a user to visit maliciously crafted web content, exploiting a use-after-free flaw in the web content rendering engine. The vulnerability affects iOS and iPadOS versions prior to 26.6.1 and macOS Tahoe prior to 26.6.2, with impact limited to availability - crashing the affected browser or WebKit-based process - and no confirmed confidentiality or integrity loss. No public exploit code or CISA KEV listing is identified at time of analysis, though the low-complexity, network-accessible attack surface warrants prompt patching given the broad Apple device install base.
Sensitive user information disclosure in Apple iOS, iPadOS, and macOS Tahoe stems from a logic issue classified as a Protection Mechanism Failure (CWE-693), where security checks were insufficiently enforced, allowing a locally installed app to bypass intended data access controls. Affected platforms include iOS and iPadOS prior to 26.6.1 and macOS Tahoe prior to 26.6.2. No public exploit code has been identified and the EPSS score of 0.17% (7th percentile) signals low exploitation probability, though the high confidentiality impact (C:H) and Apple's broad install base keep this relevant for enterprise mobile management programs.
Safari crashes on Apple iOS, iPadOS, and macOS when processing maliciously crafted web content due to a state management defect classified under CWE-119 (buffer boundary violation). Affected platforms span iOS and iPadOS prior to 18.7.10 and 26.6.1, and macOS Tahoe prior to 26.6.2. An unauthenticated remote attacker can trigger this denial-of-service condition by luring a user to a specially crafted webpage, though impact is limited to an application crash with no confirmed confidentiality or integrity consequence. No public exploit identified at time of analysis, and EPSS at 0.14% (4th percentile) signals negligible current attacker interest.
Memory corruption in Apple's Safari browser across iOS, iPadOS, and macOS Tahoe allows remote attackers to crash Safari by delivering maliciously crafted web content, requiring only passive user interaction - visiting a malicious page. Impact is strictly limited to availability (denial of service via browser crash); no confidentiality or integrity compromise is indicated by either the description or the CVSS vector. No public exploit code has been identified at time of analysis, and the EPSS score of 0.14% (4th percentile) signals very low exploitation probability; Apple has released patches across all affected platforms.
Safari on Apple iOS, iPadOS, and macOS crashes unexpectedly when processing maliciously crafted web content due to improper memory handling (CWE-119) in the underlying WebKit engine. Affected users on iOS/iPadOS below 18.7.10 or 26.6.1, and macOS Tahoe below 26.6.2, are exposed to a denial-of-service condition triggered by visiting an attacker-controlled webpage. No public exploit code has been identified at time of analysis, and EPSS at 0.14% (4th percentile) indicates very low exploitation probability in the wild.
Safari on Apple iOS, iPadOS, and macOS crashes unexpectedly when processing maliciously crafted web content, caused by improper state management in the WebKit rendering engine. Affected platforms span iOS and iPadOS versions prior to 18.7.10 and 26.6.1, and macOS Tahoe prior to 26.6.2. No exploitation has been identified at time of analysis - EPSS sits at the 4th percentile - and impact is strictly confined to availability, making this a standard-cycle patch rather than an emergency response for most organizations.