CVE-2026-28874

CVE-2026-28874 is an Apple/security advisory entry that was addressed with improved checks and fixed in iOS 26.4 and iPadOS 26.4. Multiple connected sources (Apple, NVD, Red Hat, CIRCL, EUVD, and others) corroborate that the issue could allow a remote attacker to cause an unexpected app terminati...

CVE-2025-43383

CVE-2025-43383 is an out-of-bounds access issue resolved by improved bounds checking. Affected products/versions include tvOS 26.1, macOS Tahoe 26.1, iOS 26.1/iPadOS 26.1, iOS 18.7.2/iPadOS 18.7.2, macOS Sequoia 15.7.2, and visionOS 26.1. According to the sources, processing a maliciously crafted...

CVE-2025-43418

CVE-2025-43418 affects Apple iOS/iPadOS prior to versions 18.7.2 and 26.1, where an attacker with physical access to a locked device could view sensitive user information due to insufficient access controls on a locked state. Multiple connected sources confirm the fixed releases (iOS 18.7.2 / iPa...

CVE-2026-64742

CVE-2026-64742 is tied to Apple platforms where an app could access sensitive user data due to insecure network transmission; the issue is addressed by mandating HTTPS. Apple fixed it in iOS/iPadOS/tvOS/visionOS/watchOS 26.6. The combined sources confirm the vulnerability involved sending informa...

CVE-2025-43323

CVE-2025-43323 is an Apple privacy vulnerability addressed by adding entitlement checks. It affects visionOS, tvOS, iOS, iPadOS, and watchOS, with fixes in version 26 for all listed platforms. The issue allowed an app to fingerprint the user, and remediation is to upgrade to the specified OS rele...

CVE-2025-43350

CVE-2025-43350 is an iOS/iPadOS vulnerability describing a permissions issue that could allow an attacker to view restricted content from a locked device. The connected sources confirm this issue affects Apple iOS 26.1 and iPadOS 26.1, with Apple listing the fix in those updates. The base CVSS is...

CVE-2025-43362

CVE-2025-43362 affects Apple LaunchServices and relates to an issue where an app may be able to monitor keystrokes without user permission. Apple entries indicate the vulnerability was addressed with improved checks and that patches are available in iOS 18.7/iPadOS 18.7 and iOS 26/iPadOS 26. The ...

CVE-2025-43475

CVE-2025-43475 concerns Apple iOS and iPadOS logging. The affected software includes iOS and iPadOS prior to version 26.2. The root cause is a logging issue where sensitive data could be exposed due to insufficient redaction. The practical impact is that an app may access user‑sensitive data via ...

CVE-2026-28856

The CVE-2026-28856 issue is addressed with improved authentication and is fixed in iOS 26.4, iPadOS 26.4, visionOS 26.4, and watchOS 26.4. The description notes that an attacker with physical access to a locked device may view sensitive user information. The connected documents provide these vers...

CVE-2026-84609

CVE-2026-84609 is a permissions issue in Apple's operating systems, addressed through improved path validation . The vulnerability allows an app to modify protected system files , potentially undermining system integrity. It is fixed in iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8,...

CVE-2025-43379

CVE-2025-43379 arises from insufficient validation of symlinks in Apple OS components. Affected products include tvOS, watchOS, macOS (Tahoe 26.1; Sequoia 15.7.2; Sonoma 14.8.2), iOS/iPadOS (26.1) and visionOS 26.1. The issue may allow an app to access protected user data due to improper symlink ...

CVE-2025-43498

CVE-2025-43498 describes an authorization issue resolved by improved state management in Apple products. The fixed products and versions are macOS Tahoe 26.1, iOS 26.1, iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, and visionOS 26.1. The issue could allow an app to access sensitive user...

CVE-2026-28967

CVE-2026-28967 describes a denial-of-service due to insufficient input validation, addressed in iOS 18.7.7 / iPadOS 18.7.7 and iOS 26.4 / iPadOS 26.4. The vulnerability can be triggered by an attacker in a privileged network position, leading to a service outage. Affected components are not speci...

CVE-2026-64760

CVE-2026-64760 is an information leakage vulnerability in Apple's operating systems. An app may be able to leak sensitive kernel state , which was addressed with additional validation. The affected products are iOS 18.7.x / iPadOS 18.7.x , iOS 27 / iPadOS 27 , macOS Golden Gate 27 , tvOS 27 , vis...

CVE-2026-20682

CVE-2026-20682 describes a logic issue in Apple iOS/iPadOS related to state management that could allow an attacker to discover a user’s deleted notes. Connected sources confirm the vulnerability affects iOS/iPadOS and have been addressed with updates: iOS 18.7.5 and iPadOS 18.7.5, and iOS 26.3 a...

CVE-2026-28873

The CVE-2026-28873 issue stems from insufficient entitlement checks that could allow an app to bypass App Privacy Report logging. Affected products include Apple iOS and iPadOS, with fixes in iOS 18.7.9, iPadOS 18.7.9, iOS 26.4, and iPadOS 26.4. The underlying root cause is entitlement verificati...

CVE-2026-28875

CVE-2026-28875 is a buffer overflow in the iOS/iPadOS Baseband stack that was mitigated by improved bounds checking. Apple lists this issue as fixed in iOS 26.4 and iPadOS 26.4, with the impact of allowing a remote attacker to cause a denial-of-service. No exploitation details are provided in the...

CVE-2026-64755

CVE-2026-64755 affects Apple iOS and iPadOS. The issue is described as an authorization problem tied to improved state management that could allow an app to access sensitive user data. The vulnerability is mitigated by updates to iOS 26.6 and iPadOS 26.6. The connected documents corroborate this ...

CVE-2026-65403

CVE-2026-65403 is an improper access control vulnerability in Apple platforms that may allow an app to access sensitive user data . The issue was addressed with improved checks and is fixed in iOS 26.7 / iPadOS 26.7, iOS 27 / iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, ...

CVE-2026-43667

The vulnerability lies in Apple's AirDrop component on iOS/iPadOS. A reachable assertion triggered by crafted input from a privileged network position causes denial-of-service; the attacker needs user interaction (UI:R). Fixed in iOS 18.7.10 and iPadOS 18.7.10 via improved input validation. CVSS ...

CVE-2024-44238

CVE-2024-44238 is tied to Apple iOS/iPadOS and is described as an issue where an app may be able to corrupt coprocessor memory. The connected sources identify the root cause as bounds-check related and state that the vulnerability is fixed in iOS 18.1 and iPadOS 18.1, with remediation described a...

CVE-2026-28863

CVE-2026-28863 concerns a permissions issue that could allow an app to fingerprint a user. The entry is tied to Apple platforms and is fixed in iOS 26.4, iPadOS 26.4, tvOS 26.4, visionOS 26.4, and watchOS 26.4. Connected documents confirm a controlled update across these OS versions addressing th...

CVE-2026-28965

The CVE-2026-28965 vulnerability affects iOS and iPadOS, where a privacy issue could allow a user to view restricted content from the lock screen. It is fixed in iOS/iPadOS 26.5. Affected component is the OS’s content restriction/view logic; root cause details are not provided in the documents. R...

CVE-2026-86882

CVE-2026-86882 is an out-of-bounds write vulnerability in Apple's Accelerate Framework , addressed with improved bounds checking. Processing a maliciously crafted image may lead to unexpected process termination (denial of service). The vulnerability affects a wide range of Apple platforms, with ...

CVE-2024-54556

CVE-2024-54556 affects Apple devices running iOS 18.1 / iPadOS 18.1. The issue enables viewing restricted content from the lock screen due to a state-management flaw and has been fixed in the 18.1 updates. The description across sources consistently notes a "improved state management" fix with th...

CVE-2026-28963

CVE-2026-28963 affects iOS and iPadOS; a privacy issue was addressed by removing the vulnerable code and is fixed in iOS 26.5 and iPadOS 26.5 . An attacker with physical access could potentially use Visual Intelligence during iPhone Mirroring to access sensitive user data. The provided documents ...

CVE-2025-43422

CVE-2025-43422 affects Apple iOS/iPadOS; vulnerability arises in Stolen Device Protection and is fixed in iOS 26.1/iPadOS 26.1. An attacker with physical access could disable Stolen Device Protection, per Red Hat/NVD/NCSC entries and Apple security content. Remediation: update to iOS 26.1 / iPadO...

CVE-2025-43450

CVE-2025-43450 describes a logic issue in Apple iOS/iPadOS where an app may learn information about the current camera view before being granted camera access. The issue is fixed in iOS 18.7.2 / iPadOS 18.7.2 and in iOS 26.1 / iPadOS 26.1. Affected products: iPhone XS and later, iPad Pro models, ...

CVE-2026-20678

Summary: CVE-2026-20678 is an authorization issue in Apple’s iOS and iPadOS that arises from improved state management. The vulnerability could allow an app to access sensitive user data. Affected products/versions: iOS and iPadOS prior to 18.7.5 and prior to 26.3; fixed in iOS 18.7.5 / iPadOS 18...

CVE-2026-28895

The CVE-2026-28895 entry is confirmed by connected documents: iOS 26.4 and iPadOS 26.4 fix the issue. Attacker with physical access on a device with Stolen Device Protection enabled could access biometrics-gated Protected Apps using the passcode. Root cause is described as improved checks, with r...

CVE-2026-20663

CVE-2026-20663 affects Apple iOS/iPadOS where an app may enumerate installed apps due to improper logging handling. The issue is fixed in iOS 18.7.5/iPadOS 18.7.5 and iOS 26.3/iPadOS 26.3; affected builds prior to these versions are vulnerable. Root cause: sanitized logging mitigates the issue. P...

CVE-2026-20661

CVE-2026-20661 concerns an authorization issue arising from improved state management in Apple iOS and iPadOS. Technical details across connected sources show that affected products are iOS and iPadOS prior to versions 18.7.5 and 26.3. The issue could allow an attacker with physical access to a l...

CVE-2026-20683

CVE-2026-20683 is an authentication issue in the Apple Account component, specifically within the Sign In With Apple flow. The root cause was addressed through improved state management . The impact is that a malicious app may be able to leverage the Sign In With Apple authentication flow to acce...

CVE-2026-65410

CVE-2026-65410 is a vulnerability in Apple's AVEVideoEncoder component, present across iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. The issue was addressed with improved checks , though no further root-cause detail is provided. The impact is that an app may be able to cause unexpected system ...

CVE-2026-86881

CVE-2026-86881 is a certificate validation flaw in Apple platforms (iOS, iPadOS, macOS, tvOS, visionOS, watchOS). An attacker with a compromised intermediate certificate authority could issue certificates carrying arbitrary extended key usages , potentially enabling unauthorized trust. CISA's SSV...

CVE-2026-43657

Apple addressed a permissions issue in iOS 26.5 and iPadOS 26.5 that allowed a malicious app to enumerate installed apps on the device. The fix introduces additional restrictions to limit the information a third-party app can discover about other installed applications. The issue carries a CVSS 3...

CVE-2026-65367

CVE-2026-65367 is a null pointer dereference in Apple iOS/iPadOS , addressed with improved input validation. An app may be able to cause unexpected system termination , representing a local denial-of-service. The CVSS 3.1 score is 5.5 (MEDIUM) , with a local attack vector, low complexity, low pri...

CVE-2026-65402

CVE-2026-65402 is a use-after-free vulnerability in Apple's operating systems, addressed through improved memory management. The flaw allows an app to cause unexpected system termination (denial of service). Fixes are available in iOS/iPadOS 26.7 and 27, macOS Golden Gate 27, Sequoia 15.8, Tahoe ...

CVE-2026-86876

CVE-2026-86876 is an out-of-bounds write vulnerability in Apple's CoreMedia framework, discovered by Chris Bailey (Short Circuit). The flaw allowed a sandboxed process to circumvent sandbox restrictions , meaning a malicious app confined by sandbox boundaries could escape those constraints. The i...

CVE-2025-43452

CVE-2025-43452 affects Apple iOS/iPadOS keyboard suggestions that may reveal sensitive information on the lock screen. Public documentation confirms the issue, with remediation in iOS 26.1 and iPadOS 26.1. The core problem is a design/privacy weakness in keyboard suggestions displayed when a devi...

CVE-2026-43702

CVE-2026-43702 is a memory handling flaw in Apple products, classified by Rapid7 as an improper restriction of operations within the bounds of a memory buffer . The vulnerability is triggered by processing a maliciously crafted video file , which may lead to unexpected app termination or corrupt ...

CVE-2026-86869

CVE-2026-86869 is an out-of-bounds write in Apple's image processing component, caused by insufficient bounds checking. Processing a maliciously crafted image may lead to unexpected app termination , a denial-of-service-level impact. The issue is fixed in iOS 26.7 , iPadOS 26.7 , and macOS Golden...

CVE-2026-28935

CVE-2026-28935 is a memory handling vulnerability in Apple's operating systems, classified as an improper restriction of operations within the bounds of a memory buffer (per Rapid7). An app may be able to cause unexpected system termination or corrupt kernel memory . The issue was addressed with ...

CVE-2026-86886

CVE-2026-86886 is a path traversal vulnerability in Apple's iOS, iPadOS, and watchOS, classified by Rapid7 as Improper Limitation of a Pathname to a Restricted Directory . The root cause is insufficient input validation, which could allow a third-party app to modify protected system files . The i...

CVE-2025-43460

CVE-2025-43460 affects Apple iOS and iPadOS through a logic issue that allows an attacker with physical access to a locked device to view sensitive user information. The vulnerability is tied to insufficient checks and is fixed in iOS 26.1 and iPadOS 26.1. Affected component details are not expli...

CVE-2026-43737

CVE-2026-43737 is an authorization flaw in CoreMotion across Apple platforms. A third-party app could access motion data from headphones without user consent, a privacy-sensitive disclosure. Apple addressed it with improved validation, shipping fixes in iOS 26.7/iPadOS 26.7, iOS 27/iPadOS 27, mac...

CVE-2026-84635

CVE-2026-84635 is a logic issue in state management within the WebKit engine. Processing maliciously crafted web content may cause an unexpected process termination (denial of service). The flaw is fixed in Safari 27, iOS/iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27 . Lin...

CVE-2025-43449

CVE-2025-43449 relates to a cache mishandling issue in Apple iOS/iPadOS that could allow a malicious app to track users between installs. The connected sources confirm the vulnerability affects iOS 26.1 and iPadOS 26.1, with Apple issuing fixes in those releases by addressing cache handling. The ...

CVE-2025-43454

CVE-2025-43454 is tied to Apple iOS/iPadOS security updates. Affected components: Siri stack on iOS 18.7.2/iPadOS 18.7.2 and iOS 26.1/iPadOS 26.1. Root cause described as improper state management that could allow a device to persistently fail to lock. Impact is described as a device remaining un...

CVE-2026-28968

CVE-2026-28968 is an out-of-bounds write vulnerability in Apple operating systems, addressed with improved bounds checking . The flaw allows an app to cause unexpected system termination or corrupt kernel memory . It affects iOS 26.7 / iPadOS 26.7 , iOS 27 / iPadOS 27 , macOS Golden Gate 27 , mac...