Apple
Monthly
A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple Buffer Overflow vulnerabilities in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated,. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software running on certain models of Cisco Catalyst Switches could allow an authenticated, remote attacker to. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable. No vendor patch available.
A vulnerability in the implementation of Internet Key Exchange Version 1 (IKEv1) functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a memory leak or a. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability in the crypto engine of the Cisco Integrated Services Module for VPN (ISM-VPN) running Cisco IOS Software could allow an unauthenticated, remote attacker to cause a denial of service. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 68.5%.
An issue was discovered in certain Apple products. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and EPSS exploitation probability 76.7%.
The DHCP relay subsystem of Cisco IOS 12.2 through 15.6 and Cisco IOS XE Software contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code and gain full. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 12.3%.
A vulnerability in the Virtual Private LAN Service (VPLS) code of Cisco IOS 15.0 through 15.4 for Cisco Catalyst 6800 Series Switches could allow an unauthenticated, adjacent attacker to cause a. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and no vendor patch available.
A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS 15.0 through 15.6 and Cisco IOS XE 3.5 through 16.5 could allow an unauthenticated, remote attacker to cause high. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and no vendor patch available.
A vulnerability in the implementation of the PROFINET Discovery and Configuration Protocol (PN-DCP) for Cisco IOS 12.2 through 15.6 could allow an unauthenticated, remote attacker to cause an. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and no vendor patch available.
Multiple vulnerabilities in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS 12.4 through 15.6 could allow an unauthenticated, remote attacker to cause an affected. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and no vendor patch available.
Multiple vulnerabilities in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS 12.4 through 15.6 could allow an unauthenticated, remote attacker to cause an affected. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and no vendor patch available.
A vulnerability in the implementation of a protocol in Cisco Integrated Services Routers Generation 2 (ISR G2) Routers running Cisco IOS 15.0 through 15.6 could allow an unauthenticated, adjacent. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and no vendor patch available.
A vulnerability in the implementation of Network Address Translation (NAT) functionality in Cisco IOS 12.4 through 15.6 could allow an unauthenticated, remote attacker to cause a denial of service. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and no vendor patch available.
A vulnerability in the UDP processing code of Cisco IOS 15.1, 15.2, and 15.4 and IOS XE 3.14 through 3.18 could allow an unauthenticated, remote attacker to cause the input queue of an affected. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 10.8%.
A vulnerability in the Autonomic Networking feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause autonomic nodes of an affected system to. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and no vendor patch available.
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authenticated, remote attacker to remotely execute code. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and no vendor patch available.
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authenticated, remote attacker to remotely execute code. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 14.1%.
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authenticated, remote attacker to remotely execute code. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 10.0%.
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authenticated, remote attacker to remotely execute code. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 14.1%.
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authenticated, remote attacker to remotely execute code. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 36.1%.
The server IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.6, IOS XE through 3.18S, IOS XR 4.3.x and 5.0.x through 5.2.x, and PIX before 7.0 allows remote attackers to obtain. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
WebKit in Apple iOS before 9.3.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The kernel in Apple iOS before 9.3.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The kernel in Apple iOS before 9.3.5 allows attackers to obtain sensitive information from memory via a crafted app. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Script Editor in Apple OS X before 10.11.1 allows remote attackers to bypass an intended user-confirmation requirement for AppleScript execution via unspecified vectors. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 78.2%.
rsh in the remote_cmds component in Apple OS X before 10.11 allows local users to obtain root privileges via vectors involving environment variables. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 11.6%.
dyld in Apple OS X before 10.10.5 does not properly validate pathnames in the environment, which allows local users to gain privileges via unspecified vectors. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Admin Framework in Apple OS X before 10.10.4 does not properly restrict the location of writeconfig clients, which allows local users to obtain root privileges by moving and then modifying Directory. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Public exploit code available.
The XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to bypass authentication and obtain admin privileges via unspecified vectors. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 86.7%.
The fetch_url function in usr.bin/ftp/fetch.c in tnftp, as used in NetBSD 5.1 through 5.1.4, 5.2 through 5.2.2, 6.0 through 6.0.6, and 6.1 through 6.1.5 allows remote attackers to execute arbitrary. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 85.0%.
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Heap-based buffer overflow in IOHIDFamily in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitrary code in a privileged context via an application that provides crafted. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Buffer overflow in Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted dref atoms in a movie file. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 81.3%.
sudo 1.6.0 through 1.7.10p6 and sudo 1.8.0 through 1.8.6p6 allows local users or physically proximate attackers to bypass intended time restrictions and retain privileges without re-authenticating by. Rated medium severity (CVSS 6.9). Public exploit code available and no vendor patch available.
Buffer overflow in the plugin in Apple QuickTime before 7.7.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted MIME type. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 78.1%.
Multiple buffer overflows in Apple QuickTime before 7.7.3 allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted style element in a QuickTime. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 79.1%.
Multiple stack-based buffer overflows in Apple QuickTime before 7.7.2 on Windows allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted TeXML. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 69.6%.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Confused deputy in PriceTracking in Google Chrome on on iOS prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions into a privileged page via crafted network traffic. (Chromium security severity: Medium)
Integer overflow in the FreeRDP client's Apple/CoreAudio audio-input (audin) backend, present in all versions before 3.31.0, allows a malicious or compromised RDP server to corrupt memory on the connecting client. The server sends an MSG_SNDIN_OPEN message carrying a crafted FramesPerPacket value that wraps the size arithmetic used by AudioQueueAllocateBuffer, producing an undersized allocation that is then written past its bounds during audio capture. Impact is bounded to the client (CVSS 5.3, all impacts Low, UI:P — the victim must initiate a connection to the hostile server); patch status is 'available from vendor' with a fix in 3.31.0, and no public exploit or CISA KEV entry was identified at time of analysis.
A type confusion flaw (CWE-843) in memory handling across Apple's current operating system family lets a malicious app crash the affected device or component, producing a local denial of service. Exploitation requires the victim to install and launch a crafted app — the CVSS vector is AV:L/PR:N/UI:R with availability-only impact, so there is no remote unauthenticated path and no confidentiality or integrity loss. Apple has shipped fixes in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7 and macOS Golden Gate 27, plus tvOS 27, visionOS 27 and watchOS 27; EPSS is only 0.17% (6th percentile) and there is no public exploit identified at time of analysis, so this is a routine patch-cycle item rather than an urgent exposure.
A permissions issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A malicious application may be able to access restricted files.
Apple macOS contains an improper access-control logic flaw in state management that allows a locally running app to read protected user data outside of its intended permission scope. The issue affects macOS Sequoia, macOS Tahoe and the macOS 27 (Golden Gate) line prior to the fixed releases, and is remediated in macOS Sequoia 15.8, macOS Tahoe 26.7 and macOS Golden Gate 27. The CVSS vector (AV:L/AC:L/PR:N/UI:R, C:H/I:N/A:N) shows this is a local, confidentiality-only issue requiring a user to launch or open the malicious app, with no public exploit identified at time of analysis and a low EPSS score of 0.18% (8th percentile) — real-world exploitation pressure is currently minimal.
Improper state management in Apple macOS (all versions prior to macOS 27 "Golden Gate") lets a locally installed application reach sensitive user data that normal macOS privacy and access controls are supposed to protect. The attack is local and needs the victim to launch the malicious app (AV:L, UI:R, PR:N), and the impact is confidentiality-only (C:H/I:N/A:N), which yields a moderate CVSS of 5.5. The issue is fixed in macOS 27 per Apple's advisory, EPSS is very low (0.14%, 3rd percentile), there is no CISA KEV listing, and no public exploit code has been identified.
An out-of-bounds write in Apple's operating system memory handling lets a process already confined to the platform sandbox break out of those restrictions, gaining partial read and write access to data it should not reach. Affected platforms are iOS and iPadOS before 26.7/27, macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate before 27, visionOS before 27 and watchOS before 27. Apple has released fixes for every affected platform, and CISA's SSVC assessment records no exploitation, no automation and only partial technical impact.
An information-disclosure flaw in Apple's WebKit-based browser stack lets a malicious website infer which applications a user has installed across Safari, iOS/iPadOS, and macOS. Apple addressed it through improved state management in Safari 27, iOS 27 and iPadOS 27, and macOS Golden Gate 27, so any device still on an earlier release remains exposed. Exploitation requires the victim to visit the attacker's page (CVSS UI:R) and yields only low-confidentiality impact, with no public exploit code and no CISA KEV listing at time of analysis.
Archive extraction on Apple platforms fails to properly validate path components, letting a maliciously crafted archive write files outside the intended destination directory. Affected systems include iOS and iPadOS before 26.7 (and before 27), macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate before 27, and visionOS before 27, with the flaw rated CVSS 5.5 (integrity-only, local vector with required user interaction). Apple has released patched versions for every affected platform; there is no CISA KEV listing and no public exploit code identified, and EPSS is only 0.18% (7th percentile), indicating low predicted exploitation activity.
A race condition in Apple macOS kernel locking allows a local user with existing code execution on the host to read kernel memory, fixed in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27. Exploitation requires local authenticated access and a high-complexity timing win in the kernel's locking path, so it is probabilistic rather than reliable, and the impact is limited to confidentiality (kernel memory disclosure) with no code execution, modification, or denial of service. There is no public exploit identified at time of analysis, the issue is not in CISA KEV, and EPSS is low at 0.19% (8th percentile), making this a genuine but low-priority issue.
A race condition in Apple macOS state management allows a locally executing application to read sensitive user data; the flaw is fixed in macOS Golden Gate 27, and all earlier macOS versions are affected. Exploitation requires an attacker-controlled or malicious app already running on the host (assessed as local, PR:L, not remote despite the vendor's AV:N/PR:N vector) and depends on winning a narrow timing window, which limits reliability. Impact is confidentiality-only - no integrity or availability effect - and no public exploit has been identified at time of analysis; EPSS is 0.14% (4th percentile), so opportunistic exploitation is unlikely, though the data-disclosure impact and Apple's ecosystem prominence keep patching worthwhile.
A logic issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. An app may be able to bypass Gatekeeper checks.
Local information disclosure in Apple iOS and iPadOS (and visionOS) before version 27 allows an app running on the device to read sensitive user data it should not be able to reach. Apple fixed the flaw through improved file handling in iOS 27, iPadOS 27 and visionOS 27. No public exploit code or active exploitation has been reported, and the EPSS score of 0.15% (5th percentile) plus SSVC 'exploitation: none' point to a low-volume, user-assisted local attack rather than a mass-exploited one.
A path validation weakness in Apple's iOS, iPadOS, and macOS allows a malicious application to reach files outside its intended sandbox and read user-sensitive data. Apple addressed the flaw with improved path validation in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, and macOS Sequoia 15.8, so all older releases remain exposed until updated. Exploitation requires a locally installed app and some user interaction (CVSS AV:L/UI:R), exploit probability is currently very low (EPSS 0.20%, 10th percentile), and no public exploit code or CISA KEV entry has been identified at time of analysis.
A permissions-validation flaw (CWE-863) in Apple macOS versions prior to 27 (Golden Gate) and Xcode versions prior to 27 allows a locally installed app to reach user-sensitive data it should not be authorized to read. The issue is a local, confidentiality-only defect rated CVSS 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N): no privileges are needed, but the attack requires the victim to run the malicious application. Apple has released fixes in macOS 27 and Xcode 27; there is no CISA KEV listing, no public exploit code identified at time of analysis, and EPSS is very low at 0.16% (5th percentile), so real-world exploitation is unlikely to be widespread.
Apple fixed a kernel uninitialized-memory flaw (CWE-457) across iOS/iPadOS, macOS, tvOS, visionOS, and watchOS in which a locally installed app can determine kernel memory layout, defeating address-space randomization. The impact is information disclosure only - high confidentiality, no integrity or availability impact - and exploitation requires a local app plus user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R, 5.5). Apple shipped patches on [dates not specified] for iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27; no public exploit code or active exploitation is indicated, and EPSS is low (0.21%, 11th percentile).
An improper access-control flaw in Apple macOS allows a locally running application to bypass authorization checks and read sensitive user data it should not be able to reach, with the fix delivered in macOS Sequoia 15.8 and macOS Golden Gate 27. Exploitation is local only and requires user interaction (the victim must launch the malicious or trojanized app), so the CVSS impact is limited to confidentiality (5.5 Medium). EPSS is negligible at 0.16% (5th percentile), there is no CISA KEV listing and no public exploit code identified at time of analysis, making this a routine update rather than an emergency patch.
Integer overflow (CWE-190) in macOS allows a locally present application to crash an affected component or the operating system, producing a denial-of-service condition rather than code execution or data theft. Apple fixed the flaw with improved input validation in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27 per advisories 149035, 149042 and 149043. Exploitation requires a malicious app to be running on the target Mac and the user to interact with it (AV:L/UI:R); no public exploit code has been identified and EPSS is only 0.19% (9th percentile), so this is a routine patch-cycle item rather than an urgent one.
A race condition in Apple's kernel state handling lets a locally installed app corrupt kernel memory or trigger unexpected system termination across iOS/iPadOS, macOS, tvOS, visionOS, and watchOS. Apple addressed the flaw in iOS 18.7.10 and 26.6, iPadOS 18.7.10 and 26.6, macOS Sequoia 15.7.8, macOS Tahoe 26.6, and tvOS/visionOS/watchOS 26.6, so exploitation is limited to unpatched devices running a malicious app plus user interaction. No public exploit code and no active exploitation are known; EPSS is 0.17% (6th percentile) and CVSS rates it 6.3, reflecting a local, high-complexity attack with no confidentiality impact.
This issue was addressed with additional entitlement checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to modify protected parts of the file system.
Mounting a crafted disk image on unpatched macOS releases triggers an out-of-bounds write in the code that parses disk image content, causing unexpected system termination (crash) on macOS Sequoia, Sonoma and Tahoe. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) - a user-interaction-dependent denial-of-service with no confidentiality or integrity impact, and CISA's SSVC assessment marks exploitation as 'none' and automatable as 'no'. EPSS is 0.19% (9th percentile), no public exploit code or CISA KEV listing was identified at time of analysis, and Apple has shipped fixed builds in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8 and macOS Tahoe 26.6.
A race condition in core Apple operating system components lets a locally installed app trigger an unexpected system termination on iOS, iPadOS, macOS, tvOS, visionOS and watchOS. Apple fixed the flaw through improved state handling in iOS 26.7/27, iPadOS 26.7/27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27. Impact is availability-only (no data exposure or modification), exploitation requires a local malicious app and winning a timing window, EPSS is a low 0.21%, and no public exploit code or active exploitation has been identified at time of analysis.
Apple macOS contains an improper input validation flaw (CWE-20) that a remote attacker can leverage to crash affected system components, producing a denial-of-service condition on the host. Apple addressed the issue in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7, so all earlier builds of those release trains remain vulnerable. Exploitation requires the victim to interact with attacker-supplied content (CVSS UI:R), and there is no public exploit identified at time of analysis, though the CVSS 3.1 base score of 6.5 reflects a high availability impact with no confidentiality or integrity loss.
Improper access control in Apple's Keychain service lets a locally installed app delete credentials stored by other applications on iOS 27, iPadOS 27, macOS Golden Gate 27, and visionOS 27 (all versions prior to these releases). The bug is fixed by removing the vulnerable code path; it is rated CVSS 5.5 with integrity-only impact, and there is no public exploit or CISA KEV confirmation at time of analysis (EPSS 0.15%).
An out-of-bounds read in Apple's font parsing code lets a maliciously crafted font file leak process memory on unpatched builds of iOS, iPadOS, macOS, tvOS, visionOS and watchOS, with all affected platforms fixed in the version 27 releases. Triggering it requires the victim to render attacker-supplied content containing the crafted font — an email, document, web page or message preview — but no credentials or elevated privileges are needed once that interaction happens, and the resulting confidentiality impact is rated high with no integrity or availability effect. No public exploit code or active exploitation has been identified, and EPSS sits at a low 0.20% (10th percentile), so this is best handled as a scheduled platform update rather than an emergency response.
A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to break out of its sandbox.
An out-of-bounds read in the font-parsing path of Apple's operating systems lets a remote attacker disclose the contents of process memory when a victim processes a maliciously crafted font. All Apple platforms are affected prior to the version 27 releases — iOS and iPadOS, macOS Golden Gate, tvOS, visionOS and watchOS — and Apple has shipped fixes for each. There is no CISA KEV listing and no public exploit code identified, and the EPSS score of 0.17% (7th percentile) indicates a low probability of near-term exploitation; because the sole impact is memory disclosure and exploitation requires the victim to open or render attacker-supplied content, this is a moderate-priority patch rather than an emergency.
Information disclosure in Apple's iOS, iPadOS, macOS, tvOS and watchOS platforms allows an app running on the device to reach sensitive user data that the operating system's data protection mechanisms were supposed to keep isolated from it. Apple resolved the issue with improved data protection in iOS and iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27 and watchOS 27, with vendor advisories published across seven support pages. No public exploit code or active exploitation has been reported, EPSS is low at 0.20% (10th percentile), and the issue is not listed in CISA KEV, so this reads as a routine hardening fix rather than an urgent emergency-patch event.
A use-after-free memory-management flaw affects Apple's operating system family prior to the 26.6 releases — iOS and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6 and watchOS 26.6 — and allows a locally installed app to trigger unexpected system termination (a denial-of-service condition). The vulnerability is rated CVSS 5.5 with a local attack vector, low complexity and low privileges required, but no confidentiality or integrity impact; EPSS is only 0.19 percent and there is no CISA KEV listing and no publicly available exploit code identified at time of analysis. Apple has shipped fixes in all four platform advisories, so the practical risk is concentrated on unpatched devices rather than on active exploitation.
Improper authorization checks in Apple's headphone motion data handling allow a locally installed app to read motion sensor data from connected headphones without prompting the user for consent, affecting iOS/iPadOS 26.7 and 27 and earlier, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27 and watchOS 27 and earlier. Exploitation requires a malicious or compromised app and user interaction, and the impact is limited to confidentiality of headphone sensor data (CVSS 5.5, C:H/I:N/A:N). Apple has shipped fixes in all affected operating systems; EPSS is low (0.20%, 10th percentile), there is no CISA KEV listing and no public exploit code identified at time of analysis.
Loading attacker-controlled web content on an unpatched Apple device can trigger a null pointer dereference in the WebKit rendering pipeline, crashing the browser or app that renders the page and producing a denial-of-service on iPhone, iPad, Mac, Apple Watch and Apple Vision Pro. Apple shipped fixes in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, visionOS 27 and watchOS 27. The flaw scores CVSS 6.5 with a user-interaction requirement (UI:R), EPSS is only 0.20% (10th percentile), and there is no public exploit code or CISA KEV listing at time of analysis.
An authorization flaw in Apple's operating systems lets a locally installed malicious app bypass Privacy preferences on affected iOS, iPadOS, and macOS builds. Apple addressed the issue through improved state management in iOS 18.7.10, iPadOS 18.7.10, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.7.8, and macOS Sonoma 14.8.8. The CVSS 3.1 base score is 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N), EPSS is 0.21% (11th percentile), there is no CISA KEV listing and no public exploit code identified at the time of analysis.
An integer-overflow flaw (CWE-190) in Apple macOS lets an attacker who already occupies a privileged on-path network position crash or otherwise deny service to the affected system. The vulnerability is fixed in macOS Golden Gate 27, macOS Tahoe 26.7 and macOS Sequoia 15.8, so every earlier build of those three branches is exposed. There is no CISA KEV listing and no identified public exploit code, and EPSS places exploitation likelihood at roughly 0.17% (6th percentile), making this a routine patch-cycle item rather than an emergency for most fleets.
An out-of-bounds write in Apple's image handling code lets a maliciously crafted image crash the parsing process on affected iPhones, iPads, Macs, Apple TVs, Vision Pro and Apple Watches. Apple fixed the flaw through improved bounds checking in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27. Exploitation requires the victim to open or preview the crafted image (UI:R), the observed impact is process termination only — no code execution, data theft or tampering is described — and there is currently no public exploit code or CISA KEV listing; EPSS is a low 0.17% (7th percentile).
A permissions issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to bypass Privacy preferences.
Connecting an Apple device to an attacker-controlled NFS server can cause the kernel NFS client to mishandle memory and return out-of-bounds kernel memory to the malicious server, an information-disclosure issue tracked as CVE-2026-43687. All shipping Apple platforms are affected — iOS/iPadOS before 26.7 and 27, macOS Tahoe before 26.7, macOS Golden Gate before 27, and tvOS, visionOS and watchOS before 27 — while the fix is distributed across Apple's 26.7/27 update wave. Exploitation requires the victim to initiate a connection to the hostile server (UI:R), which keeps real-world risk moderate: EPSS is only 0.18% (7th percentile), CISA KEV does not list it, SSVC rates exploitation as 'none' and automatable as 'no', and no public exploit code was identified at time of analysis.
A buffer overflow in multiple Apple operating systems — iOS 18.7.10, iPadOS 18.7.10, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.7.8, and macOS Sonoma 14.8.8 and earlier — allows a locally executing app to crash the affected system or process, producing a denial of service. The flaw stems from insufficient bounds checking (CWE-120) and is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N, availability-only impact), meaning an attacker must already have the ability to run code as a low-privileged app on the device. Apple has released patches and there is no CISA KEV listing, no public exploit code identified, and EPSS is low at 0.21% (12th percentile), so real-world exploitation pressure is currently minimal.
An out-of-bounds write in Apple's operating system kernel (CWE-787) allows a locally installed app to corrupt kernel memory or force an unexpected system termination, affecting iOS/iPadOS, macOS, tvOS, visionOS, and watchOS. Apple fixed the flaw with improved bounds checking in iOS 26.7 and 27, iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27. Exploitation requires a local app (CVSS PR:L) with no user interaction, so real-world risk is currently low - EPSS is only 0.21% (11th percentile), the issue is not listed in CISA KEV, and no public exploit code has been identified.
Local applications running on Apple macOS releases prior to Tahoe 26.6 can exploit a race condition in the validation path guarding protected user data, allowing an app to read data it should not be able to reach. The flaw is mitigated in macOS Tahoe 26.6 per Apple's advisory, and the attack is timing-dependent and local-only (CVSS 4.7, AV:L/AC:H/PR:L), which keeps practical risk moderate. EPSS is very low at 0.14% (4th percentile), there is no CISA KEV listing, and no public exploit code was identified at time of analysis.
A race condition in Apple's state-handling code allows a locally installed app to crash the system or cause unexpected termination of system processes on iOS, iPadOS, macOS, tvOS, visionOS and watchOS. The flaw carries a CVSS 3.1 score of 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) — availability-only impact, local attack vector, high complexity — and is fixed in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, and tvOS, visionOS and watchOS 27. Neither public exploit code nor CISA KEV activity has been recorded, and EPSS puts exploitation probability at roughly 0.2% (10th percentile), so this is a patching-hygiene item rather than an emergency.
A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Opening a maliciously crafted webarchive file may lead to universal cross-site scripting.
Mounting a maliciously crafted disk image on unpatched Apple devices triggers an out-of-bounds write in image-parsing code, leading to memory corruption and unexpected system termination (denial of service). Affected platforms include iOS/iPadOS before 26.7 and 27, and macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate before 27. Apple has shipped fixes in iOS 26.7/27, iPadOS 26.7/27, and the corresponding macOS releases; no public exploit code or active exploitation has been identified, and EPSS is negligible at 0.17% (7th percentile), indicating a low-likelihood, availability-only defect.
This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to disclose kernel memory.
A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple Buffer Overflow vulnerabilities in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated,. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software running on certain models of Cisco Catalyst Switches could allow an authenticated, remote attacker to. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable. No vendor patch available.
A vulnerability in the implementation of Internet Key Exchange Version 1 (IKEv1) functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a memory leak or a. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability in the crypto engine of the Cisco Integrated Services Module for VPN (ISM-VPN) running Cisco IOS Software could allow an unauthenticated, remote attacker to cause a denial of service. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 68.5%.
An issue was discovered in certain Apple products. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and EPSS exploitation probability 76.7%.
The DHCP relay subsystem of Cisco IOS 12.2 through 15.6 and Cisco IOS XE Software contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code and gain full. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 12.3%.
A vulnerability in the Virtual Private LAN Service (VPLS) code of Cisco IOS 15.0 through 15.4 for Cisco Catalyst 6800 Series Switches could allow an unauthenticated, adjacent attacker to cause a. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and no vendor patch available.
A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS 15.0 through 15.6 and Cisco IOS XE 3.5 through 16.5 could allow an unauthenticated, remote attacker to cause high. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and no vendor patch available.
A vulnerability in the implementation of the PROFINET Discovery and Configuration Protocol (PN-DCP) for Cisco IOS 12.2 through 15.6 could allow an unauthenticated, remote attacker to cause an. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and no vendor patch available.
Multiple vulnerabilities in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS 12.4 through 15.6 could allow an unauthenticated, remote attacker to cause an affected. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and no vendor patch available.
Multiple vulnerabilities in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS 12.4 through 15.6 could allow an unauthenticated, remote attacker to cause an affected. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and no vendor patch available.
A vulnerability in the implementation of a protocol in Cisco Integrated Services Routers Generation 2 (ISR G2) Routers running Cisco IOS 15.0 through 15.6 could allow an unauthenticated, adjacent. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and no vendor patch available.
A vulnerability in the implementation of Network Address Translation (NAT) functionality in Cisco IOS 12.4 through 15.6 could allow an unauthenticated, remote attacker to cause a denial of service. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and no vendor patch available.
A vulnerability in the UDP processing code of Cisco IOS 15.1, 15.2, and 15.4 and IOS XE 3.14 through 3.18 could allow an unauthenticated, remote attacker to cause the input queue of an affected. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 10.8%.
A vulnerability in the Autonomic Networking feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause autonomic nodes of an affected system to. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and no vendor patch available.
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authenticated, remote attacker to remotely execute code. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and no vendor patch available.
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authenticated, remote attacker to remotely execute code. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 14.1%.
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authenticated, remote attacker to remotely execute code. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 10.0%.
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authenticated, remote attacker to remotely execute code. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 14.1%.
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authenticated, remote attacker to remotely execute code. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 36.1%.
The server IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.6, IOS XE through 3.18S, IOS XR 4.3.x and 5.0.x through 5.2.x, and PIX before 7.0 allows remote attackers to obtain. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
WebKit in Apple iOS before 9.3.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The kernel in Apple iOS before 9.3.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The kernel in Apple iOS before 9.3.5 allows attackers to obtain sensitive information from memory via a crafted app. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Script Editor in Apple OS X before 10.11.1 allows remote attackers to bypass an intended user-confirmation requirement for AppleScript execution via unspecified vectors. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 78.2%.
rsh in the remote_cmds component in Apple OS X before 10.11 allows local users to obtain root privileges via vectors involving environment variables. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 11.6%.
dyld in Apple OS X before 10.10.5 does not properly validate pathnames in the environment, which allows local users to gain privileges via unspecified vectors. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Admin Framework in Apple OS X before 10.10.4 does not properly restrict the location of writeconfig clients, which allows local users to obtain root privileges by moving and then modifying Directory. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Public exploit code available.
The XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to bypass authentication and obtain admin privileges via unspecified vectors. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 86.7%.
The fetch_url function in usr.bin/ftp/fetch.c in tnftp, as used in NetBSD 5.1 through 5.1.4, 5.2 through 5.2.2, 6.0 through 6.0.6, and 6.1 through 6.1.5 allows remote attackers to execute arbitrary. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 85.0%.
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Heap-based buffer overflow in IOHIDFamily in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitrary code in a privileged context via an application that provides crafted. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Buffer overflow in Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted dref atoms in a movie file. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 81.3%.
sudo 1.6.0 through 1.7.10p6 and sudo 1.8.0 through 1.8.6p6 allows local users or physically proximate attackers to bypass intended time restrictions and retain privileges without re-authenticating by. Rated medium severity (CVSS 6.9). Public exploit code available and no vendor patch available.
Buffer overflow in the plugin in Apple QuickTime before 7.7.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted MIME type. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 78.1%.
Multiple buffer overflows in Apple QuickTime before 7.7.3 allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted style element in a QuickTime. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 79.1%.
Multiple stack-based buffer overflows in Apple QuickTime before 7.7.2 on Windows allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted TeXML. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 69.6%.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Confused deputy in PriceTracking in Google Chrome on on iOS prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions into a privileged page via crafted network traffic. (Chromium security severity: Medium)
Integer overflow in the FreeRDP client's Apple/CoreAudio audio-input (audin) backend, present in all versions before 3.31.0, allows a malicious or compromised RDP server to corrupt memory on the connecting client. The server sends an MSG_SNDIN_OPEN message carrying a crafted FramesPerPacket value that wraps the size arithmetic used by AudioQueueAllocateBuffer, producing an undersized allocation that is then written past its bounds during audio capture. Impact is bounded to the client (CVSS 5.3, all impacts Low, UI:P — the victim must initiate a connection to the hostile server); patch status is 'available from vendor' with a fix in 3.31.0, and no public exploit or CISA KEV entry was identified at time of analysis.
A type confusion flaw (CWE-843) in memory handling across Apple's current operating system family lets a malicious app crash the affected device or component, producing a local denial of service. Exploitation requires the victim to install and launch a crafted app — the CVSS vector is AV:L/PR:N/UI:R with availability-only impact, so there is no remote unauthenticated path and no confidentiality or integrity loss. Apple has shipped fixes in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7 and macOS Golden Gate 27, plus tvOS 27, visionOS 27 and watchOS 27; EPSS is only 0.17% (6th percentile) and there is no public exploit identified at time of analysis, so this is a routine patch-cycle item rather than an urgent exposure.
A permissions issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A malicious application may be able to access restricted files.
Apple macOS contains an improper access-control logic flaw in state management that allows a locally running app to read protected user data outside of its intended permission scope. The issue affects macOS Sequoia, macOS Tahoe and the macOS 27 (Golden Gate) line prior to the fixed releases, and is remediated in macOS Sequoia 15.8, macOS Tahoe 26.7 and macOS Golden Gate 27. The CVSS vector (AV:L/AC:L/PR:N/UI:R, C:H/I:N/A:N) shows this is a local, confidentiality-only issue requiring a user to launch or open the malicious app, with no public exploit identified at time of analysis and a low EPSS score of 0.18% (8th percentile) — real-world exploitation pressure is currently minimal.
Improper state management in Apple macOS (all versions prior to macOS 27 "Golden Gate") lets a locally installed application reach sensitive user data that normal macOS privacy and access controls are supposed to protect. The attack is local and needs the victim to launch the malicious app (AV:L, UI:R, PR:N), and the impact is confidentiality-only (C:H/I:N/A:N), which yields a moderate CVSS of 5.5. The issue is fixed in macOS 27 per Apple's advisory, EPSS is very low (0.14%, 3rd percentile), there is no CISA KEV listing, and no public exploit code has been identified.
An out-of-bounds write in Apple's operating system memory handling lets a process already confined to the platform sandbox break out of those restrictions, gaining partial read and write access to data it should not reach. Affected platforms are iOS and iPadOS before 26.7/27, macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate before 27, visionOS before 27 and watchOS before 27. Apple has released fixes for every affected platform, and CISA's SSVC assessment records no exploitation, no automation and only partial technical impact.
An information-disclosure flaw in Apple's WebKit-based browser stack lets a malicious website infer which applications a user has installed across Safari, iOS/iPadOS, and macOS. Apple addressed it through improved state management in Safari 27, iOS 27 and iPadOS 27, and macOS Golden Gate 27, so any device still on an earlier release remains exposed. Exploitation requires the victim to visit the attacker's page (CVSS UI:R) and yields only low-confidentiality impact, with no public exploit code and no CISA KEV listing at time of analysis.
Archive extraction on Apple platforms fails to properly validate path components, letting a maliciously crafted archive write files outside the intended destination directory. Affected systems include iOS and iPadOS before 26.7 (and before 27), macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate before 27, and visionOS before 27, with the flaw rated CVSS 5.5 (integrity-only, local vector with required user interaction). Apple has released patched versions for every affected platform; there is no CISA KEV listing and no public exploit code identified, and EPSS is only 0.18% (7th percentile), indicating low predicted exploitation activity.
A race condition in Apple macOS kernel locking allows a local user with existing code execution on the host to read kernel memory, fixed in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27. Exploitation requires local authenticated access and a high-complexity timing win in the kernel's locking path, so it is probabilistic rather than reliable, and the impact is limited to confidentiality (kernel memory disclosure) with no code execution, modification, or denial of service. There is no public exploit identified at time of analysis, the issue is not in CISA KEV, and EPSS is low at 0.19% (8th percentile), making this a genuine but low-priority issue.
A race condition in Apple macOS state management allows a locally executing application to read sensitive user data; the flaw is fixed in macOS Golden Gate 27, and all earlier macOS versions are affected. Exploitation requires an attacker-controlled or malicious app already running on the host (assessed as local, PR:L, not remote despite the vendor's AV:N/PR:N vector) and depends on winning a narrow timing window, which limits reliability. Impact is confidentiality-only - no integrity or availability effect - and no public exploit has been identified at time of analysis; EPSS is 0.14% (4th percentile), so opportunistic exploitation is unlikely, though the data-disclosure impact and Apple's ecosystem prominence keep patching worthwhile.
A logic issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. An app may be able to bypass Gatekeeper checks.
Local information disclosure in Apple iOS and iPadOS (and visionOS) before version 27 allows an app running on the device to read sensitive user data it should not be able to reach. Apple fixed the flaw through improved file handling in iOS 27, iPadOS 27 and visionOS 27. No public exploit code or active exploitation has been reported, and the EPSS score of 0.15% (5th percentile) plus SSVC 'exploitation: none' point to a low-volume, user-assisted local attack rather than a mass-exploited one.
A path validation weakness in Apple's iOS, iPadOS, and macOS allows a malicious application to reach files outside its intended sandbox and read user-sensitive data. Apple addressed the flaw with improved path validation in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, and macOS Sequoia 15.8, so all older releases remain exposed until updated. Exploitation requires a locally installed app and some user interaction (CVSS AV:L/UI:R), exploit probability is currently very low (EPSS 0.20%, 10th percentile), and no public exploit code or CISA KEV entry has been identified at time of analysis.
A permissions-validation flaw (CWE-863) in Apple macOS versions prior to 27 (Golden Gate) and Xcode versions prior to 27 allows a locally installed app to reach user-sensitive data it should not be authorized to read. The issue is a local, confidentiality-only defect rated CVSS 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N): no privileges are needed, but the attack requires the victim to run the malicious application. Apple has released fixes in macOS 27 and Xcode 27; there is no CISA KEV listing, no public exploit code identified at time of analysis, and EPSS is very low at 0.16% (5th percentile), so real-world exploitation is unlikely to be widespread.
Apple fixed a kernel uninitialized-memory flaw (CWE-457) across iOS/iPadOS, macOS, tvOS, visionOS, and watchOS in which a locally installed app can determine kernel memory layout, defeating address-space randomization. The impact is information disclosure only - high confidentiality, no integrity or availability impact - and exploitation requires a local app plus user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R, 5.5). Apple shipped patches on [dates not specified] for iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27; no public exploit code or active exploitation is indicated, and EPSS is low (0.21%, 11th percentile).
An improper access-control flaw in Apple macOS allows a locally running application to bypass authorization checks and read sensitive user data it should not be able to reach, with the fix delivered in macOS Sequoia 15.8 and macOS Golden Gate 27. Exploitation is local only and requires user interaction (the victim must launch the malicious or trojanized app), so the CVSS impact is limited to confidentiality (5.5 Medium). EPSS is negligible at 0.16% (5th percentile), there is no CISA KEV listing and no public exploit code identified at time of analysis, making this a routine update rather than an emergency patch.
Integer overflow (CWE-190) in macOS allows a locally present application to crash an affected component or the operating system, producing a denial-of-service condition rather than code execution or data theft. Apple fixed the flaw with improved input validation in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27 per advisories 149035, 149042 and 149043. Exploitation requires a malicious app to be running on the target Mac and the user to interact with it (AV:L/UI:R); no public exploit code has been identified and EPSS is only 0.19% (9th percentile), so this is a routine patch-cycle item rather than an urgent one.
A race condition in Apple's kernel state handling lets a locally installed app corrupt kernel memory or trigger unexpected system termination across iOS/iPadOS, macOS, tvOS, visionOS, and watchOS. Apple addressed the flaw in iOS 18.7.10 and 26.6, iPadOS 18.7.10 and 26.6, macOS Sequoia 15.7.8, macOS Tahoe 26.6, and tvOS/visionOS/watchOS 26.6, so exploitation is limited to unpatched devices running a malicious app plus user interaction. No public exploit code and no active exploitation are known; EPSS is 0.17% (6th percentile) and CVSS rates it 6.3, reflecting a local, high-complexity attack with no confidentiality impact.
This issue was addressed with additional entitlement checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to modify protected parts of the file system.
Mounting a crafted disk image on unpatched macOS releases triggers an out-of-bounds write in the code that parses disk image content, causing unexpected system termination (crash) on macOS Sequoia, Sonoma and Tahoe. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) - a user-interaction-dependent denial-of-service with no confidentiality or integrity impact, and CISA's SSVC assessment marks exploitation as 'none' and automatable as 'no'. EPSS is 0.19% (9th percentile), no public exploit code or CISA KEV listing was identified at time of analysis, and Apple has shipped fixed builds in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8 and macOS Tahoe 26.6.
A race condition in core Apple operating system components lets a locally installed app trigger an unexpected system termination on iOS, iPadOS, macOS, tvOS, visionOS and watchOS. Apple fixed the flaw through improved state handling in iOS 26.7/27, iPadOS 26.7/27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27. Impact is availability-only (no data exposure or modification), exploitation requires a local malicious app and winning a timing window, EPSS is a low 0.21%, and no public exploit code or active exploitation has been identified at time of analysis.
Apple macOS contains an improper input validation flaw (CWE-20) that a remote attacker can leverage to crash affected system components, producing a denial-of-service condition on the host. Apple addressed the issue in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7, so all earlier builds of those release trains remain vulnerable. Exploitation requires the victim to interact with attacker-supplied content (CVSS UI:R), and there is no public exploit identified at time of analysis, though the CVSS 3.1 base score of 6.5 reflects a high availability impact with no confidentiality or integrity loss.
Improper access control in Apple's Keychain service lets a locally installed app delete credentials stored by other applications on iOS 27, iPadOS 27, macOS Golden Gate 27, and visionOS 27 (all versions prior to these releases). The bug is fixed by removing the vulnerable code path; it is rated CVSS 5.5 with integrity-only impact, and there is no public exploit or CISA KEV confirmation at time of analysis (EPSS 0.15%).
An out-of-bounds read in Apple's font parsing code lets a maliciously crafted font file leak process memory on unpatched builds of iOS, iPadOS, macOS, tvOS, visionOS and watchOS, with all affected platforms fixed in the version 27 releases. Triggering it requires the victim to render attacker-supplied content containing the crafted font — an email, document, web page or message preview — but no credentials or elevated privileges are needed once that interaction happens, and the resulting confidentiality impact is rated high with no integrity or availability effect. No public exploit code or active exploitation has been identified, and EPSS sits at a low 0.20% (10th percentile), so this is best handled as a scheduled platform update rather than an emergency response.
A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to break out of its sandbox.
An out-of-bounds read in the font-parsing path of Apple's operating systems lets a remote attacker disclose the contents of process memory when a victim processes a maliciously crafted font. All Apple platforms are affected prior to the version 27 releases — iOS and iPadOS, macOS Golden Gate, tvOS, visionOS and watchOS — and Apple has shipped fixes for each. There is no CISA KEV listing and no public exploit code identified, and the EPSS score of 0.17% (7th percentile) indicates a low probability of near-term exploitation; because the sole impact is memory disclosure and exploitation requires the victim to open or render attacker-supplied content, this is a moderate-priority patch rather than an emergency.
Information disclosure in Apple's iOS, iPadOS, macOS, tvOS and watchOS platforms allows an app running on the device to reach sensitive user data that the operating system's data protection mechanisms were supposed to keep isolated from it. Apple resolved the issue with improved data protection in iOS and iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27 and watchOS 27, with vendor advisories published across seven support pages. No public exploit code or active exploitation has been reported, EPSS is low at 0.20% (10th percentile), and the issue is not listed in CISA KEV, so this reads as a routine hardening fix rather than an urgent emergency-patch event.
A use-after-free memory-management flaw affects Apple's operating system family prior to the 26.6 releases — iOS and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6 and watchOS 26.6 — and allows a locally installed app to trigger unexpected system termination (a denial-of-service condition). The vulnerability is rated CVSS 5.5 with a local attack vector, low complexity and low privileges required, but no confidentiality or integrity impact; EPSS is only 0.19 percent and there is no CISA KEV listing and no publicly available exploit code identified at time of analysis. Apple has shipped fixes in all four platform advisories, so the practical risk is concentrated on unpatched devices rather than on active exploitation.
Improper authorization checks in Apple's headphone motion data handling allow a locally installed app to read motion sensor data from connected headphones without prompting the user for consent, affecting iOS/iPadOS 26.7 and 27 and earlier, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27 and watchOS 27 and earlier. Exploitation requires a malicious or compromised app and user interaction, and the impact is limited to confidentiality of headphone sensor data (CVSS 5.5, C:H/I:N/A:N). Apple has shipped fixes in all affected operating systems; EPSS is low (0.20%, 10th percentile), there is no CISA KEV listing and no public exploit code identified at time of analysis.
Loading attacker-controlled web content on an unpatched Apple device can trigger a null pointer dereference in the WebKit rendering pipeline, crashing the browser or app that renders the page and producing a denial-of-service on iPhone, iPad, Mac, Apple Watch and Apple Vision Pro. Apple shipped fixes in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, visionOS 27 and watchOS 27. The flaw scores CVSS 6.5 with a user-interaction requirement (UI:R), EPSS is only 0.20% (10th percentile), and there is no public exploit code or CISA KEV listing at time of analysis.
An authorization flaw in Apple's operating systems lets a locally installed malicious app bypass Privacy preferences on affected iOS, iPadOS, and macOS builds. Apple addressed the issue through improved state management in iOS 18.7.10, iPadOS 18.7.10, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.7.8, and macOS Sonoma 14.8.8. The CVSS 3.1 base score is 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N), EPSS is 0.21% (11th percentile), there is no CISA KEV listing and no public exploit code identified at the time of analysis.
An integer-overflow flaw (CWE-190) in Apple macOS lets an attacker who already occupies a privileged on-path network position crash or otherwise deny service to the affected system. The vulnerability is fixed in macOS Golden Gate 27, macOS Tahoe 26.7 and macOS Sequoia 15.8, so every earlier build of those three branches is exposed. There is no CISA KEV listing and no identified public exploit code, and EPSS places exploitation likelihood at roughly 0.17% (6th percentile), making this a routine patch-cycle item rather than an emergency for most fleets.
An out-of-bounds write in Apple's image handling code lets a maliciously crafted image crash the parsing process on affected iPhones, iPads, Macs, Apple TVs, Vision Pro and Apple Watches. Apple fixed the flaw through improved bounds checking in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27. Exploitation requires the victim to open or preview the crafted image (UI:R), the observed impact is process termination only — no code execution, data theft or tampering is described — and there is currently no public exploit code or CISA KEV listing; EPSS is a low 0.17% (7th percentile).
A permissions issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to bypass Privacy preferences.
Connecting an Apple device to an attacker-controlled NFS server can cause the kernel NFS client to mishandle memory and return out-of-bounds kernel memory to the malicious server, an information-disclosure issue tracked as CVE-2026-43687. All shipping Apple platforms are affected — iOS/iPadOS before 26.7 and 27, macOS Tahoe before 26.7, macOS Golden Gate before 27, and tvOS, visionOS and watchOS before 27 — while the fix is distributed across Apple's 26.7/27 update wave. Exploitation requires the victim to initiate a connection to the hostile server (UI:R), which keeps real-world risk moderate: EPSS is only 0.18% (7th percentile), CISA KEV does not list it, SSVC rates exploitation as 'none' and automatable as 'no', and no public exploit code was identified at time of analysis.
A buffer overflow in multiple Apple operating systems — iOS 18.7.10, iPadOS 18.7.10, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.7.8, and macOS Sonoma 14.8.8 and earlier — allows a locally executing app to crash the affected system or process, producing a denial of service. The flaw stems from insufficient bounds checking (CWE-120) and is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N, availability-only impact), meaning an attacker must already have the ability to run code as a low-privileged app on the device. Apple has released patches and there is no CISA KEV listing, no public exploit code identified, and EPSS is low at 0.21% (12th percentile), so real-world exploitation pressure is currently minimal.
An out-of-bounds write in Apple's operating system kernel (CWE-787) allows a locally installed app to corrupt kernel memory or force an unexpected system termination, affecting iOS/iPadOS, macOS, tvOS, visionOS, and watchOS. Apple fixed the flaw with improved bounds checking in iOS 26.7 and 27, iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27. Exploitation requires a local app (CVSS PR:L) with no user interaction, so real-world risk is currently low - EPSS is only 0.21% (11th percentile), the issue is not listed in CISA KEV, and no public exploit code has been identified.
Local applications running on Apple macOS releases prior to Tahoe 26.6 can exploit a race condition in the validation path guarding protected user data, allowing an app to read data it should not be able to reach. The flaw is mitigated in macOS Tahoe 26.6 per Apple's advisory, and the attack is timing-dependent and local-only (CVSS 4.7, AV:L/AC:H/PR:L), which keeps practical risk moderate. EPSS is very low at 0.14% (4th percentile), there is no CISA KEV listing, and no public exploit code was identified at time of analysis.
A race condition in Apple's state-handling code allows a locally installed app to crash the system or cause unexpected termination of system processes on iOS, iPadOS, macOS, tvOS, visionOS and watchOS. The flaw carries a CVSS 3.1 score of 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) — availability-only impact, local attack vector, high complexity — and is fixed in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, and tvOS, visionOS and watchOS 27. Neither public exploit code nor CISA KEV activity has been recorded, and EPSS puts exploitation probability at roughly 0.2% (10th percentile), so this is a patching-hygiene item rather than an emergency.
A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Opening a maliciously crafted webarchive file may lead to universal cross-site scripting.
Mounting a maliciously crafted disk image on unpatched Apple devices triggers an out-of-bounds write in image-parsing code, leading to memory corruption and unexpected system termination (denial of service). Affected platforms include iOS/iPadOS before 26.7 and 27, and macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate before 27. Apple has shipped fixes in iOS 26.7/27, iPadOS 26.7/27, and the corresponding macOS releases; no public exploit code or active exploitation has been identified, and EPSS is negligible at 0.17% (7th percentile), indicating a low-likelihood, availability-only defect.
This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to disclose kernel memory.