Apple Software and Device Maker
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in any Apple product.
RSS Feeds for Apple security vulnerabilities
Create a CVE RSS feed including security vulnerabilities found in Apple products with stack.watch. Just hit watch, then grab your custom RSS feed url.
Products by Apple Sorted by Most Security Vulnerabilities since 2018
Recent Apple Security Advisories
| Advisory | Title | Published |
|---|---|---|
| 149035 | macOS Golden Gate 27 - Apple Security Content | September 14, 2026 |
| 149034 | iOS 27 and iPadOS 27 - Apple Security Content | September 14, 2026 |
| 149037 | watchOS 27 - Apple Security Content | September 14, 2026 |
| 149040 | Xcode 27 - Apple Security Content | September 14, 2026 |
| 149038 | visionOS 27 - Apple Security Content | September 14, 2026 |
| 149042 | macOS Tahoe 26.7 - Apple Security Content | September 14, 2026 |
| 149041 | iOS 26.7 and iPadOS 26.7 - Apple Security Content | September 14, 2026 |
| 149039 | Safari 27 - Apple Security Content | September 14, 2026 |
| 149043 | macOS Sequoia 15.8 - Apple Security Content | September 14, 2026 |
| 149036 | tvOS 27 - Apple Security Content | September 14, 2026 |
Known Exploited Apple Vulnerabilities
The following Apple vulnerabilities have recently been marked by CISA as Known to be Exploited by threat actors.
| Title | Description | Added |
|---|---|---|
| Apple macOS Improper Authentication Vulnerability |
Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials. CVE-2026-65400 |
August 18, 2026 |
| Apple Multiple Products Classic Buffer Overflow Vulnerability |
Apple watchOS, iOS, iPadOS, macOS, visionOS, tvOS, and iPadOS contain a classic buffer overflow vulnerability which could allow a malicious application to cause unexpected system termination or write kernel memory. CVE-2025-43520 Exploit Probability: 0.4% |
March 20, 2026 |
| Apple Multiple Products Improper Locking Vulnerability |
Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain an improper locking vulnerability that could allow a malicious application to cause unexpected changes in memory shared between processes. CVE-2025-43510 Exploit Probability: 0.4% |
March 20, 2026 |
| Apple Multiple Products Buffer Overflow Vulnerability |
Apple Safari, iOS, watchOS, visionOS, iPadOS, macOS, and tvOS contain a buffer overflow vulnerability that could allow the processing of maliciously crafted web content which may lead to memory corruption. CVE-2025-31277 Exploit Probability: 1.5% |
March 20, 2026 |
| Apple Multiple products Use-After-Free Vulnerability |
Apple macOS, iOS, iPadOS, and Safari 16.6 contain a use-after-free vulnerability due to the processing of maliciously crafted web content that may lead to memory corruption. CVE-2023-43000 Exploit Probability: 3.9% |
March 5, 2026 |
| Apple iOS and iPadOS Use-After-Free Vulnerability |
Apple iOS and iPadOS contain a use-after-free vulnerability. An app may be able to execute arbitrary code with kernel privileges. CVE-2023-41974 Exploit Probability: 1.4% |
March 5, 2026 |
| Apple Multiple Products Integer Overflow or Wraparound Vulnerability |
Apple tvOS, macOS, Safari, iPadOS and watchOS contain an integer overflow or wraparound vulnerability due to the processing of maliciously crafted web content that may lead to arbitrary code execution. CVE-2021-30952 Exploit Probability: 7.0% |
March 5, 2026 |
| Apple Multiple Buffer Overflow Vulnerability |
Apple iOS, macOS, tvOS, watchOS, and visionOS contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow an attacker with memory write the capability to execute arbitrary code. CVE-2026-20700 Exploit Probability: 1.3% |
February 12, 2026 |
| Apple Multiple Products Use-After-Free WebKit Vulnerability |
Apple iOS, iPadOS, macOS, and other Apple products contain a use-after-free vulnerability in WebKit. Processing maliciously crafted web content may lead to memory corruption. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. CVE-2025-43529 Exploit Probability: 8.8% |
December 15, 2025 |
| Apple Multiple Products Unspecified Vulnerability |
Apple macOS, iOS, tvOS, Safari, and watchOS contain an unspecified vulnerability in JavaScriptCore that when processing web content may lead to arbitrary code execution. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. CVE-2022-48503 Exploit Probability: 3.2% |
October 20, 2025 |
| Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability |
Apple iOS, iPadOS, and macOS contain an out-of-bounds write vulnerability in the Image I/O framework. CVE-2025-43300 Exploit Probability: 20.4% |
August 21, 2025 |
| Apple Multiple Products Unspecified Vulnerability |
Apple iOS, iPadOS, macOS, watchOS, and visionOS, contain an unspecified vulnerability when processing a maliciously crafted photo or video shared via an iCloud Link. CVE-2025-43200 Exploit Probability: 1.1% |
June 16, 2025 |
| Apple Multiple Products Memory Corruption Vulnerability |
Apple iOS, iPadOS, macOS, and other Apple products contain a memory corruption vulnerability that allows for code execution when processing an audio stream in a maliciously crafted media file. CVE-2025-31200 Exploit Probability: 19.7% |
April 17, 2025 |
| Apple Multiple Products Arbitrary Read and Write Vulnerability |
Apple iOS, iPadOS, macOS, and other Apple products contain an arbitrary read and write vulnerability that allows an attacker to bypass Pointer Authentication. CVE-2025-31201 Exploit Probability: 14.7% |
April 17, 2025 |
| Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability |
Apple iOS, iPadOS, macOS, and other Apple products contain an out-of-bounds write vulnerability in WebKit that may allow maliciously crafted web content to break out of Web Content sandbox. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. CVE-2025-24201 Exploit Probability: 4.1% |
March 13, 2025 |
| Apple iOS and iPadOS Incorrect Authorization Vulnerability |
Apple iOS and iPadOS contains an incorrect authorization vulnerability that allows a physical attacker to disable USB Restricted Mode on a locked device. CVE-2025-24200 Exploit Probability: 4.4% |
February 12, 2025 |
| Apple Multiple Products Use-After-Free Vulnerability |
Apple iOS, macOS, and other Apple products contain a user-after-free vulnerability that could allow a malicious application to elevate privileges. CVE-2025-24085 Exploit Probability: 17.3% |
January 29, 2025 |
| Apple Multiple Products Code Execution Vulnerability |
Apple iOS, macOS, and other Apple products contain an unspecified vulnerability when processing maliciously crafted web content that may lead to arbitrary code execution. CVE-2024-44308 Exploit Probability: 9.2% |
November 21, 2024 |
| Apple Multiple Products Cross-Site Scripting (XSS) Vulnerability |
Apple iOS, macOS, and other Apple products contain an unspecified vulnerability when processing maliciously crafted web content that may lead to a cross-site scripting (XSS) attack. CVE-2024-44309 Exploit Probability: 22.7% |
November 21, 2024 |
| Apple iOS and iPadOS Memory Corruption Vulnerability |
Apple iOS and iPadOS RTKit contain a memory corruption vulnerability that allows an attacker with arbitrary kernel read and write capability to bypass kernel memory protections. CVE-2024-23296 Exploit Probability: 1.4% |
March 6, 2024 |
5 known exploited Apple vulnerabilities are in the top 5% (95th percentile or greater) of the EPSS exploit probability rankings.
Top 10 Riskiest Apple Vulnerabilities
Based on the current exploit probability, these Apple vulnerabilities are on CISA's Known Exploited vulnerabilities list (KEV) and are ranked by the current EPSS exploit probability.
| Rank | CVE | EPSS | Vulnerability |
|---|---|---|---|
| 1 | CVE-2021-30860 | 76.0% | Apple iOS "FORCEDENTRY" Remote Code Execution Vulnerability |
| 2 | CVE-2021-30657 | 68.5% | Apple macOS Policy Subsystem Gatekeeper Bypass |
| 3 | CVE-2016-4657 | 66.8% | Apple iOS Webkit Memory Corruption Vulnerability |
| 4 | CVE-2023-32434 | 51.5% | Apple Multiple Products Integer Overflow Vulnerability |
| 5 | CVE-2014-4404 | 49.0% | Apple OS X Heap-Based Buffer Overflow Vulnerability |
| 6 | CVE-2023-41064 | 45.1% | Apple iOS, iPadOS, and macOS ImageIO Buffer Overflow Vulnerability |
| 7 | CVE-2016-4655 | 33.4% | Apple iOS Information Disclosure Vulnerability |
| 8 | CVE-2023-41993 | 29.2% | Apple Multiple Products WebKit Code Execution Vulnerability |
| 9 | CVE-2021-30807 | 28.8% | Apple iOS and macOS Memory Corruption Vulnerability |
| 10 | CVE-2023-28205 | 27.1% | Apple Multiple Products WebKit Use-After-Free Vulnerability |
By the Year
In 2026 there have been 810 vulnerabilities in Apple with an average score of 6.6 out of ten. Last year, in 2025 Apple had 757 security vulnerabilities published. That is, 53 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.03.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 810 | 6.57 |
| 2025 | 757 | 6.54 |
| 2024 | 628 | 6.30 |
| 2023 | 514 | 6.71 |
| 2022 | 464 | 7.06 |
| 2021 | 603 | 6.94 |
| 2020 | 502 | 6.89 |
| 2019 | 564 | 7.67 |
| 2018 | 226 | 7.33 |
It may take a day or so for new Apple vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Apple Security Vulnerabilities
| CVE | Date | Vulnerability | Products |
|---|---|---|---|
| CVE-2026-65388 | Sep 16, 2026 |
Apple Containerization before 0.41.0 remote token request host spoofingA remote attacker who controls a container registry may be able to direct a client's token request to a host of the attacker's choice, and disclose the victim's registry credentials to that host. This vulnerability is addressed in containerization version 0.41.0. |
|
| CVE-2026-65409 | Sep 14, 2026 |
Apple OSes Type Confusion DFS before 27 via memory handlingA type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause a denial of service. |
iOS
iPadOS
macOS
And others... |
| CVE-2026-84559 | Sep 14, 2026 |
macOS file permissions issue allows privileged access before 27/15.8A permissions issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A malicious application may be able to access restricted files. |
macOS
|
| CVE-2026-28960 | Sep 14, 2026 |
Apple iOS/iPadOS DoS via Validation (fixed 18.7.10)A denial-of-service issue was addressed with improved validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10. A remote attacker may be able to cause a denial-of-service. |
Ios And Ipados
|
| CVE-2026-43741 | Sep 14, 2026 |
macOS 27/15.8/26.7: State Management Logic Issue Allows Protected Data AccessA logic issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access protected user data. |
macOS
|
| CVE-2026-28937 | Sep 14, 2026 |
macOS Golden Gate State MGmt Flaw: App Access Sensitive DataThis issue was addressed through improved state management. This issue is fixed in macOS Golden Gate 27. An app may be able to access sensitive user data. |
macOS
|
| CVE-2026-86876 | Sep 14, 2026 |
Apple OS OOB Write (fixed in iOS 26.7/27)An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27, watchOS 27. A sandboxed process may be able to circumvent sandbox restrictions. |
iOS
iPadOS
macOS
And others... |
| CVE-2026-84518 | Sep 14, 2026 |
Apple Safari 27: Exfiltration of installed apps via state managementThis issue was addressed through improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27. A malicious website may be able to determine what apps a user has installed. |
iOS
iPadOS
macOS
And others... |
| CVE-2026-84631 | Sep 14, 2026 |
Privilege Escalation via Entitlement Check Bypass in macOS Golden GateThis issue was addressed with additional entitlement checks. This issue is fixed in macOS Golden Gate 27. An app may be able to gain root privileges. |
macOS
|
| CVE-2026-84563 | Sep 14, 2026 |
Apple macOS Logic Flaw Unexpected Termination (GG 27, Sequoia 15.8, Tahoe 26.7)A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause unexpected system termination. |
macOS
|
| CVE-2026-84534 | Sep 14, 2026 |
File Write via Malicious Archive in iOS/iPadOS 26.7+, macOS 27+, visionOS 27A path handling issue was addressed with improved validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27. Extracting a maliciously crafted archive may allow an attacker to write arbitrary files. |
iOS
iPadOS
macOS
And others... |
| CVE-2026-43690 | Sep 14, 2026 |
macOS Kernel Memory Read via Race Condition (Fixed in 27, 15.8, 26.7)A race condition was addressed with improved locking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A local user may be able to read kernel memory. |
macOS
|
| CVE-2026-84522 | Sep 14, 2026 |
Race Condition in macOS State Management Enables Sensitive Data AccessA race condition was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. An app may be able to access sensitive user data. |
macOS
|
| CVE-2026-86909 | Sep 14, 2026 |
macOS Gatekeeper Bypass via Logic Issue in State ManagementA logic issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. An app may be able to bypass Gatekeeper checks. |
macOS
|
| CVE-2026-43686 | Sep 14, 2026 |
Apple OS kernel use-after-free via NFS (fixed in 26.7/27)A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Connecting to a malicious NFS server may lead to kernel memory corruption. |
iOS
iPadOS
macOS
And others... |
| CVE-2026-84575 | Sep 14, 2026 |
Apple OS OOB Write in File Processing (Fixed in iOS 27, macOS 15.8)An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted file may lead to unexpected app termination. |
iOS
iPadOS
macOS
And others... |
| CVE-2026-86883 | Sep 14, 2026 |
Apple iOS 27 Privacy Flaw: App Access to Sensitive Data via File HandlingA privacy issue was addressed with improved handling of files. This issue is fixed in iOS 27 and iPadOS 27, visionOS 27. An app may be able to access sensitive user data. |
iOS
iPadOS
visionOS
And others... |
| CVE-2026-64756 | Sep 14, 2026 |
Path Handling Vulnerability in Apple OS (iOS/iPadOS <27, macOS <27)A path handling issue was addressed with improved validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access user-sensitive data. |
iOS
iPadOS
macOS
And others... |
| CVE-2026-65393 | Sep 14, 2026 |
Apple Xcode/macOS Golden Gate Permission Validation FlawA permissions issue was addressed with improved validation. This issue is fixed in Xcode 27, macOS Golden Gate 27. An app may be able to access user-sensitive data. |
macOS
Xcode
|
| CVE-2026-65405 | Sep 14, 2026 |
Memory init flaw in Apple OS (fixed in iOS 26.7, iPadOS 26.7, macOS 27)A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to determine kernel memory layout. |
iOS
iPadOS
macOS
And others... |
| CVE-2026-64701 | Sep 14, 2026 |
macOS root privilege escalation via permissions flaw fixed in 15.7.8/26.6A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Tahoe 26.6. A malicious app may be able to gain root privileges. |
macOS
|
| CVE-2026-84555 | Sep 14, 2026 |
macOS Authorization Flaw allows data access prior to 27/15.8An authorization issue was addressed with improved access control. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8. An app may be able to access sensitive user data. |
macOS
|
| CVE-2026-65413 | Sep 14, 2026 |
macOS Integer Overflow in Input Validation Causing DoS (Fixed 27, 15.8, 26.7)An integer overflow was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause a denial of service. |
macOS
|
| CVE-2026-64717 | Sep 14, 2026 |
Apple OS Kernel Race Condition Leading to Termination (fixed iOS 18.7.10)A race condition was addressed with improved state handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination or corrupt kernel memory. |
Ios And Ipados
macOS
tvOS
And others... |
| CVE-2026-84543 | Sep 14, 2026 |
Out-of-bounds SMB access in macOS Kernel pre-Sequoia 15.8An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Connecting to a malicious SMB server may cause unexpected system termination or corrupt kernel memory. |
macOS
|
| CVE-2026-86895 | Sep 14, 2026 |
Apple iOS Persistent Account ID Disclosure via State ManagementAn information disclosure issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, tvOS 27, visionOS 27, watchOS 27. A local app may be able to read a persistent account identifier. |
iOS
iPadOS
tvOS
And others... |
| CVE-2026-84514 | Sep 14, 2026 |
macOS FS Mod via Entitlement Bypass (pre-27)This issue was addressed with additional entitlement checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to modify protected parts of the file system. |
macOS
|
| CVE-2026-43761 | Sep 14, 2026 |
macOS OOB Write in Disk Image Mounting (fixed in 15.7.8/14.8.8/26.6)An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. Mounting a malicious disk image may cause unexpected system termination. |
macOS
|
| CVE-2026-84580 | Sep 14, 2026 |
macOS Sandbox Breakout (Pre-27 Golden Gate, Pre-15.8 Sequoia, Pre-26.7 Tahoe)The issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to break out of its sandbox. |
macOS
|
| CVE-2026-84611 | Sep 14, 2026 |
Apple OS OOB Write via Malicious 3D Model (Fixed in 26.7/27)An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted 3D model may lead to memory corruption. |
iOS
iPadOS
macOS
And others... |
| CVE-2026-84492 | Sep 14, 2026 |
Apple OSs: Race Condition Causing Unexpected Termination (CVE202684492)A race condition was addressed with improved state handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination. |
iOS
iPadOS
macOS
And others... |
| CVE-2026-84538 | Sep 14, 2026 |
macOS DoS via bad input validation (fixed in 27, 15.8, 26.7)A denial-of-service issue was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A remote attacker may be able to cause a denial-of-service. |
macOS
|
| CVE-2026-84607 | Sep 14, 2026 |
Race condition in Apple iOS 26.7 allows kernel-priv exec via sandboxed appA race condition was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. A sandboxed app may be able to execute arbitrary code with kernel privileges. |
iOS
iPadOS
macOS
And others... |
| CVE-2026-86905 | Sep 14, 2026 |
Apple Keychain Credential Deletion Vulnerability in iOS/macOS/visionOS 27This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. An app may be able to delete credentials stored in Keychain. |
iOS
iPadOS
macOS
And others... |
| CVE-2026-84596 | Sep 14, 2026 |
Apple OS Font Engine OOB Read Exposes Process MemoryAn out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted font may result in the disclosure of process memory. |
iOS
iPadOS
macOS
And others... |
| CVE-2026-84578 | Sep 14, 2026 |
macOS Sandbox Breakout Logic Issue Fixed in 27, 15.8, 26.7A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to break out of its sandbox. |
macOS
|
| CVE-2026-84597 | Sep 14, 2026 |
Out-of-Bounds Read in Apple OS Font Parsing (CVE-2026-84597)An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted font may result in the disclosure of process memory. |
iOS
iPadOS
macOS
And others... |
| CVE-2026-86904 | Sep 14, 2026 |
Apple iOS/iPadOS/watchOS Privacy Tracking Vulnerability (CVE-2026-86904)A privacy issue was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, watchOS 27. An app may be able to track users across apps and websites without permission. |
iOS
iPadOS
watchOS
And others... |
| CVE-2026-43664 | Sep 14, 2026 |
Apple iOS 26.7/iPadOS 26.7 App Data Leakage VulnerabilityThis issue was addressed with improved data protection. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, watchOS 27. An app may be able to access sensitive user data. |
iOS
iPadOS
macOS
And others... |
| CVE-2026-84606 | Sep 14, 2026 |
Apple iOS Identifier Privacy Leak Across ReinstallsA privacy issue was addressed with improved handling of identifiers. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. An app may be able to identify a user across reinstalls. |
iOS
iPadOS
macOS
And others... |
| CVE-2026-43808 | Sep 14, 2026 |
Use-After-Free in Apple OS 26.6 (iOS, macOS, tvOS, watchOS, iPadOS)A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination. |
Ios And Ipados
macOS
tvOS
And others... |
| CVE-2026-43737 | Sep 14, 2026 |
Auth Issue: Motion Data from Headphones Access without Consent (iOS 26.7+)An authorization issue was addressed with improved validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, watchOS 27. An app may be able to access motion data from headphones without user consent. |
iOS
iPadOS
macOS
And others... |
| CVE-2026-84581 | Sep 14, 2026 |
macOS Disk Image Buffer Overflow (fixed v27/15.8/26.7)A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory. |
macOS
|
| CVE-2026-86894 | Sep 14, 2026 |
Apple macOS Golden Gate Sandbox Escape (CVE-2026-86894)A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27. An app may be able to break out of its sandbox. |
macOS
|
| CVE-2026-84515 | Sep 14, 2026 |
macOS OOB Write via SMB, fixed in 27, Sequoia 15.8, Tahoe 26.7An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Connecting to a malicious SMB server may lead to kernel memory corruption. |
macOS
|
| CVE-2026-65412 | Sep 14, 2026 |
Apple WebKit Null Pointer Deref in Web Content (iOS 26.7+, macOS 15.8+)A null pointer dereference was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27, watchOS 27. Processing web content may lead to a denial-of-service. |
iOS
iPadOS
macOS
And others... |
| CVE-2026-65404 | Sep 14, 2026 |
Apple iOS/iPadOS Auth Bypass via State Management (18.7.10)An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. A malicious application may be able to bypass Privacy preferences. |
iOS
iPadOS
macOS
And others... |
| CVE-2026-84554 | Sep 14, 2026 |
macOS Integer Overflow DoS Fixed in GA 27/Sequoia 15.8/Tahoe 26.7An integer overflow was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker in a privileged network position may be able to cause a denial-of-service. |
macOS
|
| CVE-2026-86882 | Sep 14, 2026 |
Apple OS ImageIO OOB Write pre 26.7An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted image may lead to unexpected process termination. |
iOS
iPadOS
macOS
And others... |
| CVE-2026-84574 | Sep 14, 2026 |
macOS State Mgmt Overrides Privacy Bypass pre27/15.8/26.7A permissions issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to bypass Privacy preferences. |
macOS
|