CVE-2026-64781: Improper Input Validation

The issue was addressed with improved input validation. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 27. Processing maliciously crafted web content may lead to an unexpected Safari crash...

CVE-2026-64760: Exposure of Sensitive Information to an Unauthorized Actor

An information leakage was addressed with additional validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. An app may be able to leak sensitive kernel state...

CVE-2026-43794: Improper Restriction of Operations within the Bounds of a Memory Buffer

A memory corruption issue was addressed with improved memory handling. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to memory corruption...

CVE-2026-43667: Reachable Assertion

A reachable assertion was addressed with improved input validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, visionOS 26.5, watchOS 26.5. An attacker in a privileged network position may be able to cause a denial-of-service...

About the security content of iOS 18.7.10 and iPadOS 18.7.10

About the security content of iOS 18.7.10 and iPadOS 18.7.10 This update delivers security fixes that were first made available in the iOS 26.6 and 27 and iPadOS 26.6 and 27 betas. This document describes the security content of iOS 18.7.10 and iPadOS 18.7.10. About Apple security updates For our...

CVE-2026-65332: Improper Check or Handling of Exceptional Conditions

This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 27. Processing maliciously crafted web content may lead to an unexpected Safari crash...

About the security content of iOS 26.6.1 and iPadOS 26.6.1

About the security content of iOS 26.6.1 and iPadOS 26.6.1 This update delivers security fixes that were first made available in the iOS 27 and iPadOS 27 betas. This document describes the security content of iOS 26.6.1 and iPadOS 26.6.1. About Apple security updates For our customers' protection...

PT-2026-76856

Name of the Vulnerable Software and Affected Versions iOS versions prior to 26.6.1 iPadOS versions prior to 26.6.1 macOS Tahoe versions prior to 26.6.2 Description A logic issue exists where an app may be able to leak sensitive user information. This was addressed by implementing improved checks...

PT-2026-76846

An authentication issue was addressed with improved state management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1. An attacker in a privileged network position may be able to bypass IPSec authentication and intercept network traffic...

CVE-2026-64779: Concurrent Execution using Shared Resource with Improper Synchronization

A memory corruption vulnerability was addressed with improved locking. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 27. Processing maliciously crafted web content may lead to an unexpected Safari crash...

CVE-2026-64782: Concurrent Execution using Shared Resource with Improper Synchronization

A memory corruption vulnerability was addressed with improved locking. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 27. Processing maliciously crafted web content may lead to an unexpected Safari crash...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: webkit2gtk3 (UTSA-2026-100895)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100895 advisory. A privacy issue was addressed with improved handling of files. This issue is fixed in Safari 18.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3. Copying a URL from W...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: webkit2gtk3 (UTSA-2026-101304)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101304 advisory. The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6,...

PT-2026-76841

Name of the Vulnerable Software and Affected Versions iOS versions prior to 18.7.10 iPadOS versions prior to 18.7.10 iOS versions prior to 26.6.1 iPadOS versions prior to 26.6.1 macOS Tahoe versions prior to 26.6.2 Description Processing maliciously crafted web content in Safari may lead to an...

Malicious code in @demopack/www (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d65caef119676a35e0ed5c3ef5a3be0d08c6a487c57270c802319fe68521dadd Package.json describes the package as 'Static assets distribution', but the shipped HTML/JS is an iOS-version-gated payload loader. js/index.js...

MAL-2026-14041 Malicious code in @demopack/www (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d65caef119676a35e0ed5c3ef5a3be0d08c6a487c57270c802319fe68521dadd Package.json describes the package as 'Static assets distribution', but the shipped HTML/JS is an iOS-version-gated payload loader. js/index.js...

Malicious code in @cdnshell/loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b572368b522527a308a0a8057b3b0945ded5c73f4dcad6ab738eaa2b7ddf6e3 Package presents itself as a CDN static-asset distribution library but ships 19 pre-compiled arm64 Mach-O binaries under 03payloads/ stager, kbridge,...

MAL-2026-14039 Malicious code in @cdnshell/loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b572368b522527a308a0a8057b3b0945ded5c73f4dcad6ab738eaa2b7ddf6e3 Package presents itself as a CDN static-asset distribution library but ships 19 pre-compiled arm64 Mach-O binaries under 03payloads/ stager, kbridge,...

clipwire

clipwire Kernel exploit development harness for the iPhone...

PT-2026-71379

Name of the Vulnerable Software and Affected Versions Palo Alto Networks GlobalProtect app affected versions not specified Description Improper certificate validation allows an unauthenticated attacker with man-in-the-middle MitM access to intercept and modify application communications. MitM is ...