CVE-2026-20696

An authorization issue exists in macOS Tahoe prior to version 26.4 due to improper state management . This vulnerability could allow an application to access sensitive user data . The issue is addressed in macOS Sequoia 15.7.4 , macOS Sonoma 14.8.4 , and macOS Tahoe 26.4 . Detailed exploitation i...

CVE-2026-28951

An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to gain root privileges...

CVE-2026-28951

An authorization issue exists in Apple's operating systems due to improper state management. This vulnerability could allow an application to gain root privileges . Affected products include iOS 18.7.9 , iPadOS 18.7.9 , iOS 26.5 , iPadOS 26.5 , macOS Sequoia 15.7.7 , macOS Sonoma 14.8.7 , and mac...

CVE-2026-28906

This vulnerability involves an issue addressed through improved state management across multiple Apple platforms. The flaw could allow an attacker to track users via their IP address . Affected products and versions include iOS 18.7.9 , iPadOS 18.7.9 , iOS 26.5 , iPadOS 26.5 , macOS Sequoia 15.7....

CVE-2026-28951

An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to gain root privileges...

CVE-2026-28987

A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. An app may be able to leak sensitive kernel state...

CVE-2026-28987

A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. An app may be able to leak sensitive kernel state...

CVE-2026-28987

A logging issue in various Apple products could allow an app to leak sensitive kernel state . The vulnerability has been addressed through improved data redaction. Affected systems include iOS 18.7.9 , iPadOS 18.7.9 , iOS 26.5 , iPadOS 26.5 , macOS Sequoia 15.7.7 , macOS Sonoma 14.8.7 , macOS Tah...

CVE-2026-28964

A vulnerability in CoreAnimation was addressed with improved state management to resolve an inconsistent user interface issue. This flaw could allow an application to access sensitive user data . The issue is fixed in iOS 26.5 , iPadOS 26.5 , and visionOS 26.5 . Specific versions affected include...

CVE-2026-28964

An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 26.5 and iPadOS 26.5, visionOS 26.5. An app may be able to access sensitive user data...

CVE-2026-28860

A vulnerability exists in several Apple products due to improper input validation, which may allow a local attacker to modify the state of the Keychain . Affected versions include iOS prior to 18.7.7 and 26.4, iPadOS prior to 18.7.7 and 26.4, macOS Sequoia prior to 15.7.5, macOS Sonoma prior to 1...

CVE-2026-28919

A consistency issue was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to gain root privileges...

CVE-2026-28919

A consistency issue in macOS involving improved state handling allows an application to potentially gain root privileges . This vulnerability affects versions prior to macOS Sequoia 15.7.7 , macOS Sonoma 14.8.7 , and macOS Tahoe 26.5 . Affected systems can be remediated by installing the latest s...

CVE-2026-28919

A consistency issue was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to gain root privileges...

CVE-2026-28922

This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to access private information...

CVE-2026-28922

The macOS operating system is vulnerable to a security issue where an application may be able to access private information . This vulnerability was addressed through improved state management . The issue is fixed in macOS Sequoia 15.7.7 , macOS Sonoma 14.8.7 , and macOS Tahoe 26.5 . No specific ...

Arbitrary Code Injection

Overview mermaid is a package for generation of diagrams and flowcharts from text in a similar manner as markdown. Affected versions of this package are vulnerable to Arbitrary Code Injection due to improper sanitization of the classDef function in state diagrams. An attacker can inject arbitrary...

NPM: Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection

NPM: Mermaid: Improper sanitization of classDef in state diagrams leads to HTML injection vulnerability discovered by ? in WordPress Npm mermaid versions = 10.9.5...

GHSA-GHCM-XQFW-Q4VR Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection

Impact Under the default configuration, Mermaid state diagram's classDef allow DOM injection that escapes the SVG, although tags are removed, preventing XSS. Proof-of-concept stateDiagram-v2 classDef xss...

Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection

Impact Under the default configuration, Mermaid state diagram's classDef allow DOM injection that escapes the SVG, although tags are removed, preventing XSS. Proof-of-concept stateDiagram-v2 classDef xss...