Apple Software and Device Maker
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in any Apple product.
RSS Feeds for Apple security vulnerabilities
Create a CVE RSS feed including security vulnerabilities found in Apple products with stack.watch. Just hit watch, then grab your custom RSS feed url.
Products by Apple Sorted by Most Security Vulnerabilities since 2018
Recent Apple Security Advisories
| Advisory | Title | Published |
|---|---|---|
| 149228 | macOS Tahoe 26.7.1 - Apple Security Content | September 28, 2026 |
| 149229 | macOS Sequoia 15.8.1 - Apple Security Content | September 28, 2026 |
| 149226 | iOS 26.7.1 and iPadOS 26.7.1 - Apple Security Content | September 28, 2026 |
| 149035 | macOS Golden Gate 27 - Apple Security Content | September 14, 2026 |
| 149034 | iOS 27 and iPadOS 27 - Apple Security Content | September 14, 2026 |
| 149037 | watchOS 27 - Apple Security Content | September 14, 2026 |
| 149038 | visionOS 27 - Apple Security Content | September 14, 2026 |
| 149042 | macOS Tahoe 26.7 - Apple Security Content | September 14, 2026 |
| 149041 | iOS 26.7 and iPadOS 26.7 - Apple Security Content | September 14, 2026 |
| 149043 | macOS Sequoia 15.8 - Apple Security Content | September 14, 2026 |
Known Exploited Apple Vulnerabilities
The following Apple vulnerabilities have recently been marked by CISA as Known to be Exploited by threat actors.
| Title | Description | Added |
|---|---|---|
| Apple Multiple Products Out-of-Bounds Write Vulnerability |
Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution. CVE-2026-86950 |
September 29, 2026 |
| Apple macOS Improper Authentication Vulnerability |
Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials. CVE-2026-65400 |
August 18, 2026 |
| Apple Multiple Products Classic Buffer Overflow Vulnerability |
Apple watchOS, iOS, iPadOS, macOS, visionOS, tvOS, and iPadOS contain a classic buffer overflow vulnerability which could allow a malicious application to cause unexpected system termination or write kernel memory. CVE-2025-43520 Exploit Probability: 0.4% |
March 20, 2026 |
| Apple Multiple Products Improper Locking Vulnerability |
Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain an improper locking vulnerability that could allow a malicious application to cause unexpected changes in memory shared between processes. CVE-2025-43510 Exploit Probability: 0.4% |
March 20, 2026 |
| Apple Multiple Products Buffer Overflow Vulnerability |
Apple Safari, iOS, watchOS, visionOS, iPadOS, macOS, and tvOS contain a buffer overflow vulnerability that could allow the processing of maliciously crafted web content which may lead to memory corruption. CVE-2025-31277 Exploit Probability: 1.6% |
March 20, 2026 |
| Apple Multiple products Use-After-Free Vulnerability |
Apple macOS, iOS, iPadOS, and Safari 16.6 contain a use-after-free vulnerability due to the processing of maliciously crafted web content that may lead to memory corruption. CVE-2023-43000 Exploit Probability: 4.0% |
March 5, 2026 |
| Apple iOS and iPadOS Use-After-Free Vulnerability |
Apple iOS and iPadOS contain a use-after-free vulnerability. An app may be able to execute arbitrary code with kernel privileges. CVE-2023-41974 Exploit Probability: 2.0% |
March 5, 2026 |
| Apple Multiple Products Integer Overflow or Wraparound Vulnerability |
Apple tvOS, macOS, Safari, iPadOS and watchOS contain an integer overflow or wraparound vulnerability due to the processing of maliciously crafted web content that may lead to arbitrary code execution. CVE-2021-30952 Exploit Probability: 7.0% |
March 5, 2026 |
| Apple Multiple Buffer Overflow Vulnerability |
Apple iOS, macOS, tvOS, watchOS, and visionOS contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow an attacker with memory write the capability to execute arbitrary code. CVE-2026-20700 Exploit Probability: 1.3% |
February 12, 2026 |
| Apple Multiple Products Use-After-Free WebKit Vulnerability |
Apple iOS, iPadOS, macOS, and other Apple products contain a use-after-free vulnerability in WebKit. Processing maliciously crafted web content may lead to memory corruption. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. CVE-2025-43529 Exploit Probability: 8.8% |
December 15, 2025 |
| Apple Multiple Products Unspecified Vulnerability |
Apple macOS, iOS, tvOS, Safari, and watchOS contain an unspecified vulnerability in JavaScriptCore that when processing web content may lead to arbitrary code execution. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. CVE-2022-48503 Exploit Probability: 3.2% |
October 20, 2025 |
| Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability |
Apple iOS, iPadOS, and macOS contain an out-of-bounds write vulnerability in the Image I/O framework. CVE-2025-43300 Exploit Probability: 32.5% |
August 21, 2025 |
| Apple Multiple Products Unspecified Vulnerability |
Apple iOS, iPadOS, macOS, watchOS, and visionOS, contain an unspecified vulnerability when processing a maliciously crafted photo or video shared via an iCloud Link. CVE-2025-43200 Exploit Probability: 1.2% |
June 16, 2025 |
| Apple Multiple Products Memory Corruption Vulnerability |
Apple iOS, iPadOS, macOS, and other Apple products contain a memory corruption vulnerability that allows for code execution when processing an audio stream in a maliciously crafted media file. CVE-2025-31200 Exploit Probability: 18.8% |
April 17, 2025 |
| Apple Multiple Products Arbitrary Read and Write Vulnerability |
Apple iOS, iPadOS, macOS, and other Apple products contain an arbitrary read and write vulnerability that allows an attacker to bypass Pointer Authentication. CVE-2025-31201 Exploit Probability: 14.0% |
April 17, 2025 |
| Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability |
Apple iOS, iPadOS, macOS, and other Apple products contain an out-of-bounds write vulnerability in WebKit that may allow maliciously crafted web content to break out of Web Content sandbox. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. CVE-2025-24201 Exploit Probability: 3.8% |
March 13, 2025 |
| Apple iOS and iPadOS Incorrect Authorization Vulnerability |
Apple iOS and iPadOS contains an incorrect authorization vulnerability that allows a physical attacker to disable USB Restricted Mode on a locked device. CVE-2025-24200 Exploit Probability: 4.4% |
February 12, 2025 |
| Apple Multiple Products Use-After-Free Vulnerability |
Apple iOS, macOS, and other Apple products contain a user-after-free vulnerability that could allow a malicious application to elevate privileges. CVE-2025-24085 Exploit Probability: 17.5% |
January 29, 2025 |
| Apple Multiple Products Code Execution Vulnerability |
Apple iOS, macOS, and other Apple products contain an unspecified vulnerability when processing maliciously crafted web content that may lead to arbitrary code execution. CVE-2024-44308 Exploit Probability: 10.2% |
November 21, 2024 |
| Apple Multiple Products Cross-Site Scripting (XSS) Vulnerability |
Apple iOS, macOS, and other Apple products contain an unspecified vulnerability when processing maliciously crafted web content that may lead to a cross-site scripting (XSS) attack. CVE-2024-44309 Exploit Probability: 22.6% |
November 21, 2024 |
7 known exploited Apple vulnerabilities are in the top 5% (95th percentile or greater) of the EPSS exploit probability rankings.
Top 10 Riskiest Apple Vulnerabilities
Based on the current exploit probability, these Apple vulnerabilities are on CISA's Known Exploited vulnerabilities list (KEV) and are ranked by the current EPSS exploit probability.
| Rank | CVE | EPSS | Vulnerability |
|---|---|---|---|
| 1 | CVE-2021-30860 | 76.0% | Apple iOS "FORCEDENTRY" Remote Code Execution Vulnerability |
| 2 | CVE-2021-30657 | 68.5% | Apple macOS Policy Subsystem Gatekeeper Bypass |
| 3 | CVE-2016-4657 | 66.8% | Apple iOS Webkit Memory Corruption Vulnerability |
| 4 | CVE-2023-41064 | 53.4% | Apple iOS, iPadOS, and macOS ImageIO Buffer Overflow Vulnerability |
| 5 | CVE-2023-32434 | 51.5% | Apple Multiple Products Integer Overflow Vulnerability |
| 6 | CVE-2014-4404 | 48.9% | Apple OS X Heap-Based Buffer Overflow Vulnerability |
| 7 | CVE-2016-4655 | 33.4% | Apple iOS Information Disclosure Vulnerability |
| 8 | CVE-2025-43300 | 32.5% | Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability |
| 9 | CVE-2021-30807 | 28.8% | Apple iOS and macOS Memory Corruption Vulnerability |
| 10 | CVE-2023-28205 | 27.1% | Apple Multiple Products WebKit Use-After-Free Vulnerability |
By the Year
In 2026 there have been 857 vulnerabilities in Apple with an average score of 6.5 out of ten. Last year, in 2025 Apple had 757 security vulnerabilities published. That is, 100 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 0.02
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 857 | 6.52 |
| 2025 | 757 | 6.54 |
| 2024 | 628 | 6.30 |
| 2023 | 514 | 6.71 |
| 2022 | 464 | 7.06 |
| 2021 | 603 | 6.91 |
| 2020 | 502 | 6.94 |
| 2019 | 564 | 7.66 |
| 2018 | 227 | 7.33 |
It may take a day or so for new Apple vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Apple Security Vulnerabilities
| CVE | Date | Vulnerability | Products |
|---|---|---|---|
| CVE-2026-86981 | Oct 20, 2026 |
macOS OOB Write in Sequoia/Tahoe (before 15.8/26.7)An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause unexpected system termination. |
macOS
|
| CVE-2026-86979 | Oct 20, 2026 |
macOS Golden Gate 27 Privacy Flaw: App Access to Sensitive DataA privacy issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27. An app may be able to access sensitive user data. |
macOS
|
| CVE-2026-86977 | Oct 20, 2026 |
Apple iOS/iPadOS 27 Auth Issue: App Can Initiate Calls/MessagesAn authorization issue was addressed with improved network restrictions. This issue is fixed in iOS 27 and iPadOS 27. An app may be able to initiate calls or send messages. |
Ios And Ipados
|
| CVE-2026-86976 | Oct 20, 2026 |
Apple iOS 27 App Data Leakage via Improper State MngmtAn authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. An app may be able to access sensitive user data. |
Ios And Ipados
macOS
|
| CVE-2026-86975 | Oct 20, 2026 |
Apple OS Image Decoder OOB Read CVE-2026-86975An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted image may lead to unexpected process termination. |
Ios And Ipados
macOS
tvOS
And others... |
| CVE-2026-86963 | Oct 20, 2026 |
Apple iOS/iPadOS DoS via Input Validation (Fixed 26.7,27)A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27. An attacker in a privileged network position may be able to cause a denial-of-service. |
Ios And Ipados
|
| CVE-2026-86962 | Oct 20, 2026 |
Apple OS Double Free Vulnerability (iOS 26.7+, macOS Sequoia 15.8+)A double free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination. |
Ios And Ipados
macOS
tvOS
And others... |
| CVE-2026-86961 | Oct 20, 2026 |
Apple iOS/iPadOS/macOS 27 Sandbox Breakout Race ConditionA race condition was addressed with additional validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. A malicious app may be able to break out of its sandbox. |
Ios And Ipados
macOS
|
| CVE-2026-86959 | Oct 20, 2026 |
Apple iOS/macos Input Validation Bug (before 26.7)An input validation issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Processing a maliciously crafted image may lead to unexpected process termination. |
Ios And Ipados
macOS
|
| CVE-2026-86953 | Oct 20, 2026 |
Apple OS OOB Write in System LibrariesAn out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. An attacker in physical proximity may be able to cause a denial-of-service. |
Ios And Ipados
macOS
tvOS
And others... |
| CVE-2026-86955 | Oct 20, 2026 |
Apple iOS 27 Auth Issue: Improper State Management Exposes Sensitive DataAn authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27. An app may be able to access sensitive user data. |
Ios And Ipados
|
| CVE-2026-86957 | Oct 20, 2026 |
Apple OS OOB Read Fixed in iOS 26.7, iPadOS 26.7, macOS Sequoia 15.8An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An attacker in wireless proximity may be able to cause unexpected system termination. |
Ios And Ipados
macOS
tvOS
And others... |
| CVE-2026-86940 | Oct 20, 2026 |
macOS Kernel Mem Disclosure (CVE202686940)This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Golden Gate 27. An app may be able to disclose kernel memory. |
macOS
|
| CVE-2026-86944 | Oct 20, 2026 |
Apple macOS Sequoia 15.8 OOB Write CVE-2026-86944An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause unexpected system termination. |
Ios And Ipados
macOS
|
| CVE-2026-86948 | Oct 20, 2026 |
Apple Xcode 27: Library Validation Failure Enables Sandbox BreakoutThis issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. An app may be able to break out of its sandbox. |
Xcode
|
| CVE-2026-86949 | Oct 20, 2026 |
Apple Xcode 27 Sandbox Escape via Library Validation BypassThis issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. A malicious app may be able to break out of its sandbox. |
Xcode
|
| CVE-2026-86935 | Oct 20, 2026 |
macOS Golden Gate Entitlement Escalation (CVE-2026-86935)This issue was addressed by removing additional entitlements. This issue is fixed in macOS Golden Gate 27. An app may be able to access user-sensitive data. |
macOS
|
| CVE-2026-86928 | Oct 20, 2026 |
macOS Golden Gate Path Handling Flaw Exposing Protected DataA path handling issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27. An app may be able to access protected user data. |
macOS
|
| CVE-2026-86932 | Oct 20, 2026 |
Authorization Issue in macOS Golden Gate 27 Allows App Access to Sensitive DataAn authorization issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. An app may be able to access sensitive user data. |
macOS
|
| CVE-2026-86933 | Oct 20, 2026 |
macOS Golden Gate Sandbox Restriction Issue Allows Contact Data AccessA permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Golden Gate 27. An app may be able to access information about a user's contacts. |
macOS
|
| CVE-2026-86919 | Oct 20, 2026 |
Apple iOS/iPadOS/macOS VisionOS Stack Overflow via Paired Bluetooth (pre-26.7/27)A stack overflow was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27. An attacker with a paired Bluetooth device may be able to execute arbitrary code. |
Ios And Ipados
macOS
visionOS
And others... |
| CVE-2026-86921 | Oct 20, 2026 |
iOS 26.7/27 Permissions Flaw: Local Attacker Can Overwrite FilesA permissions issue was addressed with improved validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. A local attacker may be able to overwrite restricted files. |
Ios And Ipados
macOS
visionOS
And others... |
| CVE-2026-86922 | Oct 20, 2026 |
Safari Type Confusion Vulnerability Arbitrary Code ExecutionA type confusion issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Processing maliciously crafted web content may lead to arbitrary code execution. |
Safari
Ios And Ipados
macOS
And others... |
| CVE-2026-86915 | Oct 20, 2026 |
macOS Golden Gate Race Condition App CrashA race condition was addressed with improved locking. This issue is fixed in macOS Golden Gate 27. An app may be able to cause unexpected system termination. |
macOS
|
| CVE-2026-86918 | Oct 20, 2026 |
Apple OS Image Parser OOB Write Causing App Crash (CVE-2026-86918)An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted image may lead to unexpected app termination. |
Ios And Ipados
macOS
tvOS
And others... |
| CVE-2026-86913 | Oct 20, 2026 |
Apple iOS/iPadOS UAF Media Parsing (fixed 26.7/27)A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory. |
Ios And Ipados
macOS
tvOS
And others... |
| CVE-2026-86914 | Oct 20, 2026 |
Apple macOS Info Disclosure via State Mgmt flaw (pre-27/15.8/26.7)An information disclosure issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access sensitive network connection information. |
macOS
|
| CVE-2026-86907 | Oct 20, 2026 |
macOS Entitlement Check Bypass: Admin App Alters System Keychain 15.7/26.6An authorization issue was addressed with improved entitlement checks. This issue is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7. An app with admin privileges may be able to modify the System Keychain. |
macOS
|
| CVE-2026-86874 | Oct 20, 2026 |
CVE-2026-86874: Xcode 27 OOB Read in Binary Parser Causes Tool CrashAn out-of-bounds read was addressed with improved input validation. This issue is fixed in Xcode 27. Parsing a maliciously crafted binary may lead to unexpected tool termination. |
Xcode
|
| CVE-2026-86875 | Oct 20, 2026 |
Apple Xcode 27 Input Validation CVE-2026-86875An input validation issue was addressed with improved input validation. This issue is fixed in Xcode 27. Parsing a maliciously crafted binary may lead to unexpected app termination. |
Xcode
|
| CVE-2026-86872 | Oct 20, 2026 |
Logic Flaw in Safari Web Rendering Allows Unexpected BehaviorA logic issue was addressed with improved state management. This issue is fixed in Safari 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to unexpected behavior. |
Safari
visionOS
watchOS
And others... |
| CVE-2026-86871 | Oct 20, 2026 |
macOS NetFS Integer Underflow (v27+, Sequoia 15.8)An integer underflow was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker with control of a network file server may be able to cause unexpected system termination. |
macOS
|
| CVE-2026-86868 | Oct 20, 2026 |
Authentication issue permits user impersonation in macOS before GG27, S15.8, T26.7An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker may be able to impersonate other users. |
macOS
|
| CVE-2026-84613 | Oct 20, 2026 |
Out-of-Bounds Write in Apple OS (iOS/iPadOS/macOS/tvOS) Fixed in 26.7-27An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An attacker in radio range may be able to cause unexpected system termination. |
Ios And Ipados
macOS
tvOS
And others... |
| CVE-2026-84582 | Oct 20, 2026 |
Apple OS Privacy Flaw lets Apps Access Sensitive Data - CVE-2026-84582A privacy issue was addressed with improved access restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. An app may be able to access sensitive user data. |
Ios And Ipados
macOS
tvOS
And others... |
| CVE-2026-84579 | Oct 20, 2026 |
macOS Network Share File Exec (pre- Golden Gate 27/Sequoia 15.8/Tahoe 26.7)A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Opening a file referencing a network share may lead to unexpected software execution. |
macOS
|
| CVE-2026-84547 | Oct 20, 2026 |
Memory Corruption CVE-2026-84547 in macOS GoldG<27 Sequoia<15.8 Tahoe<26.7A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker in physical proximity may be able to corrupt process memory. |
macOS
|
| CVE-2026-84508 | Oct 20, 2026 |
Apple iOS 27 Access Control Flaw via Caller ValidationThis issue was addressed with improved validation of the caller's access. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, visionOS 27. An app may be able to access protected user data. |
Ios And Ipados
macOS
visionOS
And others... |
| CVE-2026-84490 | Oct 20, 2026 |
iPhone Mirroring: Physical Access Bypass of Digital ID AuthThis issue was addressed through improved state management. This issue is fixed in iOS 27 and iPadOS 27. An attacker with physical access to a locked device may be able to bypass Digital ID authentication when iPhone Mirroring is active. |
Ios And Ipados
|
| CVE-2026-65396 | Oct 20, 2026 |
macOS Buffer Overflow (pre-27) in size validationA buffer overflow was addressed with improved size validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause unexpected system termination. |
macOS
|
| CVE-2026-65379 | Oct 20, 2026 |
macOS Secure Input State RCE, fixed in 27, 15.8, 26.7The issue was addressed with improved handling of secure input state. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access sensitive user data. |
macOS
|
| CVE-2026-65372 | Oct 20, 2026 |
macOS Race Condition Bypasses Privacy Prefs (Fixed in 27, 15.8, 26.7)A race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A malicious application may be able to bypass Privacy preferences. |
macOS
|
| CVE-2026-65356 | Oct 20, 2026 |
macOS Access Control Bypass (pre-27 GG, <15.8 SQ)An access issue was addressed with improved access controls. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access sensitive user data. |
macOS
|
| CVE-2026-28853 | Oct 20, 2026 |
macOS Sequoia 15.8 Privilege Escalation via Improper ChecksThe issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to elevate privileges. |
macOS
|
| CVE-2026-28854 | Oct 20, 2026 |
macOS App Bundle Integrity Bypass Allows Malicious App LaunchThe issue was addressed with additional app bundle integrity checks. This issue is fixed in macOS Golden Gate 27. A maliciously modified app may not be prevented from launching. |
macOS
|
| CVE-2026-28850 | Oct 20, 2026 |
visionOS Auth Bypass for Sensitive Data AccessAn authorization issue was addressed with improved state management. This issue is fixed in visionOS 27. An app may be able to access sensitive user data. |
visionOS
|
| CVE-2026-86950 | Sep 28, 2026 |
Apple iOS 26.7.1 OOB Write Arbitrary Code ExecAn out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27. |
iOS
iPadOS
macOS
And others... |
| CVE-2026-65388 | Sep 16, 2026 |
Apple Containerization before 0.41.0 remote token request host spoofingA remote attacker who controls a container registry may be able to direct a client's token request to a host of the attacker's choice, and disclose the victim's registry credentials to that host. This vulnerability is addressed in containerization version 0.41.0. |
|
| CVE-2026-65409 | Sep 14, 2026 |
Apple OSes Type Confusion DFS before 27 via memory handlingA type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause a denial of service. |
iOS
iPadOS
macOS
And others... |
| CVE-2026-84559 | Sep 14, 2026 |
macOS file permissions issue allows privileged access before 27/15.8A permissions issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A malicious application may be able to access restricted files. |
macOS
|