CVE-2026-65404

CVE-2026-65404 is an authorization flaw in Apple's Accounts component, affecting iOS 18.7.10, iPadOS 18.7.10, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.7.8, and macOS Sonoma 14.8.8 . The root cause is a state-management issue that allows a malicious application to bypass Privacy p...

CVE-2026-84596

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted font may result in the disclosure of process memory.

CVE-2026-64761

CVE-2026-64761 affects the Accessibility component of iOS and iPadOS , specifically devices from iPhone 11 and later through various iPad models. The root cause is a privacy issue in the handling of user preferences , which allows an app to identify what other apps a user has installed. The vulne...

CVE-2026-84491

CVE-2026-84491 is a permissions issue in Apple platforms, fixed in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27 . An app may be able to access sensitive user data due to insufficient access restrictions. The CVSS 3.1 score is 5.5 (Medium) wi...

CVE-2026-84551

CVE-2026-84551 affects Apple's iOS 27 , iPadOS 27 , macOS Golden Gate 27 , visionOS 27 , and watchOS 27 . It stems from a logic issue addressed through improved validation, which may allow an app to bypass network restrictions . The NVD-assigned CVSS 3.1 score is 4.4 (Medium) with a local attack ...

CVE-2026-84561

CVE-2026-84561 is a double free memory management flaw across multiple Apple platforms, including macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7 , iOS/iPadOS 26.7 and 27, tvOS 27, visionOS 27, and watchOS 27. An app may cause unexpected system termination or kernel memory corruption ,...

CVE-2026-86878

CVE-2026-86878 is a permissions issue in iOS 27 and iPadOS 27 that allows an app to potentially access sensitive user data . Apple addressed it by applying additional restrictions, as noted in their security update (support.apple.com ). The vulnerability carries a CVSS 3.1 score of 5.5 (Medium) w...

CVE-2026-86895

CVE-2026-86895 is an information disclosure vulnerability in the CloudKit framework affecting iOS 27, iPadOS 27, tvOS 27, visionOS 27, and watchOS 27 . A local app may be able to read a persistent account identifier , enabling user tracking or fingerprinting across apps. The root cause was addres...

CVE-2026-86905

This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. An app may be able to delete credentials stored in Keychain.

CVE-2026-65390

CVE-2026-65390 is an integer overflow in Safari's WebKit WebRTC component, addressed with improved input validation. Processing maliciously crafted web content may lead to memory corruption . The vulnerability is available for macOS Sonoma and macOS Sequoia , and is fixed in Safari 26.6.1 , iOS 2...

CVE-2026-65405

CVE-2026-65405 is a memory initialization issue in Apple products, fixed with improved memory handling. The affected platforms include iOS/iPadOS 26.7 and 27 , macOS Golden Gate 27, Sequoia 15.8, and Tahoe 26.7 , as well as tvOS 27, visionOS 27, and watchOS 27 . The core impact is that an app may...

CVE-2026-65406

CVE-2026-65406 is a logic issue in Apple's BackgroundAssets component, disclosed by Ye Zhang (@VAR10CK) of Baidu Security . The vulnerability allows an app to access sensitive user data due to insufficient validation, and was fixed by improved validation . It affects iOS 26.7/iPadOS 26.7, iOS 27/...

CVE-2026-65409

CVE-2026-65409 is a type confusion vulnerability in Apple's operating systems, addressed with improved memory handling . The flaw allows an app to cause a denial of service , with a CVSS v3.1 score of 5.5 (Medium) reflecting a local attack vector requiring user interaction and high availability i...

CVE-2026-65415

A race condition was addressed with additional validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. A local user may be able to cause unexpected system termination or read kernel memory.

CVE-2026-84487

CVE-2026-84487 is an integer overflow in Apple products, addressed with improved input validation. Processing a maliciously crafted file may result in disclosure of process memory , with a high confidentiality impact but no integrity or availability impact (CVSS 6.5, MEDIUM). User interaction is ...

CVE-2026-84489

A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. An app may be able to cause a denial of service.

CVE-2026-84518

CVE-2026-84518 is an information disclosure vulnerability in Apple products affecting Safari, iOS, iPadOS, and macOS . The root cause is a flaw in state management , which allowed a malicious website to determine which apps a user has installed. The issue was addressed through improved state mana...

CVE-2026-84575

CVE-2026-84575 is an out-of-bounds write in the CoreUI framework across multiple Apple platforms, fixed in iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27 . The issue was addressed with improved bounds checking. Processing a mali...

CVE-2026-84583

CVE-2026-84583 affects Apple's AuthKit component across multiple platforms. A permissions issue allowed a local app to read a persistent account identifier , a privacy-relevant information disclosure. The flaw was resolved through additional restrictions in iOS 26.7/iPadOS 26.7, iOS 27/iPadOS 27,...

CVE-2026-86885

An input validation issue was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27. An attacker in radio range may be able to cause unexpected system termination.

CVE-2026-64717

A race condition in Apple's kernel, addressed with improved state handling, may allow a malicious app to cause unexpected system termination or corrupt kernel memory . The vulnerability requires a local attack with user interaction and high complexity, rated CVSS 6.3 (Medium) . No specific kernel...

CVE-2026-65355

CVE-2026-65355 is an information disclosure vulnerability in Apple Private Relay , where improper state management allowed a website to determine a user's real IP address even with Private Relay enabled. The issue is rated CVSS 4.3 (Medium) with required user interaction and low confidentiality i...

CVE-2026-84492

A race condition was addressed with improved state handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination.

CVE-2026-84497

CVE-2026-84497 is a buffer overflow in Apple products that was addressed with improved size validation . The primary impact is that opening a maliciously crafted file may lead to unexpected process termination . The vulnerability affects a wide range of Apple platforms and is fixed in iOS 26.7/iP...

CVE-2026-84552

CVE-2026-84552 is a memory handling vulnerability in Apple iOS , iPadOS , and macOS that may allow an app to cause unexpected system termination (denial of service). The NVD-assigned CVSS 3.1 score is 5.5 (MEDIUM) with a local attack vector, low privileges required, and no user interaction needed...

CVE-2026-86890

CVE-2026-86890 is a logic issue in Apple iOS and iPadOS addressed with improved checks. An attacker with physical access to a locked device may be able to view sensitive user information . The vulnerability is fixed in iOS 26.7, iPadOS 26.7, iOS 27, and iPadOS 27 . CVSS score is 4.6 (MEDIUM) with...