CVE Daily – Apple iOS https://cvedaily.com/pages/tags/ios.html CVE Daily – Apple iOS en Wed, 03 Jun 2026 21:26:32 +0000 [Medium] CVE-2026-35049 – wire-ios is an iOS client for the Wire secure messaging application. Prior to ve... https://nvd.nist.gov/vuln/detail/CVE-2026-35049 https://nvd.nist.gov/vuln/detail/CVE-2026-35049 Tue, 02 Jun 2026 20:16:35 +0000 Medium CVE-2026-35049

wire-ios is an iOS client for the Wire secure messaging application. Prior to version 4.16.0, upon receiving a crafted malicious Proteus external message with an encrypted payload that is shorter than 16 bytes, the Wire iOS client crashes. The crash is triggered automatically after message receival with no user interaction. Since the malicious message persists in the conversation, the app enters…

CVSS: 6.5 · CWE: CWE-20

View on NVD

]]> [Medium] CVE-2026-9309 – Firefox for iOS Reader View did not properly escape HTML tags in JSON-LD metadat... https://nvd.nist.gov/vuln/detail/CVE-2026-9309 https://nvd.nist.gov/vuln/detail/CVE-2026-9309 Mon, 01 Jun 2026 13:16:33 +0000 Medium CVE-2026-9309

Firefox for iOS Reader View did not properly escape HTML tags in JSON-LD metadata. A malicious page could inject markup that changed Reader View behavior and leaked sensitive URL parameters. These parameters could then be used to access internal pages, potentially resulting in arbitrary JavaScript execution in an internal origin. This vulnerability was fixed in Firefox for iOS 151.2.

CVSS: 5.4 · CWE: CWE-79

View on NVD

]]> [Medium] CVE-2026-9308 – Firefox for iOS Reader View replaced page content in its HTML template before re... https://nvd.nist.gov/vuln/detail/CVE-2026-9308 https://nvd.nist.gov/vuln/detail/CVE-2026-9308 Mon, 01 Jun 2026 13:16:33 +0000 Medium CVE-2026-9308

Firefox for iOS Reader View replaced page content in its HTML template before replacing other internal placeholders. A malicious page could include a placeholder string that was later substituted with JSON-LD data, potentially resulting in arbitrary JavaScript execution. This vulnerability was fixed in Firefox for iOS 151.2.

CVSS: 5.4 · CWE: CWE-79

View on NVD

]]> [High] CVE-2026-44698 – Home Assistant is open source home automation software that puts local control a... https://nvd.nist.gov/vuln/detail/CVE-2026-44698 https://nvd.nist.gov/vuln/detail/CVE-2026-44698 Fri, 29 May 2026 14:16:28 +0000 High CVE-2026-44698

Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.4.1 for iOS and 2026.4.4 for Android, he Home Assistant Companion apps for Android and iOS expose a JavaScript bridge to the in-app WebView window.externalApp on Android and webkit.messageHandlers.getExternalAuth (alongside revokeExternalAuth and externalBus) on iOS. Two flaws expose th…

CVSS: 8.3 · CWE: CWE-94

View on NVD

]]> [Medium] CVE-2026-9971 – Inappropriate implementation in iOS in Google Chrome on iOS prior to 148.0.7778... https://nvd.nist.gov/vuln/detail/CVE-2026-9971 https://nvd.nist.gov/vuln/detail/CVE-2026-9971 Thu, 28 May 2026 23:16:55 +0000 Medium CVE-2026-9971

Inappropriate implementation in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific UI gestures to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: High)

CVSS: 5.4 · CWE: CWE-79

View on NVD

]]> [High] CVE-2026-9963 – Uninitialized Use in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed... https://nvd.nist.gov/vuln/detail/CVE-2026-9963 https://nvd.nist.gov/vuln/detail/CVE-2026-9963 Thu, 28 May 2026 23:16:54 +0000 High CVE-2026-9963

Uninitialized Use in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS: 7.5 · CWE: CWE-457

View on NVD

]]> [High] CVE-2026-9956 – Use after free in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed a ... https://nvd.nist.gov/vuln/detail/CVE-2026-9956 https://nvd.nist.gov/vuln/detail/CVE-2026-9956 Thu, 28 May 2026 23:16:53 +0000 High CVE-2026-9956

Use after free in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

CVSS: 7.5 · CWE: CWE-416

View on NVD

]]> [Medium] CVE-2026-9955 – Inappropriate implementation in iOS in Google Chrome on iOS prior to 148.0.7778... https://nvd.nist.gov/vuln/detail/CVE-2026-9955 https://nvd.nist.gov/vuln/detail/CVE-2026-9955 Thu, 28 May 2026 23:16:53 +0000 Medium CVE-2026-9955

Inappropriate implementation in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

CVSS: 4.3 · CWE: CWE-200

View on NVD

]]> [Low] CVE-2026-9950 – Insufficient validation of untrusted input in iOS in Google Chrome on iOS prior ... https://nvd.nist.gov/vuln/detail/CVE-2026-9950 https://nvd.nist.gov/vuln/detail/CVE-2026-9950 Thu, 28 May 2026 23:16:53 +0000 Low CVE-2026-9950

Insufficient validation of untrusted input in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)

CVSS: 3.1 · CWE: CWE-20

View on NVD

]]> [Medium] CVE-2026-48693 – FastNetMon Community Edition through 1.2.9 is vulnerable to a local symlink atta... https://nvd.nist.gov/vuln/detail/CVE-2026-48693 https://nvd.nist.gov/vuln/detail/CVE-2026-48693 Tue, 26 May 2026 17:16:53 +0000 Medium CVE-2026-48693

FastNetMon Community Edition through 1.2.9 is vulnerable to a local symlink attack via predictable file paths in /tmp. The statistics file path defaults to '/tmp/fastnetmon.dat' (src/fastnetmon.cpp line 159). The print_screen_contents_into_file() function (src/fastnetmon_logic.cpp line 2186) opens this path with std::ios::trunc without checking for symlinks or using O_NOFOLLOW. Additionally, the…

CVSS: 5.5 · CWE: CWE-59

View on NVD

]]> [Medium] CVE-2026-9078 – Firefox for iOS displayed specially crafted right-to-left (RTL) and internationa... https://nvd.nist.gov/vuln/detail/CVE-2026-9078 https://nvd.nist.gov/vuln/detail/CVE-2026-9078 Mon, 25 May 2026 15:16:22 +0000 Medium CVE-2026-9078

Firefox for iOS displayed specially crafted right-to-left (RTL) and internationalized domain names (IDNs) incorrectly in link preview UI surfaces. A crafted RTL hostname could visually reorder portions of the displayed domain, causing attacker-controlled sites to appear as trusted origins. This vulnerability was fixed in Firefox for iOS 151.1.

CVSS: 5.4 · CWE: CWE-451

View on NVD

]]> [Medium] CVE-2026-8706 – Firefox for iOS hosted Reader mode on an unauthenticated local web server, allow... https://nvd.nist.gov/vuln/detail/CVE-2026-8706 https://nvd.nist.gov/vuln/detail/CVE-2026-8706 Tue, 19 May 2026 16:16:22 +0000 Medium CVE-2026-8706

Firefox for iOS hosted Reader mode on an unauthenticated local web server, allowing another application on the same device to request arbitrary URLs and receive the response rendered with the signed-in user's cookies. This vulnerability was fixed in Firefox for iOS 151.0.

CVSS: 6.5 · CWE: CWE-200

View on NVD

]]> [High] CVE-2021-47973 – Sticky Notes Widget 3.0.6 contains a denial of service vulnerability that allows... https://nvd.nist.gov/vuln/detail/CVE-2021-47973 https://nvd.nist.gov/vuln/detail/CVE-2021-47973 Sat, 16 May 2026 16:16:22 +0000 High CVE-2021-47973

Sticky Notes Widget 3.0.6 contains a denial of service vulnerability that allows attackers to crash the application by pasting excessively long character strings into note fields. Attackers can generate a payload containing 350000 repeated characters and paste it twice into a new note to trigger an application crash on iOS devices.

CVSS: 7.5 · CWE: CWE-789

View on NVD

]]> [High] CVE-2026-8585 – Inappropriate implementation in Media in Google Chrome on iOS prior to 148.0.777... https://nvd.nist.gov/vuln/detail/CVE-2026-8585 https://nvd.nist.gov/vuln/detail/CVE-2026-8585 Thu, 14 May 2026 20:17:20 +0000 High CVE-2026-8585

Inappropriate implementation in Media in Google Chrome on iOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)

CVSS: 7.5 · CWE: CWE-693

View on NVD

]]> [Medium] CVE-2026-8584 – Inappropriate implementation in Views in Google Chrome on iOS prior to 148.0.777... https://nvd.nist.gov/vuln/detail/CVE-2026-8584 https://nvd.nist.gov/vuln/detail/CVE-2026-8584 Thu, 14 May 2026 20:17:20 +0000 Medium CVE-2026-8584

Inappropriate implementation in Views in Google Chrome on iOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

CVSS: 4.2 · CWE: CWE-451

View on NVD

]]> [Medium] CVE-2026-8560 – Heap buffer overflow in SwiftShader in Google Chrome on Mac and iOS prior to 148... https://nvd.nist.gov/vuln/detail/CVE-2026-8560 https://nvd.nist.gov/vuln/detail/CVE-2026-8560 Thu, 14 May 2026 20:17:18 +0000 Medium CVE-2026-8560

Heap buffer overflow in SwiftShader in Google Chrome on Mac and iOS prior to 148.0.7778.168 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)

CVSS: 4.3 · CWE: CWE-122

View on NVD

]]> [Low] CVE-2026-30904 – Protection Mechanism Failure in Zoom Workplace for iOS before version 7.0.0 may ... https://nvd.nist.gov/vuln/detail/CVE-2026-30904 https://nvd.nist.gov/vuln/detail/CVE-2026-30904 Wed, 13 May 2026 19:17:05 +0000 Low CVE-2026-30904

Protection Mechanism Failure in Zoom Workplace for iOS before version 7.0.0 may allow an authenticated user to conduct a disclosure of information via physical access.

CVSS: 1.8 · CWE: CWE-693

View on NVD

]]> [Medium] CVE-2026-0251 – Multiple local privilege escalation vulnerabilities in the Palo Alto Networks Gl... https://nvd.nist.gov/vuln/detail/CVE-2026-0251 https://nvd.nist.gov/vuln/detail/CVE-2026-0251 Wed, 13 May 2026 19:16:59 +0000 Medium CVE-2026-0251

Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allow a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative privileges. The GlobalProtect app on iOS, Android, Chrome OS and GlobalProtect UWP app are not affect…

CVSS: 5.9 · CWE: CWE-426

View on NVD

]]> [Medium] CVE-2026-0250 – A buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect™ ... https://nvd.nist.gov/vuln/detail/CVE-2026-0250 https://nvd.nist.gov/vuln/detail/CVE-2026-0250 Wed, 13 May 2026 19:16:59 +0000 Medium CVE-2026-0250

A buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect™ app that enables a man in the middle attacker to disrupt system processes and potentially execute arbitrary code with SYSTEM privileges. This vulnerability is triggered during the processing of requests and responses exchanged between Portal and Gateway. The GlobalProtect app on iOS is not affected.

CVSS: 5.2 · CWE: CWE-787

View on NVD

]]> [Medium] CVE-2026-0249 – Multiple improper certificate validation vulnerabilities in the Palo Alto Networ... https://nvd.nist.gov/vuln/detail/CVE-2026-0249 https://nvd.nist.gov/vuln/detail/CVE-2026-0249 Wed, 13 May 2026 19:16:59 +0000 Medium CVE-2026-0249

Multiple improper certificate validation vulnerabilities in the Palo Alto Networks GlobalProtect™ app enables an attacker to intercept encrypted communications and potentially compromise the endpoint. This can enable a local non-administrative operating system user or an attacker on the same subnet to redirect traffic to an unauthorized server and facilitate the installation of malicious software…

CVSS: 4.9 · CWE: CWE-295

View on NVD

]]> [Medium] CVE-2026-0248 – An improper certificate validation vulnerability in the Prisma Access Agent® for... https://nvd.nist.gov/vuln/detail/CVE-2026-0248 https://nvd.nist.gov/vuln/detail/CVE-2026-0248 Wed, 13 May 2026 19:16:58 +0000 Medium CVE-2026-0248

An improper certificate validation vulnerability in the Prisma Access Agent® for Android and Chrome OS enables an attacker to perform a man-in-the-middle (MitM) attack to intercept VPN traffic. By presenting a certificate for any domain issued by a trusted Certificate Authority, the attacker can capture sensitive device information. The Prisma Access Agent on macOS, Windows, Linux and iOS are…

CVSS: 6.2 · CWE: CWE-295

View on NVD

]]> [Medium] CVE-2026-0246 – A vulnerability with a privilege management mechanism in the Palo Alto Networks ... https://nvd.nist.gov/vuln/detail/CVE-2026-0246 https://nvd.nist.gov/vuln/detail/CVE-2026-0246 Wed, 13 May 2026 19:16:58 +0000 Medium CVE-2026-0246

A vulnerability with a privilege management mechanism in the Palo Alto Networks Prisma Access Agent® enables a locally authenticated non-administrative user to escalate their privileges to root on macOS and Linux or NT AUTHORITY\SYSTEM on Windows. This allows the user to execute arbitrary code and read sensitive information otherwise accessible only to privileged accounts. The Prisma Access Ag…

CVSS: 5.9 · CWE: CWE-862

View on NVD

]]> [Medium] CVE-2026-0245 – Multiple information disclosure vulnerabilities in Prisma Access Agent® allow a ... https://nvd.nist.gov/vuln/detail/CVE-2026-0245 https://nvd.nist.gov/vuln/detail/CVE-2026-0245 Wed, 13 May 2026 19:16:58 +0000 Medium CVE-2026-0245

Multiple information disclosure vulnerabilities in Prisma Access Agent® allow a local user to access sensitive configuration data and credentials. The Prisma Access Agent on Linux, ChromeOS, Android, and iOS are not affected.

CVSS: 4.3 · CWE: CWE-200

View on NVD

]]> [High] CVE-2025-46311 – An inconsistent user interface issue was addressed with improved state managemen... https://nvd.nist.gov/vuln/detail/CVE-2025-46311 https://nvd.nist.gov/vuln/detail/CVE-2025-46311 Tue, 12 May 2026 18:16:35 +0000 High CVE-2025-46311

An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2. An app may be able to access sensitive user data.

CVSS: 7.5 · CWE: CWE-451

View on NVD

]]> [High] CVE-2026-43668 – A use after free issue was addressed with improved memory management. This issue... https://nvd.nist.gov/vuln/detail/CVE-2026-43668 https://nvd.nist.gov/vuln/detail/CVE-2026-43668 Mon, 11 May 2026 21:19:02 +0000 High CVE-2026-43668

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. A remote attacker may be able to cause unexpected system termination or corrupt kernel memory.

CVSS: 7.5 · CWE: CWE-416

View on NVD

]]> [Medium] CVE-2026-43666 – An out-of-bounds write issue was addressed with improved bounds checking. This i... https://nvd.nist.gov/vuln/detail/CVE-2026-43666 https://nvd.nist.gov/vuln/detail/CVE-2026-43666 Mon, 11 May 2026 21:19:01 +0000 Medium CVE-2026-43666

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An attacker on the local network may be able to cause a denial-of-service.

CVSS: 6.2 · CWE: CWE-787

View on NVD

]]> [High] CVE-2026-43661 – A buffer overflow issue was addressed with improved memory handling. This issue ... https://nvd.nist.gov/vuln/detail/CVE-2026-43661 https://nvd.nist.gov/vuln/detail/CVE-2026-43661 Mon, 11 May 2026 21:19:01 +0000 High CVE-2026-43661

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. Processing a maliciously crafted image may corrupt process memory.

CVSS: 7.5 · CWE: CWE-121

View on NVD

]]> [High] CVE-2026-43660 – A validation issue was addressed with improved logic. This issue is fixed in Saf... https://nvd.nist.gov/vuln/detail/CVE-2026-43660 https://nvd.nist.gov/vuln/detail/CVE-2026-43660 Mon, 11 May 2026 21:19:01 +0000 High CVE-2026-43660

A validation issue was addressed with improved logic. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.

CVSS: 7.5 · CWE: CWE-693

View on NVD

]]> [Medium] CVE-2026-43659 – A race condition was addressed with additional validation. This issue is fixed i... https://nvd.nist.gov/vuln/detail/CVE-2026-43659 https://nvd.nist.gov/vuln/detail/CVE-2026-43659 Mon, 11 May 2026 21:19:01 +0000 Medium CVE-2026-43659

A race condition was addressed with additional validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, visionOS 26.5. An app may be able to access sensitive user data.

CVSS: 4.7 · CWE: CWE-362

View on NVD

]]> [High] CVE-2026-43658 – The issue was addressed with improved memory handling. This issue is fixed in Sa... https://nvd.nist.gov/vuln/detail/CVE-2026-43658 https://nvd.nist.gov/vuln/detail/CVE-2026-43658 Mon, 11 May 2026 21:19:01 +0000 High CVE-2026-43658

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.

CVSS: 7.5 · CWE: CWE-119

View on NVD

]]> [High] CVE-2026-43656 – An out-of-bounds write issue was addressed with improved input validation. This ... https://nvd.nist.gov/vuln/detail/CVE-2026-43656 https://nvd.nist.gov/vuln/detail/CVE-2026-43656 Mon, 11 May 2026 21:19:01 +0000 High CVE-2026-43656

An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. Parsing a maliciously crafted file may lead to an unexpected app termination.

CVSS: 7.3 · CWE: CWE-787

View on NVD

]]> [High] CVE-2026-43655 – An out-of-bounds read was addressed with improved bounds checking. This issue is... https://nvd.nist.gov/vuln/detail/CVE-2026-43655 https://nvd.nist.gov/vuln/detail/CVE-2026-43655 Mon, 11 May 2026 21:19:01 +0000 High CVE-2026-43655

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. An app may be able to cause unexpected system termination or read kernel memory.

CVSS: 7.3 · CWE: CWE-125

View on NVD

]]> [High] CVE-2026-43654 – The issue was addressed with improved memory handling. This issue is fixed in iO... https://nvd.nist.gov/vuln/detail/CVE-2026-43654 https://nvd.nist.gov/vuln/detail/CVE-2026-43654 Mon, 11 May 2026 21:19:01 +0000 High CVE-2026-43654

The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to disclose kernel memory.

CVSS: 7.5 · CWE: CWE-497

View on NVD

]]> [Medium] CVE-2026-43653 – The issue was addressed with improved memory handling. This issue is fixed in iO... https://nvd.nist.gov/vuln/detail/CVE-2026-43653 https://nvd.nist.gov/vuln/detail/CVE-2026-43653 Mon, 11 May 2026 21:19:01 +0000 Medium CVE-2026-43653

The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5. An attacker on the local network may be able to cause a denial-of-service.

CVSS: 6.2 · CWE: CWE-400

View on NVD

]]> [Medium] CVE-2026-39869 – The issue was addressed with improved memory handling. This issue is fixed in iO... https://nvd.nist.gov/vuln/detail/CVE-2026-39869 https://nvd.nist.gov/vuln/detail/CVE-2026-39869 Mon, 11 May 2026 21:18:59 +0000 Medium CVE-2026-39869

The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing an audio stream in a maliciously crafted media file may terminate the process.

CVSS: 4.3 · CWE: CWE-120

View on NVD

]]> [Medium] CVE-2026-28996 – A race condition was addressed with additional validation. This issue is fixed i... https://nvd.nist.gov/vuln/detail/CVE-2026-28996 https://nvd.nist.gov/vuln/detail/CVE-2026-28996 Mon, 11 May 2026 21:18:59 +0000 Medium CVE-2026-28996

A race condition was addressed with additional validation. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to access sensitive user data.

CVSS: 5.5 · CWE: CWE-362

View on NVD

]]> [High] CVE-2026-28995 – A logic issue was addressed with improved restrictions. This issue is fixed in i... https://nvd.nist.gov/vuln/detail/CVE-2026-28995 https://nvd.nist.gov/vuln/detail/CVE-2026-28995 Mon, 11 May 2026 21:18:59 +0000 High CVE-2026-28995

A logic issue was addressed with improved restrictions. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. A malicious app may be able to break out of its sandbox.

CVSS: 8.8 · CWE: CWE-269

View on NVD

]]> [Medium] CVE-2026-28994 – A use after free issue was addressed with improved memory management. This issue... https://nvd.nist.gov/vuln/detail/CVE-2026-28994 https://nvd.nist.gov/vuln/detail/CVE-2026-28994 Mon, 11 May 2026 21:18:59 +0000 Medium CVE-2026-28994

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets.

CVSS: 5.3 · CWE: CWE-416

View on NVD

]]> [Medium] CVE-2026-28993 – This issue was addressed by adding an additional prompt for user consent. This i... https://nvd.nist.gov/vuln/detail/CVE-2026-28993 https://nvd.nist.gov/vuln/detail/CVE-2026-28993 Mon, 11 May 2026 21:18:59 +0000 Medium CVE-2026-28993

This issue was addressed by adding an additional prompt for user consent. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, visionOS 26.5. An app may be able to access user-sensitive data.

CVSS: 5.5 · CWE: CWE-284

View on NVD

]]> [Medium] CVE-2026-28992 – A memory corruption vulnerability was addressed with improved locking. This issu... https://nvd.nist.gov/vuln/detail/CVE-2026-28992 https://nvd.nist.gov/vuln/detail/CVE-2026-28992 Mon, 11 May 2026 21:18:59 +0000 Medium CVE-2026-28992

A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An attacker may be able to cause unexpected app termination.

CVSS: 4.7 · CWE: CWE-362

View on NVD

]]> [High] CVE-2026-28991 – An out-of-bounds read was addressed with improved bounds checking. This issue is... https://nvd.nist.gov/vuln/detail/CVE-2026-28991 https://nvd.nist.gov/vuln/detail/CVE-2026-28991 Mon, 11 May 2026 21:18:59 +0000 High CVE-2026-28991

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to cause a denial-of-service.

CVSS: 7.5 · CWE: CWE-125

View on NVD

]]> [High] CVE-2026-28990 – The issue was addressed with improved memory handling. This issue is fixed in iO... https://nvd.nist.gov/vuln/detail/CVE-2026-28990 https://nvd.nist.gov/vuln/detail/CVE-2026-28990 Mon, 11 May 2026 21:18:58 +0000 High CVE-2026-28990

The issue was addressed with improved memory handling. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing a maliciously crafted image may corrupt process memory.

CVSS: 7.5 · CWE: CWE-119

View on NVD

]]> [Medium] CVE-2026-28988 – A permissions issue was addressed with additional restrictions. This issue is fi... https://nvd.nist.gov/vuln/detail/CVE-2026-28988 https://nvd.nist.gov/vuln/detail/CVE-2026-28988 Mon, 11 May 2026 21:18:58 +0000 Medium CVE-2026-28988

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, visionOS 26.5, watchOS 26.5. An app may be able to bypass certain Privacy preferences.

CVSS: 5.5 · CWE: CWE-284

View on NVD

]]> [High] CVE-2026-28987 – A logging issue was addressed with improved data redaction. This issue is fixed ... https://nvd.nist.gov/vuln/detail/CVE-2026-28987 https://nvd.nist.gov/vuln/detail/CVE-2026-28987 Mon, 11 May 2026 21:18:58 +0000 High CVE-2026-28987

A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. An app may be able to leak sensitive kernel state.

CVSS: 7.5 · CWE: CWE-532

View on NVD

]]> [High] CVE-2026-28986 – A race condition was addressed with additional validation. This issue is fixed i... https://nvd.nist.gov/vuln/detail/CVE-2026-28986 https://nvd.nist.gov/vuln/detail/CVE-2026-28986 Mon, 11 May 2026 21:18:58 +0000 High CVE-2026-28986

A race condition was addressed with additional validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. An app may be able to cause unexpected system termination.

CVSS: 7.5 · CWE: CWE-362

View on NVD

]]> [Medium] CVE-2026-28985 – A null pointer dereference was addressed with improved input validation. This is... https://nvd.nist.gov/vuln/detail/CVE-2026-28985 https://nvd.nist.gov/vuln/detail/CVE-2026-28985 Mon, 11 May 2026 21:18:58 +0000 Medium CVE-2026-28985

A null pointer dereference was addressed with improved input validation. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5. An attacker on the local network may be able to cause a denial-of-service.

CVSS: 6.2 · CWE: CWE-476

View on NVD

]]> [High] CVE-2026-28983 – A type confusion issue was addressed with improved checks. This issue is fixed i... https://nvd.nist.gov/vuln/detail/CVE-2026-28983 https://nvd.nist.gov/vuln/detail/CVE-2026-28983 Mon, 11 May 2026 21:18:58 +0000 High CVE-2026-28983

A type confusion issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. A remote attacker may be able to cause a denial of service.

CVSS: 7.5 · CWE: CWE-843

View on NVD

]]> [Medium] CVE-2026-28977 – The issue was addressed with improved bounds checks. This issue is fixed in iOS ... https://nvd.nist.gov/vuln/detail/CVE-2026-28977 https://nvd.nist.gov/vuln/detail/CVE-2026-28977 Mon, 11 May 2026 21:18:58 +0000 Medium CVE-2026-28977

The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing a maliciously crafted file may lead to unexpected app termination.

CVSS: 6.2 · CWE: CWE-119

View on NVD

]]> [High] CVE-2026-28974 – This issue was addressed with improved checks to prevent unauthorized actions. T... https://nvd.nist.gov/vuln/detail/CVE-2026-28974 https://nvd.nist.gov/vuln/detail/CVE-2026-28974 Mon, 11 May 2026 21:18:58 +0000 High CVE-2026-28974

This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to cause a denial-of-service.

CVSS: 7.5 · CWE: CWE-284

View on NVD

]]> [Medium] CVE-2026-28972 – An out-of-bounds write issue was addressed with improved input validation. This ... https://nvd.nist.gov/vuln/detail/CVE-2026-28972 https://nvd.nist.gov/vuln/detail/CVE-2026-28972 Mon, 11 May 2026 21:18:57 +0000 Medium CVE-2026-28972

An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to cause unexpected system termination or write kernel memory.

CVSS: 6.5 · CWE: CWE-787

View on NVD

]]> [Medium] CVE-2026-28971 – The issue was addressed with improved UI handling. This issue is fixed in Safari... https://nvd.nist.gov/vuln/detail/CVE-2026-28971 https://nvd.nist.gov/vuln/detail/CVE-2026-28971 Mon, 11 May 2026 21:18:57 +0000 Medium CVE-2026-28971

The issue was addressed with improved UI handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, visionOS 26.5. A malicious iframe may use another website’s download settings.

CVSS: 4.3 · CWE: CWE-1021

View on NVD

]]> [High] CVE-2026-28969 – A use after free issue was addressed with improved memory management. This issue... https://nvd.nist.gov/vuln/detail/CVE-2026-28969 https://nvd.nist.gov/vuln/detail/CVE-2026-28969 Mon, 11 May 2026 21:18:57 +0000 High CVE-2026-28969

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to cause unexpected system termination.

CVSS: 7.5 · CWE: CWE-416

View on NVD

]]> [Medium] CVE-2026-28967 – A denial-of-service issue was addressed with improved input validation. This iss... https://nvd.nist.gov/vuln/detail/CVE-2026-28967 https://nvd.nist.gov/vuln/detail/CVE-2026-28967 Mon, 11 May 2026 21:18:57 +0000 Medium CVE-2026-28967

A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4. An attacker in a privileged network position may be able to cause a denial-of-service.

CVSS: 4.9 · CWE: CWE-400

View on NVD

]]> [High] CVE-2026-28965 – A privacy issue was addressed with improved checks. This issue is fixed in iOS 2... https://nvd.nist.gov/vuln/detail/CVE-2026-28965 https://nvd.nist.gov/vuln/detail/CVE-2026-28965 Mon, 11 May 2026 21:18:57 +0000 High CVE-2026-28965

A privacy issue was addressed with improved checks. This issue is fixed in iOS 26.5 and iPadOS 26.5. A user may be able to view restricted content from the lock screen.

CVSS: 7.5 · CWE: CWE-284

View on NVD

]]> [High] CVE-2026-28964 – An inconsistent user interface issue was addressed with improved state managemen... https://nvd.nist.gov/vuln/detail/CVE-2026-28964 https://nvd.nist.gov/vuln/detail/CVE-2026-28964 Mon, 11 May 2026 21:18:57 +0000 High CVE-2026-28964

An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 26.5 and iPadOS 26.5, visionOS 26.5. An app may be able to access sensitive user data.

CVSS: 7.5 · CWE: CWE-451

View on NVD

]]> [Medium] CVE-2026-28963 – A privacy issue was addressed by removing the vulnerable code. This issue is fix... https://nvd.nist.gov/vuln/detail/CVE-2026-28963 https://nvd.nist.gov/vuln/detail/CVE-2026-28963 Mon, 11 May 2026 21:18:57 +0000 Medium CVE-2026-28963

A privacy issue was addressed by removing the vulnerable code. This issue is fixed in iOS 26.5 and iPadOS 26.5. An attacker with physical access may be able to use Visual Intelligence to access sensitive user data during iPhone Mirroring.

CVSS: 4.6 · CWE: CWE-359

View on NVD

]]> [High] CVE-2026-28962 – This issue was addressed with improved access restrictions. This issue is fixed ... https://nvd.nist.gov/vuln/detail/CVE-2026-28962 https://nvd.nist.gov/vuln/detail/CVE-2026-28962 Mon, 11 May 2026 21:18:57 +0000 High CVE-2026-28962

This issue was addressed with improved access restrictions. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, visionOS 26.5. Processing maliciously crafted web content may disclose sensitive user information.

CVSS: 7.5 · CWE: CWE-200

View on NVD

]]> [High] CVE-2026-28959 – A buffer overflow was addressed with improved bounds checking. This issue is fix... https://nvd.nist.gov/vuln/detail/CVE-2026-28959 https://nvd.nist.gov/vuln/detail/CVE-2026-28959 Mon, 11 May 2026 21:18:56 +0000 High CVE-2026-28959

A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to cause unexpected system termination.

CVSS: 7.5 · CWE: CWE-120

View on NVD

]]> [Medium] CVE-2026-28958 – This issue was addressed with improved data protection. This issue is fixed in S... https://nvd.nist.gov/vuln/detail/CVE-2026-28958 https://nvd.nist.gov/vuln/detail/CVE-2026-28958 Mon, 11 May 2026 21:18:56 +0000 Medium CVE-2026-28958

This issue was addressed with improved data protection. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, visionOS 26.5. An app may be able to access sensitive user data.

CVSS: 5.5 · CWE: CWE-200

View on NVD

]]> [Low] CVE-2026-28957 – An issue with app access to camera metadata was addressed with improved logic. T... https://nvd.nist.gov/vuln/detail/CVE-2026-28957 https://nvd.nist.gov/vuln/detail/CVE-2026-28957 Mon, 11 May 2026 21:18:56 +0000 Low CVE-2026-28957

An issue with app access to camera metadata was addressed with improved logic. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, visionOS 26.5. An app may be able to capture a user's screen.

CVSS: 3.3 · CWE: CWE-284

View on NVD

]]> [Medium] CVE-2026-28956 – A memory corruption issue was addressed with improved input validation. This iss... https://nvd.nist.gov/vuln/detail/CVE-2026-28956 https://nvd.nist.gov/vuln/detail/CVE-2026-28956 Mon, 11 May 2026 21:18:56 +0000 Medium CVE-2026-28956

A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory.

CVSS: 6.5 · CWE: CWE-125

View on NVD

]]> [High] CVE-2026-28955 – The issue was addressed with improved memory handling. This issue is fixed in Sa... https://nvd.nist.gov/vuln/detail/CVE-2026-28955 https://nvd.nist.gov/vuln/detail/CVE-2026-28955 Mon, 11 May 2026 21:18:56 +0000 High CVE-2026-28955

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS: 8.8 · CWE: CWE-119

View on NVD

]]> [High] CVE-2026-28954 – A file quarantine bypass was addressed with additional checks. This issue is fix... https://nvd.nist.gov/vuln/detail/CVE-2026-28954 https://nvd.nist.gov/vuln/detail/CVE-2026-28954 Mon, 11 May 2026 21:18:56 +0000 High CVE-2026-28954

A file quarantine bypass was addressed with additional checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. A maliciously crafted disk image may bypass Gatekeeper checks.

CVSS: 7.5 · CWE: CWE-290

View on NVD

]]> [High] CVE-2026-28953 – The issue was addressed with improved memory handling. This issue is fixed in Sa... https://nvd.nist.gov/vuln/detail/CVE-2026-28953 https://nvd.nist.gov/vuln/detail/CVE-2026-28953 Mon, 11 May 2026 21:18:56 +0000 High CVE-2026-28953

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS: 7.5 · CWE: CWE-119

View on NVD

]]> [High] CVE-2026-28952 – An integer overflow was addressed with improved input validation. This issue is ... https://nvd.nist.gov/vuln/detail/CVE-2026-28952 https://nvd.nist.gov/vuln/detail/CVE-2026-28952 Mon, 11 May 2026 21:18:56 +0000 High CVE-2026-28952

An integer overflow was addressed with improved input validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to cause unexpected system termination.

CVSS: 7.5 · CWE: CWE-190

View on NVD

]]> [High] CVE-2026-28951 – An authorization issue was addressed with improved state management. This issue ... https://nvd.nist.gov/vuln/detail/CVE-2026-28951 https://nvd.nist.gov/vuln/detail/CVE-2026-28951 Mon, 11 May 2026 21:18:56 +0000 High CVE-2026-28951

An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to gain root privileges.

CVSS: 7.8 · CWE: CWE-863

View on NVD

]]> [High] CVE-2026-28947 – A use-after-free issue was addressed with improved memory management. This issue... https://nvd.nist.gov/vuln/detail/CVE-2026-28947 https://nvd.nist.gov/vuln/detail/CVE-2026-28947 Mon, 11 May 2026 21:18:55 +0000 High CVE-2026-28947

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.

CVSS: 8.8 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-28944 – The issue was addressed with improved memory handling. This issue is fixed in Sa... https://nvd.nist.gov/vuln/detail/CVE-2026-28944 https://nvd.nist.gov/vuln/detail/CVE-2026-28944 Mon, 11 May 2026 21:18:55 +0000 High CVE-2026-28944

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, visionOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS: 7.5 · CWE: CWE-119

View on NVD

]]> [High] CVE-2026-28943 – A logging issue was addressed with improved data redaction. This issue is fixed ... https://nvd.nist.gov/vuln/detail/CVE-2026-28943 https://nvd.nist.gov/vuln/detail/CVE-2026-28943 Mon, 11 May 2026 21:18:55 +0000 High CVE-2026-28943

A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. An app may be able to determine kernel memory layout.

CVSS: 7.5 · CWE: CWE-532

View on NVD

]]> [Medium] CVE-2026-28942 – A use-after-free issue was addressed with improved memory management. This issue... https://nvd.nist.gov/vuln/detail/CVE-2026-28942 https://nvd.nist.gov/vuln/detail/CVE-2026-28942 Mon, 11 May 2026 21:18:55 +0000 Medium CVE-2026-28942

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.

CVSS: 6.5 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-28941 – The issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 ... https://nvd.nist.gov/vuln/detail/CVE-2026-28941 https://nvd.nist.gov/vuln/detail/CVE-2026-28941 Mon, 11 May 2026 21:18:55 +0000 High CVE-2026-28941

The issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Tahoe 26.5. Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents.

CVSS: 7.1 · CWE: CWE-119

View on NVD

]]> [High] CVE-2026-28940 – The issue was addressed with improved memory handling. This issue is fixed in iO... https://nvd.nist.gov/vuln/detail/CVE-2026-28940 https://nvd.nist.gov/vuln/detail/CVE-2026-28940 Mon, 11 May 2026 21:18:55 +0000 High CVE-2026-28940

The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5. Processing a maliciously crafted image may corrupt process memory.

CVSS: 8.8 · CWE: CWE-119

View on NVD

]]> [High] CVE-2026-28936 – The issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 ... https://nvd.nist.gov/vuln/detail/CVE-2026-28936 https://nvd.nist.gov/vuln/detail/CVE-2026-28936 Mon, 11 May 2026 21:18:55 +0000 High CVE-2026-28936

The issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sonoma 14.8.7, macOS Tahoe 26.5, visionOS 26.5. Processing a maliciously crafted file may lead to unexpected app termination.

CVSS: 7.5 · CWE: CWE-20

View on NVD

]]> [High] CVE-2026-28929 – A logic issue was addressed with improved checks. This issue is fixed in iOS 18... https://nvd.nist.gov/vuln/detail/CVE-2026-28929 https://nvd.nist.gov/vuln/detail/CVE-2026-28929 Mon, 11 May 2026 21:18:54 +0000 High CVE-2026-28929

A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. Replying to an email could display remote images in Mail in Lockdown Mode.

CVSS: 7.5 · CWE: CWE-1254

View on NVD

]]> [Medium] CVE-2026-28920 – An information leakage was addressed with additional validation. This issue is f... https://nvd.nist.gov/vuln/detail/CVE-2026-28920 https://nvd.nist.gov/vuln/detail/CVE-2026-28920 Mon, 11 May 2026 21:18:54 +0000 Medium CVE-2026-28920

An information leakage was addressed with additional validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Visiting a maliciously crafted website may leak sensitive data.

CVSS: 6.5 · CWE: CWE-200

View on NVD

]]> [Medium] CVE-2026-28918 – An out-of-bounds access issue was addressed with improved bounds checking. This ... https://nvd.nist.gov/vuln/detail/CVE-2026-28918 https://nvd.nist.gov/vuln/detail/CVE-2026-28918 Mon, 11 May 2026 21:18:54 +0000 Medium CVE-2026-28918

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Parsing a maliciously crafted file may lead to an unexpected app termination.

CVSS: 6.5 · CWE: CWE-125

View on NVD

]]> [Medium] CVE-2026-28917 – The issue was addressed with improved input validation. This issue is fixed in S... https://nvd.nist.gov/vuln/detail/CVE-2026-28917 https://nvd.nist.gov/vuln/detail/CVE-2026-28917 Mon, 11 May 2026 21:18:54 +0000 Medium CVE-2026-28917

The issue was addressed with improved input validation. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS: 4.3 · CWE: CWE-20

View on NVD

]]> [High] CVE-2026-28913 – The issue was addressed with improved memory handling. This issue is fixed in Sa... https://nvd.nist.gov/vuln/detail/CVE-2026-28913 https://nvd.nist.gov/vuln/detail/CVE-2026-28913 Mon, 11 May 2026 21:18:53 +0000 High CVE-2026-28913

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS: 7.5 · CWE: CWE-119

View on NVD

]]> [High] CVE-2026-28907 – The issue was addressed with improved input validation. This issue is fixed in S... https://nvd.nist.gov/vuln/detail/CVE-2026-28907 https://nvd.nist.gov/vuln/detail/CVE-2026-28907 Mon, 11 May 2026 21:18:53 +0000 High CVE-2026-28907

The issue was addressed with improved input validation. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.

CVSS: 8.1 · CWE: CWE-20

View on NVD

]]> [High] CVE-2026-28906 – This issue was addressed through improved state management. This issue is fixed ... https://nvd.nist.gov/vuln/detail/CVE-2026-28906 https://nvd.nist.gov/vuln/detail/CVE-2026-28906 Mon, 11 May 2026 21:18:53 +0000 High CVE-2026-28906

This issue was addressed through improved state management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, visionOS 26.5. An attacker may be able to track users through their IP address.

CVSS: 7.5 · CWE: CWE-359

View on NVD

]]> [High] CVE-2026-28905 – The issue was addressed with improved memory handling. This issue is fixed in Sa... https://nvd.nist.gov/vuln/detail/CVE-2026-28905 https://nvd.nist.gov/vuln/detail/CVE-2026-28905 Mon, 11 May 2026 21:18:53 +0000 High CVE-2026-28905

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS: 7.5 · CWE: CWE-119

View on NVD

]]> [High] CVE-2026-28904 – The issue was addressed with improved memory handling. This issue is fixed in Sa... https://nvd.nist.gov/vuln/detail/CVE-2026-28904 https://nvd.nist.gov/vuln/detail/CVE-2026-28904 Mon, 11 May 2026 21:18:53 +0000 High CVE-2026-28904

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS: 7.5 · CWE: CWE-119

View on NVD

]]> [Medium] CVE-2026-28903 – The issue was addressed with improved memory handling. This issue is fixed in Sa... https://nvd.nist.gov/vuln/detail/CVE-2026-28903 https://nvd.nist.gov/vuln/detail/CVE-2026-28903 Mon, 11 May 2026 21:18:53 +0000 Medium CVE-2026-28903

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS: 6.5 · CWE: CWE-119

View on NVD

]]> [Medium] CVE-2026-28902 – The issue was addressed with improved memory handling. This issue is fixed in Sa... https://nvd.nist.gov/vuln/detail/CVE-2026-28902 https://nvd.nist.gov/vuln/detail/CVE-2026-28902 Mon, 11 May 2026 21:18:53 +0000 Medium CVE-2026-28902

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS: 6.5 · CWE: CWE-119

View on NVD

]]> [Medium] CVE-2026-28901 – The issue was addressed with improved memory handling. This issue is fixed in Sa... https://nvd.nist.gov/vuln/detail/CVE-2026-28901 https://nvd.nist.gov/vuln/detail/CVE-2026-28901 Mon, 11 May 2026 21:18:52 +0000 Medium CVE-2026-28901

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS: 4.3 · CWE: CWE-119

View on NVD

]]> [Medium] CVE-2026-28897 – A buffer overflow was addressed with improved input validation. This issue is fi... https://nvd.nist.gov/vuln/detail/CVE-2026-28897 https://nvd.nist.gov/vuln/detail/CVE-2026-28897 Mon, 11 May 2026 21:18:52 +0000 Medium CVE-2026-28897

A buffer overflow was addressed with improved input validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. A local user may be able to cause unexpected system termination or read kernel memory.

CVSS: 6.2 · CWE: CWE-121

View on NVD

]]> [High] CVE-2026-28883 – A use-after-free issue was addressed with improved memory management. This issue... https://nvd.nist.gov/vuln/detail/CVE-2026-28883 https://nvd.nist.gov/vuln/detail/CVE-2026-28883 Mon, 11 May 2026 21:18:52 +0000 High CVE-2026-28883

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS: 7.5 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-28873 – This issue was addressed with additional entitlement checks. This issue is fixed... https://nvd.nist.gov/vuln/detail/CVE-2026-28873 https://nvd.nist.gov/vuln/detail/CVE-2026-28873 Mon, 11 May 2026 21:18:52 +0000 High CVE-2026-28873

This issue was addressed with additional entitlement checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.4 and iPadOS 26.4. An app may be able to circumvent App Privacy Report logging.

CVSS: 7.5 · CWE: CWE-863

View on NVD

]]> [High] CVE-2026-28872 – A resource exhaustion issue was addressed with improved input validation. This i... https://nvd.nist.gov/vuln/detail/CVE-2026-28872 https://nvd.nist.gov/vuln/detail/CVE-2026-28872 Mon, 11 May 2026 21:18:51 +0000 High CVE-2026-28872

A resource exhaustion issue was addressed with improved input validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.4 and iPadOS 26.4. A remote attacker may be able to cause a denial-of-service.

CVSS: 7.5 · CWE: CWE-400

View on NVD

]]> [High] CVE-2026-28860 – The issue was addressed with improved input validation. This issue is fixed in i... https://nvd.nist.gov/vuln/detail/CVE-2026-28860 https://nvd.nist.gov/vuln/detail/CVE-2026-28860 Mon, 11 May 2026 21:18:51 +0000 High CVE-2026-28860

The issue was addressed with improved input validation. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. A local attacker may be able to modify the state of the Keychain.

CVSS: 7.5 · CWE: CWE-20

View on NVD

]]> [High] CVE-2026-28847 – The issue was addressed with improved memory handling. This issue is fixed in Sa... https://nvd.nist.gov/vuln/detail/CVE-2026-28847 https://nvd.nist.gov/vuln/detail/CVE-2026-28847 Mon, 11 May 2026 21:18:51 +0000 High CVE-2026-28847

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS: 8.8 · CWE: CWE-119

View on NVD

]]> [High] CVE-2026-28846 – A buffer overflow was addressed with improved bounds checking. This issue is fix... https://nvd.nist.gov/vuln/detail/CVE-2026-28846 https://nvd.nist.gov/vuln/detail/CVE-2026-28846 Mon, 11 May 2026 21:18:51 +0000 High CVE-2026-28846

A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. A remote attacker may be able to cause unexpected app termination.

CVSS: 7.5 · CWE: CWE-121

View on NVD

]]> [Medium] CVE-2026-28819 – An out-of-bounds write issue was addressed with improved bounds checking. This i... https://nvd.nist.gov/vuln/detail/CVE-2026-28819 https://nvd.nist.gov/vuln/detail/CVE-2026-28819 Mon, 11 May 2026 21:18:50 +0000 Medium CVE-2026-28819

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to execute arbitrary code with kernel privileges.

CVSS: 5.4 · CWE: CWE-787

View on NVD

]]> [High] CVE-2021-47944 – memono Notepad 4.2 contains a denial of service vulnerability that allows attack... https://nvd.nist.gov/vuln/detail/CVE-2021-47944 https://nvd.nist.gov/vuln/detail/CVE-2021-47944 Sun, 10 May 2026 13:16:30 +0000 High CVE-2021-47944

memono Notepad 4.2 contains a denial of service vulnerability that allows attackers to crash the application by pasting excessively long character buffers into note fields. Attackers can generate a payload containing 350000 repeated characters and paste it twice into a new note to trigger an application crash on iOS devices.

CVSS: 7.5 · CWE: CWE-789

View on NVD

]]> [High] CVE-2026-7957 – Out of bounds write in Media in Google Chrome on Mac, iOS prior to 148.0.7778.96... https://nvd.nist.gov/vuln/detail/CVE-2026-7957 https://nvd.nist.gov/vuln/detail/CVE-2026-7957 Wed, 06 May 2026 19:16:44 +0000 High CVE-2026-7957

Out of bounds write in Media in Google Chrome on Mac, iOS prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVSS: 8.8 · CWE: CWE-787

View on NVD

]]> [Medium] CVE-2026-7931 – Insufficient validation of untrusted input in iOS in Google Chrome on iOS prior ... https://nvd.nist.gov/vuln/detail/CVE-2026-7931 https://nvd.nist.gov/vuln/detail/CVE-2026-7931 Wed, 06 May 2026 19:16:41 +0000 Medium CVE-2026-7931

Insufficient validation of untrusted input in iOS in Google Chrome on iOS prior to 148.0.7778.96 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

CVSS: 5.4 · CWE: CWE-20

View on NVD

]]> [High] CVE-2026-7897 – Use after free in Mobile in Google Chrome on iOS prior to 148.0.7778.96 allowed ... https://nvd.nist.gov/vuln/detail/CVE-2026-7897 https://nvd.nist.gov/vuln/detail/CVE-2026-7897 Wed, 06 May 2026 19:16:37 +0000 High CVE-2026-7897

Use after free in Mobile in Google Chrome on iOS prior to 148.0.7778.96 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

CVSS: 7.5 · CWE: CWE-416

View on NVD

]]> [Critical] CVE-2026-42090 – Notesnook is a note-taking app focused on user privacy & ease of use. Prior to N... https://nvd.nist.gov/vuln/detail/CVE-2026-42090 https://nvd.nist.gov/vuln/detail/CVE-2026-42090 Mon, 04 May 2026 17:16:25 +0000 Critical CVE-2026-42090

Notesnook is a note-taking app focused on user privacy & ease of use. Prior to Notesnook Web/Desktop version 3.3.15 and prior to Notesnook iOS/Android version 3.3.20, a stored XSS vulnerability in the note export flow can be escalated to remote code execution in the desktop app. The root cause is that exported note fields such as title, headline, and content are inserted into the generated HTML t…

CVSS: 9.6 · CWE: CWE-79

View on NVD

]]> [Low] CVE-2026-7671 – A vulnerability has been found in CodeWise Tornet Scooter Mobile App 4.75 on iOS... https://nvd.nist.gov/vuln/detail/CVE-2026-7671 https://nvd.nist.gov/vuln/detail/CVE-2026-7671 Sun, 03 May 2026 00:16:16 +0000 Low CVE-2026-7671

A vulnerability has been found in CodeWise Tornet Scooter Mobile App 4.75 on iOS/Android. The impacted element is an unknown function of the file /TwoFactor. Such manipulation leads to improper restriction of excessive authentication attempts. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is regarded as difficult. The exploit has been discl…

CVSS: 3.7 · CWE: CWE-307

View on NVD

]]> [Medium] CVE-2026-7638 – The App Builder – Create Native Android & iOS Apps On The Flight plugin for Word... https://nvd.nist.gov/vuln/detail/CVE-2026-7638 https://nvd.nist.gov/vuln/detail/CVE-2026-7638 Sat, 02 May 2026 04:16:23 +0000 Medium CVE-2026-7638

The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to and including 5.6.0. This is due to missing authorization validation in the `upload_avatar()` function, which accepts an attacker-controlled `user_id` parameter from the POST request body and uses it to update user meta without verifying th…

CVSS: 5.3 · CWE: CWE-639

View on NVD

]]>