Apple
Monthly
Sensitive data exposure in Apple iOS, iPadOS, and macOS Tahoe can be triggered when a user visits a maliciously crafted website, requiring no attacker-side authentication per the CVSS PR:N designation. Classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), the flaw carries a CVSS 3.1 score of 6.5 with high confidentiality impact despite requiring user interaction to deliver. Apple has simultaneously patched both the legacy 18.x and current 26.x release trains across iOS and iPadOS, as well as macOS Tahoe 26.6.2; no public exploit code or CISA KEV listing has been identified at time of analysis.
Denial-of-service in Apple iOS and iPadOS (all versions before 18.7.10) can be triggered by an attacker occupying a privileged network position - such as a network middleman - who sends malformed input that trips a reachable assertion, crashing the affected process or device. The CVSS vector confirms no attacker privileges are required and the attack is network-reachable, though user interaction and a specific network vantage point are prerequisites. No public exploit code or active exploitation in CISA KEV has been identified at time of analysis; Apple has released a vendor patch.
Safari on iOS, iPadOS, and macOS Tahoe crashes when processing maliciously crafted web content due to improper input validation (CWE-20). Affected users running iOS/iPadOS versions prior to 18.7.10 or 26.6.1, and macOS Tahoe prior to 26.6.2, are exposed to a remotely-triggered denial-of-service that terminates the browser. The vulnerability requires user interaction (visiting attacker-controlled or injected content), carries no code-execution or data-exfiltration risk, and no public exploit or CISA KEV listing exists at time of analysis.
Use-after-free memory corruption in Apple's WebKit web rendering engine crashes the browser process when handling maliciously crafted web content on iOS, iPadOS, and macOS Tahoe. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) confirms network-reachable exploitation limited to availability impact - a process crash - with no confidentiality or integrity compromise. Apple has released fixes across both the legacy iOS 18.x branch and the current iOS 26.x line, indicating broad exposure across the installed base. No active exploitation or public proof-of-concept has been identified at time of analysis.
IPSec authentication bypass in Apple iOS and iPadOS (all versions prior to 26.6.1) allows an adjacent-network attacker to circumvent IPSec mutual authentication and intercept device network traffic. The root cause is improper state management (CWE-287) in the IPSec stack, corrected in iOS 26.6.1 and iPadOS 26.6.1. No public exploit code has been identified at time of analysis, and EPSS at 0.19% (10th percentile) confirms minimal observed exploitation activity.
Safari crashes unexpectedly when processing maliciously crafted web content on Apple platforms due to a buffer boundary violation (CWE-119) in the WebKit rendering engine. Affected are all iOS and iPadOS releases prior to 18.7.10 and 26.6.1, and macOS Tahoe prior to 26.6.2. The impact is limited to availability - an attacker-controlled webpage can force Safari to crash - with no confirmed confidentiality or integrity consequence. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Memory corruption via a race condition in Apple's web content processing engine (WebKit) causes Safari to crash when a user loads maliciously crafted content on iOS, iPadOS, or macOS Tahoe. The root cause is an improper locking deficiency (CWE-362), confirmed by Apple's own description of the fix as "improved locking." No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA's KEV catalog; Apple has released patches across all affected platforms.
Safari on Apple iOS, iPadOS, and macOS crashes when processing maliciously crafted web content due to a state management deficiency, constituting a network-delivered denial-of-service condition with no data exposure. Affected platforms span iOS and iPadOS below 18.7.10 (legacy branch) and 26.6.1 (iOS 26 branch), and macOS Tahoe below 26.6.2, all now patched by Apple. No public exploit code or active exploitation has been identified; EPSS sits at 0.14% (4th percentile), confirming very low real-world exploitation probability.
Out-of-bounds read in Apple iOS, iPadOS, and macOS kernel components allows a low-privileged local app to trigger unexpected system termination or disclose sensitive kernel memory. Affected platforms include iOS and iPadOS prior to 26.6.1 and macOS Tahoe prior to 26.6.2, with Apple releasing emergency point releases to address the flaw. No public exploit or active exploitation has been identified (not in CISA KEV), and EPSS sits at the 5th percentile (0.15%), indicating very low likelihood of observed exploitation at this time.
In the Linux kernel, the following vulnerability has been resolved: nvme-apple: Prevent shared tags across queues on Apple A11 On Apple A11, tags of pending commands must be unique across the admin and IO queues, else the firmware crashes with "duplicate tag error for tag N", with N being the tag. Apply the existing workaround for M1 of reserving two tags for the admin queue to A11.
Local privilege escalation in Palo Alto Networks GlobalProtect app (Windows, macOS, and Linux) allows any local non-administrative user to gain NT AUTHORITY\SYSTEM on Windows or root on macOS and Linux via CWE-426 (Untrusted Search Path), enabling arbitrary command execution at the highest OS privilege level. The vulnerability is confirmed by Palo Alto Networks in their own advisory and affects desktop platforms only - iOS, Android, and Chrome OS are explicitly excluded. No public exploit code or active exploitation is confirmed at time of analysis; the CVSS 4.0 score of 5.9 Medium reflects the local-only attack vector requirement.
Remote code execution in Palo Alto Networks GlobalProtect app on Windows allows a network-adjacent man-in-the-middle attacker to execute arbitrary code with SYSTEM privileges by exploiting improper input validation in the Pre-Logon Access Provider (PLAP) component (CWE-94). Only Windows deployments with the PLAP feature configured are affected; GlobalProtect on Linux, macOS, iOS, Android, and Chrome OS is explicitly excluded from the vulnerability scope. No public exploit code exists at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the SYSTEM-level code execution outcome before user logon warrants prioritized remediation for any enterprise Windows fleet using the pre-logon VPN feature.
Out-of-bounds write in Palo Alto Networks GlobalProtect app exposes Windows, macOS, and Linux endpoints to arbitrary code execution at SYSTEM or root privilege levels when clients connect to an attacker-controlled rogue gateway or are subjected to a man-in-the-middle attack. The vulnerability resides in the client-side VPN agent's processing of gateway-supplied data, where a crafted response can corrupt memory and hijack execution. No public exploit has been identified at time of analysis, and CISA has not confirmed active exploitation, but full confidentiality, integrity, and availability compromise is possible on any affected endpoint that connects through a manipulated gateway.
Privilege escalation to root in Palo Alto Networks GlobalProtect App on macOS is enabled by a race condition exploitable by a locally authenticated, low-privileged user. The vulnerability is strictly macOS-specific - GlobalProtect on Linux, Windows, iOS, Android, and Chrome OS is explicitly not affected per vendor advisory. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 4.1 reflects the local, timing-dependent, and low-privilege-required nature of this attack.
Privilege escalation via an uncontrolled search path (CWE-427) in Palo Alto Networks Prisma Access Agent on Windows and macOS allows a local user to execute arbitrary code with elevated privileges. The vulnerability is platform-specific and explicitly does not affect the Linux, iOS, Android, or ChromeOS versions of the agent. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; the CVSS 4.0 base score of 6.0 reflects the local-only attack vector, though the high confidentiality and integrity impact to the vulnerable system is significant for enterprise endpoint deployments.
Anti-tamper protection bypass in Palo Alto Networks Prisma Access Agent on Windows allows a local administrator to gain unauthorized access to the agent's protected processes and files, effectively disabling endpoint security enforcement. Only the Windows platform is affected - Linux, macOS, iOS, Android, and Chrome OS deployments are explicitly not impacted. No public exploit code has been identified and no active exploitation has been confirmed (CVSS E:U), keeping real-world risk constrained to insider threat and post-compromise scenarios.
Authentication bypass in the Windows network driver of Palo Alto Networks Prisma Access Agent allows a local administrator to circumvent the agent's security inspection enforcement, subsequently enabling injection and interception of arbitrary network traffic. Only the Windows platform is affected - Linux, macOS, iOS, Android, and Chrome OS deployments are explicitly confirmed unaffected by the vendor. No public exploit has been identified at time of analysis, and exploitation requires pre-existing local administrator access, significantly narrowing the realistic threat population.
Symlink-following (CWE-59) in Palo Alto Networks Prisma Access Agent on Linux allows a local low-privileged user to delete a limited set of system files and disable the agent entirely. Only Linux deployments are affected - macOS, Windows, iOS, Android, and Chrome OS are explicitly confirmed safe by the vendor. No public exploit code or active exploitation (CISA KEV) has been identified; the CVSS 4.0 supplemental vector classifies exploitation as unlikely (E:U) with Amber urgency, making this a low-priority but genuine patch target for Linux endpoint fleets.
OS command injection in PDF::WebKit for Perl (versions through 1.2) allows arbitrary command execution under the process UID when untrusted input is forwarded as an output path or stylesheet path to `to_pdf`, `to_file`, or `_style_tag_for`. The root cause is Perl's 2-arg `open()` combined with the diamond operator, which interprets pipe-flanked strings (`| cmd` or `cmd |`) as shell commands and redirect-prefixed strings (`> path`) as file write operations rather than filenames. No public exploit code has been confirmed and the vulnerability is not listed in CISA KEV at time of analysis, but the technique exploits well-documented Perl behavior making reproduction trivial for any developer familiar with the language.
Man-in-the-middle interception of ECOVACS PRO app traffic is possible due to improper TLS server certificate validation (CWE-295) in both the Android and iOS versions of the application, published by ECOVACS Robotics and coordinated by JPCERT under JVNVU92804348. An attacker with a network-positioned MITM capability can present a rogue certificate that the app accepts without proper validation, enabling retrieval and alteration of all app-server communications, which may include device control commands, account credentials, and home telemetry. No active exploitation is confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.
Denial of service in Cisco IOS XE Software's web-based management interface allows an authenticated remote attacker with low privileges to reload an affected device by presenting a malformed certificate during authentication. The root cause is insufficient error handling (CWE-126, buffer over-read) in the certificate parsing path of the HTTPS management interface, affecting a broad swath of IOS XE releases from 17.3.x through 26.x. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the wide deployment footprint of IOS XE in enterprise and service provider networks makes even a low-probability DoS meaningful at scale.
Denial-of-service in Cisco IOS XE Software's web-based management interface (WebUI) allows an authenticated remote attacker holding only low-privilege credentials to render the management interface unresponsive by sending crafted input that bypasses input validation. The vulnerability spans an exceptionally broad version footprint - from 16.9.x through the 26.x release train - making patching scope significant for organizations running Cisco enterprise routing and switching infrastructure. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, placing real-world urgency below its broad scope might suggest.
Parent process code-sign spoofing in Electron on macOS allows a local low-privileged attacker to bypass fuse-based hardening controls restricting ELECTRON_RUN_AS_NODE and NODE_OPTIONS, injecting code inside the signed Electron application and inheriting its TCC permissions and keychain access. Only macOS deployments of Electron apps that have explicitly enabled same-signed-parent fuse restrictions are exposed; applications without this hardening are unaffected. No public exploit has been identified at time of analysis, and CVSS AC:H reflects the PID-reuse race-condition timing requirement inherent to the attack.
UI spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to deceive users into believing they are interacting with a legitimate browser interface by serving a crafted HTML page. The root cause is insufficient policy enforcement (CWE-346, origin validation error), allowing the attacker to manipulate rendered UI elements. No public exploit code exists and no active exploitation has been confirmed; EPSS stands at 0.16% (6th percentile) and CISA SSVC classifies exploitation as none, placing this firmly in a patch-and-monitor priority tier rather than an emergency response.
UI spoofing in Google Chrome for iOS prior to version 151.0.7922.72 enables a remote unauthenticated attacker to misrepresent critical interface elements - such as the address bar or origin indicators - through a specially crafted HTML page. Classified as CWE-451 (UI Misrepresentation of Critical Information), the impact is limited to integrity: no code execution or data exfiltration is possible directly, but users can be deceived into trusting a malicious page as legitimate. No public exploit code exists, EPSS sits at 0.16% (6th percentile), and Chromium internally rated this as Low severity - consistent with a constrained, social-engineering-dependent attack surface.
Chrome for iOS prior to 151.0.7922.72 exposes potentially sensitive process memory contents to an attacker with physical access to the device through an inappropriate implementation flaw. The vulnerability is classified CWE-200 (Information Disclosure) and is iOS-platform-specific, not affecting Chrome on other operating systems. No public exploit code exists and CISA SSVC confirms no active exploitation, placing this firmly in the low-urgency tier despite requiring prompt patching for high-assurance mobile environments.
UI spoofing in Google Chrome on iOS prior to 151.0.7922.72 enables a remote attacker to deceive users about page identity or browser security state by serving a crafted HTML page. The flaw is iOS-specific, exploiting an inappropriate implementation in the Chrome for iOS rendering layer rather than the broader Chromium engine, and requires only that the victim navigate to an attacker-controlled page. No public exploit has been identified and EPSS stands at 0.19% (9th percentile), consistent with Chromium's own 'Low' internal severity classification; this is a real but low-urgency integrity issue.
UI spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote, unauthenticated attacker to misrepresent security-critical interface elements - such as the address bar or origin indicators - by serving a crafted HTML page to a victim. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-delivered and requires no privileges, but does require the user to interact with the malicious page, limiting its reach. No public exploit or active exploitation has been identified; EPSS at 0.17% (7th percentile) and SSVC exploitation status of 'none' collectively indicate low real-world risk at this time.
UI spoofing in Google Chrome for iOS prior to version 151.0.7922.72 enables remote attackers to deceive users by manipulating security indicators through a crafted HTML page. The vulnerability causes incorrect rendering of Chrome's browser-managed security UI elements - such as origin display or HTTPS trust badges - potentially causing victims to mistake malicious pages for legitimate or secure ones. No active exploitation has been confirmed (not in CISA KEV), EPSS at 0.17% (7th percentile) indicates low near-term exploitation probability, and a vendor-released patch is available in version 151.0.7922.72.
No-referrer policy bypass in Google Chrome for iOS prior to 151.0.7922.72 allows a remote, unauthenticated attacker to exfiltrate origin page URL information that the site operator explicitly suppressed via the Referrer-Policy header. Exploitation requires luring a victim to a crafted HTML page, classifying this as a social-engineering-dependent, low-severity integrity/confidentiality boundary failure. No active exploitation is confirmed (not in CISA KEV), EPSS sits at the 8th percentile (0.18%), and SSVC rates technical impact as only partial - signaling a low operational priority despite the network attack vector.
Navigation restriction bypass in Google Chrome for iOS prior to 151.0.7922.72 allows a remote attacker to serve a crafted HTML page that circumvents the browser's navigation controls, resulting in limited integrity impact. The flaw is confined to Chrome's iOS-specific implementation layer (CWE-284: Improper Access Control) and is not present in Chrome on other platforms. No public exploit code has been identified at time of analysis, and EPSS exploitation probability is very low at 0.18% (8th percentile), consistent with SSVC's 'exploitation: none' determination.
Omnibox (URL bar) spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to display misleading URL content to a victim by serving a crafted HTML page, undermining the browser's fundamental trust signal. The flaw is iOS-specific and classified by Google as low severity (Chromium severity: Low), with EPSS at 0.21% and SSVC exploitation status of none, indicating no public exploitation at time of analysis. No public exploit code exists; the primary risk is phishing and credential harvesting against users who rely on the Omnibox to authenticate site identity.
Insufficient policy enforcement in Google Chrome for iOS prior to version 151.0.7922.72 enables a remote attacker to bypass discretionary access controls (CWE-284) by delivering a crafted HTML page to a victim, resulting in high integrity impact with no confidentiality or availability consequence. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms network reachability with no attacker privileges needed, though user interaction is required. With EPSS at 0.18% (8th percentile), SSVC exploitation classified as none, and no public exploit identified at time of analysis, real-world mass exploitation risk is low despite the meaningful integrity bypass potential on a widely-used mobile browser.
UI spoofing in Google Chrome for iOS (versions prior to 151.0.7922.72) enables remote attackers to misrepresent browser interface elements through specially crafted HTML pages, potentially deceiving users into disclosing information or taking unintended actions. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms network-deliverable exploitation requiring only user interaction with no attacker privileges needed. EPSS at 0.21% (11th percentile), no CISA KEV listing, and Chromium's own internal 'Low' severity rating all converge on low real-world exploitation pressure; no public exploit identified at time of analysis.
Navigation restriction bypass in Google Chrome for iOS (prior to 151.0.7922.72) enables a remote attacker to redirect users to unintended URLs via a crafted HTML page, exploiting a CWE-601 open redirect condition. The Chromium team rated this Low severity, consistent with the CVSS 4.3 score and the limited integrity-only impact (no confidentiality or availability consequences). No public exploit identified at time of analysis, and the EPSS score of 0.18% (8th percentile) reflects minimal exploitation interest from the threat actor community.
UI spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to manipulate the browser's visual interface through a crafted HTML page, potentially deceiving users into disclosing sensitive information or interacting with falsified content. Exploitation requires user interaction (visiting the malicious page), limiting opportunistic exploitation, and the EPSS score of 0.18% (8th percentile) reflects low observed exploitation probability. No public exploit code or active exploitation (CISA KEV) has been identified; vendor patch is available at version 151.0.7922.72.
Discretionary access control bypass in Google Chrome for iOS prior to 151.0.7922.72 allows a remote attacker to violate iOS access control boundaries by enticing a user to visit a specially crafted HTML page. The flaw stems from insufficient policy enforcement unique to the iOS version of Chrome, meaning desktop Chrome is not affected by this specific variant. No public exploit code has been identified and EPSS signals low exploitation probability, but the integrity-only CVSS impact and user-interaction requirement make this a realistic phishing-assisted attack path.
Omnibox (URL bar) spoofing in Google Chrome for iOS prior to 151.0.7922.72 allows a remote attacker to manipulate the displayed URL via malicious network traffic, deceiving users about the true origin of page content. The flaw is iOS-platform-specific and classified under CWE-451 (UI Misrepresentation of Critical Information), making it a phishing-enablement vulnerability rather than a code execution or data-exfiltration primitive. No public exploit or active exploitation has been identified at time of analysis; EPSS probability is very low at 0.20% (10th percentile).
Same-origin policy bypass in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to violate cross-origin isolation by luring a user into performing specific UI gestures on a crafted HTML page. The flaw stems from CWE-346 (Origin Validation Error) in an iOS-specific Chrome implementation, granting unauthorized write-level access to cross-origin content. No public exploit code has been identified and no active exploitation is confirmed; with an EPSS of 0.19% (9th percentile), real-world exploitation probability remains low but the integrity impact is high if successfully triggered.
UI spoofing in Google Chrome for iOS prior to 151.0.7922.72 allows a remote attacker to deceive users about the origin or content of a web page by exploiting a race condition via a crafted HTML page. The vulnerability requires the victim to visit the attacker-controlled page (UI:R), but no authentication or elevated privileges are needed. No public exploit code or CISA KEV listing exists at time of analysis; EPSS places exploitation probability at 0.14% (4th percentile), indicating low observed exploitation activity despite medium CVSS severity.
UI spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to misrepresent browser interface elements - such as the address bar or security indicators - by delivering a crafted HTML page, potentially deceiving users into believing they are interacting with a trusted site or legitimate browser chrome. The vulnerability maps to CWE-451 (UI Misrepresentation of Critical Information) and carries a High integrity impact despite no direct confidentiality or availability loss, because successful spoofing can facilitate credential theft or social engineering at scale. No public exploit identified at time of analysis, and EPSS at 0.17% (7th percentile) reflects low current opportunistic exploitation probability.
Domain spoofing in Google Chrome on iOS prior to 151.0.7922.72 allows a remote unauthenticated attacker to misrepresent the displayed origin in the browser's security UI by delivering a crafted HTML page to a victim. The flaw (CWE-451) enables phishing-class attacks where the address bar or site identity indicator shows a trusted domain while content is served from a different origin. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), indicating low automated exploitation likelihood, but the integrity impact is high for targeted phishing campaigns against iOS Chrome users.
UI spoofing in Google Chrome for iOS prior to version 151.0.7922.72 enables remote attackers to misrepresent critical browser interface elements - such as the address bar or security indicators - by delivering a crafted HTML page to a victim. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) confirms the attack is network-reachable with no attacker authentication, though it requires the victim to interact with a malicious page. No public exploit code or active exploitation has been identified; EPSS sits at 0.17% (7th percentile), indicating low current exploitation interest despite the vendor-confirmed patch.
Navigation restriction bypass in Google Chrome for iOS (prior to 151.0.7922.72) enables a remote attacker to circumvent browser-enforced navigation controls by delivering a crafted HTML page. The root cause is an inappropriate implementation (CWE-284) in Chrome's iOS-specific navigation stack, meaning the flaw is isolated to the iOS platform and does not affect Chrome on Android or desktop. No public exploit code exists and EPSS probability stands at just 0.22% (13th percentile), indicating low real-world exploitation pressure at time of analysis; this vulnerability is not listed in the CISA KEV catalog.
UI spoofing in Google Chrome for iOS prior to version 151.0.7922.72 enables a remote attacker to misrepresent critical browser interface elements - such as the address bar or security indicators - by delivering a crafted HTML page to the victim (CWE-451). The CVSS vector assigns high integrity impact (I:H) with no privileges required from the attacker, but mandates user interaction (UI:R), meaning the victim must visit the malicious page. No public exploit identified at time of analysis, and an EPSS score of 0.17% at the 7th percentile indicates very low observed exploitation interest; Chromium's own severity rating of Medium aligns with this assessment.
Cross-origin data leakage in Google Chrome for iOS (versions prior to 151.0.7922.72) allows remote attackers to read cross-origin data by delivering a crafted HTML page that socially engineers the victim into performing specific UI gestures. The root cause is an inappropriate implementation classified under CWE-346 (Origin Validation Error), meaning Chrome's iOS-specific code fails to correctly enforce same-origin policy boundaries under particular interaction sequences. No active exploitation has been confirmed - CISA KEV status is absent, SSVC exploitation rating is 'none', and EPSS sits at 0.21% (11th percentile) - placing this firmly in the low-priority tier despite its network delivery vector.
UI spoofing via race condition in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to deceive users about page origin or security context by serving a crafted HTML page. The vulnerability stems from CWE-362 (concurrent execution with improper synchronization), allowing an attacker to manipulate browser UI elements - such as the address bar or security indicators - during a timing window. No active exploitation is confirmed (EPSS 0.17%, 7th percentile; not listed in CISA KEV), and Google has released a patch in the stable channel update.
Navigation restriction bypass in Google Chrome for iOS (versions prior to 151.0.7922.72) enables unauthenticated remote attackers to circumvent browser navigation controls by inducing a user to load a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) confirms network-accessible, low-complexity exploitation with no privilege requirements but mandatory user interaction, yielding high integrity impact with no confidentiality or availability consequences. No public exploit identified at time of analysis, and EPSS at 0.22% (13th percentile) indicates limited near-term exploitation likelihood despite the medium severity rating.
Navigation restriction bypass in Google Chrome for iOS prior to 151.0.7922.72 enables remote attackers to circumvent browser-enforced navigation policies by delivering a crafted HTML page to a victim. The flaw originates from insufficient client-side policy enforcement (CWE-602), where the iOS-specific Chrome policy engine fails to prevent unauthorized navigation actions triggered by attacker-controlled content. No public exploit has been identified at time of analysis, and an EPSS score of 0.18% (8th percentile) indicates minimal current exploitation activity; vendor-released patch 151.0.7922.72 is available.
Navigation restriction bypass in Google Chrome for iOS prior to 151.0.7922.72 allows remote attackers to circumvent browser navigation controls by delivering maliciously crafted network traffic to a victim device. The flaw stems from insufficient input validation (CWE-20) in the iOS-specific implementation of Chrome, resulting in an Integrity:High impact - enabling unauthorized navigation, redirect manipulation, or security-boundary evasion - with no confidentiality or availability consequences. No public exploit has been identified and EPSS places exploitation probability at just 0.17% (7th percentile), indicating low active exploitation risk at time of analysis.
Omnibox (URL bar) spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to deceive users about the actual origin of the page they are viewing by serving a crafted HTML page. The flaw is a CWE-451 UI misrepresentation defect, meaning the browser fails to accurately convey security-critical location information to the user, creating a reliable phishing vector. No public exploit code exists and EPSS sits at 0.21% (11th percentile); SSVC confirms exploitation as none and technical impact as partial, placing this firmly in lower-priority remediation tiers despite the phishing relevance.
Cross-origin data leakage in Google Chrome for iOS prior to 151.0.7922.72 exposes sensitive information from other browser origins when a user visits a specially crafted HTML page. The root cause is an inappropriate implementation of origin validation (CWE-346) within Chrome's iOS-specific code path, breaking the browser's same-origin policy boundary. No public exploit code or active exploitation has been identified; EPSS probability stands at 0.21% (11th percentile), and the vulnerability is absent from the CISA KEV catalog, indicating low near-term exploitation pressure.
Universal Cross-Site Scripting (UXSS) in Google Chrome for iOS prior to 151.0.7922.72 enables remote attackers to inject arbitrary scripts or HTML across origin boundaries via crafted malicious network traffic, requiring only passive user interaction such as visiting a compromised page. The vulnerability stems from insufficient input validation (CWE-20) in the iOS-specific Chrome codebase, which uses Apple's WebKit engine rather than Blink. No public exploit code has been identified and CISA KEV does not list this vulnerability; EPSS probability sits at 0.19%, placing it in the 9th percentile of exploitation likelihood.
Universal Cross-Site Scripting (UXSS) in Google Chrome for iOS prior to 151.0.7922.72 allows a remote attacker to inject arbitrary scripts or HTML across origin boundaries by exploiting a race condition triggered through a crafted HTML page. The vulnerability requires user interaction and benefits from high attack complexity due to race-condition timing, placing real-world exploitation difficulty well above typical web vulnerabilities. No public exploit code exists and no active exploitation has been identified; SSVC assessment confirms exploitation status as none at time of analysis.
Navigation restriction bypass in Google Chrome on iOS prior to 151.0.7922.72 allows a remote, unauthenticated attacker to circumvent the browser's built-in navigation policy controls by delivering a specially crafted HTML page. Rooted in CWE-602 (Client-Side Enforcement of Server-Side Security), the flaw reflects an iOS-specific policy enforcement gap not present in desktop Chrome builds. The Chromium team rated this High severity internally; however, no confirmed active exploitation exists - CISA KEV is absent, EPSS stands at 0.30%, and SSVC classifies exploitation as none with partial technical impact.
Arbitrary file overwrite in Develar app-builder (all versions ≤ 4.2.0 on macOS) allows an unauthenticated remote attacker to escape the ZIP extraction directory by exploiting APFS Unicode case-folding combined with symlink following in the `zipx.Unzip` routine. A crafted archive containing a symlink entry `ss` pointing to an external victim file and a subsequent regular-file entry `ß` causes the builder to follow the symlink - because APFS folds `ß` to `ss` - overwriting the target with attacker-controlled content. SSVC rates the attack automatable with no confirmed exploitation; no public exploit code has been identified at time of analysis, though CERT/CC advisory VU#293714 and ENISA EUVD-2026-50423 confirm coordinated disclosure.
An information disclosure vulnerability in Apple macOS allows a local malicious application to access sensitive user data without proper authorization. This issue was resolved in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. No active exploitation or public exploit code has been identified at this time, and EPSS indicates a very low probability of exploitation.
Kernel memory disclosure in Apple macOS allows a rogue application to read sensitive kernel data via an out-of-bounds read. Fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6. No public exploit identified and EPSS score is low (0.15%), indicating low exploitation risk in the wild.
Information disclosure in Apple iOS and iPadOS 26.6, along with macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6, allows a local app to access sensitive user data due to a state management flaw. The vulnerability was addressed with improved state handling, and no public exploit code or active exploitation has been identified; EPSS indicates a low likelihood of real-world attacks.
Information disclosure in macOS allows a local app to access sensitive user data. The issue affects macOS Sonoma before 14.8.8 and macOS Sequoia before 15.7.8, where missing privacy controls could be abused by a malicious application. With a CVSS score of 5.5 and EPSS at 0.14%, no public exploit or active exploitation has been observed; Apple has released patches.
Information disclosure in macOS Screen Sharing allows a local attacker with low privileges to read the legacy VNC password. This issue affects macOS versions prior to 15.7.8 and 14.8.8, and could enable unauthorized remote access if VNC is enabled. No active exploitation or public exploit code has been identified.
A file quarantine bypass in macOS Gatekeeper allows maliciously crafted ZIP archives to evade security checks. Affected versions include macOS Sequoia before 15.7.8 and macOS Sonoma before 14.8.8. Exploitation is not confirmed in the wild, public exploit code has not been identified, and EPSS indicates very low likelihood of widespread attacks.
Unauthorized reading of a persistent device identifier in Apple iOS, iPadOS, tvOS, watchOS, and visionOS allows a malicious app to access a unique identifier without user consent. The issue originates from a permissions enforcement weakness fixed in iOS 26.6, iPadOS 26.6, tvOS 26.6, watchOS 26.6, and visionOS 26.6. No active exploitation or public exploit code is known, and EPSS predicts a very low exploitation probability (0.16%).
A Gatekeeper bypass in macOS allows maliciously crafted ZIP archives to evade security checks, enabling installation of untrusted applications. Affected are macOS Sonoma 14.x prior to 14.8.8 and Sequoia 15.x prior to 15.7.8; exploitation requires user interaction. No active exploitation or public exploit code is known, and a vendor patch is available.
Safari and WebKit-based apps across Apple platforms crash when a user visits a specially crafted website, due to a state management flaw (CWE-400: Uncontrolled Resource Consumption) in versions prior to 26.6. Affected platforms include Safari on macOS Tahoe, iOS 26, iPadOS 26, and visionOS 26. No confidentiality or integrity impact is present - the consequence is an app-level denial-of-service. No public exploit code exists and CISA SSVC confirms no active exploitation, with EPSS at 0.16% (6th percentile), indicating very low exploitation likelihood at time of analysis.
Information disclosure in macOS allows a malicious app to access user-sensitive data when the user is tricked into running it. Affected versions include macOS Sequoia before 15.7.8, Sonoma before 14.8.8, and Tahoe before 26.6. No active exploitation has been confirmed, and the EPSS score is low (0.15%), indicating minimal real-world risk at this time.
A permissions validation flaw across Apple's iOS, iPadOS, macOS, and visionOS could allow a local malicious app to delete arbitrary files, leading to data loss. The issue has a low exploitation probability (EPSS 0.16%) and no known active exploits or public exploit code. Patches are available in the respective OS updates.
Local information disclosure in Apple iOS and iPadOS 26.6 and earlier, as well as multiple macOS versions, allows an app to leak sensitive user data due to missing entitlement checks. The vulnerability requires user interaction and local access, but has low exploitation probability (EPSS 0.16%) and no known public exploits or active exploitation per CISA KEV.
A local denial-of-service vulnerability in macOS versions before Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 allows a malicious app to cause unexpected system termination due to a memory handling flaw. Exploitation requires a low-privilege user to run a crafted application, and no active exploitation is known at this time.
Local access to sensitive user data in macOS allows a malicious app to bypass sandbox restrictions and read protected files or information. This issue affects all macOS versions prior to Tahoe 26.6, requires user interaction to run the malicious app (e.g., via social engineering or masquerading as legitimate software), and has no public exploit or active exploitation reported at this time.
macOS authorization bypass allows an app to access sensitive user data without proper permission, potentially triggered via malicious website in Safari
UI spoofing in Apple Safari 26.5 and earlier allows attackers using cross-origin framing to misrepresent website identity. The vulnerability requires user interaction (visiting a malicious page) and could lead to phishing or deceptive actions. No active exploitation or public exploit code identified; patch is available.
Information disclosure in macOS and tvOS due to a race condition allows a malicious local app to read sensitive user data without authorization. Affected versions include macOS prior to Sonoma 14.8.8, Sequoia 15.7.8, and Tahoe 26.6, and tvOS prior to 26.6. No active exploitation or public exploit code has been identified, and EPSS indicates very low exploitation probability.
Information disclosure in macOS allows an attacker with physical access to a locked device to view sensitive user information. Affected versions include macOS Sonoma below 14.8.8, macOS Sequoia below 15.7.8, and macOS Tahoe below 26.6. No public exploit or active exploitation has been identified, and EPSS probability is very low at 0.16%, reflecting the physical access requirement.
Information disclosure in macOS prior to 15.7.8, 14.8.8, and 26.6 allows a malicious app to leak sensitive user information. The vulnerability arises from improper removal of sensitive data, which Apple addressed in these updates. No active exploitation is known, and EPSS indicates a low probability of exploitation (0.16%).
A symlink handling vulnerability in macOS allows a malicious application to modify protected parts of the file system. Affected versions include macOS prior to Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. Exploitation requires user interaction (opening a malicious app), and no public exploit code or active exploitation has been identified.
A malicious app on macOS can read kernel memory due to insufficient validation. This information disclosure vulnerability is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6. No active exploitation or public exploit code has been identified, and the EPSS score is very low (0.16%).
Unauthorized file read via a sandbox escape vulnerability in Apple iOS, iPadOS, macOS, tvOS, watchOS, and visionOS allows a malicious app to access files outside its designated sandbox. Exploitation requires user interaction to install and launch a malicious app, but no active exploitation or public exploit code is currently known. CVSS medium severity (6.5) is offset by a very low EPSS score (0.17%), indicating low real-world exploitation probability.
A local denial-of-service vulnerability in Apple's operating systems allows a malicious app to cause unexpected system termination by triggering an out-of-bounds read. Fixes are available in version 26.6 for iOS, iPadOS, macOS, tvOS, visionOS, and watchOS; no active exploitation or public exploit has been identified, and EPSS indicates a low probability of exploitation.
Local information disclosure in Apple iOS/iPadOS 26.x, macOS Tahoe 26.x, macOS Sequoia 15.x, macOS Sonoma 14.x, tvOS 26.x, visionOS 26.x and watchOS 26.x lets an app installed and run by the user read sensitive user data because of insufficient access checks (CWE-200), a flaw Apple fixed in iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, visionOS 26.6 and watchOS 26.6. Exploitation requires the user to install and launch a malicious or malicious-behaving app on an unpatched device (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 5.5); there is no remote or network-reachable path and no privilege escalation is needed, so the practical exposure is limited to confidentiality on devices where sideloaded or otherwise untrusted apps are allowed. There is no public exploit identified at time of analysis, CISA's SSVC decision framework records exploitation as none and technical impact as partial, and EPSS is only 0.17% (6th percentile), so every signal aligns with a genuine but low-priority issue that should be resolved by routine patch cycles rather than emergency response.
Kernel memory disclosure in macOS allows a local app to read uninitialized kernel memory, potentially exposing sensitive information. Apple has released patches in macOS Sonoma 14.8.8, Sequoia 15.7.8, and Tahoe 26.6. The vulnerability has a low EPSS score (0.17%) with no known active exploitation or public exploit code.
Physical access to a locked Apple device running vulnerable iOS or macOS allows an attacker to view sensitive user information due to an out-of-bounds read. The flaw is fixed in iOS 26.6, iPadOS 26.6, and multiple macOS versions. No public exploit or active exploitation has been reported.
Kernel memory disclosure in Apple iOS and iPadOS (fixed in 26.6), macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6 and watchOS 26.6 allows a locally running app to read kernel memory that should be inaccessible to it, undermining the isolation boundary between user-space apps and the kernel. The prerequisite is meaningful: an attacker must first get attacker-controlled code executing on the device (a malicious, sideloaded, or compromised app), and the flaw itself yields only disclosure - high confidentiality impact but no integrity or availability impact, so it is best characterized as one link in a larger privilege-escalation or jailbreak chain rather than a standalone compromise. Vendor patches are available for every affected platform; there is no remote or network attack vector, no public exploit code identified at time of analysis, no confirmed active exploitation (CISA SSVC exploitation: none), and EPSS is low at 0.17% (7th percentile), consistent with the moderate 5.5 severity and the local-only, code-execution-gated exploitation model.
A file quarantine bypass in Apple macOS allows a malicious application to evade Gatekeeper integrity checks. Affected versions include macOS prior to 15.7.8, 14.8.8, and 26.6. Local attackers with user interaction can leverage this to execute unsigned code that would normally be blocked, leading to potential integrity compromise.
Denial-of-service via out-of-bounds write in Apple CoreAudio when processing malicious audio streams. Affected iOS, iPadOS, macOS, tvOS, watchOS, and visionOS versions are vulnerable. No known active exploitation or public exploit code exists at time of analysis, and EPSS probability is low (0.17%).
Denial of service in macOS versions prior to Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 allows a local malicious app to trigger memory corruption and crash the system. Exploitation requires user interaction to run the app; no active exploitation is known (not in CISA KEV) and EPSS indicates a very low probability (0.16%). Apple has released updates to address the logic issue.
Physical access to an iPhone or iPad running vulnerable iOS/iPadOS versions allows an attacker to access sensitive user data during the iPhone Mirroring feature due to improper state management. This issue is fixed in iOS 26.6 and iPadOS 26.6. No known exploitation in the wild; EPSS score is low (0.15%, percentile 5%).
Local denial of service in macOS allows a malicious app to trigger unexpected system termination via memory exhaustion. Affects macOS Sequoia prior to 15.7.8, macOS Sonoma prior to 14.8.8, and macOS Tahoe prior to 26.6. No active exploitation or public exploit identified; EPSS probability is low (0.16%).
Information disclosure in Apple iOS/iPadOS versions prior to 26.6 allows a locally installed app to access sensitive user data without proper permissions. Apple has released patches in iOS/iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, and watchOS 26.6. No public exploit or active exploitation has been reported, and the EPSS score indicates a low likelihood of exploitation.
An out-of-bounds write vulnerability in Apple iOS 26.6 and earlier allows a malicious app to cause unexpected system termination (kernel panic). No public exploit or active exploitation has been reported; patch available from Apple.
Sensitive data exposure in Apple iOS, iPadOS, and macOS Tahoe can be triggered when a user visits a maliciously crafted website, requiring no attacker-side authentication per the CVSS PR:N designation. Classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), the flaw carries a CVSS 3.1 score of 6.5 with high confidentiality impact despite requiring user interaction to deliver. Apple has simultaneously patched both the legacy 18.x and current 26.x release trains across iOS and iPadOS, as well as macOS Tahoe 26.6.2; no public exploit code or CISA KEV listing has been identified at time of analysis.
Denial-of-service in Apple iOS and iPadOS (all versions before 18.7.10) can be triggered by an attacker occupying a privileged network position - such as a network middleman - who sends malformed input that trips a reachable assertion, crashing the affected process or device. The CVSS vector confirms no attacker privileges are required and the attack is network-reachable, though user interaction and a specific network vantage point are prerequisites. No public exploit code or active exploitation in CISA KEV has been identified at time of analysis; Apple has released a vendor patch.
Safari on iOS, iPadOS, and macOS Tahoe crashes when processing maliciously crafted web content due to improper input validation (CWE-20). Affected users running iOS/iPadOS versions prior to 18.7.10 or 26.6.1, and macOS Tahoe prior to 26.6.2, are exposed to a remotely-triggered denial-of-service that terminates the browser. The vulnerability requires user interaction (visiting attacker-controlled or injected content), carries no code-execution or data-exfiltration risk, and no public exploit or CISA KEV listing exists at time of analysis.
Use-after-free memory corruption in Apple's WebKit web rendering engine crashes the browser process when handling maliciously crafted web content on iOS, iPadOS, and macOS Tahoe. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) confirms network-reachable exploitation limited to availability impact - a process crash - with no confidentiality or integrity compromise. Apple has released fixes across both the legacy iOS 18.x branch and the current iOS 26.x line, indicating broad exposure across the installed base. No active exploitation or public proof-of-concept has been identified at time of analysis.
IPSec authentication bypass in Apple iOS and iPadOS (all versions prior to 26.6.1) allows an adjacent-network attacker to circumvent IPSec mutual authentication and intercept device network traffic. The root cause is improper state management (CWE-287) in the IPSec stack, corrected in iOS 26.6.1 and iPadOS 26.6.1. No public exploit code has been identified at time of analysis, and EPSS at 0.19% (10th percentile) confirms minimal observed exploitation activity.
Safari crashes unexpectedly when processing maliciously crafted web content on Apple platforms due to a buffer boundary violation (CWE-119) in the WebKit rendering engine. Affected are all iOS and iPadOS releases prior to 18.7.10 and 26.6.1, and macOS Tahoe prior to 26.6.2. The impact is limited to availability - an attacker-controlled webpage can force Safari to crash - with no confirmed confidentiality or integrity consequence. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Memory corruption via a race condition in Apple's web content processing engine (WebKit) causes Safari to crash when a user loads maliciously crafted content on iOS, iPadOS, or macOS Tahoe. The root cause is an improper locking deficiency (CWE-362), confirmed by Apple's own description of the fix as "improved locking." No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA's KEV catalog; Apple has released patches across all affected platforms.
Safari on Apple iOS, iPadOS, and macOS crashes when processing maliciously crafted web content due to a state management deficiency, constituting a network-delivered denial-of-service condition with no data exposure. Affected platforms span iOS and iPadOS below 18.7.10 (legacy branch) and 26.6.1 (iOS 26 branch), and macOS Tahoe below 26.6.2, all now patched by Apple. No public exploit code or active exploitation has been identified; EPSS sits at 0.14% (4th percentile), confirming very low real-world exploitation probability.
Out-of-bounds read in Apple iOS, iPadOS, and macOS kernel components allows a low-privileged local app to trigger unexpected system termination or disclose sensitive kernel memory. Affected platforms include iOS and iPadOS prior to 26.6.1 and macOS Tahoe prior to 26.6.2, with Apple releasing emergency point releases to address the flaw. No public exploit or active exploitation has been identified (not in CISA KEV), and EPSS sits at the 5th percentile (0.15%), indicating very low likelihood of observed exploitation at this time.
In the Linux kernel, the following vulnerability has been resolved: nvme-apple: Prevent shared tags across queues on Apple A11 On Apple A11, tags of pending commands must be unique across the admin and IO queues, else the firmware crashes with "duplicate tag error for tag N", with N being the tag. Apply the existing workaround for M1 of reserving two tags for the admin queue to A11.
Local privilege escalation in Palo Alto Networks GlobalProtect app (Windows, macOS, and Linux) allows any local non-administrative user to gain NT AUTHORITY\SYSTEM on Windows or root on macOS and Linux via CWE-426 (Untrusted Search Path), enabling arbitrary command execution at the highest OS privilege level. The vulnerability is confirmed by Palo Alto Networks in their own advisory and affects desktop platforms only - iOS, Android, and Chrome OS are explicitly excluded. No public exploit code or active exploitation is confirmed at time of analysis; the CVSS 4.0 score of 5.9 Medium reflects the local-only attack vector requirement.
Remote code execution in Palo Alto Networks GlobalProtect app on Windows allows a network-adjacent man-in-the-middle attacker to execute arbitrary code with SYSTEM privileges by exploiting improper input validation in the Pre-Logon Access Provider (PLAP) component (CWE-94). Only Windows deployments with the PLAP feature configured are affected; GlobalProtect on Linux, macOS, iOS, Android, and Chrome OS is explicitly excluded from the vulnerability scope. No public exploit code exists at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the SYSTEM-level code execution outcome before user logon warrants prioritized remediation for any enterprise Windows fleet using the pre-logon VPN feature.
Out-of-bounds write in Palo Alto Networks GlobalProtect app exposes Windows, macOS, and Linux endpoints to arbitrary code execution at SYSTEM or root privilege levels when clients connect to an attacker-controlled rogue gateway or are subjected to a man-in-the-middle attack. The vulnerability resides in the client-side VPN agent's processing of gateway-supplied data, where a crafted response can corrupt memory and hijack execution. No public exploit has been identified at time of analysis, and CISA has not confirmed active exploitation, but full confidentiality, integrity, and availability compromise is possible on any affected endpoint that connects through a manipulated gateway.
Privilege escalation to root in Palo Alto Networks GlobalProtect App on macOS is enabled by a race condition exploitable by a locally authenticated, low-privileged user. The vulnerability is strictly macOS-specific - GlobalProtect on Linux, Windows, iOS, Android, and Chrome OS is explicitly not affected per vendor advisory. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 4.1 reflects the local, timing-dependent, and low-privilege-required nature of this attack.
Privilege escalation via an uncontrolled search path (CWE-427) in Palo Alto Networks Prisma Access Agent on Windows and macOS allows a local user to execute arbitrary code with elevated privileges. The vulnerability is platform-specific and explicitly does not affect the Linux, iOS, Android, or ChromeOS versions of the agent. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; the CVSS 4.0 base score of 6.0 reflects the local-only attack vector, though the high confidentiality and integrity impact to the vulnerable system is significant for enterprise endpoint deployments.
Anti-tamper protection bypass in Palo Alto Networks Prisma Access Agent on Windows allows a local administrator to gain unauthorized access to the agent's protected processes and files, effectively disabling endpoint security enforcement. Only the Windows platform is affected - Linux, macOS, iOS, Android, and Chrome OS deployments are explicitly not impacted. No public exploit code has been identified and no active exploitation has been confirmed (CVSS E:U), keeping real-world risk constrained to insider threat and post-compromise scenarios.
Authentication bypass in the Windows network driver of Palo Alto Networks Prisma Access Agent allows a local administrator to circumvent the agent's security inspection enforcement, subsequently enabling injection and interception of arbitrary network traffic. Only the Windows platform is affected - Linux, macOS, iOS, Android, and Chrome OS deployments are explicitly confirmed unaffected by the vendor. No public exploit has been identified at time of analysis, and exploitation requires pre-existing local administrator access, significantly narrowing the realistic threat population.
Symlink-following (CWE-59) in Palo Alto Networks Prisma Access Agent on Linux allows a local low-privileged user to delete a limited set of system files and disable the agent entirely. Only Linux deployments are affected - macOS, Windows, iOS, Android, and Chrome OS are explicitly confirmed safe by the vendor. No public exploit code or active exploitation (CISA KEV) has been identified; the CVSS 4.0 supplemental vector classifies exploitation as unlikely (E:U) with Amber urgency, making this a low-priority but genuine patch target for Linux endpoint fleets.
OS command injection in PDF::WebKit for Perl (versions through 1.2) allows arbitrary command execution under the process UID when untrusted input is forwarded as an output path or stylesheet path to `to_pdf`, `to_file`, or `_style_tag_for`. The root cause is Perl's 2-arg `open()` combined with the diamond operator, which interprets pipe-flanked strings (`| cmd` or `cmd |`) as shell commands and redirect-prefixed strings (`> path`) as file write operations rather than filenames. No public exploit code has been confirmed and the vulnerability is not listed in CISA KEV at time of analysis, but the technique exploits well-documented Perl behavior making reproduction trivial for any developer familiar with the language.
Man-in-the-middle interception of ECOVACS PRO app traffic is possible due to improper TLS server certificate validation (CWE-295) in both the Android and iOS versions of the application, published by ECOVACS Robotics and coordinated by JPCERT under JVNVU92804348. An attacker with a network-positioned MITM capability can present a rogue certificate that the app accepts without proper validation, enabling retrieval and alteration of all app-server communications, which may include device control commands, account credentials, and home telemetry. No active exploitation is confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.
Denial of service in Cisco IOS XE Software's web-based management interface allows an authenticated remote attacker with low privileges to reload an affected device by presenting a malformed certificate during authentication. The root cause is insufficient error handling (CWE-126, buffer over-read) in the certificate parsing path of the HTTPS management interface, affecting a broad swath of IOS XE releases from 17.3.x through 26.x. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the wide deployment footprint of IOS XE in enterprise and service provider networks makes even a low-probability DoS meaningful at scale.
Denial-of-service in Cisco IOS XE Software's web-based management interface (WebUI) allows an authenticated remote attacker holding only low-privilege credentials to render the management interface unresponsive by sending crafted input that bypasses input validation. The vulnerability spans an exceptionally broad version footprint - from 16.9.x through the 26.x release train - making patching scope significant for organizations running Cisco enterprise routing and switching infrastructure. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, placing real-world urgency below its broad scope might suggest.
Parent process code-sign spoofing in Electron on macOS allows a local low-privileged attacker to bypass fuse-based hardening controls restricting ELECTRON_RUN_AS_NODE and NODE_OPTIONS, injecting code inside the signed Electron application and inheriting its TCC permissions and keychain access. Only macOS deployments of Electron apps that have explicitly enabled same-signed-parent fuse restrictions are exposed; applications without this hardening are unaffected. No public exploit has been identified at time of analysis, and CVSS AC:H reflects the PID-reuse race-condition timing requirement inherent to the attack.
UI spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to deceive users into believing they are interacting with a legitimate browser interface by serving a crafted HTML page. The root cause is insufficient policy enforcement (CWE-346, origin validation error), allowing the attacker to manipulate rendered UI elements. No public exploit code exists and no active exploitation has been confirmed; EPSS stands at 0.16% (6th percentile) and CISA SSVC classifies exploitation as none, placing this firmly in a patch-and-monitor priority tier rather than an emergency response.
UI spoofing in Google Chrome for iOS prior to version 151.0.7922.72 enables a remote unauthenticated attacker to misrepresent critical interface elements - such as the address bar or origin indicators - through a specially crafted HTML page. Classified as CWE-451 (UI Misrepresentation of Critical Information), the impact is limited to integrity: no code execution or data exfiltration is possible directly, but users can be deceived into trusting a malicious page as legitimate. No public exploit code exists, EPSS sits at 0.16% (6th percentile), and Chromium internally rated this as Low severity - consistent with a constrained, social-engineering-dependent attack surface.
Chrome for iOS prior to 151.0.7922.72 exposes potentially sensitive process memory contents to an attacker with physical access to the device through an inappropriate implementation flaw. The vulnerability is classified CWE-200 (Information Disclosure) and is iOS-platform-specific, not affecting Chrome on other operating systems. No public exploit code exists and CISA SSVC confirms no active exploitation, placing this firmly in the low-urgency tier despite requiring prompt patching for high-assurance mobile environments.
UI spoofing in Google Chrome on iOS prior to 151.0.7922.72 enables a remote attacker to deceive users about page identity or browser security state by serving a crafted HTML page. The flaw is iOS-specific, exploiting an inappropriate implementation in the Chrome for iOS rendering layer rather than the broader Chromium engine, and requires only that the victim navigate to an attacker-controlled page. No public exploit has been identified and EPSS stands at 0.19% (9th percentile), consistent with Chromium's own 'Low' internal severity classification; this is a real but low-urgency integrity issue.
UI spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote, unauthenticated attacker to misrepresent security-critical interface elements - such as the address bar or origin indicators - by serving a crafted HTML page to a victim. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-delivered and requires no privileges, but does require the user to interact with the malicious page, limiting its reach. No public exploit or active exploitation has been identified; EPSS at 0.17% (7th percentile) and SSVC exploitation status of 'none' collectively indicate low real-world risk at this time.
UI spoofing in Google Chrome for iOS prior to version 151.0.7922.72 enables remote attackers to deceive users by manipulating security indicators through a crafted HTML page. The vulnerability causes incorrect rendering of Chrome's browser-managed security UI elements - such as origin display or HTTPS trust badges - potentially causing victims to mistake malicious pages for legitimate or secure ones. No active exploitation has been confirmed (not in CISA KEV), EPSS at 0.17% (7th percentile) indicates low near-term exploitation probability, and a vendor-released patch is available in version 151.0.7922.72.
No-referrer policy bypass in Google Chrome for iOS prior to 151.0.7922.72 allows a remote, unauthenticated attacker to exfiltrate origin page URL information that the site operator explicitly suppressed via the Referrer-Policy header. Exploitation requires luring a victim to a crafted HTML page, classifying this as a social-engineering-dependent, low-severity integrity/confidentiality boundary failure. No active exploitation is confirmed (not in CISA KEV), EPSS sits at the 8th percentile (0.18%), and SSVC rates technical impact as only partial - signaling a low operational priority despite the network attack vector.
Navigation restriction bypass in Google Chrome for iOS prior to 151.0.7922.72 allows a remote attacker to serve a crafted HTML page that circumvents the browser's navigation controls, resulting in limited integrity impact. The flaw is confined to Chrome's iOS-specific implementation layer (CWE-284: Improper Access Control) and is not present in Chrome on other platforms. No public exploit code has been identified at time of analysis, and EPSS exploitation probability is very low at 0.18% (8th percentile), consistent with SSVC's 'exploitation: none' determination.
Omnibox (URL bar) spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to display misleading URL content to a victim by serving a crafted HTML page, undermining the browser's fundamental trust signal. The flaw is iOS-specific and classified by Google as low severity (Chromium severity: Low), with EPSS at 0.21% and SSVC exploitation status of none, indicating no public exploitation at time of analysis. No public exploit code exists; the primary risk is phishing and credential harvesting against users who rely on the Omnibox to authenticate site identity.
Insufficient policy enforcement in Google Chrome for iOS prior to version 151.0.7922.72 enables a remote attacker to bypass discretionary access controls (CWE-284) by delivering a crafted HTML page to a victim, resulting in high integrity impact with no confidentiality or availability consequence. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms network reachability with no attacker privileges needed, though user interaction is required. With EPSS at 0.18% (8th percentile), SSVC exploitation classified as none, and no public exploit identified at time of analysis, real-world mass exploitation risk is low despite the meaningful integrity bypass potential on a widely-used mobile browser.
UI spoofing in Google Chrome for iOS (versions prior to 151.0.7922.72) enables remote attackers to misrepresent browser interface elements through specially crafted HTML pages, potentially deceiving users into disclosing information or taking unintended actions. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms network-deliverable exploitation requiring only user interaction with no attacker privileges needed. EPSS at 0.21% (11th percentile), no CISA KEV listing, and Chromium's own internal 'Low' severity rating all converge on low real-world exploitation pressure; no public exploit identified at time of analysis.
Navigation restriction bypass in Google Chrome for iOS (prior to 151.0.7922.72) enables a remote attacker to redirect users to unintended URLs via a crafted HTML page, exploiting a CWE-601 open redirect condition. The Chromium team rated this Low severity, consistent with the CVSS 4.3 score and the limited integrity-only impact (no confidentiality or availability consequences). No public exploit identified at time of analysis, and the EPSS score of 0.18% (8th percentile) reflects minimal exploitation interest from the threat actor community.
UI spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to manipulate the browser's visual interface through a crafted HTML page, potentially deceiving users into disclosing sensitive information or interacting with falsified content. Exploitation requires user interaction (visiting the malicious page), limiting opportunistic exploitation, and the EPSS score of 0.18% (8th percentile) reflects low observed exploitation probability. No public exploit code or active exploitation (CISA KEV) has been identified; vendor patch is available at version 151.0.7922.72.
Discretionary access control bypass in Google Chrome for iOS prior to 151.0.7922.72 allows a remote attacker to violate iOS access control boundaries by enticing a user to visit a specially crafted HTML page. The flaw stems from insufficient policy enforcement unique to the iOS version of Chrome, meaning desktop Chrome is not affected by this specific variant. No public exploit code has been identified and EPSS signals low exploitation probability, but the integrity-only CVSS impact and user-interaction requirement make this a realistic phishing-assisted attack path.
Omnibox (URL bar) spoofing in Google Chrome for iOS prior to 151.0.7922.72 allows a remote attacker to manipulate the displayed URL via malicious network traffic, deceiving users about the true origin of page content. The flaw is iOS-platform-specific and classified under CWE-451 (UI Misrepresentation of Critical Information), making it a phishing-enablement vulnerability rather than a code execution or data-exfiltration primitive. No public exploit or active exploitation has been identified at time of analysis; EPSS probability is very low at 0.20% (10th percentile).
Same-origin policy bypass in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to violate cross-origin isolation by luring a user into performing specific UI gestures on a crafted HTML page. The flaw stems from CWE-346 (Origin Validation Error) in an iOS-specific Chrome implementation, granting unauthorized write-level access to cross-origin content. No public exploit code has been identified and no active exploitation is confirmed; with an EPSS of 0.19% (9th percentile), real-world exploitation probability remains low but the integrity impact is high if successfully triggered.
UI spoofing in Google Chrome for iOS prior to 151.0.7922.72 allows a remote attacker to deceive users about the origin or content of a web page by exploiting a race condition via a crafted HTML page. The vulnerability requires the victim to visit the attacker-controlled page (UI:R), but no authentication or elevated privileges are needed. No public exploit code or CISA KEV listing exists at time of analysis; EPSS places exploitation probability at 0.14% (4th percentile), indicating low observed exploitation activity despite medium CVSS severity.
UI spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to misrepresent browser interface elements - such as the address bar or security indicators - by delivering a crafted HTML page, potentially deceiving users into believing they are interacting with a trusted site or legitimate browser chrome. The vulnerability maps to CWE-451 (UI Misrepresentation of Critical Information) and carries a High integrity impact despite no direct confidentiality or availability loss, because successful spoofing can facilitate credential theft or social engineering at scale. No public exploit identified at time of analysis, and EPSS at 0.17% (7th percentile) reflects low current opportunistic exploitation probability.
Domain spoofing in Google Chrome on iOS prior to 151.0.7922.72 allows a remote unauthenticated attacker to misrepresent the displayed origin in the browser's security UI by delivering a crafted HTML page to a victim. The flaw (CWE-451) enables phishing-class attacks where the address bar or site identity indicator shows a trusted domain while content is served from a different origin. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), indicating low automated exploitation likelihood, but the integrity impact is high for targeted phishing campaigns against iOS Chrome users.
UI spoofing in Google Chrome for iOS prior to version 151.0.7922.72 enables remote attackers to misrepresent critical browser interface elements - such as the address bar or security indicators - by delivering a crafted HTML page to a victim. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) confirms the attack is network-reachable with no attacker authentication, though it requires the victim to interact with a malicious page. No public exploit code or active exploitation has been identified; EPSS sits at 0.17% (7th percentile), indicating low current exploitation interest despite the vendor-confirmed patch.
Navigation restriction bypass in Google Chrome for iOS (prior to 151.0.7922.72) enables a remote attacker to circumvent browser-enforced navigation controls by delivering a crafted HTML page. The root cause is an inappropriate implementation (CWE-284) in Chrome's iOS-specific navigation stack, meaning the flaw is isolated to the iOS platform and does not affect Chrome on Android or desktop. No public exploit code exists and EPSS probability stands at just 0.22% (13th percentile), indicating low real-world exploitation pressure at time of analysis; this vulnerability is not listed in the CISA KEV catalog.
UI spoofing in Google Chrome for iOS prior to version 151.0.7922.72 enables a remote attacker to misrepresent critical browser interface elements - such as the address bar or security indicators - by delivering a crafted HTML page to the victim (CWE-451). The CVSS vector assigns high integrity impact (I:H) with no privileges required from the attacker, but mandates user interaction (UI:R), meaning the victim must visit the malicious page. No public exploit identified at time of analysis, and an EPSS score of 0.17% at the 7th percentile indicates very low observed exploitation interest; Chromium's own severity rating of Medium aligns with this assessment.
Cross-origin data leakage in Google Chrome for iOS (versions prior to 151.0.7922.72) allows remote attackers to read cross-origin data by delivering a crafted HTML page that socially engineers the victim into performing specific UI gestures. The root cause is an inappropriate implementation classified under CWE-346 (Origin Validation Error), meaning Chrome's iOS-specific code fails to correctly enforce same-origin policy boundaries under particular interaction sequences. No active exploitation has been confirmed - CISA KEV status is absent, SSVC exploitation rating is 'none', and EPSS sits at 0.21% (11th percentile) - placing this firmly in the low-priority tier despite its network delivery vector.
UI spoofing via race condition in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to deceive users about page origin or security context by serving a crafted HTML page. The vulnerability stems from CWE-362 (concurrent execution with improper synchronization), allowing an attacker to manipulate browser UI elements - such as the address bar or security indicators - during a timing window. No active exploitation is confirmed (EPSS 0.17%, 7th percentile; not listed in CISA KEV), and Google has released a patch in the stable channel update.
Navigation restriction bypass in Google Chrome for iOS (versions prior to 151.0.7922.72) enables unauthenticated remote attackers to circumvent browser navigation controls by inducing a user to load a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) confirms network-accessible, low-complexity exploitation with no privilege requirements but mandatory user interaction, yielding high integrity impact with no confidentiality or availability consequences. No public exploit identified at time of analysis, and EPSS at 0.22% (13th percentile) indicates limited near-term exploitation likelihood despite the medium severity rating.
Navigation restriction bypass in Google Chrome for iOS prior to 151.0.7922.72 enables remote attackers to circumvent browser-enforced navigation policies by delivering a crafted HTML page to a victim. The flaw originates from insufficient client-side policy enforcement (CWE-602), where the iOS-specific Chrome policy engine fails to prevent unauthorized navigation actions triggered by attacker-controlled content. No public exploit has been identified at time of analysis, and an EPSS score of 0.18% (8th percentile) indicates minimal current exploitation activity; vendor-released patch 151.0.7922.72 is available.
Navigation restriction bypass in Google Chrome for iOS prior to 151.0.7922.72 allows remote attackers to circumvent browser navigation controls by delivering maliciously crafted network traffic to a victim device. The flaw stems from insufficient input validation (CWE-20) in the iOS-specific implementation of Chrome, resulting in an Integrity:High impact - enabling unauthorized navigation, redirect manipulation, or security-boundary evasion - with no confidentiality or availability consequences. No public exploit has been identified and EPSS places exploitation probability at just 0.17% (7th percentile), indicating low active exploitation risk at time of analysis.
Omnibox (URL bar) spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to deceive users about the actual origin of the page they are viewing by serving a crafted HTML page. The flaw is a CWE-451 UI misrepresentation defect, meaning the browser fails to accurately convey security-critical location information to the user, creating a reliable phishing vector. No public exploit code exists and EPSS sits at 0.21% (11th percentile); SSVC confirms exploitation as none and technical impact as partial, placing this firmly in lower-priority remediation tiers despite the phishing relevance.
Cross-origin data leakage in Google Chrome for iOS prior to 151.0.7922.72 exposes sensitive information from other browser origins when a user visits a specially crafted HTML page. The root cause is an inappropriate implementation of origin validation (CWE-346) within Chrome's iOS-specific code path, breaking the browser's same-origin policy boundary. No public exploit code or active exploitation has been identified; EPSS probability stands at 0.21% (11th percentile), and the vulnerability is absent from the CISA KEV catalog, indicating low near-term exploitation pressure.
Universal Cross-Site Scripting (UXSS) in Google Chrome for iOS prior to 151.0.7922.72 enables remote attackers to inject arbitrary scripts or HTML across origin boundaries via crafted malicious network traffic, requiring only passive user interaction such as visiting a compromised page. The vulnerability stems from insufficient input validation (CWE-20) in the iOS-specific Chrome codebase, which uses Apple's WebKit engine rather than Blink. No public exploit code has been identified and CISA KEV does not list this vulnerability; EPSS probability sits at 0.19%, placing it in the 9th percentile of exploitation likelihood.
Universal Cross-Site Scripting (UXSS) in Google Chrome for iOS prior to 151.0.7922.72 allows a remote attacker to inject arbitrary scripts or HTML across origin boundaries by exploiting a race condition triggered through a crafted HTML page. The vulnerability requires user interaction and benefits from high attack complexity due to race-condition timing, placing real-world exploitation difficulty well above typical web vulnerabilities. No public exploit code exists and no active exploitation has been identified; SSVC assessment confirms exploitation status as none at time of analysis.
Navigation restriction bypass in Google Chrome on iOS prior to 151.0.7922.72 allows a remote, unauthenticated attacker to circumvent the browser's built-in navigation policy controls by delivering a specially crafted HTML page. Rooted in CWE-602 (Client-Side Enforcement of Server-Side Security), the flaw reflects an iOS-specific policy enforcement gap not present in desktop Chrome builds. The Chromium team rated this High severity internally; however, no confirmed active exploitation exists - CISA KEV is absent, EPSS stands at 0.30%, and SSVC classifies exploitation as none with partial technical impact.
Arbitrary file overwrite in Develar app-builder (all versions ≤ 4.2.0 on macOS) allows an unauthenticated remote attacker to escape the ZIP extraction directory by exploiting APFS Unicode case-folding combined with symlink following in the `zipx.Unzip` routine. A crafted archive containing a symlink entry `ss` pointing to an external victim file and a subsequent regular-file entry `ß` causes the builder to follow the symlink - because APFS folds `ß` to `ss` - overwriting the target with attacker-controlled content. SSVC rates the attack automatable with no confirmed exploitation; no public exploit code has been identified at time of analysis, though CERT/CC advisory VU#293714 and ENISA EUVD-2026-50423 confirm coordinated disclosure.
An information disclosure vulnerability in Apple macOS allows a local malicious application to access sensitive user data without proper authorization. This issue was resolved in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. No active exploitation or public exploit code has been identified at this time, and EPSS indicates a very low probability of exploitation.
Kernel memory disclosure in Apple macOS allows a rogue application to read sensitive kernel data via an out-of-bounds read. Fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6. No public exploit identified and EPSS score is low (0.15%), indicating low exploitation risk in the wild.
Information disclosure in Apple iOS and iPadOS 26.6, along with macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6, allows a local app to access sensitive user data due to a state management flaw. The vulnerability was addressed with improved state handling, and no public exploit code or active exploitation has been identified; EPSS indicates a low likelihood of real-world attacks.
Information disclosure in macOS allows a local app to access sensitive user data. The issue affects macOS Sonoma before 14.8.8 and macOS Sequoia before 15.7.8, where missing privacy controls could be abused by a malicious application. With a CVSS score of 5.5 and EPSS at 0.14%, no public exploit or active exploitation has been observed; Apple has released patches.
Information disclosure in macOS Screen Sharing allows a local attacker with low privileges to read the legacy VNC password. This issue affects macOS versions prior to 15.7.8 and 14.8.8, and could enable unauthorized remote access if VNC is enabled. No active exploitation or public exploit code has been identified.
A file quarantine bypass in macOS Gatekeeper allows maliciously crafted ZIP archives to evade security checks. Affected versions include macOS Sequoia before 15.7.8 and macOS Sonoma before 14.8.8. Exploitation is not confirmed in the wild, public exploit code has not been identified, and EPSS indicates very low likelihood of widespread attacks.
Unauthorized reading of a persistent device identifier in Apple iOS, iPadOS, tvOS, watchOS, and visionOS allows a malicious app to access a unique identifier without user consent. The issue originates from a permissions enforcement weakness fixed in iOS 26.6, iPadOS 26.6, tvOS 26.6, watchOS 26.6, and visionOS 26.6. No active exploitation or public exploit code is known, and EPSS predicts a very low exploitation probability (0.16%).
A Gatekeeper bypass in macOS allows maliciously crafted ZIP archives to evade security checks, enabling installation of untrusted applications. Affected are macOS Sonoma 14.x prior to 14.8.8 and Sequoia 15.x prior to 15.7.8; exploitation requires user interaction. No active exploitation or public exploit code is known, and a vendor patch is available.
Safari and WebKit-based apps across Apple platforms crash when a user visits a specially crafted website, due to a state management flaw (CWE-400: Uncontrolled Resource Consumption) in versions prior to 26.6. Affected platforms include Safari on macOS Tahoe, iOS 26, iPadOS 26, and visionOS 26. No confidentiality or integrity impact is present - the consequence is an app-level denial-of-service. No public exploit code exists and CISA SSVC confirms no active exploitation, with EPSS at 0.16% (6th percentile), indicating very low exploitation likelihood at time of analysis.
Information disclosure in macOS allows a malicious app to access user-sensitive data when the user is tricked into running it. Affected versions include macOS Sequoia before 15.7.8, Sonoma before 14.8.8, and Tahoe before 26.6. No active exploitation has been confirmed, and the EPSS score is low (0.15%), indicating minimal real-world risk at this time.
A permissions validation flaw across Apple's iOS, iPadOS, macOS, and visionOS could allow a local malicious app to delete arbitrary files, leading to data loss. The issue has a low exploitation probability (EPSS 0.16%) and no known active exploits or public exploit code. Patches are available in the respective OS updates.
Local information disclosure in Apple iOS and iPadOS 26.6 and earlier, as well as multiple macOS versions, allows an app to leak sensitive user data due to missing entitlement checks. The vulnerability requires user interaction and local access, but has low exploitation probability (EPSS 0.16%) and no known public exploits or active exploitation per CISA KEV.
A local denial-of-service vulnerability in macOS versions before Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 allows a malicious app to cause unexpected system termination due to a memory handling flaw. Exploitation requires a low-privilege user to run a crafted application, and no active exploitation is known at this time.
Local access to sensitive user data in macOS allows a malicious app to bypass sandbox restrictions and read protected files or information. This issue affects all macOS versions prior to Tahoe 26.6, requires user interaction to run the malicious app (e.g., via social engineering or masquerading as legitimate software), and has no public exploit or active exploitation reported at this time.
macOS authorization bypass allows an app to access sensitive user data without proper permission, potentially triggered via malicious website in Safari
UI spoofing in Apple Safari 26.5 and earlier allows attackers using cross-origin framing to misrepresent website identity. The vulnerability requires user interaction (visiting a malicious page) and could lead to phishing or deceptive actions. No active exploitation or public exploit code identified; patch is available.
Information disclosure in macOS and tvOS due to a race condition allows a malicious local app to read sensitive user data without authorization. Affected versions include macOS prior to Sonoma 14.8.8, Sequoia 15.7.8, and Tahoe 26.6, and tvOS prior to 26.6. No active exploitation or public exploit code has been identified, and EPSS indicates very low exploitation probability.
Information disclosure in macOS allows an attacker with physical access to a locked device to view sensitive user information. Affected versions include macOS Sonoma below 14.8.8, macOS Sequoia below 15.7.8, and macOS Tahoe below 26.6. No public exploit or active exploitation has been identified, and EPSS probability is very low at 0.16%, reflecting the physical access requirement.
Information disclosure in macOS prior to 15.7.8, 14.8.8, and 26.6 allows a malicious app to leak sensitive user information. The vulnerability arises from improper removal of sensitive data, which Apple addressed in these updates. No active exploitation is known, and EPSS indicates a low probability of exploitation (0.16%).
A symlink handling vulnerability in macOS allows a malicious application to modify protected parts of the file system. Affected versions include macOS prior to Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. Exploitation requires user interaction (opening a malicious app), and no public exploit code or active exploitation has been identified.
A malicious app on macOS can read kernel memory due to insufficient validation. This information disclosure vulnerability is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6. No active exploitation or public exploit code has been identified, and the EPSS score is very low (0.16%).
Unauthorized file read via a sandbox escape vulnerability in Apple iOS, iPadOS, macOS, tvOS, watchOS, and visionOS allows a malicious app to access files outside its designated sandbox. Exploitation requires user interaction to install and launch a malicious app, but no active exploitation or public exploit code is currently known. CVSS medium severity (6.5) is offset by a very low EPSS score (0.17%), indicating low real-world exploitation probability.
A local denial-of-service vulnerability in Apple's operating systems allows a malicious app to cause unexpected system termination by triggering an out-of-bounds read. Fixes are available in version 26.6 for iOS, iPadOS, macOS, tvOS, visionOS, and watchOS; no active exploitation or public exploit has been identified, and EPSS indicates a low probability of exploitation.
Local information disclosure in Apple iOS/iPadOS 26.x, macOS Tahoe 26.x, macOS Sequoia 15.x, macOS Sonoma 14.x, tvOS 26.x, visionOS 26.x and watchOS 26.x lets an app installed and run by the user read sensitive user data because of insufficient access checks (CWE-200), a flaw Apple fixed in iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, visionOS 26.6 and watchOS 26.6. Exploitation requires the user to install and launch a malicious or malicious-behaving app on an unpatched device (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 5.5); there is no remote or network-reachable path and no privilege escalation is needed, so the practical exposure is limited to confidentiality on devices where sideloaded or otherwise untrusted apps are allowed. There is no public exploit identified at time of analysis, CISA's SSVC decision framework records exploitation as none and technical impact as partial, and EPSS is only 0.17% (6th percentile), so every signal aligns with a genuine but low-priority issue that should be resolved by routine patch cycles rather than emergency response.
Kernel memory disclosure in macOS allows a local app to read uninitialized kernel memory, potentially exposing sensitive information. Apple has released patches in macOS Sonoma 14.8.8, Sequoia 15.7.8, and Tahoe 26.6. The vulnerability has a low EPSS score (0.17%) with no known active exploitation or public exploit code.
Physical access to a locked Apple device running vulnerable iOS or macOS allows an attacker to view sensitive user information due to an out-of-bounds read. The flaw is fixed in iOS 26.6, iPadOS 26.6, and multiple macOS versions. No public exploit or active exploitation has been reported.
Kernel memory disclosure in Apple iOS and iPadOS (fixed in 26.6), macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6 and watchOS 26.6 allows a locally running app to read kernel memory that should be inaccessible to it, undermining the isolation boundary between user-space apps and the kernel. The prerequisite is meaningful: an attacker must first get attacker-controlled code executing on the device (a malicious, sideloaded, or compromised app), and the flaw itself yields only disclosure - high confidentiality impact but no integrity or availability impact, so it is best characterized as one link in a larger privilege-escalation or jailbreak chain rather than a standalone compromise. Vendor patches are available for every affected platform; there is no remote or network attack vector, no public exploit code identified at time of analysis, no confirmed active exploitation (CISA SSVC exploitation: none), and EPSS is low at 0.17% (7th percentile), consistent with the moderate 5.5 severity and the local-only, code-execution-gated exploitation model.
A file quarantine bypass in Apple macOS allows a malicious application to evade Gatekeeper integrity checks. Affected versions include macOS prior to 15.7.8, 14.8.8, and 26.6. Local attackers with user interaction can leverage this to execute unsigned code that would normally be blocked, leading to potential integrity compromise.
Denial-of-service via out-of-bounds write in Apple CoreAudio when processing malicious audio streams. Affected iOS, iPadOS, macOS, tvOS, watchOS, and visionOS versions are vulnerable. No known active exploitation or public exploit code exists at time of analysis, and EPSS probability is low (0.17%).
Denial of service in macOS versions prior to Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 allows a local malicious app to trigger memory corruption and crash the system. Exploitation requires user interaction to run the app; no active exploitation is known (not in CISA KEV) and EPSS indicates a very low probability (0.16%). Apple has released updates to address the logic issue.
Physical access to an iPhone or iPad running vulnerable iOS/iPadOS versions allows an attacker to access sensitive user data during the iPhone Mirroring feature due to improper state management. This issue is fixed in iOS 26.6 and iPadOS 26.6. No known exploitation in the wild; EPSS score is low (0.15%, percentile 5%).
Local denial of service in macOS allows a malicious app to trigger unexpected system termination via memory exhaustion. Affects macOS Sequoia prior to 15.7.8, macOS Sonoma prior to 14.8.8, and macOS Tahoe prior to 26.6. No active exploitation or public exploit identified; EPSS probability is low (0.16%).
Information disclosure in Apple iOS/iPadOS versions prior to 26.6 allows a locally installed app to access sensitive user data without proper permissions. Apple has released patches in iOS/iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, and watchOS 26.6. No public exploit or active exploitation has been reported, and the EPSS score indicates a low likelihood of exploitation.
An out-of-bounds write vulnerability in Apple iOS 26.6 and earlier allows a malicious app to cause unexpected system termination (kernel panic). No public exploit or active exploitation has been reported; patch available from Apple.