Visionos

CVE-2026-84630 Sep 14, 20:50 PATCH Awaiting Data

A race condition was addressed with improved state handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination.

CVE-2026-86898 Sep 14, 20:50 PATCH Awaiting Data

A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Opening a maliciously crafted webarchive file may lead to universal cross-site scripting.

CVE-2026-65371 Sep 14, 20:50 PATCH Awaiting Data

This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to disclose kernel memory.

CVE-2026-84626 Sep 14, 20:50 PATCH Awaiting Data

An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to identify what other apps a user has installed.

CVE-2026-65395 Sep 14, 20:50 PATCH Awaiting Data

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27. Processing a maliciously crafted image may result in memory corruption.

CVE-2026-65403 Sep 14, 20:50 PATCH Awaiting Data

This issue was addressed with improved checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27, watchOS 27. An app may be able to access sensitive user data.

CVE-2026-65415 Sep 14, 20:50 PATCH Awaiting Data

A race condition was addressed with additional validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. A local user may be able to cause unexpected system termination or read kernel memory.

CVE-2026-86893 Sep 14, 20:50 PATCH Awaiting Data

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, tvOS 27, visionOS 27, watchOS 27. An app may be able to read device name.

CVE-2026-86903 Sep 14, 20:50 PATCH Awaiting Data

An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. An app may be able to disclose kernel memory.

CVE-2026-65399 Sep 14, 20:50 PATCH Awaiting Data

A file quarantine bypass was addressed with additional checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27, watchOS 27. An archive may be able to bypass Gatekeeper.

CVE-2026-28966 Sep 14, 20:50 PATCH Awaiting Data

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27. Processing a maliciously crafted file may lead to unexpected app termination.

CVE-2026-65360 Sep 14, 20:50 PATCH Awaiting Data

A race condition was addressed with improved state handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination.

CVE-2026-86870 Sep 14, 20:50 PATCH Awaiting Data

A heap buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27, watchOS 27. Processing a maliciously crafted file may lead to unexpected app termination.

CVE-2026-84532 Sep 14, 20:50 PATCH Awaiting Data

An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27. Opening a maliciously crafted file may cause unexpected process termination or disclose process memory.

CVE-2026-84524 Sep 14, 20:50 PATCH Awaiting Data

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted font file may lead to unexpected app termination.

CVE-2026-43785 Sep 14, 20:50 PATCH Awaiting Data

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27. An app may be able to modify a file it only had permission to read.

CVE-2026-84564 Sep 14, 20:50 PATCH Awaiting Data

An uninitialized memory issue was addressed with improved memory initialization. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted image may result in disclosure of process memory.

CVE-2026-84636 Sep 14, 20:50 PATCH Awaiting Data

An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, tvOS 27, visionOS 27, watchOS 27. An app may be able to access sensitive user data.

CVE-2026-65398 Sep 14, 20:50 PATCH Awaiting Data

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination or corrupt kernel memory.

CVE-2026-65377 Sep 14, 20:50 PATCH Awaiting Data

A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination.

CVE-2026-84620 Sep 14, 20:50 PATCH Awaiting Data

An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted 3D model may lead to memory corruption.

CVE-2026-86888 Sep 14, 20:50 PATCH Awaiting Data

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. A local app may be able to read a persistent account identifier.

CVE-2026-65357 Sep 14, 20:49 PATCH Awaiting Data

The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination or write kernel memory.

CVE-2026-84600 Sep 14, 20:49 PATCH Awaiting Data

An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. A malicious shortcut may be able to send messages without user confirmation.

CVE-2026-84616 Sep 14, 20:49 PATCH Awaiting Data

A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination.

CVE-2026-86892 Sep 14, 20:49 PATCH Awaiting Data

This issue was addressed with additional entitlement checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, visionOS 27. An app may be able to cause a denial-of-service.

CVE-2026-84513 Sep 14, 20:49 PATCH Awaiting Data

A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. A malicious application may be able to determine a user's current location.

CVE-2026-65402 Sep 14, 20:49 PATCH Awaiting Data

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination.

CVE-2026-84603 Sep 14, 20:49 PATCH Awaiting Data

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, visionOS 27, watchOS 27. An app may be able to access sensitive user data.

CVE-2026-84615 Sep 14, 20:49 PATCH Awaiting Data

An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, tvOS 27, visionOS 27. An app may be able to access sensitive user data.

CVE-2026-28968 Sep 14, 20:49 PATCH Awaiting Data

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination or corrupt kernel memory.

CVE-2026-84551 Sep 14, 20:49 PATCH Awaiting Data

A logic issue was addressed with improved validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27, watchOS 27. An app may be able to bypass network restrictions.

CVE-2026-86887 Sep 14, 20:49 PATCH Awaiting Data

A privacy issue was addressed by removing sensitive data. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, visionOS 27. An app may be able to bypass certain Privacy preferences.

CVE-2026-65358 Sep 14, 20:49 PATCH Awaiting Data

A race condition was addressed with improved state handling. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination.

CVE-2026-84571 Sep 14, 20:49 PATCH Awaiting Data

A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted image may lead to unexpected app termination.

CVE-2026-84526 Sep 14, 20:49 PATCH Awaiting Data

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted 3D scene may lead to unexpected process termination.

CVE-2026-84530 Sep 14, 20:49 PATCH Awaiting Data

An information disclosure issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to disclose kernel memory.

CVE-2026-20683 Sep 14, 20:49 PATCH Awaiting Data

An authentication issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27. An app may be able to use the Sign In With Apple authentication flow to access the user's Apple Account.

CVE-2026-84635 Sep 14, 20:49 PATCH Awaiting Data

A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to an unexpected process termination.

CVE-2026-84622 Sep 14, 20:48 PATCH Awaiting Data

A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app with root privileges may be able to read uninitialized kernel memory.

CVE-2026-43695 Sep 14, 20:48 PATCH Awaiting Data

An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to access sensitive user data.

CVE-2026-84527 Sep 14, 20:48 PATCH Awaiting Data

A logging issue was addressed with improved data redaction. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to access sensitive user data.

CVE-2026-65359 Sep 14, 20:48 PATCH Awaiting Data

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. A local user may be able to cause unexpected system termination or read kernel memory.

CVE-2026-84507 Sep 14, 20:48 PATCH Awaiting Data

A race condition was addressed with improved state handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination or corrupt kernel memory.

CVE-2026-64753 Sep 14, 20:48 PATCH Awaiting Data

A permissions issue was addressed by removing the vulnerable code. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may disclose sensitive user information.

CVE-2026-84546 Sep 14, 20:48 PATCH Awaiting Data

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted 3D model may lead to memory corruption.

CVE-2026-84511 Sep 14, 20:48 PATCH Awaiting Data

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted asset catalog may lead to unexpected process termination.

CVE-2026-84497 Sep 14, 20:48 PATCH Awaiting Data

A buffer overflow was addressed with improved size validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27. Opening a maliciously crafted file may lead to unexpected process termination.

CVE-2026-84602 Sep 14, 20:48 PATCH Awaiting Data

A type confusion issue was addressed with improved checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination.

CVE-2026-65355 Sep 14, 20:48 MEDIUM PATCH This Month

iCloud Private Relay on Apple platforms could disclose a user's real IP address to a website even while the privacy proxy is active, because of a state-management flaw in the relay implementation. The issue affects iOS and iPadOS before 18.7.10 and before 26.6.1, macOS Tahoe before 26.6.2, and visionOS before 26.6.1, and requires the victim to browse to attacker-controlled web content (UI:R, no privileges needed). Severity is modest (CVSS 4.3, confidentiality-only) and there is no CISA KEV listing or public exploit identified at time of analysis, but the privacy impact is disproportionate for users who depend on Private Relay for anonymity.

CVE-2026-84609 Sep 14, 20:48 PATCH Awaiting Data

A permissions issue was addressed with improved path validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to modify protected system files.

CVE-2026-84561 Sep 14, 20:48 PATCH Awaiting Data

A double free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination or corrupt kernel memory.

CVE-2026-28935 Sep 14, 20:48 PATCH Awaiting Data

The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Sequoia 15.8, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination or corrupt kernel memory.

CVE-2026-84625 Sep 14, 20:48 PATCH Awaiting Data

A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27, watchOS 27. An app may be able to fingerprint the user.

CVE-2026-65352 Sep 14, 20:48 MEDIUM PATCH This Month

An information disclosure flaw in Apple's iCloud Private Relay lets a website determine a visitor's real IP address even when Private Relay is switched on, defeating the core privacy guarantee of the feature. The issue affects iOS and iPadOS before 26.6.1, macOS before 26.6.2 (Tahoe), and visionOS before 26.6.1, and is reachable from the network but requires the victim to browse to an attacker-controlled page. Apple addressed it through improved state management, and no public exploit code or active exploitation has been identified at time of analysis.

CVE-2026-65344 Sep 14, 20:47 PATCH Awaiting Data

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27. Processing a maliciously crafted video file may lead to unexpected app termination.

CVE-2026-86897 Sep 14, 20:47 PATCH Awaiting Data

This issue was addressed with additional entitlement checks. This issue is fixed in Safari 27, iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. An app may be able to access sensitive user data.

CVE-2026-65411 Sep 14, 20:47 PATCH Awaiting Data

A path handling issue was addressed with improved validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, visionOS 27. An app may be able to modify protected parts of the file system.

CVE-2026-65407 Sep 14, 20:47 PATCH Awaiting Data

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.6, macOS Tahoe 26.7, tvOS 26.6, tvOS 27, visionOS 26.6, visionOS 27, watchOS 26.6, watchOS 27. An app may be able to cause unexpected system termination.

CVE-2026-65391 Sep 14, 20:47 PATCH Awaiting Data

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in Safari 26.6.1, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to memory corruption.

CVE-2026-86881 Sep 14, 20:47 PATCH Awaiting Data

A certificate validation issue was addressed with improved certificate validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An attacker with a compromised intermediate certificate authority may be able to issue certificates with arbitrary extended key usages.

CVE-2026-84629 Sep 14, 20:47 PATCH Awaiting Data

This issue was addressed with additional entitlement checks. This issue is fixed in iOS 27 and iPadOS 27, tvOS 27, visionOS 27, watchOS 27. An app may be able to fingerprint the user.

CVE-2026-84628 Sep 14, 20:47 PATCH Awaiting Data

An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. A sandboxed app may be able to access the System Keychain.

CVE-2026-65390 Sep 14, 20:47 PATCH Awaiting Data

An integer overflow was addressed with improved input validation. This issue is fixed in Safari 26.6.1, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to memory corruption.

CVE-2026-65406 Sep 14, 20:47 PATCH Awaiting Data

A logic issue was addressed with improved validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27. An app may be able to access sensitive user data.

CVE-2026-65410 Sep 14, 20:47 PATCH Awaiting Data

The issue was addressed with improved checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination.

CVE-2026-43762 Sep 14, 20:47 PATCH Awaiting Data

The issue was addressed with improved checks. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, visionOS 26.6. An app may be able to access user-sensitive data.

CVE-2026-84583 Sep 14, 20:47 PATCH Awaiting Data

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. A local app may be able to read a persistent account identifier.

CVE-2026-84612 Sep 14, 20:47 PATCH Awaiting Data

An authorization issue was addressed with improved access control. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to read persistent device identifiers.

CVE-2026-84491 Sep 14, 20:47 PATCH Awaiting Data

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. An app may be able to access sensitive user data.

CVE-2026-84487 Sep 14, 20:47 PATCH Awaiting Data

An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted file may result in disclosure of process memory.

CVE-2026-84624 Sep 14, 20:47 PATCH Awaiting Data

A permissions issue was addressed with improved path validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27. A sandboxed app may be able to access restricted files.

CVE-2026-84632 Sep 14, 20:47 PATCH Awaiting Data

The issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted 3D model may lead to memory corruption.

CVE-2026-84560 Sep 14, 20:47 PATCH Awaiting Data

An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. An app may gain unauthorized access to Bluetooth.

CVE-2026-84521 Sep 14, 20:47 PATCH Awaiting Data

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27. An app may be able to cause unexpected system termination.

CVE-2026-64721 Jul 27, 20:14 MEDIUM PATCH This Month

Information disclosure in Apple iOS and iPadOS 26.6, along with macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6, allows a local app to access sensitive user data due to a state management flaw. The vulnerability was addressed with improved state handling, and no public exploit code or active exploitation has been identified; EPSS indicates a low likelihood of real-world attacks.

CVE-2026-64741 Jul 27, 20:14 MEDIUM PATCH This Month

Unauthorized reading of a persistent device identifier in Apple iOS, iPadOS, tvOS, watchOS, and visionOS allows a malicious app to access a unique identifier without user consent. The issue originates from a permissions enforcement weakness fixed in iOS 26.6, iPadOS 26.6, tvOS 26.6, watchOS 26.6, and visionOS 26.6. No active exploitation or public exploit code is known, and EPSS predicts a very low exploitation probability (0.16%).

CVE-2026-43804 Jul 27, 20:14 MEDIUM PATCH This Month

Safari and WebKit-based apps across Apple platforms crash when a user visits a specially crafted website, due to a state management flaw (CWE-400: Uncontrolled Resource Consumption) in versions prior to 26.6. Affected platforms include Safari on macOS Tahoe, iOS 26, iPadOS 26, and visionOS 26. No confidentiality or integrity impact is present - the consequence is an app-level denial-of-service. No public exploit code exists and CISA SSVC confirms no active exploitation, with EPSS at 0.16% (6th percentile), indicating very low exploitation likelihood at time of analysis.

CVE-2026-64707 Jul 27, 20:14 MEDIUM PATCH This Month

A permissions validation flaw across Apple's iOS, iPadOS, macOS, and visionOS could allow a local malicious app to delete arbitrary files, leading to data loss. The issue has a low exploitation probability (EPSS 0.16%) and no known active exploits or public exploit code. Patches are available in the respective OS updates.

CVE-2026-64730 Jul 27, 20:13 MEDIUM PATCH This Month

UI spoofing in Apple Safari 26.5 and earlier allows attackers using cross-origin framing to misrepresent website identity. The vulnerability requires user interaction (visiting a malicious page) and could lead to phishing or deceptive actions. No active exploitation or public exploit code identified; patch is available.

CVE-2026-43821 Jul 27, 20:13 MEDIUM PATCH This Month

Unauthorized file read via a sandbox escape vulnerability in Apple iOS, iPadOS, macOS, tvOS, watchOS, and visionOS allows a malicious app to access files outside its designated sandbox. Exploitation requires user interaction to install and launch a malicious app, but no active exploitation or public exploit code is currently known. CVSS medium severity (6.5) is offset by a very low EPSS score (0.17%), indicating low real-world exploitation probability.

CVE-2026-43817 Jul 27, 20:13 MEDIUM PATCH This Month

A local denial-of-service vulnerability in Apple's operating systems allows a malicious app to cause unexpected system termination by triggering an out-of-bounds read. Fixes are available in version 26.6 for iOS, iPadOS, macOS, tvOS, visionOS, and watchOS; no active exploitation or public exploit has been identified, and EPSS indicates a low probability of exploitation.

CVE-2026-43801 Jul 27, 20:13 MEDIUM PATCH This Month

We need to generate a comprehensive JSON synthesis based on provided CVE data. The output must be plain text strings, each field a coherent paragraph, following strict rules. Let's analyze the given data. CVE-2026-43801: Description: "This issue was addressed with improved checks. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to access sensitive user data." CVSS: 5.5, vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. CWE-200: Information Exposure. Multi-source intelligence: EPSS 0.17% (6 percentile), Patch: Available from vendor, Reported by: apple. CPEs: many Apple operating systems. Tags: Apple, Information Disclosure, etc. EUVD affected versions list. References: Apple support pages. We need to fill out the JSON fields: product_name: 1-3 words ONLY. Affected product is Apple's operating systems across multiple platforms. The specific product? "Apple iOS" or "Apple macOS"? The vulnerability affects multiple products, but choose primary. Since iOS is listed first, maybe "Apple iOS". Or maybe "Apple iOS and macOS"? It's an app that can access sensitive user data across all these OSs. The product name should be the primary affected product. The CPE includes ios_and_ipados, macos, tvos, visionos, watchos. So it's essentially all Apple OS platforms. Could we say "Apple Operating Systems"? That's not 1-3 words, it's 3 words: "Apple Operating Systems"? Or "Apple OS". The description says "This issue is fixed in iOS 26.6 ..." So the primary product might be the general OS. I'll go with "Apple iOS/macOS" but that's two. I'll say "Apple OS". The rule: "1-3 words ONLY. The specific product or service name affected." If multiple products, pick the primary one. The primary might be "iOS" as it's the first listed. So I'll put "Apple iOS". But it's not just iOS; it's all Apple platforms. However, the CVE description typically picks one platform. I'

CVE-2026-64709 Jul 27, 20:13 MEDIUM PATCH This Month

We need to analyze CVE-2026-64709 and produce a JSON with the specified fields. Let's gather all input data: - CVE ID: CVE-2026-64709 - Description: "The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to disclose kernel memory." - CVSS Score: 5.5 - CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - CWE: CWE-200 (Information Exposure) - EPSS: 0.17% (percentile 7%), so low. - Patch: Available from vendor - Reported by: apple - CPEs: apple:ios_and_ipados:* (all versions), apple:macos:* (all versions), apple:tvos:*, apple:visionos:*, apple:watchos:* - Tags: Apple, Information Disclosure, Ios And Ipados, Tvos, Visionos, Watchos - SSVC: Exploitation: none, Automatable: no, Technical Impact: partial -> so not currently exploited, not automatable, partial impact. - ENISA EUVD ID: EUVD-2026-49513 - Affected versions list: macOS <14.8.8, macOS <15.7.8, visionOS <26.6, macOS <26.6 (this might be Tahoe, version 26.6?), watchOS <26.6, iOS and iPadOS <26.6, tvOS <26.6. Note the "macOS 0 <26.6" probably refers to macOS Tahoe (version 26.6), but they list macOS 0 <14.8.8 (Sonoma), macOS 0 <15.7.8 (Sequoia), and macOS 0 <26.6 (Tahoe). So three macOS branches. - References: 7 support.apple.com URLs. Now we need to produce a JSON object with the fields. All fields are plain text strings, no arrays, no objects. Let's step through each field: 1. "product_name": 1-3 words ONLY. The primary product. This vulnerability affects multiple Apple operating systems, but the description mentions "An app may be able to disclose kernel memory." The core product is the kernel, but we need to pick one product name that represents the family. The CPEs list iOS and iPadOS, macOS, tvOS, visionOS, watchOS. So the primary product is "Apple iOS" or "Apple macOS"? The description lists multiple, but it says "An app may be ab

CVE-2026-43744 Jul 27, 20:13 MEDIUM PATCH This Month

Denial-of-service via out-of-bounds write in Apple CoreAudio when processing malicious audio streams. Affected iOS, iPadOS, macOS, tvOS, watchOS, and visionOS versions are vulnerable. No known active exploitation or public exploit code exists at time of analysis, and EPSS probability is low (0.17%).

CVE-2026-43816 Jul 27, 20:13 MEDIUM PATCH This Month

An out-of-bounds write vulnerability in Apple iOS 26.6 and earlier allows a malicious app to cause unexpected system termination (kernel panic). No public exploit or active exploitation has been reported; patch available from Apple.

CVE-2026-64724 Jul 27, 20:12 MEDIUM PATCH This Month

Denial-of-service in multiple Apple operating systems allows a local network attacker to cause resource exhaustion and system unavailability. The vulnerability is addressed in iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. No public exploit or active exploitation has been identified at this time, and the EPSS score is low (0.17%).

CVE-2026-64728 Jul 27, 20:12 MEDIUM PATCH This Month

Bypass of iframe sandboxing policy in Apple Safari and all Apple operating systems through version 26.5 allows malicious web content to violate sandbox restrictions. Affected users include anyone running Safari on iOS, iPadOS, macOS Tahoe, tvOS, visionOS, or watchOS prior to version 26.6. An attacker can cause integrity violations, such as injecting or modifying content within sandboxed iframes, but requires user interaction (clicking a link or visiting a malicious page) and no public exploit or active exploitation has been identified at this time.

CVE-2026-43796 Jul 27, 20:12 MEDIUM PATCH This Month

A malicious app can access sensitive user

CVE-2026-64735 Jul 27, 20:12 MEDIUM PATCH This Month

An inconsistent user interface state management in multiple Apple operating systems allows remote attackers to bypass network filters, potentially leading to unauthorized actions on the system. The vulnerability requires user interaction (e.g., clicking a link) and affects iOS and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. No active exploitation has been reported at this time, and the EPSS score (0.27%, 20th percentile) indicates a low immediate threat.