CVE-2025-43383

CVE-2025-43383 is an out-of-bounds access issue resolved by improved bounds checking. Affected products/versions include tvOS 26.1, macOS Tahoe 26.1, iOS 26.1/iPadOS 26.1, iOS 18.7.2/iPadOS 18.7.2, macOS Sequoia 15.7.2, and visionOS 26.1. According to the sources, processing a maliciously crafted...

CVE-2025-43389

CVE-2025-43389 is a privacy issue affecting Apple platforms. The vulnerability was addressed by removing the vulnerable code, with fixes shipped in macOS Tahoe 26.1, macOS Sonoma 14.8.2, macOS Sequoia 15.7.2, visionOS 26.1, iOS 26.1 and iPadOS 26.1, and iOS 18.7.2 and iPadOS 18.7.2. Affected comp...

CVE-2025-43418

CVE-2025-43418 affects Apple iOS/iPadOS prior to versions 18.7.2 and 26.1, where an attacker with physical access to a locked device could view sensitive user information due to insufficient access controls on a locked state. Multiple connected sources confirm the fixed releases (iOS 18.7.2 / iPa...

CVE-2026-64742

CVE-2026-64742 is tied to Apple platforms where an app could access sensitive user data due to insecure network transmission; the issue is addressed by mandating HTTPS. Apple fixed it in iOS/iPadOS/tvOS/visionOS/watchOS 26.6. The combined sources confirm the vulnerability involved sending informa...

CVE-2025-43323

CVE-2025-43323 is an Apple privacy vulnerability addressed by adding entitlement checks. It affects visionOS, tvOS, iOS, iPadOS, and watchOS, with fixes in version 26 for all listed platforms. The issue allowed an app to fingerprint the user, and remediation is to upgrade to the specified OS rele...

CVE-2025-43350

CVE-2025-43350 is an iOS/iPadOS vulnerability describing a permissions issue that could allow an attacker to view restricted content from a locked device. The connected sources confirm this issue affects Apple iOS 26.1 and iPadOS 26.1, with Apple listing the fix in those updates. The base CVSS is...

CVE-2025-43362

CVE-2025-43362 affects Apple LaunchServices and relates to an issue where an app may be able to monitor keystrokes without user permission. Apple entries indicate the vulnerability was addressed with improved checks and that patches are available in iOS 18.7/iPadOS 18.7 and iOS 26/iPadOS 26. The ...

CVE-2025-43475

CVE-2025-43475 concerns Apple iOS and iPadOS logging. The affected software includes iOS and iPadOS prior to version 26.2. The root cause is a logging issue where sensitive data could be exposed due to insufficient redaction. The practical impact is that an app may access user‑sensitive data via ...

CVE-2026-28856

The CVE-2026-28856 issue is addressed with improved authentication and is fixed in iOS 26.4, iPadOS 26.4, visionOS 26.4, and watchOS 26.4. The description notes that an attacker with physical access to a locked device may view sensitive user information. The connected documents provide these vers...

CVE-2026-84609

A permissions issue was addressed with improved path validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to modify protected system files.

CVE-2025-43379

CVE-2025-43379 arises from insufficient validation of symlinks in Apple OS components. Affected products include tvOS, watchOS, macOS (Tahoe 26.1; Sequoia 15.7.2; Sonoma 14.8.2), iOS/iPadOS (26.1) and visionOS 26.1. The issue may allow an app to access protected user data due to improper symlink ...

CVE-2025-43498

CVE-2025-43498 describes an authorization issue resolved by improved state management in Apple products. The fixed products and versions are macOS Tahoe 26.1, iOS 26.1, iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, and visionOS 26.1. The issue could allow an app to access sensitive user...

CVE-2026-28967

CVE-2026-28967 describes a denial-of-service due to insufficient input validation, addressed in iOS 18.7.7 / iPadOS 18.7.7 and iOS 26.4 / iPadOS 26.4. The vulnerability can be triggered by an attacker in a privileged network position, leading to a service outage. Affected components are not speci...

CVE-2026-64760

An information leakage was addressed with additional validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. An app may be able to leak sensitive kernel state.

CVE-2026-20682

CVE-2026-20682 describes a logic issue in Apple iOS/iPadOS related to state management that could allow an attacker to discover a user’s deleted notes. Connected sources confirm the vulnerability affects iOS/iPadOS and have been addressed with updates: iOS 18.7.5 and iPadOS 18.7.5, and iOS 26.3 a...

CVE-2026-28873

The CVE-2026-28873 issue stems from insufficient entitlement checks that could allow an app to bypass App Privacy Report logging. Affected products include Apple iOS and iPadOS, with fixes in iOS 18.7.9, iPadOS 18.7.9, iOS 26.4, and iPadOS 26.4. The underlying root cause is entitlement verificati...

CVE-2026-28875

CVE-2026-28875 is a buffer overflow in the iOS/iPadOS Baseband stack that was mitigated by improved bounds checking. Apple lists this issue as fixed in iOS 26.4 and iPadOS 26.4, with the impact of allowing a remote attacker to cause a denial-of-service. No exploitation details are provided in the...

CVE-2026-64755

CVE-2026-64755 affects Apple iOS and iPadOS. The issue is described as an authorization problem tied to improved state management that could allow an app to access sensitive user data. The vulnerability is mitigated by updates to iOS 26.6 and iPadOS 26.6. The connected documents corroborate this ...

CVE-2026-65403

This issue was addressed with improved checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27, watchOS 27. An app may be able to access sensitive user data.

CVE-2026-43667

The vulnerability lies in Apple's AirDrop component on iOS/iPadOS. A reachable assertion triggered by crafted input from a privileged network position causes denial-of-service; the attacker needs user interaction (UI:R). Fixed in iOS 18.7.10 and iPadOS 18.7.10 via improved input validation. CVSS ...

CVE-2024-44238

CVE-2024-44238 is tied to Apple iOS/iPadOS and is described as an issue where an app may be able to corrupt coprocessor memory. The connected sources identify the root cause as bounds-check related and state that the vulnerability is fixed in iOS 18.1 and iPadOS 18.1, with remediation described a...

CVE-2026-28863

CVE-2026-28863 concerns a permissions issue that could allow an app to fingerprint a user. The entry is tied to Apple platforms and is fixed in iOS 26.4, iPadOS 26.4, tvOS 26.4, visionOS 26.4, and watchOS 26.4. Connected documents confirm a controlled update across these OS versions addressing th...

CVE-2026-28965

The CVE-2026-28965 vulnerability affects iOS and iPadOS, where a privacy issue could allow a user to view restricted content from the lock screen. It is fixed in iOS/iPadOS 26.5. Affected component is the OS’s content restriction/view logic; root cause details are not provided in the documents. R...

CVE-2024-54556

CVE-2024-54556 affects Apple devices running iOS 18.1 / iPadOS 18.1. The issue enables viewing restricted content from the lock screen due to a state-management flaw and has been fixed in the 18.1 updates. The description across sources consistently notes a "improved state management" fix with th...

CVE-2026-28963

CVE-2026-28963 affects iOS and iPadOS; a privacy issue was addressed by removing the vulnerable code and is fixed in iOS 26.5 and iPadOS 26.5 . An attacker with physical access could potentially use Visual Intelligence during iPhone Mirroring to access sensitive user data. The provided documents ...

CVE-2025-43450

CVE-2025-43450 describes a logic issue in Apple iOS/iPadOS where an app may learn information about the current camera view before being granted camera access. The issue is fixed in iOS 18.7.2 / iPadOS 18.7.2 and in iOS 26.1 / iPadOS 26.1. Affected products: iPhone XS and later, iPad Pro models, ...

CVE-2026-20678

Summary: CVE-2026-20678 is an authorization issue in Apple’s iOS and iPadOS that arises from improved state management. The vulnerability could allow an app to access sensitive user data. Affected products/versions: iOS and iPadOS prior to 18.7.5 and prior to 26.3; fixed in iOS 18.7.5 / iPadOS 18...

CVE-2026-86882

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted image may lead to unexpec...

CVE-2025-43422

CVE-2025-43422 affects Apple iOS/iPadOS; vulnerability arises in Stolen Device Protection and is fixed in iOS 26.1/iPadOS 26.1. An attacker with physical access could disable Stolen Device Protection, per Red Hat/NVD/NCSC entries and Apple security content. Remediation: update to iOS 26.1 / iPadO...

CVE-2026-20663

CVE-2026-20663 affects Apple iOS/iPadOS where an app may enumerate installed apps due to improper logging handling. The issue is fixed in iOS 18.7.5/iPadOS 18.7.5 and iOS 26.3/iPadOS 26.3; affected builds prior to these versions are vulnerable. Root cause: sanitized logging mitigates the issue. P...

CVE-2026-28895

The CVE-2026-28895 entry is confirmed by connected documents: iOS 26.4 and iPadOS 26.4 fix the issue. Attacker with physical access on a device with Stolen Device Protection enabled could access biometrics-gated Protected Apps using the passcode. Root cause is described as improved checks, with r...

CVE-2026-43657

Apple addressed a permissions issue in iOS 26.5 and iPadOS 26.5 that allowed a malicious app to enumerate installed apps on the device. The fix introduces additional restrictions to limit the information a third-party app can discover about other installed applications. The issue carries a CVSS 3...

CVE-2026-65367

CVE-2026-65367 is a null pointer dereference in Apple iOS/iPadOS , addressed with improved input validation. An app may be able to cause unexpected system termination , representing a local denial-of-service. The CVSS 3.1 score is 5.5 (MEDIUM) , with a local attack vector, low complexity, low pri...

CVE-2026-65410

The issue was addressed with improved checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination.

CVE-2026-86881

A certificate validation issue was addressed with improved certificate validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An attacker with a compromised intermediate certi...

CVE-2025-43452

CVE-2025-43452 affects Apple iOS/iPadOS keyboard suggestions that may reveal sensitive information on the lock screen. Public documentation confirms the issue, with remediation in iOS 26.1 and iPadOS 26.1. The core problem is a design/privacy weakness in keyboard suggestions displayed when a devi...

CVE-2026-20661

CVE-2026-20661 concerns an authorization issue arising from improved state management in Apple iOS and iPadOS. Technical details across connected sources show that affected products are iOS and iPadOS prior to versions 18.7.5 and 26.3. The issue could allow an attacker with physical access to a l...

CVE-2026-65402

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination.

CVE-2026-86869

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, macOS Golden Gate 27. Processing a maliciously crafted image may lead to unexpected app termination.

CVE-2026-86876

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27, watchOS 27. A sandboxed process may be able to circumvent sandbox restrictions.

CVE-2026-20683

An authentication issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27. An app may be able to use the Sign In With Apple authentication flow to access the user's Apple Account.

CVE-2026-86886

A path traversal issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, watchOS 27. An app may be able to modify protected system files.

CVE-2025-43454

CVE-2025-43454 is tied to Apple iOS/iPadOS security updates. Affected components: Siri stack on iOS 18.7.2/iPadOS 18.7.2 and iOS 26.1/iPadOS 26.1. Root cause described as improper state management that could allow a device to persistently fail to lock. Impact is described as a device remaining un...

CVE-2025-43460

CVE-2025-43460 affects Apple iOS and iPadOS through a logic issue that allows an attacker with physical access to a locked device to view sensitive user information. The vulnerability is tied to insufficient checks and is fixed in iOS 26.1 and iPadOS 26.1. Affected component details are not expli...

CVE-2026-43702

The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, iOS 26.7 and iPadOS 26.7, macOS Sequoia 15.8, macOS Tahoe 26.6, macOS Tahoe 26.7, tvOS 26.6, watchOS 26.6. Processing a maliciously crafted video file may lead to unexpected app termination or ...

CVE-2026-43737

An authorization issue was addressed with improved validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, watchOS 27. An app may be able to access motion data from headphones without user consent.

CVE-2026-64752

A memory corruption issue was addressed by removing the vulnerable code. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Processing a maliciously crafted image may lead to arbitrary code execution.

CVE-2026-28968

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination ...

CVE-2026-65411

A path handling issue was addressed with improved validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, visionOS 27. An app may be able to modify protected parts of the file system.

CVE-2026-84635

A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to an unexpected process termination.