CVE Daily – Apple macOS https://cvedaily.com/pages/tags/macos.html CVE Daily – Apple macOS en Wed, 03 Jun 2026 21:26:40 +0000 [Medium] CVE-2026-6892 – Improper handling of symbolic links in the installer of CUPS Printer Driver for ... https://nvd.nist.gov/vuln/detail/CVE-2026-6892 https://nvd.nist.gov/vuln/detail/CVE-2026-6892 Fri, 29 May 2026 00:16:16 +0000 Medium CVE-2026-6892

Improper handling of symbolic links in the installer of CUPS Printer Driver for macOS(*) may allow a local attacker with login privileges to exploit a specially crafted symbolic link during installation to modify permissions of directories for which they would not normally have authorization.  *:Canon PIXUS iX6800 Series CUPS Printer Driver for macOS Version 16.91.0.0 or earlier (Japan) Canon P…

CVSS: 5.0 · CWE: CWE-59

View on NVD

]]> [Medium] CVE-2026-6891 – Improper handling of symbolic links in the installer of My Image Garden for macO... https://nvd.nist.gov/vuln/detail/CVE-2026-6891 https://nvd.nist.gov/vuln/detail/CVE-2026-6891 Fri, 29 May 2026 00:16:15 +0000 Medium CVE-2026-6891

Improper handling of symbolic links in the installer of My Image Garden for macOS Version 3.6.8 or earlier may allow a local attacker with login privileges to exploit a specially crafted symbolic link during installation to modify permissions of files for which they would not normally have authorization.

CVSS: 5.0 · CWE: CWE-59

View on NVD

]]> [High] CVE-2026-49237 – An issue was discovered in Canonical Multipass for macOS before version 1.16.3 d... https://nvd.nist.gov/vuln/detail/CVE-2026-49237 https://nvd.nist.gov/vuln/detail/CVE-2026-49237 Thu, 28 May 2026 14:16:24 +0000 High CVE-2026-49237

An issue was discovered in Canonical Multipass for macOS before version 1.16.3 due to an incomplete fix for CVE-2025-5199. While the patch in version 1.16.0 updated the ownership of the multipassd daemon binary to root:wheel, five co-located binaries (multipass, qemu-img, qemu-system-aarch64, qemu-system-x86_64, and sshfs_server) in /Library/Application Support/com.canonical.multipass/bin/ retain…

CVSS: 7.8 · CWE: CWE-276

View on NVD

]]> [Medium] CVE-2025-46307 – A logic issue was addressed with improved restrictions. This issue is fixed in m... https://nvd.nist.gov/vuln/detail/CVE-2025-46307 https://nvd.nist.gov/vuln/detail/CVE-2025-46307 Tue, 26 May 2026 22:16:41 +0000 Medium CVE-2025-46307

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Tahoe 26. An app may be able to access sensitive user data.

CVSS: 5.5 · CWE: CWE-284

View on NVD

]]> [High] CVE-2025-46284 – A race condition was addressed with additional validation. This issue is fixed i... https://nvd.nist.gov/vuln/detail/CVE-2025-46284 https://nvd.nist.gov/vuln/detail/CVE-2025-46284 Tue, 26 May 2026 22:16:41 +0000 High CVE-2025-46284

A race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.7, macOS Tahoe 26. An app may be able to gain root privileges.

CVSS: 7.0 · CWE: CWE-362

View on NVD

]]> [Medium] CVE-2025-46280 – An out-of-bounds read was addressed with improved bounds checking. This issue is... https://nvd.nist.gov/vuln/detail/CVE-2025-46280 https://nvd.nist.gov/vuln/detail/CVE-2025-46280 Tue, 26 May 2026 22:16:41 +0000 Medium CVE-2025-46280

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Tahoe 26. An app may be able to cause unexpected system termination.

CVSS: 5.5 · CWE: CWE-125

View on NVD

]]> [Medium] CVE-2025-43451 – A permissions issue was addressed by removing the vulnerable code. This issue is... https://nvd.nist.gov/vuln/detail/CVE-2025-43451 https://nvd.nist.gov/vuln/detail/CVE-2025-43451 Tue, 26 May 2026 22:16:41 +0000 Medium CVE-2025-43451

A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Tahoe 26. An app may be able to access sensitive user data.

CVSS: 5.5 · CWE: CWE-284

View on NVD

]]> [High] CVE-2025-43306 – A logic issue was addressed with improved checks. This issue is fixed in macOS S... https://nvd.nist.gov/vuln/detail/CVE-2025-43306 https://nvd.nist.gov/vuln/detail/CVE-2025-43306 Tue, 26 May 2026 22:16:40 +0000 High CVE-2025-43306

A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. A malicious app may be able to gain root privileges.

CVSS: 7.8 · CWE: CWE-269

View on NVD

]]> [Medium] CVE-2025-43290 – A permissions issue was addressed with additional restrictions. This issue is fi... https://nvd.nist.gov/vuln/detail/CVE-2025-43290 https://nvd.nist.gov/vuln/detail/CVE-2025-43290 Tue, 26 May 2026 22:16:40 +0000 Medium CVE-2025-43290

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app may be able to modify protected parts of the file system.

CVSS: 5.5 · CWE: CWE-732

View on NVD

]]> [Medium] CVE-2025-43289 – A logic issue was addressed with improved validation. This issue is fixed in mac... https://nvd.nist.gov/vuln/detail/CVE-2025-43289 https://nvd.nist.gov/vuln/detail/CVE-2025-43289 Tue, 26 May 2026 22:16:40 +0000 Medium CVE-2025-43289

A logic issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. A malicious app may be able to access sensitive user data.

CVSS: 5.5 · CWE: CWE-285

View on NVD

]]> [High] CVE-2026-9560 – Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8... https://nvd.nist.gov/vuln/detail/CVE-2026-9560 https://nvd.nist.gov/vuln/detail/CVE-2026-9560 Tue, 26 May 2026 18:16:58 +0000 High CVE-2026-9560

Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS allows attackers to execute arbitrary commands with elevated privileges via local IPC channel

CVSS: 7.8 · CWE: CWE-78

View on NVD

]]> [Medium] CVE-2026-46430 – Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, the SSE ... https://nvd.nist.gov/vuln/detail/CVE-2026-46430 https://nvd.nist.gov/vuln/detail/CVE-2026-46430 Tue, 26 May 2026 17:16:50 +0000 Medium CVE-2026-46430

Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, the SSE event server bound to 0.0.0.0:5553 on Linux/macOS by default because the platform-dependent host default in engine/flags.go:39-46 set host = "" for non-Windows, and utils.JoinHostPort("", ":5553") resolves to ":5553". This vulnerability is fixed in 1.17.7.

CVSS: 4.3 · CWE: CWE-668

View on NVD

]]> [High] CVE-2026-5843 – The MLX inference backend in Docker Model Runner on macOS uses the MLX-LM librar... https://nvd.nist.gov/vuln/detail/CVE-2026-5843 https://nvd.nist.gov/vuln/detail/CVE-2026-5843 Fri, 22 May 2026 20:16:35 +0000 High CVE-2026-5843

The MLX inference backend in Docker Model Runner on macOS uses the MLX-LM library, which unconditionally imports and executes arbitrary Python files from model directories via the model_file configuration field in config.json. When a model's config.json specifies a model_file pointing to a Python file, MLX-LM uses importlib to load and execute it with no trust_remote_code gate or equivalent safet…

CVSS: 8.2 · CWE: CWE-829

View on NVD

]]> [High] CVE-2026-5817 – The vllm-metal inference backend in Docker Model Runner on macOS unconditionally... https://nvd.nist.gov/vuln/detail/CVE-2026-5817 https://nvd.nist.gov/vuln/detail/CVE-2026-5817 Fri, 22 May 2026 20:16:35 +0000 High CVE-2026-5817

The vllm-metal inference backend in Docker Model Runner on macOS unconditionally sets trust_remote_code=True when loading model tokenizers, and runs without sandboxing. This causes transformers.AutoTokenizer.from_pretrained() to import and execute arbitrary Python files included in any model pulled from an OCI registry, resulting in arbitrary code execution on the Docker host as the Docker Deskto…

CVSS: 8.2 · CWE: CWE-829

View on NVD

]]> [High] CVE-2026-47114 – IINA before 1.4.3 contains a user-assisted command execution vulnerability that ... https://nvd.nist.gov/vuln/detail/CVE-2026-47114 https://nvd.nist.gov/vuln/detail/CVE-2026-47114 Thu, 21 May 2026 20:16:14 +0000 High CVE-2026-47114

IINA before 1.4.3 contains a user-assisted command execution vulnerability that allows remote attackers to execute arbitrary commands by supplying malicious mpv_-prefixed query parameters through the iina://open custom URL scheme handler. Attackers can deliver a crafted URL via a browser that passes unvalidated mpv_options/input-commands parameters into the mpv runtime, causing arbitrary command…

CVSS: 8.8 · CWE: CWE-88

View on NVD

]]> [Medium] CVE-2026-39309 – Trilium Notes is a cross-platform, hierarchical note taking application focused ... https://nvd.nist.gov/vuln/detail/CVE-2026-39309 https://nvd.nist.gov/vuln/detail/CVE-2026-39309 Wed, 20 May 2026 00:16:37 +0000 Medium CVE-2026-39309

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. In versions 0.102.1 and prior, the Electron configuration is vulnerable to TCC Bypass via Prompt Spoofing, allowing local attackers to trigger misleading macOS permission prompts by running malicious code under the identity of the trusted app. The root cause is that the RunA…

CVSS: 5.5 · CWE: CWE-290

View on NVD

]]> [High] CVE-2026-32323 – Mullvad VPN is a VPN client app for desktop and mobile. When using macOS with ve... https://nvd.nist.gov/vuln/detail/CVE-2026-32323 https://nvd.nist.gov/vuln/detail/CVE-2026-32323 Tue, 19 May 2026 02:16:14 +0000 High CVE-2026-32323

Mullvad VPN is a VPN client app for desktop and mobile. When using macOS with versions 2026.1 and below, Mullvad VPN may allow local privilege escalation during installation or upgrade. The installer package executes binaries from /Applications/Mullvad VPN.app without verifying if the bundle is attacker-controlled or that the path is the legitimate Mullvad application. A user in the admin group c…

CVSS: 7.3 · CWE: CWE-269

View on NVD

]]> [Critical] CVE-2026-26191 – Fleet is open source device management software. Prior to version 4.81.0, a vuln... https://nvd.nist.gov/vuln/detail/CVE-2026-26191 https://nvd.nist.gov/vuln/detail/CVE-2026-26191 Thu, 14 May 2026 20:17:02 +0000 Critical CVE-2026-26191

Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet's software installer pipeline could allow a crafted software package to execute arbitrary commands as root (macOS/Linux) or SYSTEM (Windows) on managed endpoints when an uninstall is triggered. When a software package (.pkg, .deb, .rpm, .exe, or .msi) is uploaded to Fleet, metadata is extracted from…

CVSS: 9.8 · CWE: CWE-78

View on NVD

]]> [Medium] CVE-2026-0251 – Multiple local privilege escalation vulnerabilities in the Palo Alto Networks Gl... https://nvd.nist.gov/vuln/detail/CVE-2026-0251 https://nvd.nist.gov/vuln/detail/CVE-2026-0251 Wed, 13 May 2026 19:16:59 +0000 Medium CVE-2026-0251

Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allow a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative privileges. The GlobalProtect app on iOS, Android, Chrome OS and GlobalProtect UWP app are not affect…

CVSS: 5.9 · CWE: CWE-426

View on NVD

]]> [Medium] CVE-2026-0248 – An improper certificate validation vulnerability in the Prisma Access Agent® for... https://nvd.nist.gov/vuln/detail/CVE-2026-0248 https://nvd.nist.gov/vuln/detail/CVE-2026-0248 Wed, 13 May 2026 19:16:58 +0000 Medium CVE-2026-0248

An improper certificate validation vulnerability in the Prisma Access Agent® for Android and Chrome OS enables an attacker to perform a man-in-the-middle (MitM) attack to intercept VPN traffic. By presenting a certificate for any domain issued by a trusted Certificate Authority, the attacker can capture sensitive device information. The Prisma Access Agent on macOS, Windows, Linux and iOS are…

CVSS: 6.2 · CWE: CWE-295

View on NVD

]]> [Medium] CVE-2026-0246 – A vulnerability with a privilege management mechanism in the Palo Alto Networks ... https://nvd.nist.gov/vuln/detail/CVE-2026-0246 https://nvd.nist.gov/vuln/detail/CVE-2026-0246 Wed, 13 May 2026 19:16:58 +0000 Medium CVE-2026-0246

A vulnerability with a privilege management mechanism in the Palo Alto Networks Prisma Access Agent® enables a locally authenticated non-administrative user to escalate their privileges to root on macOS and Linux or NT AUTHORITY\SYSTEM on Windows. This allows the user to execute arbitrary code and read sensitive information otherwise accessible only to privileged accounts. The Prisma Access Ag…

CVSS: 5.9 · CWE: CWE-862

View on NVD

]]> [High] CVE-2026-0236 – A code injection vulnerability in Palo Alto Networks Prisma® Browser on macOS fa... https://nvd.nist.gov/vuln/detail/CVE-2026-0236 https://nvd.nist.gov/vuln/detail/CVE-2026-0236 Wed, 13 May 2026 19:16:57 +0000 High CVE-2026-0236

A code injection vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to its AppleScript interface allowing a locally authenticated non-admin user to leverage this exposed Apple Event handler to send unauthorized commands to the browser.

CVSS: 7.3 · CWE: CWE-94

View on NVD

]]> [High] CVE-2026-0237 – An improper protection of alternate path vulnerability in Palo Alto Networks Pri... https://nvd.nist.gov/vuln/detail/CVE-2026-0237 https://nvd.nist.gov/vuln/detail/CVE-2026-0237 Wed, 13 May 2026 18:16:12 +0000 High CVE-2026-0237

An improper protection of alternate path vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to an internal automation bridge. This allows a locally authenticated non-admin user to leverage an exposed communication channel to send unauthorized commands to the browser, bypassing security controls.

CVSS: 7.3 · CWE: CWE-424

View on NVD

]]> [High] CVE-2025-43524 – An access issue was addressed with additional sandbox restrictions. This issue i... https://nvd.nist.gov/vuln/detail/CVE-2025-43524 https://nvd.nist.gov/vuln/detail/CVE-2025-43524 Tue, 12 May 2026 18:16:35 +0000 High CVE-2025-43524

An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.2. An app may be able to break out of its sandbox.

CVSS: 8.8 · CWE: CWE-284

View on NVD

]]> [High] CVE-2026-43668 – A use after free issue was addressed with improved memory management. This issue... https://nvd.nist.gov/vuln/detail/CVE-2026-43668 https://nvd.nist.gov/vuln/detail/CVE-2026-43668 Mon, 11 May 2026 21:19:02 +0000 High CVE-2026-43668

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. A remote attacker may be able to cause unexpected system termination or corrupt kernel memory.

CVSS: 7.5 · CWE: CWE-416

View on NVD

]]> [Medium] CVE-2026-43666 – An out-of-bounds write issue was addressed with improved bounds checking. This i... https://nvd.nist.gov/vuln/detail/CVE-2026-43666 https://nvd.nist.gov/vuln/detail/CVE-2026-43666 Mon, 11 May 2026 21:19:01 +0000 Medium CVE-2026-43666

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An attacker on the local network may be able to cause a denial-of-service.

CVSS: 6.2 · CWE: CWE-787

View on NVD

]]> [High] CVE-2026-43661 – A buffer overflow issue was addressed with improved memory handling. This issue ... https://nvd.nist.gov/vuln/detail/CVE-2026-43661 https://nvd.nist.gov/vuln/detail/CVE-2026-43661 Mon, 11 May 2026 21:19:01 +0000 High CVE-2026-43661

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. Processing a maliciously crafted image may corrupt process memory.

CVSS: 7.5 · CWE: CWE-121

View on NVD

]]> [High] CVE-2026-43660 – A validation issue was addressed with improved logic. This issue is fixed in Saf... https://nvd.nist.gov/vuln/detail/CVE-2026-43660 https://nvd.nist.gov/vuln/detail/CVE-2026-43660 Mon, 11 May 2026 21:19:01 +0000 High CVE-2026-43660

A validation issue was addressed with improved logic. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.

CVSS: 7.5 · CWE: CWE-693

View on NVD

]]> [Medium] CVE-2026-43659 – A race condition was addressed with additional validation. This issue is fixed i... https://nvd.nist.gov/vuln/detail/CVE-2026-43659 https://nvd.nist.gov/vuln/detail/CVE-2026-43659 Mon, 11 May 2026 21:19:01 +0000 Medium CVE-2026-43659

A race condition was addressed with additional validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, visionOS 26.5. An app may be able to access sensitive user data.

CVSS: 4.7 · CWE: CWE-362

View on NVD

]]> [High] CVE-2026-43658 – The issue was addressed with improved memory handling. This issue is fixed in Sa... https://nvd.nist.gov/vuln/detail/CVE-2026-43658 https://nvd.nist.gov/vuln/detail/CVE-2026-43658 Mon, 11 May 2026 21:19:01 +0000 High CVE-2026-43658

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.

CVSS: 7.5 · CWE: CWE-119

View on NVD

]]> [High] CVE-2026-43656 – An out-of-bounds write issue was addressed with improved input validation. This ... https://nvd.nist.gov/vuln/detail/CVE-2026-43656 https://nvd.nist.gov/vuln/detail/CVE-2026-43656 Mon, 11 May 2026 21:19:01 +0000 High CVE-2026-43656

An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. Parsing a maliciously crafted file may lead to an unexpected app termination.

CVSS: 7.3 · CWE: CWE-787

View on NVD

]]> [High] CVE-2026-43655 – An out-of-bounds read was addressed with improved bounds checking. This issue is... https://nvd.nist.gov/vuln/detail/CVE-2026-43655 https://nvd.nist.gov/vuln/detail/CVE-2026-43655 Mon, 11 May 2026 21:19:01 +0000 High CVE-2026-43655

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. An app may be able to cause unexpected system termination or read kernel memory.

CVSS: 7.3 · CWE: CWE-125

View on NVD

]]> [High] CVE-2026-43654 – The issue was addressed with improved memory handling. This issue is fixed in iO... https://nvd.nist.gov/vuln/detail/CVE-2026-43654 https://nvd.nist.gov/vuln/detail/CVE-2026-43654 Mon, 11 May 2026 21:19:01 +0000 High CVE-2026-43654

The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to disclose kernel memory.

CVSS: 7.5 · CWE: CWE-497

View on NVD

]]> [Medium] CVE-2026-43653 – The issue was addressed with improved memory handling. This issue is fixed in iO... https://nvd.nist.gov/vuln/detail/CVE-2026-43653 https://nvd.nist.gov/vuln/detail/CVE-2026-43653 Mon, 11 May 2026 21:19:01 +0000 Medium CVE-2026-43653

The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5. An attacker on the local network may be able to cause a denial-of-service.

CVSS: 6.2 · CWE: CWE-400

View on NVD

]]> [High] CVE-2026-43652 – A permissions issue was addressed with additional restrictions. This issue is fi... https://nvd.nist.gov/vuln/detail/CVE-2026-43652 https://nvd.nist.gov/vuln/detail/CVE-2026-43652 Mon, 11 May 2026 21:19:00 +0000 High CVE-2026-43652

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.5. An app may be able to access protected user data.

CVSS: 7.5 · CWE: CWE-284

View on NVD

]]> [High] CVE-2026-39871 – A path handling issue was addressed with improved logic. This issue is fixed in ... https://nvd.nist.gov/vuln/detail/CVE-2026-39871 https://nvd.nist.gov/vuln/detail/CVE-2026-39871 Mon, 11 May 2026 21:19:00 +0000 High CVE-2026-39871

A path handling issue was addressed with improved logic. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to observe unprotected user data.

CVSS: 7.5 · CWE: CWE-552

View on NVD

]]> [High] CVE-2026-39870 – The issue was addressed with improved memory handling. This issue is fixed in ma... https://nvd.nist.gov/vuln/detail/CVE-2026-39870 https://nvd.nist.gov/vuln/detail/CVE-2026-39870 Mon, 11 May 2026 21:18:59 +0000 High CVE-2026-39870

The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. Processing a maliciously crafted image may corrupt process memory.

CVSS: 7.5 · CWE: CWE-119

View on NVD

]]> [Medium] CVE-2026-39869 – The issue was addressed with improved memory handling. This issue is fixed in iO... https://nvd.nist.gov/vuln/detail/CVE-2026-39869 https://nvd.nist.gov/vuln/detail/CVE-2026-39869 Mon, 11 May 2026 21:18:59 +0000 Medium CVE-2026-39869

The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing an audio stream in a maliciously crafted media file may terminate the process.

CVSS: 4.3 · CWE: CWE-120

View on NVD

]]> [Medium] CVE-2026-28996 – A race condition was addressed with additional validation. This issue is fixed i... https://nvd.nist.gov/vuln/detail/CVE-2026-28996 https://nvd.nist.gov/vuln/detail/CVE-2026-28996 Mon, 11 May 2026 21:18:59 +0000 Medium CVE-2026-28996

A race condition was addressed with additional validation. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to access sensitive user data.

CVSS: 5.5 · CWE: CWE-362

View on NVD

]]> [High] CVE-2026-28995 – A logic issue was addressed with improved restrictions. This issue is fixed in i... https://nvd.nist.gov/vuln/detail/CVE-2026-28995 https://nvd.nist.gov/vuln/detail/CVE-2026-28995 Mon, 11 May 2026 21:18:59 +0000 High CVE-2026-28995

A logic issue was addressed with improved restrictions. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. A malicious app may be able to break out of its sandbox.

CVSS: 8.8 · CWE: CWE-269

View on NVD

]]> [Medium] CVE-2026-28994 – A use after free issue was addressed with improved memory management. This issue... https://nvd.nist.gov/vuln/detail/CVE-2026-28994 https://nvd.nist.gov/vuln/detail/CVE-2026-28994 Mon, 11 May 2026 21:18:59 +0000 Medium CVE-2026-28994

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets.

CVSS: 5.3 · CWE: CWE-416

View on NVD

]]> [Medium] CVE-2026-28993 – This issue was addressed by adding an additional prompt for user consent. This i... https://nvd.nist.gov/vuln/detail/CVE-2026-28993 https://nvd.nist.gov/vuln/detail/CVE-2026-28993 Mon, 11 May 2026 21:18:59 +0000 Medium CVE-2026-28993

This issue was addressed by adding an additional prompt for user consent. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, visionOS 26.5. An app may be able to access user-sensitive data.

CVSS: 5.5 · CWE: CWE-284

View on NVD

]]> [Medium] CVE-2026-28992 – A memory corruption vulnerability was addressed with improved locking. This issu... https://nvd.nist.gov/vuln/detail/CVE-2026-28992 https://nvd.nist.gov/vuln/detail/CVE-2026-28992 Mon, 11 May 2026 21:18:59 +0000 Medium CVE-2026-28992

A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An attacker may be able to cause unexpected app termination.

CVSS: 4.7 · CWE: CWE-362

View on NVD

]]> [High] CVE-2026-28991 – An out-of-bounds read was addressed with improved bounds checking. This issue is... https://nvd.nist.gov/vuln/detail/CVE-2026-28991 https://nvd.nist.gov/vuln/detail/CVE-2026-28991 Mon, 11 May 2026 21:18:59 +0000 High CVE-2026-28991

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to cause a denial-of-service.

CVSS: 7.5 · CWE: CWE-125

View on NVD

]]> [High] CVE-2026-28990 – The issue was addressed with improved memory handling. This issue is fixed in iO... https://nvd.nist.gov/vuln/detail/CVE-2026-28990 https://nvd.nist.gov/vuln/detail/CVE-2026-28990 Mon, 11 May 2026 21:18:58 +0000 High CVE-2026-28990

The issue was addressed with improved memory handling. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing a maliciously crafted image may corrupt process memory.

CVSS: 7.5 · CWE: CWE-119

View on NVD

]]> [Medium] CVE-2026-28988 – A permissions issue was addressed with additional restrictions. This issue is fi... https://nvd.nist.gov/vuln/detail/CVE-2026-28988 https://nvd.nist.gov/vuln/detail/CVE-2026-28988 Mon, 11 May 2026 21:18:58 +0000 Medium CVE-2026-28988

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, visionOS 26.5, watchOS 26.5. An app may be able to bypass certain Privacy preferences.

CVSS: 5.5 · CWE: CWE-284

View on NVD

]]> [High] CVE-2026-28987 – A logging issue was addressed with improved data redaction. This issue is fixed ... https://nvd.nist.gov/vuln/detail/CVE-2026-28987 https://nvd.nist.gov/vuln/detail/CVE-2026-28987 Mon, 11 May 2026 21:18:58 +0000 High CVE-2026-28987

A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. An app may be able to leak sensitive kernel state.

CVSS: 7.5 · CWE: CWE-532

View on NVD

]]> [High] CVE-2026-28986 – A race condition was addressed with additional validation. This issue is fixed i... https://nvd.nist.gov/vuln/detail/CVE-2026-28986 https://nvd.nist.gov/vuln/detail/CVE-2026-28986 Mon, 11 May 2026 21:18:58 +0000 High CVE-2026-28986

A race condition was addressed with additional validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. An app may be able to cause unexpected system termination.

CVSS: 7.5 · CWE: CWE-362

View on NVD

]]> [Medium] CVE-2026-28985 – A null pointer dereference was addressed with improved input validation. This is... https://nvd.nist.gov/vuln/detail/CVE-2026-28985 https://nvd.nist.gov/vuln/detail/CVE-2026-28985 Mon, 11 May 2026 21:18:58 +0000 Medium CVE-2026-28985

A null pointer dereference was addressed with improved input validation. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5. An attacker on the local network may be able to cause a denial-of-service.

CVSS: 6.2 · CWE: CWE-476

View on NVD

]]> [High] CVE-2026-28983 – A type confusion issue was addressed with improved checks. This issue is fixed i... https://nvd.nist.gov/vuln/detail/CVE-2026-28983 https://nvd.nist.gov/vuln/detail/CVE-2026-28983 Mon, 11 May 2026 21:18:58 +0000 High CVE-2026-28983

A type confusion issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. A remote attacker may be able to cause a denial of service.

CVSS: 7.5 · CWE: CWE-843

View on NVD

]]> [High] CVE-2026-28978 – A permissions issue was addressed with additional restrictions. This issue is fi... https://nvd.nist.gov/vuln/detail/CVE-2026-28978 https://nvd.nist.gov/vuln/detail/CVE-2026-28978 Mon, 11 May 2026 21:18:58 +0000 High CVE-2026-28978

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. A malicious app may be able to break out of its sandbox.

CVSS: 8.8 · CWE: CWE-284

View on NVD

]]> [Medium] CVE-2026-28977 – The issue was addressed with improved bounds checks. This issue is fixed in iOS ... https://nvd.nist.gov/vuln/detail/CVE-2026-28977 https://nvd.nist.gov/vuln/detail/CVE-2026-28977 Mon, 11 May 2026 21:18:58 +0000 Medium CVE-2026-28977

The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing a maliciously crafted file may lead to unexpected app termination.

CVSS: 6.2 · CWE: CWE-119

View on NVD

]]> [High] CVE-2026-28976 – An information leakage was addressed with additional validation. This issue is f... https://nvd.nist.gov/vuln/detail/CVE-2026-28976 https://nvd.nist.gov/vuln/detail/CVE-2026-28976 Mon, 11 May 2026 21:18:58 +0000 High CVE-2026-28976

An information leakage was addressed with additional validation. This issue is fixed in macOS Tahoe 26.5. An app may be able to gain root privileges.

CVSS: 7.5 · CWE: CWE-200

View on NVD

]]> [High] CVE-2026-28974 – This issue was addressed with improved checks to prevent unauthorized actions. T... https://nvd.nist.gov/vuln/detail/CVE-2026-28974 https://nvd.nist.gov/vuln/detail/CVE-2026-28974 Mon, 11 May 2026 21:18:58 +0000 High CVE-2026-28974

This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to cause a denial-of-service.

CVSS: 7.5 · CWE: CWE-284

View on NVD

]]> [Medium] CVE-2026-28972 – An out-of-bounds write issue was addressed with improved input validation. This ... https://nvd.nist.gov/vuln/detail/CVE-2026-28972 https://nvd.nist.gov/vuln/detail/CVE-2026-28972 Mon, 11 May 2026 21:18:57 +0000 Medium CVE-2026-28972

An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to cause unexpected system termination or write kernel memory.

CVSS: 6.5 · CWE: CWE-787

View on NVD

]]> [Medium] CVE-2026-28971 – The issue was addressed with improved UI handling. This issue is fixed in Safari... https://nvd.nist.gov/vuln/detail/CVE-2026-28971 https://nvd.nist.gov/vuln/detail/CVE-2026-28971 Mon, 11 May 2026 21:18:57 +0000 Medium CVE-2026-28971

The issue was addressed with improved UI handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, visionOS 26.5. A malicious iframe may use another website’s download settings.

CVSS: 4.3 · CWE: CWE-1021

View on NVD

]]> [High] CVE-2026-28969 – A use after free issue was addressed with improved memory management. This issue... https://nvd.nist.gov/vuln/detail/CVE-2026-28969 https://nvd.nist.gov/vuln/detail/CVE-2026-28969 Mon, 11 May 2026 21:18:57 +0000 High CVE-2026-28969

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to cause unexpected system termination.

CVSS: 7.5 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-28962 – This issue was addressed with improved access restrictions. This issue is fixed ... https://nvd.nist.gov/vuln/detail/CVE-2026-28962 https://nvd.nist.gov/vuln/detail/CVE-2026-28962 Mon, 11 May 2026 21:18:57 +0000 High CVE-2026-28962

This issue was addressed with improved access restrictions. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, visionOS 26.5. Processing maliciously crafted web content may disclose sensitive user information.

CVSS: 7.5 · CWE: CWE-200

View on NVD

]]> [Medium] CVE-2026-28961 – This issue was addressed with improved checks. This issue is fixed in macOS Taho... https://nvd.nist.gov/vuln/detail/CVE-2026-28961 https://nvd.nist.gov/vuln/detail/CVE-2026-28961 Mon, 11 May 2026 21:18:57 +0000 Medium CVE-2026-28961

This issue was addressed with improved checks. This issue is fixed in macOS Tahoe 26.5. An attacker with physical access to a locked device may be able to view sensitive user information.

CVSS: 4.6 · CWE: CWE-522

View on NVD

]]> [High] CVE-2026-28959 – A buffer overflow was addressed with improved bounds checking. This issue is fix... https://nvd.nist.gov/vuln/detail/CVE-2026-28959 https://nvd.nist.gov/vuln/detail/CVE-2026-28959 Mon, 11 May 2026 21:18:56 +0000 High CVE-2026-28959

A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to cause unexpected system termination.

CVSS: 7.5 · CWE: CWE-120

View on NVD

]]> [Medium] CVE-2026-28958 – This issue was addressed with improved data protection. This issue is fixed in S... https://nvd.nist.gov/vuln/detail/CVE-2026-28958 https://nvd.nist.gov/vuln/detail/CVE-2026-28958 Mon, 11 May 2026 21:18:56 +0000 Medium CVE-2026-28958

This issue was addressed with improved data protection. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, visionOS 26.5. An app may be able to access sensitive user data.

CVSS: 5.5 · CWE: CWE-200

View on NVD

]]> [Medium] CVE-2026-28956 – A memory corruption issue was addressed with improved input validation. This iss... https://nvd.nist.gov/vuln/detail/CVE-2026-28956 https://nvd.nist.gov/vuln/detail/CVE-2026-28956 Mon, 11 May 2026 21:18:56 +0000 Medium CVE-2026-28956

A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory.

CVSS: 6.5 · CWE: CWE-125

View on NVD

]]> [High] CVE-2026-28955 – The issue was addressed with improved memory handling. This issue is fixed in Sa... https://nvd.nist.gov/vuln/detail/CVE-2026-28955 https://nvd.nist.gov/vuln/detail/CVE-2026-28955 Mon, 11 May 2026 21:18:56 +0000 High CVE-2026-28955

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS: 8.8 · CWE: CWE-119

View on NVD

]]> [High] CVE-2026-28954 – A file quarantine bypass was addressed with additional checks. This issue is fix... https://nvd.nist.gov/vuln/detail/CVE-2026-28954 https://nvd.nist.gov/vuln/detail/CVE-2026-28954 Mon, 11 May 2026 21:18:56 +0000 High CVE-2026-28954

A file quarantine bypass was addressed with additional checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. A maliciously crafted disk image may bypass Gatekeeper checks.

CVSS: 7.5 · CWE: CWE-290

View on NVD

]]> [High] CVE-2026-28953 – The issue was addressed with improved memory handling. This issue is fixed in Sa... https://nvd.nist.gov/vuln/detail/CVE-2026-28953 https://nvd.nist.gov/vuln/detail/CVE-2026-28953 Mon, 11 May 2026 21:18:56 +0000 High CVE-2026-28953

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS: 7.5 · CWE: CWE-119

View on NVD

]]> [High] CVE-2026-28952 – An integer overflow was addressed with improved input validation. This issue is ... https://nvd.nist.gov/vuln/detail/CVE-2026-28952 https://nvd.nist.gov/vuln/detail/CVE-2026-28952 Mon, 11 May 2026 21:18:56 +0000 High CVE-2026-28952

An integer overflow was addressed with improved input validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to cause unexpected system termination.

CVSS: 7.5 · CWE: CWE-190

View on NVD

]]> [High] CVE-2026-28951 – An authorization issue was addressed with improved state management. This issue ... https://nvd.nist.gov/vuln/detail/CVE-2026-28951 https://nvd.nist.gov/vuln/detail/CVE-2026-28951 Mon, 11 May 2026 21:18:56 +0000 High CVE-2026-28951

An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to gain root privileges.

CVSS: 7.8 · CWE: CWE-863

View on NVD

]]> [High] CVE-2026-28947 – A use-after-free issue was addressed with improved memory management. This issue... https://nvd.nist.gov/vuln/detail/CVE-2026-28947 https://nvd.nist.gov/vuln/detail/CVE-2026-28947 Mon, 11 May 2026 21:18:55 +0000 High CVE-2026-28947

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.

CVSS: 8.8 · CWE: CWE-416

View on NVD

]]> [Medium] CVE-2026-28946 – A use-after-free issue was addressed with improved memory management. This issue... https://nvd.nist.gov/vuln/detail/CVE-2026-28946 https://nvd.nist.gov/vuln/detail/CVE-2026-28946 Mon, 11 May 2026 21:18:55 +0000 Medium CVE-2026-28946

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5, macOS Tahoe 26.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.

CVSS: 6.5 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-28944 – The issue was addressed with improved memory handling. This issue is fixed in Sa... https://nvd.nist.gov/vuln/detail/CVE-2026-28944 https://nvd.nist.gov/vuln/detail/CVE-2026-28944 Mon, 11 May 2026 21:18:55 +0000 High CVE-2026-28944

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, visionOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS: 7.5 · CWE: CWE-119

View on NVD

]]> [High] CVE-2026-28943 – A logging issue was addressed with improved data redaction. This issue is fixed ... https://nvd.nist.gov/vuln/detail/CVE-2026-28943 https://nvd.nist.gov/vuln/detail/CVE-2026-28943 Mon, 11 May 2026 21:18:55 +0000 High CVE-2026-28943

A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. An app may be able to determine kernel memory layout.

CVSS: 7.5 · CWE: CWE-532

View on NVD

]]> [Medium] CVE-2026-28942 – A use-after-free issue was addressed with improved memory management. This issue... https://nvd.nist.gov/vuln/detail/CVE-2026-28942 https://nvd.nist.gov/vuln/detail/CVE-2026-28942 Mon, 11 May 2026 21:18:55 +0000 Medium CVE-2026-28942

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.

CVSS: 6.5 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-28941 – The issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 ... https://nvd.nist.gov/vuln/detail/CVE-2026-28941 https://nvd.nist.gov/vuln/detail/CVE-2026-28941 Mon, 11 May 2026 21:18:55 +0000 High CVE-2026-28941

The issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Tahoe 26.5. Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents.

CVSS: 7.1 · CWE: CWE-119

View on NVD

]]> [High] CVE-2026-28940 – The issue was addressed with improved memory handling. This issue is fixed in iO... https://nvd.nist.gov/vuln/detail/CVE-2026-28940 https://nvd.nist.gov/vuln/detail/CVE-2026-28940 Mon, 11 May 2026 21:18:55 +0000 High CVE-2026-28940

The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5. Processing a maliciously crafted image may corrupt process memory.

CVSS: 8.8 · CWE: CWE-119

View on NVD

]]> [High] CVE-2026-28936 – The issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 ... https://nvd.nist.gov/vuln/detail/CVE-2026-28936 https://nvd.nist.gov/vuln/detail/CVE-2026-28936 Mon, 11 May 2026 21:18:55 +0000 High CVE-2026-28936

The issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sonoma 14.8.7, macOS Tahoe 26.5, visionOS 26.5. Processing a maliciously crafted file may lead to unexpected app termination.

CVSS: 7.5 · CWE: CWE-20

View on NVD

]]> [High] CVE-2026-28930 – A permissions issue was addressed with additional restrictions. This issue is fi... https://nvd.nist.gov/vuln/detail/CVE-2026-28930 https://nvd.nist.gov/vuln/detail/CVE-2026-28930 Mon, 11 May 2026 21:18:55 +0000 High CVE-2026-28930

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.5. An app may be able to access protected user data.

CVSS: 7.5 · CWE: CWE-284

View on NVD

]]> [High] CVE-2026-28929 – A logic issue was addressed with improved checks. This issue is fixed in iOS 18... https://nvd.nist.gov/vuln/detail/CVE-2026-28929 https://nvd.nist.gov/vuln/detail/CVE-2026-28929 Mon, 11 May 2026 21:18:54 +0000 High CVE-2026-28929

A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. Replying to an email could display remote images in Mail in Lockdown Mode.

CVSS: 7.5 · CWE: CWE-1254

View on NVD

]]> [High] CVE-2026-28925 – A buffer overflow was addressed with improved bounds checking. This issue is fix... https://nvd.nist.gov/vuln/detail/CVE-2026-28925 https://nvd.nist.gov/vuln/detail/CVE-2026-28925 Mon, 11 May 2026 21:18:54 +0000 High CVE-2026-28925

A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to cause unexpected system termination or write kernel memory.

CVSS: 7.5 · CWE: CWE-120

View on NVD

]]> [High] CVE-2026-28924 – A race condition was addressed with improved handling of symbolic links. This is... https://nvd.nist.gov/vuln/detail/CVE-2026-28924 https://nvd.nist.gov/vuln/detail/CVE-2026-28924 Mon, 11 May 2026 21:18:54 +0000 High CVE-2026-28924

A race condition was addressed with improved handling of symbolic links. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to access Contacts without user consent.

CVSS: 7.5 · CWE: CWE-362

View on NVD

]]> [High] CVE-2026-28923 – A logging issue was addressed with improved data redaction. This issue is fixed ... https://nvd.nist.gov/vuln/detail/CVE-2026-28923 https://nvd.nist.gov/vuln/detail/CVE-2026-28923 Mon, 11 May 2026 21:18:54 +0000 High CVE-2026-28923

A logging issue was addressed with improved data redaction. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. A malicious app may be able to break out of its sandbox.

CVSS: 8.8 · CWE: CWE-532

View on NVD

]]> [Medium] CVE-2026-28922 – This issue was addressed through improved state management. This issue is fixed ... https://nvd.nist.gov/vuln/detail/CVE-2026-28922 https://nvd.nist.gov/vuln/detail/CVE-2026-28922 Mon, 11 May 2026 21:18:54 +0000 Medium CVE-2026-28922

This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to access private information.

CVSS: 6.5 · CWE: CWE-200

View on NVD

]]> [Medium] CVE-2026-28920 – An information leakage was addressed with additional validation. This issue is f... https://nvd.nist.gov/vuln/detail/CVE-2026-28920 https://nvd.nist.gov/vuln/detail/CVE-2026-28920 Mon, 11 May 2026 21:18:54 +0000 Medium CVE-2026-28920

An information leakage was addressed with additional validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Visiting a maliciously crafted website may leak sensitive data.

CVSS: 6.5 · CWE: CWE-200

View on NVD

]]> [High] CVE-2026-28919 – A consistency issue was addressed with improved state handling. This issue is fi... https://nvd.nist.gov/vuln/detail/CVE-2026-28919 https://nvd.nist.gov/vuln/detail/CVE-2026-28919 Mon, 11 May 2026 21:18:54 +0000 High CVE-2026-28919

A consistency issue was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to gain root privileges.

CVSS: 7.8 · CWE: CWE-269

View on NVD

]]> [Medium] CVE-2026-28918 – An out-of-bounds access issue was addressed with improved bounds checking. This ... https://nvd.nist.gov/vuln/detail/CVE-2026-28918 https://nvd.nist.gov/vuln/detail/CVE-2026-28918 Mon, 11 May 2026 21:18:54 +0000 Medium CVE-2026-28918

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Parsing a maliciously crafted file may lead to an unexpected app termination.

CVSS: 6.5 · CWE: CWE-125

View on NVD

]]> [Medium] CVE-2026-28917 – The issue was addressed with improved input validation. This issue is fixed in S... https://nvd.nist.gov/vuln/detail/CVE-2026-28917 https://nvd.nist.gov/vuln/detail/CVE-2026-28917 Mon, 11 May 2026 21:18:54 +0000 Medium CVE-2026-28917

The issue was addressed with improved input validation. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS: 4.3 · CWE: CWE-20

View on NVD

]]> [High] CVE-2026-28915 – A parsing issue in the handling of directory paths was addressed with improved p... https://nvd.nist.gov/vuln/detail/CVE-2026-28915 https://nvd.nist.gov/vuln/detail/CVE-2026-28915 Mon, 11 May 2026 21:18:54 +0000 High CVE-2026-28915

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to gain root privileges.

CVSS: 7.8 · CWE: CWE-22

View on NVD

]]> [Medium] CVE-2026-28914 – A logic issue was addressed with improved file handling. This issue is fixed in ... https://nvd.nist.gov/vuln/detail/CVE-2026-28914 https://nvd.nist.gov/vuln/detail/CVE-2026-28914 Mon, 11 May 2026 21:18:53 +0000 Medium CVE-2026-28914

A logic issue was addressed with improved file handling. This issue is fixed in macOS Tahoe 26.5. A maliciously crafted ZIP archive may bypass Gatekeeper checks.

CVSS: 5.5 · CWE: CWE-358

View on NVD

]]> [High] CVE-2026-28913 – The issue was addressed with improved memory handling. This issue is fixed in Sa... https://nvd.nist.gov/vuln/detail/CVE-2026-28913 https://nvd.nist.gov/vuln/detail/CVE-2026-28913 Mon, 11 May 2026 21:18:53 +0000 High CVE-2026-28913

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS: 7.5 · CWE: CWE-119

View on NVD

]]> [Low] CVE-2026-28910 – This issue was addressed with improved permissions checking. This issue is fixed... https://nvd.nist.gov/vuln/detail/CVE-2026-28910 https://nvd.nist.gov/vuln/detail/CVE-2026-28910 Mon, 11 May 2026 21:18:53 +0000 Low CVE-2026-28910

This issue was addressed with improved permissions checking. This issue is fixed in macOS Tahoe 26.4. A malicious app may be able to access arbitrary files.

CVSS: 3.3 · CWE: CWE-284

View on NVD

]]> [High] CVE-2026-28908 – A denial of service issue was addressed by removing the vulnerable code. This is... https://nvd.nist.gov/vuln/detail/CVE-2026-28908 https://nvd.nist.gov/vuln/detail/CVE-2026-28908 Mon, 11 May 2026 21:18:53 +0000 High CVE-2026-28908

A denial of service issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to modify protected parts of the file system.

CVSS: 7.5 · CWE: CWE-400

View on NVD

]]> [High] CVE-2026-28907 – The issue was addressed with improved input validation. This issue is fixed in S... https://nvd.nist.gov/vuln/detail/CVE-2026-28907 https://nvd.nist.gov/vuln/detail/CVE-2026-28907 Mon, 11 May 2026 21:18:53 +0000 High CVE-2026-28907

The issue was addressed with improved input validation. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.

CVSS: 8.1 · CWE: CWE-20

View on NVD

]]> [High] CVE-2026-28906 – This issue was addressed through improved state management. This issue is fixed ... https://nvd.nist.gov/vuln/detail/CVE-2026-28906 https://nvd.nist.gov/vuln/detail/CVE-2026-28906 Mon, 11 May 2026 21:18:53 +0000 High CVE-2026-28906

This issue was addressed through improved state management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, visionOS 26.5. An attacker may be able to track users through their IP address.

CVSS: 7.5 · CWE: CWE-359

View on NVD

]]> [High] CVE-2026-28905 – The issue was addressed with improved memory handling. This issue is fixed in Sa... https://nvd.nist.gov/vuln/detail/CVE-2026-28905 https://nvd.nist.gov/vuln/detail/CVE-2026-28905 Mon, 11 May 2026 21:18:53 +0000 High CVE-2026-28905

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS: 7.5 · CWE: CWE-119

View on NVD

]]> [High] CVE-2026-28904 – The issue was addressed with improved memory handling. This issue is fixed in Sa... https://nvd.nist.gov/vuln/detail/CVE-2026-28904 https://nvd.nist.gov/vuln/detail/CVE-2026-28904 Mon, 11 May 2026 21:18:53 +0000 High CVE-2026-28904

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS: 7.5 · CWE: CWE-119

View on NVD

]]> [Medium] CVE-2026-28903 – The issue was addressed with improved memory handling. This issue is fixed in Sa... https://nvd.nist.gov/vuln/detail/CVE-2026-28903 https://nvd.nist.gov/vuln/detail/CVE-2026-28903 Mon, 11 May 2026 21:18:53 +0000 Medium CVE-2026-28903

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS: 6.5 · CWE: CWE-119

View on NVD

]]> [Medium] CVE-2026-28902 – The issue was addressed with improved memory handling. This issue is fixed in Sa... https://nvd.nist.gov/vuln/detail/CVE-2026-28902 https://nvd.nist.gov/vuln/detail/CVE-2026-28902 Mon, 11 May 2026 21:18:53 +0000 Medium CVE-2026-28902

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS: 6.5 · CWE: CWE-119

View on NVD

]]> [Medium] CVE-2026-28901 – The issue was addressed with improved memory handling. This issue is fixed in Sa... https://nvd.nist.gov/vuln/detail/CVE-2026-28901 https://nvd.nist.gov/vuln/detail/CVE-2026-28901 Mon, 11 May 2026 21:18:52 +0000 Medium CVE-2026-28901

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS: 4.3 · CWE: CWE-119

View on NVD

]]> [Medium] CVE-2026-28897 – A buffer overflow was addressed with improved input validation. This issue is fi... https://nvd.nist.gov/vuln/detail/CVE-2026-28897 https://nvd.nist.gov/vuln/detail/CVE-2026-28897 Mon, 11 May 2026 21:18:52 +0000 Medium CVE-2026-28897

A buffer overflow was addressed with improved input validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. A local user may be able to cause unexpected system termination or read kernel memory.

CVSS: 6.2 · CWE: CWE-121

View on NVD

]]> [High] CVE-2026-28883 – A use-after-free issue was addressed with improved memory management. This issue... https://nvd.nist.gov/vuln/detail/CVE-2026-28883 https://nvd.nist.gov/vuln/detail/CVE-2026-28883 Mon, 11 May 2026 21:18:52 +0000 High CVE-2026-28883

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS: 7.5 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-28860 – The issue was addressed with improved input validation. This issue is fixed in i... https://nvd.nist.gov/vuln/detail/CVE-2026-28860 https://nvd.nist.gov/vuln/detail/CVE-2026-28860 Mon, 11 May 2026 21:18:51 +0000 High CVE-2026-28860

The issue was addressed with improved input validation. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. A local attacker may be able to modify the state of the Keychain.

CVSS: 7.5 · CWE: CWE-20

View on NVD

]]>