CVE-2026-28958

CVE-2026-28958 is an Apple vulnerability addressed by updates to iOS/iPadOS 26.5, macOS Tahoe 26.5, and visionOS 26.5. The issue is described as an access to sensitive user data due to improved data protection in the fixed releases. Connected advisories confirm fixes across macOS, iOS/iPadOS, and...

CVE-2026-43799

The CVE-2026-43799 issue is a use-after-free memory management vulnerability in Apple platforms. Affected components are Apple OS family releases including iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. The underlying caus...

CVE-2026-64692

CVE-2026-64692 is an Apple-ecosystem issue described as an out-of-bounds read that was addressed by improving bounds checking. The vulnerability is fixed in multiple Apple OS updates (iOS 26.6 and iPadOS 26.6; macOS Sequoia 15.7.8; macOS Sonoma 14.8.8; macOS Tahoe 26.6; tvOS 26.6; visionOS 26.6; ...

CVE-2024-40851

CVE-2024-40851 affects Apple iOS 18.1 and iPadOS 18.1. The issue allowed an attacker with physical access to view contact photos from the lock screen due to insufficient restrictions on options presented on a locked device. Apple fixed this in iOS 18.1 / iPadOS 18.1 via strengthened authenticatio...

CVE-2024-44235

CVE-2024-44235 concerns Apple iOS/iPadOS where an attacker with physical access could view restricted content from a locked device. The Apple advisories indicate the issue was addressed with improved checks and is fixed in iOS 18.1 and iPadOS 18.1. Red Hat and other sources reference the same vul...

CVE-2025-43445

CVE-2025-43445 is an out-of-bounds read vulnerability that Apple fixed via input validation improvements. The CVE affects media processing paths and can cause an app to terminate unexpectedly or memory corruption when handling a malicious media file. Affected platforms and versions, per available...

CVE-2026-20617

CVE-2026-20617 describes a race condition in CoreServices that could allow an app to gain root privileges. The issue was mitigated by improved state handling and is fixed in multiple Apple platforms: iOS 26.3, iPadOS 26.3, watchOS 26.3, tvOS 26.3, visionOS 26.3, macOS Sonoma 14.8.4, and macOS Tah...

CVE-2026-20664

CVE-2026-20664 is a memory-handling vulnerability where processing malicious web content may cause an unexpected process crash. It is fixed in Safari 26.4, iOS 26.4/iPadOS 26.4, macOS Tahoe 26.4, and visionOS 26.4. The connected advisories corroborate a fixed-upgrade path (WebKitGTK/WebKit2GTK re...

CVE-2026-28857

CVE-2026-28857 is a memory handling issue affecting processing of malicious web content that can lead to an unexpected process crash. The issue is addressed and fixed in Safari 26.4, iOS 26.4 / iPadOS 26.4, macOS Tahoe 26.4, and visionOS 26.4. The CVSSv3.1 vector from the initial document indicat...

CVE-2026-28905

CVE-2026-28905 is an Apple memory-handling flaw affecting how web content is processed, potentially causing an application/process crash. The primary description specifies the issue is fixed in Apple OS updates: iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, and visionOS 26.5. The CVSSv3.1 m...

CVE-2026-28954

CVE-2026-28954 describes a file-quarantine bypass where a malicious disk image could bypass Gatekeeper checks. Concrete details from connected advisories confirm affected Apple platforms and fixed versions: iOS 18.7.9 and iPadOS 18.7.9; macOS Sequoia 15.7.7; macOS Sonoma 14.8.7; macOS Tahoe 26.5....

CVE-2026-28983

Apple fixed CVE-2026-28983 as a type confusion vulnerability. Affected platforms include iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS, with fixes shipped in iOS 18.7.9/iPadOS 18.7.9 (and corresponding OS updates for other devices). Impact: remote attacker may cause denial of service. Roo...

CVE-2023-40385

CVE-2023-40385 affects Apple platforms: macOS Sonoma 14, Safari 17, iOS 17, and iPadOS 17. The issue stems from vulnerable code related to DNS query handling that could allow a remote attacker to view leaked DNS queries when Private Relay is enabled. The public documents consistently state that A...

CVE-2023-42831

CVE-2023-42831 affects Apple operating systems, with remediation in macOS Big Sur 11.7.9, iOS 15.7.8, iPadOS 15.7.8, macOS Monterey 12.6.8, and macOS Ventura 13.5. The issue was addressed by removing the vulnerable code, and may allow an app to fingerprint the user.

CVE-2024-40826

CVE-2024-40826 affects Apple products (iOS/iPadOS 18 and macOS Sequoia 15). The issue is a privacy flaw where an unencrypted document may be written to a temporary file during print preview. Apple documents remediation: the vulnerability is fixed in iOS 18, iPadOS 18, and macOS Sequoia 15. Refere...

CVE-2024-40840

CVE-2024-40840 affects Apple iOS 18 and iPadOS 18. The issue arises from a state-management weakness that could allow an attacker with physical access to use Siri to access sensitive user data. Apple states the vulnerability is fixed in iOS 18 / iPadOS 18. Practical impact is limited to scenarios...

CVE-2024-54485

CVE-2024-54485 affects Apple iOS/iPadOS where a user’s lock-screen notifications could be viewed by an attacker with physical access. The issue is mitigated by updates: iPadOS 17.7.3, iOS 18.2, and iPadOS 18.2 fix the flaw by adding additional logic to prevent lock-screen notification content exp...

CVE-2025-24225

CVE-2025-24225 is an injection issue in Apple’s mail-processing path that arises from insufficient input validation, potentially enabling user-interface spoofing when processing an email. The vulnerability affects iPadOS/iOS versions as noted: iPadOS 18.5 and iOS 18.5 (and iPadOS 17.7.7 also list...

CVE-2025-43186

The CVE-2025-43186 issue is a memory-handling vulnerability fixed across multiple Apple platforms: watchOS 11.6, iOS 18.6, iPadOS 18.6, tvOS 18.6, macOS Sequoia 15.6, macOS Sonoma 14.7.7, visionOS 2.6, and macOS Ventura 13.7.7. The vulnerability arises during file parsing and may cause an unexpec...

CVE-2025-43344

CVE-2025-43344 describes an out-of-bounds access issue in Apple OS components that is mitigated by improved bounds checking. The vulnerability is fixed in visionOS 26, tvOS 26, iOS 26, iPadOS 26, and watchOS 26. The issue could allow an app to terminate the system, depending on context. Connected...

CVE-2025-43385

CVE-2025-43385 is an out-of-bounds access vulnerability that could cause an app to terminate or corrupt memory when processing a malicious media file. The issue has concrete fixes in multiple Apple platforms: tvOS 26.1, macOS Tahoe 26.1, iOS 26.1 and iPadOS 26.1, iOS 18.7.2 and iPadOS 18.7.2, mac...

CVE-2025-43427

CVE-2025-43427 is a WebKitGTK/WebKit issue where processing maliciously crafted web content may cause an unexpected process crash. The connected advisories show WebKitGTK/WebKit updates addressing this and related CVEs (e.g., 43392, 43429–43432, 43434, 43458, 66287). The fix is implemented via up...

CVE-2025-43431

CVE-2025-43431 is a WebKitGTK/WebKit2GTK memory corruption issue triggered by processing malicious web content. Public advisories show fixes across Linux distros: AL2 webkitgtk4 2.50.4-1.amzn2.*; Debian/webkit2gtk 2.50.2-1~deb11u1 (and related stable/bookworm updates); Mageia/alma/other entries l...

CVE-2026-28819

CVE-2026-28819 is an out-of-bounds write vulnerability fixed by updates: iOS 18.7.9, iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, and macOS Tahoe 26.5. The issue may enable arbitrary code execution with kernel privileges. Exploitation details are not provided in the supplied document...

CVE-2026-28903

CVE-2026-28903 affects WebKitGTK4 (webkitgtk4) in Amazon Linux 2 AL2. The issue is a memory handling/problem in processing malicious web content that may trigger an unexpected process crash. Fixes are shipped as webkitgtk4 2.52.4-1.amzn2 (and related devel/jsc packages) in ALAS2-2026-3381; update...

CVE-2026-39872

CVE-2026-39872 affects WebKit-based browser components used in Safari and related Apple platforms. The issue involves improper memory handling that could be triggered by processing malicious web content, potentially causing an unexpected process crash. Apple notes the fix in Safari 26.5.2, iOS 26...

CVE-2026-43797

CVE-2026-43797 concerns an information-disclosure issue where an app could access a user’s contacts. The CVE description notes the issue was addressed with improved checks and is fixed in Apple updates: iOS 26.6 and iPadOS 26.6, and macOS Tahoe 26.6. The accompanying metrics indicate a CVSS v3.1 ...

CVE-2026-64716

CVE-2026-64716 is a memory handling vulnerability in Apple platforms. Processing a maliciously crafted image may corrupt process memory. Affected products/versions include iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. Roo...

CVE-2026-64758

CVE-2026-64758 is actively addressed for Apple platforms (iOS, iPadOS, macOS Tahoe, tvOS, visionOS, watchOS) via improved bounds checks in ImageIO. The issue affects processing a maliciously crafted file and may cause an unexpected app termination. Public details in connected sources (Apple secur...

CVE-2026-64769

CVE-2026-64769 is an out-of-bounds write vulnerability addressed by Apple in iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, and visionOS 26.6. The issue enables a remote attacker to cause unexpected application termination or heap corruption due to improv...

CVE-2023-42869

CVE-2023-42869 is a set of multiple memory corruption issues in libxml2 that were addressed through improved input validation. The CVE entry notes the fixes are included in Apple products: macOS Ventura 13.4, iOS 16.5, and iPadOS 16.5. Connected sources corroborate that the libxml2 problems were ...

CVE-2023-42923

CVE-2023-42923 affects Apple iOS and iPadOS, specifically the Safari Private Browsing feature. The issue is described as an authentication bypass in Private Browsing tabs, addressed through improved state management and fixed in iOS 17.2 and iPadOS 17.2. Public documents from NVD/Red Hat/CVE list...

CVE-2024-40839

CVE-2024-40839 affects Apple iOS and iPadOS (Lock Screen). Reported issue arises from improper/insufficient state management that could allow a local attacker with physical access to view notification contents on the lock screen. The vulnerability is fixed in iOS 17.5 and iPadOS 17.5. Connected s...

CVE-2025-31210

CVE-2025-31210 affects iOS/iPadOS where processing web content can cause a denial-of-service. Apple attributes this to a FaceTime-related/web-content handling issue and provides fixes in iPadOS 17.7.7, iOS 18.5, and iPadOS 18.5. The vulnerability is resolved by these updates; no exploitation deta...

CVE-2025-31225

Apple fixed CVE-2025-31225 in iOS 18.5 and iPadOS 18.5. The issue exposed privacy risk where call history from deleted apps could still appear in Spotlight search results. Affected products include iPhone XS and later and iPad models supported by iPadOS 18.5; the root cause is a privacy data hand...

CVE-2025-43425

CVE-2025-43425 is linked to WebKit/WebKitGTK family as described in connected advisories. The vuln manifests as processing maliciously crafted web content that may lead to an unexpected process crash. Concrete details across connected docs show multiple distributions addressing this via updated W...

CVE-2025-43502

This CVE pertains to a privacy issue in Apple platforms that could allow an app to bypass certain Privacy preferences. Affected products include iOS, iPadOS, macOS Tahoe, visionOS, and Safari, with fixes implemented in version 26.1 across these platforms. The underlying description repeatedly not...

CVE-2025-46279

CVE-2025-46279 describes a permissions issue in Apple operating systems where an app may identify other apps installed on a user’s device. Affected platforms include watchOS, iOS/iPadOS, macOS, visionOS, and tvOS. The root cause involves insufficient restrictions on app visibility of installed so...

CVE-2026-20635

CVE-2026-20635 involves WebKit/WebKitGTK memory handling, causing an unexpected process crash when parsing malicious web content. The CVE is fixed in Apple platforms: Safari 26.3, iOS 18.7.5 / iPadOS 18.7.5, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, watchOS 26.3, and also reflected in related a...

CVE-2026-28860

CVE-2026-28860 affects Apple platforms (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) with a local attacker able to modify the Keychain state due to insufficient input validation. Apple fixed the issue in multiple OS updates: iOS/iPadOS 18.7.7 and 26.4, macOS Sequoia 15.7.5, Sonoma 14.8.5, Tahoe 2...

CVE-2026-28942

CVE-2026-28942 is a use-after-free vulnerability in WebKitGTK/WebKit2GTK (processing malicious web content) that can cause an unexpected crash. The issue is referenced across multiple advisories (Red Hat, SUSE, Oracle Linux, Amazon Linux 2) and is addressed by platform-specific security updates. ...

CVE-2026-28986

CVE-2026-28986 is a race-condition vulnerability that Apple fixed with additional validation. According to connected sources, the issue could cause an app to trigger an unexpected system termination. It is addressed in multiple Apple OS updates: iOS 18.7.9 / iPadOS 18.7.9, iOS 26.5 / iPadOS 26.5,...

CVE-2026-43666

CVE-2026-43666 corresponds to an out-of-bounds write issue fixed by Apple in multiple platforms. Affected products include iOS 18.7.9 and iPadOS 18.7.9 (also 26.5 for iOS/iPadOS), macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5. The vulnerab...

CVE-2020-27902

CVE-2020-27902 is an Apple iOS/iPadOS vulnerability describing an authentication issue where a user with physical access could access stored passwords without authentication. Apple fixed this issue in iOS 14.2 and iPadOS 14.2 by improving state management. The CVE appears under Keyboard in the Ap...

CVE-2022-46715

CVE-2022-46715 is a logic issue in Apple iOS/iPadOS where an app may bypass certain Privacy preferences. Connected Apple security content specifies the issue exists in iOS prior to 16.1 and iPadOS prior to 16, with a fix in iOS 16.1 and iPadOS 16. The root cause is described as a logic issue addr...

CVE-2026-20636

CVE-2026-20636 is a memory-handling issue in the WebKit/Web content processing path that may lead to an unexpected process crash when processing malicious web content. According to the CVE entry, the vulnerability is fixed in Safari 26.3, iOS 26.3, iPadOS 26.3, macOS Tahoe 26.3, and visionOS 26.3...

CVE-2026-20688

CVE-2026-20688 describes a path handling issue fixed by improved validation. Affected software includes Apple operating systems: iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, and visionOS 26.4. The underlying flaw allows a malicious app to break out of its...

CVE-2026-28907

CVE-2026-28907 relates to improved input validation that fixes a CSP bypass when processing malicious web content. Affected products/contexts cited in connected docs include Safari 26.5; iOS 18.7.9, iPadOS 18.7.9 and 26.5; macOS Tahoe 26.5; tvOS 26.5; visionOS 26.5; watchOS 26.5. Remediation is p...

CVE-2026-43729

CVE-2026-43729: Apple fixed a local, memory-corruption issue triggered by processing a specially crafted image. Affected products include iOS/iPadOS 26.6 and macOS Sequoia 15.7.8, macOS Tahoe 26.6, tvOS 26.6, and visionOS 26.6. Root cause involves improved memory handling to address use-after-fre...

CVE-2026-43732

CVE-2026-43732 describes a path handling issue in WebKit used by Safari and Apple OS components. The vulnerability arises from insufficient validation in path handling when processing web content, potentially allowing disclosure of sensitive user information. Apple fixes are included in Safari 26...