CVE-2025-43362

CVE-2025-43362 affects Apple LaunchServices and relates to an issue where an app may be able to monitor keystrokes without user permission. Apple entries indicate the vulnerability was addressed with improved checks and that patches are available in iOS 18.7/iPadOS 18.7 and iOS 26/iPadOS 26. The ...

CVE-2025-43379

CVE-2025-43379 arises from insufficient validation of symlinks in Apple OS components. Affected products include tvOS, watchOS, macOS (Tahoe 26.1; Sequoia 15.7.2; Sonoma 14.8.2), iOS/iPadOS (26.1) and visionOS 26.1. The issue may allow an app to access protected user data due to improper symlink ...

CVE-2025-43475

CVE-2025-43475 concerns Apple iOS and iPadOS logging. The affected software includes iOS and iPadOS prior to version 26.2. The root cause is a logging issue where sensitive data could be exposed due to insufficient redaction. The practical impact is that an app may access user‑sensitive data via ...

CVE-2026-28874

CVE-2026-28874 is an Apple/security advisory entry that was addressed with improved checks and fixed in iOS 26.4 and iPadOS 26.4. Multiple connected sources (Apple, NVD, Red Hat, CIRCL, EUVD, and others) corroborate that the issue could allow a remote attacker to cause an unexpected app terminati...

CVE-2025-43309

CVE-2025-43309 describes a logic issue in iOS/iPadOS that could allow a physically proximate attacker to view lock-screen notification contents. Affected software is iOS 26 and iPadOS 26. Root cause cited as a logic/checks issue; Apple patched this with the iOS 26 / iPadOS 26 security updates. Im...

CVE-2025-43418

CVE-2025-43418 affects Apple iOS/iPadOS prior to versions 18.7.2 and 26.1, where an attacker with physical access to a locked device could view sensitive user information due to insufficient access controls on a locked state. Multiple connected sources confirm the fixed releases (iOS 18.7.2 / iPa...

CVE-2025-43498

CVE-2025-43498 describes an authorization issue resolved by improved state management in Apple products. The fixed products and versions are macOS Tahoe 26.1, iOS 26.1, iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, and visionOS 26.1. The issue could allow an app to access sensitive user...

CVE-2026-64760

CVE-2026-64760 is an information leakage vulnerability in iOS and iPadOS where a malicious app may be able to leak sensitive kernel state . The issue was addressed with additional validation , indicating insufficient input validation as the underlying cause. It is fixed in iOS 18.7.10 and iPadOS ...

CVE-2026-20682

CVE-2026-20682 describes a logic issue in Apple iOS/iPadOS related to state management that could allow an attacker to discover a user’s deleted notes. Connected sources confirm the vulnerability affects iOS/iPadOS and have been addressed with updates: iOS 18.7.5 and iPadOS 18.7.5, and iOS 26.3 a...

CVE-2026-28875

CVE-2026-28875 is a buffer overflow in the iOS/iPadOS Baseband stack that was mitigated by improved bounds checking. Apple lists this issue as fixed in iOS 26.4 and iPadOS 26.4, with the impact of allowing a remote attacker to cause a denial-of-service. No exploitation details are provided in the...

CVE-2026-64755

CVE-2026-64755 affects Apple iOS and iPadOS. The issue is described as an authorization problem tied to improved state management that could allow an app to access sensitive user data. The vulnerability is mitigated by updates to iOS 26.6 and iPadOS 26.6. The connected documents corroborate this ...

CVE-2025-43350

CVE-2025-43350 is an iOS/iPadOS vulnerability describing a permissions issue that could allow an attacker to view restricted content from a locked device. The connected sources confirm this issue affects Apple iOS 26.1 and iPadOS 26.1, with Apple listing the fix in those updates. The base CVSS is...

CVE-2026-28967

CVE-2026-28967 describes a denial-of-service due to insufficient input validation, addressed in iOS 18.7.7 / iPadOS 18.7.7 and iOS 26.4 / iPadOS 26.4. The vulnerability can be triggered by an attacker in a privileged network position, leading to a service outage. Affected components are not speci...

CVE-2026-43667

The vulnerability lies in Apple's AirDrop component on iOS/iPadOS. A reachable assertion triggered by crafted input from a privileged network position causes denial-of-service; the attacker needs user interaction (UI:R). Fixed in iOS 18.7.10 and iPadOS 18.7.10 via improved input validation. CVSS ...

CVE-2024-44238

CVE-2024-44238 is tied to Apple iOS/iPadOS and is described as an issue where an app may be able to corrupt coprocessor memory. The connected sources identify the root cause as bounds-check related and state that the vulnerability is fixed in iOS 18.1 and iPadOS 18.1, with remediation described a...

CVE-2026-28863

CVE-2026-28863 concerns a permissions issue that could allow an app to fingerprint a user. The entry is tied to Apple platforms and is fixed in iOS 26.4, iPadOS 26.4, tvOS 26.4, visionOS 26.4, and watchOS 26.4. Connected documents confirm a controlled update across these OS versions addressing th...

CVE-2025-43437

CVE-2025-43437 describes an information disclosure where an app may fingerprint a user, due to privacy control weaknesses. The vulnerability is fixed in iOS 26.1 and iPadOS 26.1. Affected: Apple iOS and iPadOS prior to 26.1. Remediation: upgrade to iOS 26.1 / iPadOS 26.1 or later. Public details ...

CVE-2026-28965

The CVE-2026-28965 vulnerability affects iOS and iPadOS, where a privacy issue could allow a user to view restricted content from the lock screen. It is fixed in iOS/iPadOS 26.5. Affected component is the OS’s content restriction/view logic; root cause details are not provided in the documents. R...

CVE-2026-43689

CVE-2026-43689 is a permissions issue in Apple's operating systems, resolved by adding additional restrictions. A malicious app may be able to gain root privileges , representing a significant local privilege escalation. The issue affects iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gat...

CVE-2026-28873

The CVE-2026-28873 issue stems from insufficient entitlement checks that could allow an app to bypass App Privacy Report logging. Affected products include Apple iOS and iPadOS, with fixes in iOS 18.7.9, iPadOS 18.7.9, iOS 26.4, and iPadOS 26.4. The underlying root cause is entitlement verificati...

CVE-2026-28963

CVE-2026-28963 affects iOS and iPadOS; a privacy issue was addressed by removing the vulnerable code and is fixed in iOS 26.5 and iPadOS 26.5 . An attacker with physical access could potentially use Visual Intelligence during iPhone Mirroring to access sensitive user data. The provided documents ...

CVE-2024-54556

CVE-2024-54556 affects Apple devices running iOS 18.1 / iPadOS 18.1. The issue enables viewing restricted content from the lock screen due to a state-management flaw and has been fixed in the 18.1 updates. The description across sources consistently notes a "improved state management" fix with th...

CVE-2026-20663

CVE-2026-20663 affects Apple iOS/iPadOS where an app may enumerate installed apps due to improper logging handling. The issue is fixed in iOS 18.7.5/iPadOS 18.7.5 and iOS 26.3/iPadOS 26.3; affected builds prior to these versions are vulnerable. Root cause: sanitized logging mitigates the issue. P...

CVE-2025-43422

CVE-2025-43422 affects Apple iOS/iPadOS; vulnerability arises in Stolen Device Protection and is fixed in iOS 26.1/iPadOS 26.1. An attacker with physical access could disable Stolen Device Protection, per Red Hat/NVD/NCSC entries and Apple security content. Remediation: update to iOS 26.1 / iPadO...

CVE-2026-20678

Summary: CVE-2026-20678 is an authorization issue in Apple’s iOS and iPadOS that arises from improved state management. The vulnerability could allow an app to access sensitive user data. Affected products/versions: iOS and iPadOS prior to 18.7.5 and prior to 26.3; fixed in iOS 18.7.5 / iPadOS 18...

CVE-2025-43450

CVE-2025-43450 describes a logic issue in Apple iOS/iPadOS where an app may learn information about the current camera view before being granted camera access. The issue is fixed in iOS 18.7.2 / iPadOS 18.7.2 and in iOS 26.1 / iPadOS 26.1. Affected products: iPhone XS and later, iPad Pro models, ...

CVE-2026-28895

The CVE-2026-28895 entry is confirmed by connected documents: iOS 26.4 and iPadOS 26.4 fix the issue. Attacker with physical access on a device with Stolen Device Protection enabled could access biometrics-gated Protected Apps using the passcode. Root cause is described as improved checks, with r...

CVE-2026-65367

CVE-2026-65367 is a null pointer dereference in Apple iOS/iPadOS , addressed with improved input validation. An app may be able to cause unexpected system termination , representing a local denial-of-service. The CVSS 3.1 score is 5.5 (MEDIUM) , with a local attack vector, low complexity, low pri...

CVE-2026-20661

CVE-2026-20661 concerns an authorization issue arising from improved state management in Apple iOS and iPadOS. Technical details across connected sources show that affected products are iOS and iPadOS prior to versions 18.7.5 and 26.3. The issue could allow an attacker with physical access to a l...

CVE-2026-43657

Apple addressed a permissions issue in iOS 26.5 and iPadOS 26.5 that allowed a malicious app to enumerate installed apps on the device. The fix introduces additional restrictions to limit the information a third-party app can discover about other installed applications. The issue carries a CVSS 3...

CVE-2026-84607

A race condition was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. A sandboxed app may be able to execute arbitrary code with kernel pri...

CVE-2025-43452

CVE-2025-43452 affects Apple iOS/iPadOS keyboard suggestions that may reveal sensitive information on the lock screen. Public documentation confirms the issue, with remediation in iOS 26.1 and iPadOS 26.1. The core problem is a design/privacy weakness in keyboard suggestions displayed when a devi...

CVE-2025-43460

CVE-2025-43460 affects Apple iOS and iPadOS through a logic issue that allows an attacker with physical access to a locked device to view sensitive user information. The vulnerability is tied to insufficient checks and is fixed in iOS 26.1 and iPadOS 26.1. Affected component details are not expli...

CVE-2026-65402

CVE-2026-65402 is a use-after-free flaw in Apple's operating systems, addressed through improved memory management . An app may be able to cause unexpected system termination (denial of service). The flaw affects macOS Sequoia prior to 15.8, macOS Tahoe prior to 26.7, macOS Golden Gate 27, and iO...

CVE-2026-86882

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted image may lead to unexpec...

CVE-2025-43454

CVE-2025-43454 is tied to Apple iOS/iPadOS security updates. Affected components: Siri stack on iOS 18.7.2/iPadOS 18.7.2 and iOS 26.1/iPadOS 26.1. Root cause described as improper state management that could allow a device to persistently fail to lock. Impact is described as a device remaining un...

CVE-2025-43449

CVE-2025-43449 relates to a cache mishandling issue in Apple iOS/iPadOS that could allow a malicious app to track users between installs. The connected sources confirm the vulnerability affects iOS 26.1 and iPadOS 26.1, with Apple issuing fixes in those releases by addressing cache handling. The ...

CVE-2025-43439

CVE-2025-43439 affects Apple platforms (iOS, iPadOS, visionOS). Description and connected references indicate a privacy issue where an app may fingerprint the user, addressed by removing sensitive data. Fixes are included in iOS 18.7.2, iPadOS 18.7.2, iOS 26.1, iPadOS 26.1, and visionOS 26.1. Pra...

CVE-2026-20683

CVE-2026-20683 is an authentication flaw in Apple's Sign In With Apple flow, affecting iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, and visionOS 27. An app may be able to use the Sign In With Apple authentication flow to access the user's Apple Account without pr...

CVE-2026-86876

CVE-2026-86876 is an out-of-bounds write vulnerability in multiple Apple operating systems, fixed with improved bounds checking . The affected products include iOS 26.7/iPadOS 26.7, iOS 27/iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27, and watchOS 27 . The imp...

CVE-2026-28960

CVE-2026-28960 is a denial-of-service vulnerability in Apple iOS 18.7 and iPadOS 18.7 , addressed with improved validation . A remote attacker with no privileges or user interaction may cause a denial-of-service. The issue is fixed in iOS 18.7.10 and iPadOS 18.7.10 . The CVSS v3.1 base score is 7...

CVE-2026-65410

CVE-2026-65410 affects Apple's AVEVideoEncoder component across multiple platforms (iOS 26.7/27, iPadOS 26.7/27, macOS Tahoe 26.7 / Golden Gate 27, tvOS 27, visionOS 27, watchOS 27). Apple describes the fix as "improved checks" without specifying the underlying flaw type. The impact is that an ap...

CVE-2026-86881

CVE-2026-86881 is a certificate validation flaw in Apple platforms where an attacker with a compromised intermediate certificate authority may issue certificates with arbitrary extended key usages , potentially enabling unauthorized access to sensitive data or man-in-the-middle attacks. The issue...

CVE-2026-65398

CVE-2026-65398 is an out-of-bounds access vulnerability in Apple's operating systems, addressed with improved bounds checking. An app may be able to cause unexpected system termination or corrupt kernel memory . The flaw affects iOS, iPadOS, macOS, tvOS, visionOS, and watchOS , and is fixed in iO...

CVE-2026-84533

CVE-2026-84533 is a cryptographic issue in Apple's operating systems affecting iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, and watchOS 27 . The vulnerability was addressed through improved integrity checks. An attacker in a privileged network position may be able to modify network traffic, ...

CVE-2026-43686

A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Connecting to a malicious NFS server may lead to kernel memory...

CVE-2026-43785

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27. An app may be able to modify a file it only had permission to read.

CVE-2026-65395

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27. Processing a maliciously crafted image may result in memory corruption.

CVE-2026-84511

CVE-2026-84511 is an out-of-bounds write in Apple's CoreUI component, triggered by processing a maliciously crafted asset catalog , leading to unexpected process termination (denial of service). The fix applies improved bounds checking and is shipped in iOS 27, iPadOS 27, macOS Golden Gate 27, ma...

CVE-2026-84534

CVE-2026-84534 is a path handling issue in Apple's archive extraction functionality, where insufficient validation allowed a maliciously crafted archive to enable writing arbitrary files. The vulnerability requires local access and user interaction (extracting the archive), with high integrity im...